agents-can-communicate 0.4.1 → 0.4.3

package/README.md

@@ -65,6 +65,12 @@ then restart your clients from the project directory. In Codex, check `/plugins`
 review the current ACC definitions in `/hooks`; changed hooks may need fresh trust.
 [Getting started](docs/GETTING_STARTED.md) covers activation and preserved sandbox settings.
 
+For Codex live delivery on Apple Silicon macOS, installation also configures outgoing
+local socket access on Codex 0.153.4 or newer when using default workspace permissions.
+Custom policies are preserved. If its local service is missing, doctor gives the command
+`codex app-server daemon start`; then open a new Codex session. Doctor reports receiving
+channel state and outgoing permission configuration separately.
+
 Open two sessions and give them ordinary tasks, as above. Look for an agent discovering a
 peer, checking who is changing a file, asking about a shared dependency, or replying to a
 review request.
@@ -73,8 +79,8 @@ Run `acc doctor` from the project if a peer is missing. A directory containing A
 state, commonly your home directory, cannot be used as a workspace; start the client in a
 project directory. See [Troubleshooting](docs/TROUBLESHOOTING.md).
 
-Already using ACC? Follow the [upgrade guide](docs/UPGRADING.md), including the 0.4.0 →
-0.4.1 update and the data-format boundary when moving from 0.3.1.
+Already using ACC? Follow the [upgrade guide](docs/UPGRADING.md), including the 0.4.x →
+0.4.3 update and the data-format boundary when moving from 0.3.1.
 
 ## When messages arrive
 
@@ -95,9 +101,16 @@ mutations. It adds no automatic peer-message injection or idle delivery. A reloc
 **Optional live delivery can start a turn in an idle Codex or Claude Code session.** It is
 experimental, off by default, and can spend model tokens. On Apple Silicon Macs, Codex
 0.152.1 or newer requires an already-running LocalDaemon and a verified session;
-Claude Code 2.1.258 or newer requires zsh and shows its development-channel warning at
-startup. Messages arriving mid-turn wait for the turn to finish. The receiving session's
+Claude Code 2.1.258 or newer requires zsh and client-side Channels activation; check its
+startup notice for ACC and accept the development warning when shown. An MCP connection
+alone does not verify inbound delivery. Messages arriving mid-turn wait for the turn to
+finish. The receiving session's
 opt-in policy and current reachability determine whether delivery can proceed.
+`acc install` reports each client's delivery state and can save Codex consent before its
+service is available. `acc doctor` also names each session’s last native binding result,
+including missing launch consent, an unidentified client process or a failed handshake.
+It distinguishes a disabled policy from an unavailable service or a missing live channel
+in the current project.
 
 A Codex thread retained by LocalDaemon can receive opted-in messages after its terminal
 exits. Turning ACC delivery off prevents new native offers; already accepted queue entries

package/docs/ARCHITECTURE.md

@@ -68,7 +68,13 @@ livePolicy · opaqueEndpointRef · leaseUntil
 
 Core validates identity and expiry but never interprets the opaque endpoint. That remains
 inside the owning adapter. `acc status` reports available modes, policy, reachability, and
-lease without exposing the endpoint.
+lease without exposing the endpoint. The hook runner also replaces one optional native
+attempt diagnostic beside its session-owner file: closed policy/process/handshake
+metadata with a timestamp, never vendor output. Doctor joins it only to the current open
+generation and reports it separately from transport and receipt facts. It is not journalled
+or projected into agent context; session restart replaces it and SessionEnd attempts bounded
+cleanup. Doctor ignores closed or superseded generations even if cleanup could not finish. Diagnostic disk I/O runs in an
+unreferenced worker, so a stalled write cannot hold the hook process open.
 
