agents-can-communicate 0.4.1 → 0.4.3

package/node_modules/@agents-can-communicate/adapter-codex/src/install.mjs

@@ -9,7 +9,8 @@ import { bakeSkillCommand, blankJson, blankText, removeIfEmpty, removeInstalledT
   tomlString, writeForeignJson, writeHookShim }
   from "@agents-can-communicate/adapter-sdk";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
-import { inspectConfig, readConfig, removeTomlBlock, sandboxOwnership, writeTomlBlock } from "./config-block.mjs";
+import { inspectConfig, readConfig, sandboxOwnership, writeTomlBlock } from "./config-block.mjs";
+import { outgoingStatus, prepareLivePermissions, removeLivePermissions } from "./live-permissions.mjs";
 
 // Kept cohesive above 300 lines because Codex plugin install, cache, config,
 // detection, and ownership share one client topology; splitting would duplicate
@@ -159,7 +160,8 @@ const sandboxReview = (config, file, stateRoot) =>
     : [];
 
 export async function installCodexPlugin({ home, agentsHome = home,
-  codexHome = path.join(home, ".codex"), dataHome, stateRoot, runner, node, cli, preserveVersions = false }) {
+  codexHome = path.join(home, ".codex"), dataHome, stateRoot, runner, node, cli, preserveVersions = false,
+  requestedLivePolicy, livePolicy, clientVersion, platform }) {
   // Read before writing, so a manifest that will not parse is found before a
   // plugin tree is laid down that nothing will then be able to remove.
   const existing = await readJson(marketplacePath(agentsHome), { name: MARKETPLACE,
@@ -179,7 +181,10 @@ export async function installCodexPlugin({ home, agentsHome = home,
       `marketplace ${MARKETPLACE} or its plugin is already registered in this config; `
       + "remove it and install again", { config });
   }
-  const theirSandbox = foreign.sandbox;
+  const permissions = prepareLivePermissions(foreign.source, { home, codexHome, stateRoot,
+    file: config, requestedLivePolicy, livePolicy, clientVersion, platform });
+  const theirSandbox = permissions.skipLegacy || inspectConfig(permissions.source, config).sandbox;
+  const permissionActions = permissions.status?.state === "unverified" ? [permissions.status.diagnostic] : [];
 
   const target = pluginPath(agentsHome);
   await rm(target, { recursive: true, force: true });
@@ -207,7 +212,7 @@ export async function installCodexPlugin({ home, agentsHome = home,
     `[plugins.${tomlString(QUALIFIED)}]`,
     "enabled = true",
     ...sandboxTable(stateRoot, theirSandbox),
-  ]);
+  ], permissions.source);
 
   // The client runs the cached copy, so this has to happen after the shim and
   // the rewritten hooks.json are in place.
@@ -235,9 +240,11 @@ export async function installCodexPlugin({ home, agentsHome = home,
   // while ACC invented its own marketplace name and so had a root to itself.
   // make the record stale the moment the plugin version changes.
   return { ok: true, changes: [target, file, config, cachePath(codexHome)],
-    needsAction: [HOOK_REVIEW, ...sandboxReview(before, config, stateRoot)],
+    needsAction: [HOOK_REVIEW, ...permissionActions,
+      ...(permissions.skipLegacy ? [] : sandboxReview(before, config, stateRoot))],
     diagnostics: ["hooks require explicit trust in Codex before they run",
-      ...sandboxReview(before, config, stateRoot)] };
+      ...(permissions.status ? [permissions.status.diagnostic] : []),
+      ...(permissions.skipLegacy ? [] : sandboxReview(before, config, stateRoot))] };
 }
 
 /** Remove each directory that is empty, in the order given. */
@@ -255,21 +262,25 @@ export async function preflightCodexUninstall({ home, agentsHome = home,
     if (error.code === "ENOENT") return "";
     throw error;
   });
-  return { existing, withoutOurs: inspectConfig(before, configPath(codexHome)).source };
+  const permissions = removeLivePermissions(inspectConfig(before, configPath(codexHome)).source);
+  return { existing, before, withoutOurs: permissions.source, permissionState: permissions.state };
 }
 
 export async function uninstallCodexPlugin({ home, agentsHome = home,
   codexHome = path.join(home, ".codex"), keep = [] }) {
   const file = marketplacePath(agentsHome);
   // Direct adapter callers need the same check as the installer boundary.
-  const { existing, withoutOurs } = await preflightCodexUninstall({ home, agentsHome, codexHome });
+  const { existing, before, withoutOurs, permissionState } = await preflightCodexUninstall({ home, agentsHome, codexHome });
   const changes = [];
   if (existing !== null) {
     const kept = (existing.plugins ?? []).filter(entry => entry.name !== PLUGIN_NAME);
     if (kept.length !== (existing.plugins ?? []).length) changes.push(PLUGIN_NAME);
     await writeMarketplace(file, { ...existing, plugins: kept });
   }
-  if (await removeTomlBlock(configPath(codexHome))) changes.push(configPath(codexHome));
+  if (before !== withoutOurs) {
+    await writeFile(configPath(codexHome), withoutOurs);
+    changes.push(configPath(codexHome));
+  }
   // The client's `[hooks.state."<plugin>:…"]` tables stay. 0.1.9 removed them as
   // litter naming a plugin that was gone; that was wrong, and wrong in a way
   // worth writing down. The check behind it perturbed the record - a hook whose
@@ -312,13 +323,16 @@ export async function uninstallCodexPlugin({ home, agentsHome = home,
     marketplaceRoot(agentsHome),
     cacheRoot(codexHome),
   ]);
-  return { ok: true, changes, diagnostics: declaresSandbox(withoutOurs)
-    ? ["existing sandbox_workspace_write configuration was preserved; review any retained writable_roots after removal"]
-    : [] };
+  const permissionReview = permissionState === "customized"
+    ? ["customized native permissions were preserved together with their default selection and network proxy; review them in Codex config"] : [];
+  return { ok: true, changes, needsAction: permissionReview, diagnostics: [
+    ...(declaresSandbox(withoutOurs)
+      ? ["existing sandbox_workspace_write configuration was preserved; review any retained writable_roots after removal"] : []),
+    ...permissionReview] };
 }
 
 export async function detectCodex({ home, agentsHome = home,
-  codexHome = path.join(home, ".codex"), stateRoot }) {
+  codexHome = path.join(home, ".codex"), stateRoot, clientVersion, platform, nativeDelivery }) {
   const marketplace = await readJson(marketplacePath(agentsHome), null);
   const published = (marketplace?.plugins ?? []).some(entry => entry.name === PLUGIN_NAME);
   const config = await readFile(configPath(codexHome), "utf8").catch(() => "");
@@ -326,11 +340,17 @@ export async function detectCodex({ home, agentsHome = home,
   const pluginEntry = config.includes(`[plugins."${QUALIFIED}"]`);
   const cached = await stat(cachePath(codexHome))
     .then(() => true).catch(() => false);
+  const outgoingDelivery = outgoingStatus(config, { home, codexHome, stateRoot,
+    file: configPath(codexHome), clientVersion, platform });
   // Saved trust is not readiness. Codex compares every current definition's
   // hash and can disable a trusted hook. Even a commented or stale single record
   // previously suppressed this check. Leave verification to Codex's /hooks;
   // detection neither invents its hash algorithm nor starts a client service.
-  return { ok: true, changes: [], diagnostics: [
+  return { ok: true, changes: [], outgoingDelivery,
+    nativeSetup: nativeDelivery?.reasonCode === "native_endpoint_unavailable"
+      ? "Codex CLI: run codex app-server daemon start, then open a new Codex session; ACC never starts or restarts the daemon"
+      : null,
+    diagnostics: [
     published ? "acc plugin published in the marketplace" : "acc plugin not registered",
     registered && pluginEntry
       ? "marketplace and plugin entries found in config; activation not verified"
@@ -347,7 +367,8 @@ export async function detectCodex({ home, agentsHome = home,
       : []),
   ],
   needsAction: cached
-    ? [HOOK_REVIEW, ...sandboxReview(config, configPath(codexHome), stateRoot)]
+    ? [HOOK_REVIEW, ...sandboxReview(config, configPath(codexHome), stateRoot),
+      ...(outgoingDelivery.state === "unverified" ? [outgoingDelivery.diagnostic] : [])]
     : [] };
 }
 