 ## Certified capability versus current reachability
 

package/docs/CLI.md

@@ -239,8 +239,9 @@ external AI client. An addressed handoff requires acknowledgement; a room handof
 `--delivery off|actionable|all` is a per-client recipient policy request, not a capability
 switch, and the default is `off`. `--adapter` is repeatable to name several clients. An
 explicit `--delivery` applies uniformly and never prompts; omitting it on an interactive
-terminal asks one default-No question per eligible client, and on a non-interactive run or a
-`--dry-run` it keeps fresh clients off. A recorded opt-in is kept on upgrade. If the detected
+terminal asks one default-No question per supported client. Codex can save consent while
+its local service is unavailable or has no loaded session; this does not activate delivery.
+A non-interactive run or a `--dry-run` keeps fresh clients off. A recorded opt-in is kept on upgrade. If the detected
 client cannot receive native delivery - unsupported, below the captured minimum, a
 prerelease, known-bad, a wrong platform, or an unsupported shell - installation keeps the
 effective policy off and prints the reason. Claude Code shell activation writes an owned
@@ -248,7 +249,26 @@ zsh PATH block and a shim that `exec`s the real client; `ACC_BYPASS=1` bypasses
 activation. Codex LocalDaemon delivery uses recorded installation consent without changing
 ordinary launch arguments. Its opt-in remains active when shim variables are absent or
 bypassed; `acc install --adapter codex --delivery off` disables new native offers. ACC never
-starts or stops the vendor daemon. See [delivery consent](CONFIGURATION.md#keep-delivery-consent-user-owned).
+starts or stops the vendor daemon. The install summary names each client's requested policy,
+activation state and verified fallback. `doctor` separates protocol readiness, recorded
+consent and a live channel in the current workspace, with a next step for missing activation.
+A supported version or an installed plugin alone is not an active delivery channel.
+`runtime: active` means ACC has a reachable local transport binding. Claude can still
+block inbound Channels messages while its MCP server and tools remain connected;
+doctor therefore also names the client-side startup check.
+In doctor JSON, `nativeDelivery.activation` distinguishes missing launch setup from a
+recorded setup (or `not_required` for a pre-existing service). `policy` is the installed
+choice; `sessionPolicy` describes a native binding when one is visible. Existing Claude
+sessions can retain their launch policy after a different choice is installed for new
+sessions; Codex checks current recorded consent before new offers.
+`nativeDelivery.sessions` lists each current session's identity, present transport state
+and `lastAttempt`: timestamp, startup/turn event, effective policy and its source, whether
+that policy was missing/invalid/off, whether a client process was identified, and the closed
+handshake result/reason. `lastAttempt: null` means no usable attempt was observed for this
+generation; it does not prove hooks are disabled. A past successful handshake is separate
+from current transport reachability. ACC replaces this small diagnostic beside the
+hook-owner file outside the repository; it never adds attempt history to agent context.
+See [delivery consent](CONFIGURATION.md#keep-delivery-consent-user-owned).
 
 An initial `acc install` enables automatic updates. Reinstalling preserves an explicit
 `acc update --auto off` choice. A full uninstall pauses updates; reinstalling restores

package/docs/CONFIGURATION.md

@@ -144,6 +144,31 @@ consent from the installation record, not a shell-shim variable. Unavailable or
 sessions retain durable inbox fallback. Use `acc install --adapter codex --delivery off`
 to stop new native offers; bypassing a shim does not disable that recorded opt-in.
 
+### Codex outgoing permissions
+
+Receiving a native message and sending from the agent's sandbox are separate operations.
+On Codex 0.153.4 or newer on macOS arm64, live opt-in also configures outgoing access
+for default workspace permissions. This happens even when the daemon is not yet available.
+Installation, its preview, and the interactive consent question disclose this change.
+
+ACC selects a permission profile named `acc-workspace`, extending `:workspace`. It grants
+write access to the ACC state directory and allows only the local ACC channel directory
+(`/tmp/acc-ch-<uid>`) and the Codex home control socket. The profile enables networking
+through `features.network_proxy = true`, with no external domains allowed. The proxy and
+socket grants must stay together: enabling networking without the proxy changes its scope.
+
+An existing legacy workspace-write configuration is migrated only when its sole writable
+root is ACC's state directory. Custom permission/configuration profiles, additional roots,
+inline settings and uncaptured clients are preserved and reported as unverified. ACC does
+not merge arbitrary security policies or verify overrides in an already running session.
+For a custom policy, grant the same state and socket access through the proxy in the
+client's effective workspace profile; do not combine it with legacy sandbox settings.
+
+Restart Codex after changing permissions. Explicit delivery `off` or uninstall restores
+the previous configuration only while every generated permission component is unchanged.
+If any component was edited or another setting depends on it, ACC preserves the entire
+bundle and reports it for review. Plugin registration can still be removed independently.
+
 ## Override local paths and identity
 
 Nothing in `acc.workspace.json` says where state is stored, and nothing there can — that is

package/docs/GETTING_STARTED.md

@@ -15,7 +15,7 @@ pair or session-bound ACC MCP tools. See [CLI ownership](CLI.md#coordinate-from-
 
 ACC requires macOS or Linux and Node.js 24 or newer.
 
-Already using ACC? Follow the [upgrade guide](UPGRADING.md) for the 0.4.0 → 0.4.1
+Already using ACC? Follow the [upgrade guide](UPGRADING.md) for the 0.4.x → 0.4.3
 update or the data-format boundary when upgrading from 0.3.1.
 
 ```bash
@@ -39,13 +39,25 @@ printed by the installer. In Codex, use `/plugins` to check ACC is enabled, then
 to review each ACC hook and enable/trust its current definition if needed. Restart the
 session after that review; changed hook definitions may require trust again.
 
-If the installer preserved your existing Codex sandbox settings, verify the named ACC
-state directory is in `sandbox_workspace_write.writable_roots` in the config it identifies.
+For Codex live delivery, follow the outgoing-permission and local-service instructions
+from install/doctor, then start a new session. Default workspace permissions can be
+configured automatically on Codex 0.153.4 or newer on macOS arm64. Custom settings are
+preserved; see [outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions).
+With legacy sandbox settings, the named ACC state directory must also be in
+`sandbox_workspace_write.writable_roots` in the config the installer identifies.
 ACC keeps those user settings unchanged. Installed files alone do not establish that hooks
 are active; `acc doctor` leaves current readiness unverified and directs you to Codex.
 
-If you opt into Claude Code's experimental idle delivery, Claude also shows its own
-development-channel warning at every startup. The feature is off by default, can spend
+Read the delivery summary for each client. Live delivery needs an explicit opt-in and a
+verified channel in the current session. Codex can save your choice even when its local
+service is not running yet. Declining uses the reported fallback: `acc inbox`, or next-turn
+hooks only where the exact client version and platform are certified.
+
+If you opt into Claude Code's experimental idle delivery, check Claude's Channels startup
+notice for ACC and accept its development-channel warning when shown. If it reports Channels
+unavailable or blocked, a connected MCP server does not make inbound delivery work;
+see [troubleshooting](TROUBLESHOOTING.md#i-enabled-live-delivery-but-got-fallback).
+The feature is off by default, can spend
 model tokens, and currently requires Apple Silicon macOS, zsh, and Claude Code 2.1.258 or
 newer. You do not need it for durable messages or supported next-turn delivery.
 

package/docs/PROTOCOL.md

@@ -199,6 +199,10 @@ peer body into diagnostics.
 Receipt `offered` is committed only after the transport accepts bytes. A failed attempt
 leaves the receipt queued.
 
+`transport_permission_denied` means the sender's OS or sandbox refused local transport
+access (`EPERM` or `EACCES`). It is distinct from `recipient_unavailable` and remains a
+failed offer with a queued receipt; raw OS error strings are not persisted.
+
 ## Inbox, reply, and acknowledgement
 
 Without an id, public `inbox` lists bounded summary pages for unresolved messages owned

package/docs/RELEASING.md

@@ -1,7 +1,7 @@
 # Releasing
 
 Use this procedure to build one auditable npm artifact, verify that exact tarball, and keep
-its evidence tied to the commit that supplied its bytes. The package is currently `0.4.1`;
+its evidence tied to the commit that supplied its bytes. The package is currently `0.4.3`;
 the commands derive the version from `package.json` so the filename cannot drift.
 
 ```mermaid

package/docs/SECURITY_MODEL.md

@@ -79,6 +79,13 @@ consent before offers. A loaded daemon thread can receive messages after its TUI
 exits. Delivery off and uninstall prevent new Codex submissions; a submission
 already accepted by the vendor queue cannot be withdrawn.
 