package/node_modules/@agents-can-communicate/adapter-codex/src/live-permissions.mjs

@@ -0,0 +1,110 @@
+import path from "node:path";
+import { channelSocketDirectory, tomlString } from "@agents-can-communicate/adapter-sdk";
+import { compareStableVersions, parseStableVersion } from "./app-server-client.mjs";
+import { addPermissions, inspectPermissions } from "./permission-ownership.mjs";
+import { scanConfig } from "./toml-scan.mjs";
+
+const PROFILE = "acc-workspace";
+const MINIMUM = "0.153.4";
+const equal = (keys, expected) => JSON.stringify(keys) === JSON.stringify(expected);
+const literal = value => { try { return JSON.parse(value); } catch { return null; } };
+const supported = context => context.platform === "darwin-arm64"
+  && parseStableVersion(context.clientVersion) !== null
+  && compareStableVersions(context.clientVersion, MINIMUM) >= 0;
+const hasPermissions = entries => entries.some(entry =>
+  ["permissions", "default_permissions", "profile", "profiles"].includes(entry.keys[0]));
+const configured = (source, context) => {
+  const entries = scanConfig(source);
+  if (entries.some(entry => ["profile", "profiles"].includes(entry.keys[0]))) return false;
+  const value = keys => entries.find(entry => !entry.header && equal(entry.keys, keys))?.value;
+  const profile = literal(value(["default_permissions"]));
+  if (!profile || value(["sandbox_mode"]) || entries.some(entry => entry.keys[0] === "sandbox_workspace_write")) return false;
+  return literal(value(["permissions", profile, "extends"])) === ":workspace"
+    && value(["features", "network_proxy"]) === "true"
+    && value(["permissions", profile, "network", "enabled"]) === "true"
+    && literal(value(["permissions", profile, "filesystem", context.stateRoot])) === "write"
+    && sockets(context).every(socket => literal(value(["permissions", profile, "network", "unix_sockets", socket])) === "allow");
+};
+
+// Match the channel's per-user temporary directory and Codex's actual home.
+// Grants cover only ACC's local channel namespace, never arbitrary Unix sockets.
+const sockets = context => [channelSocketDirectory(),
+  path.join(context.codexHome ?? path.join(context.home, ".codex"), "app-server-control", "app-server-control.sock")];
+
+export function outgoingStatus(source, context) {
+  const state = inspectPermissions(source).state;
+  const ready = state === "owned" && supported(context) && configured(source, context);
+  const reasonCode = state === "customized" ? "permission_configuration_modified"
+    : !supported(context) ? "permission_configuration_uncaptured"
+      : ready ? null : "sender_permissions_unverified";
+  return { state: reasonCode === null ? "configured" : "unverified", reasonCode,
+    setup: supported(context)
+      ? "Codex outgoing setup: default workspace settings gain ACC state write access and an ACC local socket allowlist "
+        + "through the network proxy (external network stays denied); custom policies are preserved. Start a new session after installation."
+      : null,
+    diagnostic: reasonCode === null
+      ? "outgoing live delivery: local socket permissions configured for new sessions; active session overrides remain unverified"
+      : `outgoing live delivery: sender permissions unverified in ${context.file}; `
+        + (reasonCode === "permission_configuration_uncaptured"
+          ? `automatic setup requires Codex ${MINIMUM} or newer on darwin-arm64`
+          : "existing permissions were preserved; run acc install --adapter codex, then start a new session; "
+            + "custom permission policies must allow ACC state and local sockets through the network proxy") };
+}
+
+export function prepareLivePermissions(source, context) {
+  const owned = inspectPermissions(source);
+  const requested = (context.requestedLivePolicy ?? context.livePolicy ?? "off") !== "off";
+  if (owned.state === "customized") return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  if (!requested) return { source: owned.source, skipLegacy: hasPermissions(scanConfig(owned.source)) };
+  if (!supported(context) || !context.stateRoot) {
+    return { source, skipLegacy: hasPermissions(scanConfig(source)), status: outgoingStatus(source, context) };
+  }
+  if (owned.state === "owned" && configured(source, context)) {
+    return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  }
+  source = owned.source;
+  const entries = scanConfig(source);
+  const find = keys => entries.filter(entry => equal(entry.keys, keys));
+  const modes = find(["sandbox_mode"]), defaults = find(["default_permissions"]);
+  const legacy = entries.filter(entry => entry.keys[0] === "sandbox_workspace_write");
+  const features = entries.filter(entry => entry.keys[0] === "features");
+  const featureTable = find(["features"]);
+  const proxies = find(["features", "network_proxy"]);
+  const customized = entries.some(entry => ["permissions", "profile", "profiles"].includes(entry.keys[0]))
+    || modes.length > 1 || defaults.length > 1
+    || modes.some(entry => entry.header || literal(entry.value) !== "workspace-write")
+    || defaults.some(entry => entry.header || literal(entry.value) !== ":workspace")
+    || (legacy.length > 0 && (legacy.length !== 2 || !legacy[0].header || legacy[0].array
+      || !equal(legacy[1].keys, ["sandbox_workspace_write", "writable_roots"])
+      || JSON.stringify(literal(legacy[1].value)) !== JSON.stringify([context.stateRoot])))
+    || (features.length > 0 && (featureTable.length !== 1 || !featureTable[0].header || featureTable[0].array))
+    || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
+  if (customized) return { source, skipLegacy: hasPermissions(entries), status: outgoingStatus(source, context) };
+  const edits = [{ id: "selection", start: 0, end: 0, body: `default_permissions = "${PROFILE}"\n` }];
+  for (const [id, values] of [["mode", modes], ["default", defaults]]) {
+    if (values.length) edits.push({ id, start: values[0].start, end: values[0].end, body: "" });
+  }
+  if (legacy.length) {
+    const end = entries.find(entry => entry.header && entry.start > legacy[0].start)?.start ?? source.length;
+    edits.push({ id: "legacy", start: legacy[0].start, end, body: "" });
+  }
+  const proxy = proxies[0], table = featureTable[0];
+  edits.push({ id: "proxy", start: proxy?.start ?? table?.end ?? source.length,
+    end: proxy?.end ?? table?.end ?? source.length, table: table ? ["features"] : null,
+    body: `${table ? "" : "[features]\n"}network_proxy = true\n` });
+  // Preserve a final line without a newline through the same ownership unit.
+  const last = entries.at(-1);
+  if (last && !source.endsWith("\n") && !edits.some(edit => edit.start <= last.start && edit.end >= last.end)) {
+    edits.push({ id: "tail", start: last.start, end: last.end, body: `${last.raw}\n` });
+  }
+  edits.push({ id: "profile", start: source.length, end: source.length, body:
+    `[permissions.${PROFILE}]\nextends = ":workspace"\n`
+    + `[permissions.${PROFILE}.filesystem]\n${tomlString(context.stateRoot)} = "write"\n`
+    + `[permissions.${PROFILE}.network]\nenabled = true\n`
+    + `[permissions.${PROFILE}.network.unix_sockets]\n`
+    + sockets(context).map(socket => `${tomlString(socket)} = "allow"\n`).join("") });
+  const prepared = addPermissions(source, edits);
+  return { source: prepared, skipLegacy: true, status: outgoingStatus(prepared, context) };
+}
+
+export const removeLivePermissions = source => inspectPermissions(source);

package/node_modules/@agents-can-communicate/adapter-codex/src/native-delivery.mjs