+On captured Codex/macOS configurations, live opt-in also grants outgoing access to ACC's
+state and local Unix sockets through a deny-by-default network proxy. Custom permission
+policies remain user-owned. Selection, proxy and grants are restored together only while
+unchanged; edited or newly referenced settings remain intact. See
+[Codex outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions). Configuration
+readiness does not prove that an active session's overrides permit a live offer.
+
 ## Claims
 
 CLI claims default to advisory. Guarded enforcement must be requested explicitly and

package/docs/TROUBLESHOOTING.md

@@ -94,13 +94,65 @@ For Codex, use your ordinary launch command with 0.152.1 or newer on Apple Silic
 macOS. Its LocalDaemon must already be running, and trusted hooks must establish
 the receiver's exact thread and workspace. Embedded sessions, an absent socket,
 ambiguous recipients or failed identity checks retain durable inbox access.
-`acc doctor` reports current eligibility. ACC preserves requested consent through
-a temporary daemon outage and does not start the daemon for you.
+`acc doctor` reports readiness, consent and the current workspace's live channel separately.
+`native_endpoint_unavailable` means the local service endpoint is missing or is not a safe socket;
+`native_session_unavailable` means the service answered but has no loaded thread to probe.
+An interactive install can save consent in either case. ACC preserves it through a temporary
+outage and does not start the daemon for you.
+
+On a supported Codex CLI, a missing daemon can be started with
+`codex app-server daemon start`; open a new Codex session afterward. Doctor includes this
+command when it detects the missing endpoint.
+
+If a reply stays queued with `transport_permission_denied`, the sender's permissions
+blocked local transport. This is distinct from an unavailable recipient. The message was
+recorded successfully; the error does not mean it was read or acknowledged.
+On Codex 0.153.4 or newer on macOS arm64, rerun `acc install --adapter codex` with existing
+live consent (or add `--delivery actionable` to opt in), then start a new session.
+Doctor's `outgoingDelivery` reports the installed permission configuration separately
+from `nativeDelivery.runtime`: an active receiving channel does not establish outgoing
+access. Custom policies and active-session overrides remain unverified; inspect the config
+path doctor names and follow [outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions).
+
+Check `acc doctor --json` and `acc status --json` while both clients are open. If policy is
+`off`, opt in with `acc install --adapter codex --delivery actionable` (or select another
+adapter). This can spend model tokens. If policy is enabled but runtime is `waiting` and
+`deliveryBindings` is empty, no live channel is bound in this workspace. Start a new client
+session, check its integration prompts and re-run doctor. A healthy store, online peers,
+or a connected MCP server does not by itself establish automatic delivery. `lifecycle:
+manual` can also mean the current version has no certified session-end hook; it does not
+prove that no hooks ran.
 
 For Claude Code, open a fresh interactive zsh after installation so its launcher
-is on PATH, and accept its visible development-channel warning. A failed channel
-connection may remain in Claude's `~/.claude/mcp-needs-auth-cache.json` for about
-fifteen minutes; remove only the `acc` entry and restart if that is the cause.
+is on PATH. Check Claude's **Channels startup notice for ACC**, and accept the
+development-channel warning when it appears. A successful bootstrap cache means the
+executable passed ACC's compatibility probe. `/mcp` showing `connected` and two tools
+means the MCP server connected. Even `runtime: active` in ACC's doctor JSON describes
+the local transport; none of these proves that Claude enabled inbound channel messages.
+
+If Claude says `--dangerously-load-development-channels ignored` or `Channels are not
+currently available`, it has not enabled that delivery path. On a fresh 2.1.266 test
+profile, the first launch showed those messages and the next launch showed the development
+warning; restarting once can recheck availability, but is not a guaranteed fix. If it
+remains unavailable, follow Claude's notice. Organization policy can also block Channels;
+an administrator must enable them where required. ACC does not override that policy.
+See [Claude's Channels documentation](https://code.claude.com/docs/en/channels).
+
+If `deliveryBindings` is empty, ACC has not bound a local transport either. Read the
+per-session lines in `acc doctor`, or `nativeDelivery.sessions[].lastAttempt` in JSON:
+
+- An absent launch policy means that hook did not receive delivery consent, even if an
+  earlier bootstrap probe succeeded. For Claude, open a new terminal and client through
+  the installed launcher.
+- `client_process_unknown` means ACC could not identify the client process. A new client
+  session repeats that lookup.
+- `handshake_failed` or `handshake_timeout` means the session could not bind the local
+  channel. Check the client's integration/channel setup; the next ordinary turn retries.
+- No attempt observed can mean no native hook ran, an older runtime wrote the owner, or
+  diagnostic persistence failed. Check hook activation and the runtime versions in doctor.
+
+The timestamp describes the last attempt for that exact generation. A past successful
+handshake does not establish a currently reachable channel or client-side admission.
 