@@ -35,7 +35,7 @@ export async function probeNativeDelivery({ timeoutMs = 750, env = process.env,
   const unsupported = (reasonCode, clientVersion = null) => ({ supported: false, clientVersion,
     protocolContract: PROTOCOL_CONTRACT, executableFingerprint: null, modes: [], reasonCode });
   const socketPath = controlSocketPath(env);
-  if (!await socketIsReady(socketPath)) return unsupported("feature_probe_failed");
+  if (!await socketIsReady(socketPath)) return unsupported("native_endpoint_unavailable");
   try {
     return await usingPeer(socketPath, timeoutMs, open, async peer => {
       const probe = await probeCodexQueue(peer);
@@ -133,6 +133,7 @@ export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 5
       return { accepted: true, transport: "codex-app-server", clientVersion: endpoint.clientVersion };
     });
   } catch (error) {
+    if (["EPERM", "EACCES"].includes(error?.code)) return rejected("transport_permission_denied");
     const reason = safeReason(error);
     return rejected(reason === "request_timeout" ? "transport_error"
       : reason === "vendor_error" ? "transport_rejected" : "recipient_unavailable");

package/node_modules/@agents-can-communicate/adapter-codex/src/permission-ownership.mjs

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import { scanConfig, unsafe } from "./toml-scan.mjs";
+
+const BEGIN = "# ACC native permissions begin ";
+const END = "# ACC native permissions end ";
+const META = "# ACC native permissions restore ";
+const hash = (body, record) => createHash("sha256")
+  .update(JSON.stringify({ body, id: record.id, before: record.before, table: record.table })).digest("hex");
+const marker = (source, prefix) => source.startsWith(prefix) ? source.slice(prefix.length) : null;
+
+// Permission selection, proxy and network grants form one ownership unit. If
+// any component changes, none can be removed independently: enabled networking
+// without its proxy has a different security meaning to Codex.
+export function inspectPermissions(source) {
+  const blocks = [];
+  let open = null, metadata = null;
+  for (const entry of scanConfig(source)) {
+    const comment = entry.code ? "" : entry.raw.trim();
+    const start = marker(comment, BEGIN), end = marker(comment, END);
+    if (start !== null) {
+      if (open || !/^[a-z]+$/.test(start) || blocks.some(block => block.id === start)) {
+        unsafe("duplicate or nested native permission marker");
+      }
+      open = { id: start, start: entry.start, table: entry.table, contentStart: entry.end };
+    } else if (comment.startsWith(META)) {
+      if (!open || open.id !== "selection" || metadata !== null || entry.start !== open.contentStart) {
+        unsafe("misplaced permission metadata");
+      }
+      try { metadata = JSON.parse(comment.slice(META.length)); }
+      catch { unsafe("invalid permission metadata"); }
+      open.contentStart = entry.end;
+    } else if (end !== null) {
+      if (!open || open.id !== end) unsafe("unmatched native permission marker");
+      blocks.push({ ...open, end: entry.end, body: source.slice(open.contentStart, entry.start) });
+      open = null;
+    }
+  }
+  if (open) return { source, state: "customized" };
+  if (!blocks.length && !metadata) return { source, state: "absent" };
+  if (!Array.isArray(metadata) || metadata.length !== blocks.length
+    || metadata.some(item => !item || typeof item !== "object" || Array.isArray(item))
+    || new Set(metadata.map(item => item.id)).size !== metadata.length) return { source, state: "customized" };
+  for (const block of blocks) {
+    const record = metadata.find(item => item.id === block.id);
+    if (!record || Object.keys(record).sort().join() !== "before,hash,id,table"
+      || typeof record.before !== "string" || record.hash !== hash(block.body, record)
+      || (block.id === "selection" && block.table.length !== 0)
+      || JSON.stringify(block.table) !== JSON.stringify(record.table)) {
+      return { source, state: "customized" };
+    }
+  }
+  // A retained reference or declaration must not be left pointing at a deleted
+  // profile. Ignore peer-looking text inside strings/comments as markers.
+  const entries = scanConfig(source);
+  const inside = entry => blocks.some(block => entry.start >= block.start && entry.end <= block.end);
+  const generatedTables = entries.filter(entry => entry.header && inside(entry)).map(entry => JSON.stringify(entry.keys));
+  const outside = entries.filter(entry => !inside(entry));
+  // New profile declarations and selectors are custom policy, regardless of
+  // how TOML spells their values (including escaped or multiline references).
+  if (outside.some(entry => entry.code && (entry.keys.includes("default_permissions")
+    || entry.keys[0] === "permissions"
+    || (!entry.header && generatedTables.includes(JSON.stringify(entry.table)))))) {
+    return { source, state: "customized" };
+  }
+  let restored = source;
+  for (const block of blocks.toSorted((a, b) => b.start - a.start)) {
+    restored = restored.slice(0, block.start) + metadata.find(item => item.id === block.id).before
+      + restored.slice(block.end);
+  }
+  // Inserting restored headers can reparent foreign assignments added after
+  // a removal marker. Verify the candidate's scopes before restoring any byte.
+  let restoredEntries;
+  try { restoredEntries = new Map(scanConfig(restored).map(entry => [entry.start, entry])); }
+  catch { return { source, state: "customized" }; }
+  for (const entry of outside.filter(item => item.code)) {
+    const delta = blocks.filter(block => block.end <= entry.start).reduce((total, block) =>
+      total + metadata.find(item => item.id === block.id).before.length - (block.end - block.start), 0);
+    const candidate = restoredEntries.get(entry.start + delta);
+    if (!candidate || JSON.stringify(candidate.keys) !== JSON.stringify(entry.keys)) {
+      return { source, state: "customized" };
+    }
+  }
+  return { source: restored, state: "owned" };
+}
+
+export function addPermissions(source, edits) {
+  const metadata = edits.map(({ id, start, end, body, table = [] }) => {
+    const record = { id, before: source.slice(start, end), table };
+    return { ...record, hash: hash(body, record) };
+  });
+  const initialMetadata = JSON.stringify(metadata);
+  // Insertions at the same offset retain caller order (selection always first).
+  for (const edit of edits.map((item, index) => ({ ...item, index }))
+    .sort((a, b) => b.start - a.start || b.index - a.index)) {
+    const block = `${BEGIN}${edit.id}\n`
+      + (edit.id === "selection" ? `${META}${JSON.stringify(metadata)}\n` : "")
+      + edit.body + `${END}${edit.id}\n`;
+    source = source.slice(0, edit.start) + block + source.slice(edit.end);
+  }
+  // Record the installed scope, which can differ after removing a legacy table.
+  for (const entry of scanConfig(source)) {
+    const id = !entry.code ? marker(entry.raw.trim(), BEGIN) : null;
+    const record = metadata.find(item => item.id === id);
+    if (!record) continue;
+    record.table = entry.table;
+    record.hash = hash(edits.find(item => item.id === id).body, record);
+  }
+  return source.replace(`${META}${initialMetadata}`, `${META}${JSON.stringify(metadata)}`);
+}