 Closing a Codex terminal can leave its daemon thread loaded and eligible. Use
 `acc install --adapter codex --delivery off` to stop new ACC native offers.
@@ -115,8 +167,9 @@ definitions need review, and a trusted hook can still be disabled.
 
 `acc doctor` reports installed files separately from hook readiness, which it leaves
 unverified. A saved trust record cannot prove current activation. If installation preserved
-your own sandbox configuration, doctor also names the ACC state directory whose access
-you should check in `sandbox_workspace_write.writable_roots`.
+your own legacy sandbox configuration, doctor also names the ACC state directory whose
+access you should check in `sandbox_workspace_write.writable_roots`. Live delivery requires
+local socket permissions as well; a writable state directory alone is insufficient.
 
 ## Gemini does not guard a write
 

package/docs/UPGRADING.md

@@ -1,12 +1,13 @@
-# Upgrading to 0.4.1
+# Upgrading to 0.4.3
 
-## From 0.4.0
+## From 0.4.2, 0.4.1 or 0.4.0
 
-This patch keeps the existing workspace data format. It fixes Grok CLI ownership,
-relocated Grok profiles, automatic-update preferences after reinstall, and the warning
-when a client starts in a directory containing ACC's own state.
+This patch keeps the existing workspace data format. It fixes outgoing native delivery
+from Codex's sandbox, separates permission failures from unavailable recipients, and
+shows outgoing setup alongside receiving-channel state in doctor. It also includes the
+previous 0.4.x delivery diagnostics, session recovery and client integration fixes.
 
-Close the participating clients and persistent ACC MCP processes, then run:
+Close participating clients and persistent ACC MCP processes, then run:
 
 ```bash
 acc update
@@ -14,17 +15,33 @@ acc version
 acc doctor
 ```
 
-After publication, `acc version` should report 0.4.1. A managed update refreshes the
-installed integrations and skills. Restart the clients and complete any hook/trust
-review they request. Existing managed installations activate the selected runtime
-through `acc update`; use the npm install steps below for pre-0.4 or unmanaged
-installations. When pinned to 0.4.0, select 0.4.1 or clear the pin first.
-
-In Grok, the refreshed skill runs public status through the terminal before its first
-owned command. The hook reminder after that result supplies the session's own CLI
-arguments. Grok still reads peer messages explicitly through inbox; this patch does not
-add external wake or certify guards. Start clients in a project directory, rather than
-in a home directory containing ACC state.
+After publication, `acc version` should report 0.4.3. If a pin keeps an older version,
+select 0.4.3 or clear it first. A managed update refreshes installed integrations and
+skills; use the npm instructions below for unmanaged or pre-0.4 installations. Start
+clients again and complete any hook/trust review they request. With existing live consent,
+Codex 0.153.4 or newer on macOS arm64 receives local socket permissions when its workspace
+policy is default or contains only ACC's legacy state root. Custom policies are preserved
+and reported as unverified. See [outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions).
+If doctor names a missing local service, run `codex app-server daemon start` before opening
+the new session.
+
+Run `acc doctor` in the project after the new clients have started (or submitted a normal
+turn). Its per-session lines now explain missing launch consent, an unidentified client
+process and a failed or timed-out handshake. `nativeDelivery.sessions[].lastAttempt` in
+`acc doctor --json` provides the same closed metadata and timestamp. Existing owners may
+have no attempt record until a new hook runs; missing metadata does not prove hooks are
+disabled. A previous successful handshake and a connected MCP server do not prove that
+Claude admitted inbound Channels messages. See [delivery troubleshooting](TROUBLESHOOTING.md#i-enabled-live-delivery-but-got-fallback).
+
+Upgrading preserves delivery consent. If doctor reports native delivery off and you want
+automatic peer requests, use `acc install --adapter codex --delivery actionable` (or the
+relevant adapter); this can spend model tokens. Codex can save that consent before its
+local service/session becomes available. ACC does not start the vendor daemon, and it
+keeps durable inbox access when no verified live channel is bound.
+
+In Grok, public status supplies the session's own CLI arguments through the next tool
+hook. Grok still uses explicit inbox reads; this patch adds no external wake or guards.
+Start clients in a project directory, rather than a home directory containing ACC state.
 
 ## From 0.3.1
 
@@ -47,7 +64,7 @@ restores access; deleting or editing the record is not a remedy.
 2. Install the released package, then refresh the client integrations:
 
    ```bash
-   npm install --global agents-can-communicate@0.4.1
+   npm install --global agents-can-communicate@0.4.3
    acc version
    acc install
    ```
@@ -97,7 +114,7 @@ acc update                    # download and apply, or report what is keeping it
 acc update --check            # check without installing or changing update settings
 acc update --auto off         # disable background updates
 acc update --auto on          # enable them again
-acc update --pin 0.4.1        # stay on this exact stable version
+acc update --pin 0.4.3        # stay on this exact stable version
 acc update --pin none         # follow stable releases again
 ```
 

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/adapter.mjs

@@ -11,9 +11,9 @@ import { bindNativeSession, offerMessage, planNativeActivation, probeNativeDeliv
 export const CLAUDE_CODE_VERSION = "2.1.233";
 export const CLAUDE_CHANNEL_MINIMUM = "2.1.258";
 export const CLAUDE_DELIVERY_FALLBACK = Object.freeze({
-  diagnostic: "Claude Code native delivery is off: the 2.1.252 capture stopped at the "
-    + "development-channel security warning before the ACC MCP child started; messages "
-    + "stay durable for certified next-turn delivery or acc inbox",
+  diagnostic: "Claude Code native delivery requires client-side Channels activation; "
+    + "a successful bootstrap or connected ACC MCP server does not prove inbound delivery "
+    + "is enabled. Messages remain durable for certified next-turn delivery or acc inbox",
 });
 
 /**

package/node_modules/@agents-can-communicate/adapter-claude-code/src/channel.mjs

@@ -1,8 +1,8 @@
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { chmodSync, existsSync, mkdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import net from "node:net";
-import os from "node:os";
 import path from "node:path";
+import { channelSocketDirectory } from "@agents-can-communicate/adapter-sdk";
 
 // The production ACC Channel: a stdio MCP server Claude Code spawns, plus a
 // session-scoped Unix endpoint the delivery router reaches. One envelope on the
@@ -39,8 +39,6 @@ const shortId = () => `endpoint_${randomBytes(16).toString("hex")}`;
 // while the registration - discoverable by the hook-resolved pid - stays under
 // the workspace. The registration records the socket's absolute path, so the
 // two are decoupled.
-const defaultSocketDir = () => path.join(os.tmpdir(),
-  `acc-ch-${typeof process.getuid === "function" ? process.getuid() : "u"}`);
 
 /**
  * Compose a Channel over an endpoint directory and injected ACC callbacks.
@@ -49,7 +47,7 @@ const defaultSocketDir = () => path.join(os.tmpdir(),
  * ones backed by the real conversation service; a test supplies fakes. Neither
  * the socket path nor the nonce leaves through a return value or a log line.
  */
-export function createAccChannel({ endpointDir, socketDir = defaultSocketDir(), clientPid,
+export function createAccChannel({ endpointDir, socketDir = channelSocketDirectory(), clientPid,
   protocolContract = PROTOCOL_CONTRACT, modes = CHANNEL_MODES, leaseMs = 60_000, routeReply,
   routeAck, refreshBinding = null, observe = () => {},
   clock = () => new Date().toISOString(), write, now = Date.now }) {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/install.mjs

@@ -1,6 +1,9 @@
 import { cp, mkdir, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import path from "node:path";
 
+// Kept together above 300 lines: source and cache publication, vendor registry
+// merges and their exact uninstall share one ownership transaction and helpers.
+
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 import { fileURLToPath } from "node:url";
 
@@ -19,6 +22,9 @@ const manifest = fileURLToPath(new URL("../plugin/.claude-plugin/plugin.json",