package/node_modules/@agents-can-communicate/adapter-codex/src/toml-scan.mjs

@@ -0,0 +1,99 @@
+import { AccError, EXIT } from "@agents-can-communicate/protocol";
+
+export const unsafe = (reason = "unrecognized TOML declaration") => {
+  throw new AccError(EXIT.CONFLICT, `cannot safely edit Codex config: ${reason}; `
+    + "repair ambiguous TOML or ACC markers before retrying", { reason });
+};
+// A bounded lexical scan, not a TOML value parser. Newlines inside strings,
+// arrays and inline tables cannot introduce a header or a managed marker.
+export function* statements(source) {
+  let start = 0, code = "", quote = null;
+  const stack = [];
+  for (let i = 0; i < source.length;) {
+    const char = source[i];
+    if (quote) {
+      if (quote[0] === '"' && char === "\\") {
+        code += source.slice(i, i + 2); i += 2; continue;
+      }
+      if (source.startsWith(quote, i)) {
+        let count = quote.length;
+        if (quote.length === 3) {
+          while (source[i + count] === quote[0]) count++;
+          if (count > 5) unsafe("unsupported string quote delimiter");
+        }
+        code += source.slice(i, i + count); i += count; quote = null; continue;
+      }
+      if (quote.length === 1 && /[\r\n]/.test(char)) unsafe("newline in single-line string");
+      code += char; i++; continue;
+    }
+    if (char === "#") {
+      while (i < source.length && source[i] !== "\n") i++;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = source.startsWith(char.repeat(3), i) ? char.repeat(3) : char;
+      code += quote; i += quote.length; continue;
+    }
+    if (char === "[" || char === "{") stack.push(char);
+    if (char === "]" || char === "}") {
+      if (stack.pop() !== (char === "]" ? "[" : "{")) unsafe("mismatched collection delimiter");
+    }
+    code += char; i++;
+    if (char === "\n" && stack.length === 0) {
+      yield { raw: source.slice(start, i), code: code.trim(), start, end: i };
+      start = i; code = "";
+    }
+  }
+  if (quote || stack.length) unsafe(quote ? "unclosed string" : "unclosed collection");
+  if (start < source.length) yield { raw: source.slice(start), code: code.trim(), start, end: source.length };
+}
+
+function decodeKey(key) {
+  if (key[0] === "'") return key.slice(1, -1);
+  if (key[0] !== '"') return key;
+  return key.slice(1, -1).replace(/\\(U[\da-fA-F]{8}|u[\da-fA-F]{4}|[btnfr"\\])|\\./g,
+    (match, escape) => {
+      if (!escape) unsafe("unsupported quoted-key escape");
+      if (/^[uU]/.test(escape)) {
+        const point = Number.parseInt(escape.slice(1), 16);
+        if (point > 0x10ffff || (point >= 0xd800 && point <= 0xdfff)) {
+          unsafe("invalid quoted-key Unicode escape");
+        }
+        return String.fromCodePoint(point);
+      }
+      return ({ b: "\b", t: "\t", n: "\n", f: "\f", r: "\r", '"': '"', "\\": "\\" })[escape];
+    });
+}
+
+function keyPath(code) {
+  const keys = [];
+  let rest = code.trimStart();
+  for (;;) {
+    const match = /^(?:[A-Za-z0-9_-]+|'[^'\r\n]*'|"(?:[^"\\\r\n]|\\[^\r\n])*")/.exec(rest);
+    if (!match) unsafe("unrecognized TOML key");
+    keys.push(decodeKey(match[0]));
+    rest = rest.slice(match[0].length).trimStart();
+    if (!rest.startsWith(".")) return { keys, rest };
+    rest = rest.slice(1).trimStart();
+  }
+}
+
+export function declaration(code) {
+  const header = code.startsWith("[");
+  const array = header && code.startsWith("[[");
+  const { keys, rest } = keyPath(header ? code.slice(array ? 2 : 1) : code);
+  if (header ? rest !== (array ? "]]" : "]") : !rest.startsWith("=")) unsafe();
+  return { keys, header, array, value: header ? null : rest.slice(1).trim() };
+}
+
+// Resolved declaration paths are only structural facts, never parsed user values.
+export function scanConfig(source) {
+  let table = [];
+  return [...statements(source)].map(item => {
+    if (!item.code) return { ...item, table: [...table], keys: [] };
+    const entry = declaration(item.code);
+    if (entry.header) table = entry.keys;
+    return { ...item, ...entry, table: [...table],
+      keys: entry.header ? entry.keys : [...table, ...entry.keys] };
+  });
+}