 const PLUGIN_NAME = "agents-can-communicate";
 const MARKETPLACE = "acc-local";
 const QUALIFIED = `${PLUGIN_NAME}@${MARKETPLACE}`;
+const CHANNEL_ACTIVATION_CHECK = "Check Claude's Channels startup notice for ACC; "
+  + "an MCP connection does not verify inbound delivery. If Channels are unavailable "
+  + "or blocked, resolve that client warning before expecting live messages.";
 
 /**
  * How this client actually installs a plugin.
@@ -244,6 +250,7 @@ export async function installClaudePlugin({ configDir, runner, cli, preserveVers
     changes: [source, cached, marketplaceFile(configDir),
       knownMarketplacesPath(configDir), installedPluginsPath(configDir), file,
       ...(live ? [mcpPath(source), mcpPath(cached)] : [])],
+    needsAction: live ? [CHANNEL_ACTIVATION_CHECK] : [],
     diagnostics: live
       ? ["native channel wired; Claude's experimental development-channel warning still applies"]
       : [] };
@@ -290,7 +297,10 @@ export async function detectClaude({ configDir }) {
   const registered = Object.hasOwn(
     (await readJson(installedPluginsPath(configDir), { plugins: {} })).plugins ?? {},
     QUALIFIED);
+  const channelConfigured = enabled && registered
+    && (await readJson(mcpPath(sourceDir(configDir)), null))?.mcpServers?.["acc-channel"] != null;
   return { ok: true, changes: [],
+    needsAction: channelConfigured ? [CHANNEL_ACTIVATION_CHECK] : [],
     diagnostics: [enabled && registered
       ? "acc plugin registered and enabled"
       : "acc plugin not registered"] };

package/node_modules/@agents-can-communicate/adapter-claude-code/src/native-delivery.mjs

@@ -206,7 +206,9 @@ function sendEnvelope({ record, message, binding, connect, timeoutMs, rejected }
     const finish = value => { if (settled) return; settled = true; clearTimeout(timer);
       socket.destroy(); resolve(value); };
     const timer = setTimeout(() => finish(rejected("transport_error")), timeoutMs);
-    socket.once("error", () => finish(rejected("recipient_unavailable")));
+    socket.once("error", error => finish(rejected(
+      ["EPERM", "EACCES"].includes(error.code)
+        ? "transport_permission_denied" : "recipient_unavailable")));
     socket.once("connect", () => {
       socket.write(`${JSON.stringify(envelope)}\n`);
       let buffer = "";

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/app-server-client.mjs

@@ -65,7 +65,7 @@ export async function probeCodexQueue(peer, { threadId, minimum = MINIMUM_VERSIO
       const loaded = await pageAll(peer, "thread/loaded/list", {});
       threadId = loaded.find(id => typeof id === "string" && id !== "");
       if (threadId === undefined) return { supported: false, serverVersion,
-        reasonCode: "feature_probe_failed" };
+        reasonCode: "native_session_unavailable" };
     }
     queueEntries(await peer.request("thread/queue/list", { threadId }));
   } catch (error) {

package/node_modules/@agents-can-communicate/adapter-codex/src/config-block.mjs

@@ -3,10 +3,8 @@ import path from "node:path";
 import { BEGIN, END, renderBlock } from "@agents-can-communicate/adapter-sdk";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 
-const unsafe = (reason = "unrecognized TOML declaration") => {
-  throw new AccError(EXIT.CONFLICT, `cannot safely edit Codex config: ${reason}; `
-    + "repair ambiguous TOML or ACC markers before retrying", { reason });
-};
+import { statements, declaration, unsafe } from "./toml-scan.mjs";
+
 const ROOT = "# ACC sandbox writable_roots created with: ";
 export const sandboxOwnership = root => `${ROOT}${JSON.stringify(root)}`;
 
@@ -16,88 +14,6 @@ const OWNED = new Map([
   [JSON.stringify(["sandbox_workspace_write"]), ["writable_roots"]],
 ]);
 
-// A bounded lexical scan, not a TOML value parser. Newlines inside strings,
-// arrays and inline tables cannot introduce a header or a managed marker.
-function* statements(source) {
-  let start = 0, code = "", quote = null;
-  const stack = [];
-  for (let i = 0; i < source.length;) {
-    const char = source[i];
-    if (quote) {
-      if (quote[0] === '"' && char === "\\") {
-        code += source.slice(i, i + 2); i += 2; continue;
-      }
-      if (source.startsWith(quote, i)) {
-        let count = quote.length;
-        if (quote.length === 3) {
-          while (source[i + count] === quote[0]) count++;
-          if (count > 5) unsafe("unsupported string quote delimiter");
-        }
-        code += source.slice(i, i + count); i += count; quote = null; continue;
-      }
-      if (quote.length === 1 && /[\r\n]/.test(char)) unsafe("newline in single-line string");
-      code += char; i++; continue;
-    }
-    if (char === "#") {
-      while (i < source.length && source[i] !== "\n") i++;
-      continue;
-    }
-    if (char === '"' || char === "'") {
-      quote = source.startsWith(char.repeat(3), i) ? char.repeat(3) : char;
-      code += quote; i += quote.length; continue;
-    }
-    if (char === "[" || char === "{") stack.push(char);
-    if (char === "]" || char === "}") {
-      if (stack.pop() !== (char === "]" ? "[" : "{")) unsafe("mismatched collection delimiter");
-    }
-    code += char; i++;
-    if (char === "\n" && stack.length === 0) {
-      yield { raw: source.slice(start, i), code: code.trim() };
-      start = i; code = "";
-    }
-  }
-  if (quote || stack.length) unsafe(quote ? "unclosed string" : "unclosed collection");
-  if (start < source.length) yield { raw: source.slice(start), code: code.trim() };
-}
-
-function decodeKey(key) {
-  if (key[0] === "'") return key.slice(1, -1);
-  if (key[0] !== '"') return key;
-  return key.slice(1, -1).replace(/\\(U[\da-fA-F]{8}|u[\da-fA-F]{4}|[btnfr"\\])|\\./g,
-    (match, escape) => {
-      if (!escape) unsafe("unsupported quoted-key escape");
-      if (/^[uU]/.test(escape)) {
-        const point = Number.parseInt(escape.slice(1), 16);
-        if (point > 0x10ffff || (point >= 0xd800 && point <= 0xdfff)) {
-          unsafe("invalid quoted-key Unicode escape");
-        }
-        return String.fromCodePoint(point);
-      }
-      return ({ b: "\b", t: "\t", n: "\n", f: "\f", r: "\r", '"': '"', "\\": "\\" })[escape];
-    });
-}
-
-function keyPath(code) {
-  const keys = [];
-  let rest = code.trimStart();
-  for (;;) {
-    const match = /^(?:[A-Za-z0-9_-]+|'[^'\r\n]*'|"(?:[^"\\\r\n]|\\[^\r\n])*")/.exec(rest);
-    if (!match) unsafe("unrecognized TOML key");
-    keys.push(decodeKey(match[0]));
-    rest = rest.slice(match[0].length).trimStart();
-    if (!rest.startsWith(".")) return { keys, rest };
-    rest = rest.slice(1).trimStart();
-  }
-}
-
-function declaration(code) {
-  const header = code.startsWith("[");
-  const array = header && code.startsWith("[[");
-  const { keys, rest } = keyPath(header ? code.slice(array ? 2 : 1) : code);
-  if (header ? rest !== (array ? "]]" : "]") : !rest.startsWith("=")) unsafe();
-  return { keys, header, array, value: header ? null : rest.slice(1).trim() };
-}
-
 // An unchanged, newly generated sandbox has value provenance. A legacy or
 // edited sandbox belongs to the client as a whole and remains byte-preserved.
 function ownsSandbox(body) {
@@ -214,8 +130,8 @@ export async function readConfig(file) {
   });
 }
 
-export async function writeTomlBlock(file, body) {
-  const { source } = inspectConfig(await readConfig(file), file);
+export async function writeTomlBlock(file, body, preparedSource) {
+  const source = preparedSource ?? inspectConfig(await readConfig(file), file).source;
   const separator = source === "" || source.endsWith("\n") ? "" : "\n";
   await mkdir(path.dirname(file), { recursive: true });
   await writeFile(file, `${source}${separator}${renderBlock(body)}\n`);