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/src/channel-directory.mjs

@@ -0,0 +1,8 @@
+import os from "node:os";
+import path from "node:path";
+
+// macOS Unix paths are capped at 104 bytes. A stable, short per-user namespace
+// also lets a sandbox grant access regardless of each client's TMPDIR value.
+export const channelSocketDirectory = () => path.join(
+  process.platform === "darwin" ? "/tmp" : os.tmpdir(),
+  `acc-ch-${typeof process.getuid === "function" ? process.getuid() : "u"}`);

package/node_modules/@agents-can-communicate/adapter-sdk/src/index.mjs

@@ -23,3 +23,6 @@ export { formatJsonAs, jsonStyleOf, mergeOwnedConfig, mergeOwnedEntries, ownedEn
 export { clearSessionBinding, listSessionBindings, loadSessionBinding,
   storeSessionBinding }
   from "./session-binding.mjs";
+
+export { clearNativeAttempt, loadNativeAttempt, storeNativeAttempt } from "./native-attempt.mjs";
+export { channelSocketDirectory } from "./channel-directory.mjs";

package/node_modules/@agents-can-communicate/adapter-sdk/src/native-attempt-writer.mjs

@@ -0,0 +1,64 @@
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { parentPort, workerData } from "node:worker_threads";
+
+import { assertPortableId } from "@agents-can-communicate/protocol";
+import { withWriterMutex } from "@agents-can-communicate/storage-filesystem";
+import { loadNativeAttempt, nativeAttemptFrom } from "./native-attempt.mjs";
+
+const keyFor = harnessSessionId => createHash("sha256").update(String(harnessSessionId))
+  .digest("hex").slice(0, 32);
+const fileFor = (runtimeDir, harnessSessionId) =>
+  path.join(runtimeDir, "native-attempts", `${keyFor(harnessSessionId)}.json`);
+const checkDeadline = deadline => {
+  if (Date.now() >= deadline) throw new Error("native diagnostic deadline expired");
+};
+
+// The caller stops waiting after 250 ms at most. An in-flight filesystem call
+// may complete later, so retain this SEPARATE mutex until its continuation is
+// finished. Unique staging names also isolate cleanup after stale-lock recovery.
+// No diagnostic operation can touch the authoritative hook-owner file.
+async function boundedWrite(input, operation) {
+  const deadline = input.deadlineAt;
+  try {
+    checkDeadline(deadline);
+    await withWriterMutex({ locks: path.join(input.runtimeDir, "native-attempt-locks",
+      keyFor(input.harnessSessionId)) }, { root: input.runtimeDir,
+      clock: { now: () => new Date().toISOString() }, deadlineAt: deadline },
+    () => operation(deadline));
+    return true;
+  } catch { return false; }
+}
+
+async function storeNativeAttempt(input) {
+  return boundedWrite(input, async deadline => {
+    const { runtimeDir, harnessSessionId, accSessionId, generation } = input;
+    assertPortableId(accSessionId, "native diagnostic session id");
+    assertPortableId(generation, "native diagnostic generation");
+    const attempt = nativeAttemptFrom(input.nativeAttempt);
+    if (attempt === null) return;
+    const file = fileFor(runtimeDir, harnessSessionId);
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    checkDeadline(deadline);
+    await mkdir(path.dirname(file), { recursive: true });
+    try {
+      checkDeadline(deadline);
+      await writeFile(temporary, JSON.stringify({ schemaVersion: 1, accSessionId, generation,
+        attempt }) + "\n", "utf8");
+      checkDeadline(deadline);
+      await rename(temporary, file);
+    } finally { await rm(temporary, { force: true }).catch(() => {}); }
+  });
+}
+
+async function clearNativeAttempt(input) {
+  return boundedWrite(input, async deadline => {
+    if (await loadNativeAttempt(input) === null) return;
+    checkDeadline(deadline);
+    await rm(fileFor(input.runtimeDir, input.harnessSessionId), { force: true });
+  });
+}
+
+const operation = workerData.operation === "clear" ? clearNativeAttempt : storeNativeAttempt;
+parentPort.postMessage(await operation(workerData.input));