agents-can-communicate 0.4.4 → 0.5.1

package/README.md

@@ -80,7 +80,7 @@ state, commonly your home directory, cannot be used as a workspace; start the cl
 project directory. See [Troubleshooting](docs/TROUBLESHOOTING.md).
 
 Already using ACC? Follow the [upgrade guide](docs/UPGRADING.md), including the 0.4.x →
-0.4.4 update and the data-format boundary when moving from 0.3.1.
+0.5.0 update and the data-format boundary when moving from 0.3.1.
 
 ## When messages arrive
 
@@ -141,8 +141,10 @@ One npm package. ACC needs no separate account, model API key, or hosted service
 ## Update or remove ACC
 
 Initial installation enables automatic updates. ACC downloads stable releases in the
-background and waits for active clients and ACC processes to exit before switching the
-runtime and refreshing integrations. When a verified Codex service needs a restart,
+background, then switches the runtime and refreshes integrations once nothing blocks. A
+live client or ACC process blocks only while the store contract it declares differs from
+the incoming version's or is unknown; one declaring a matching contract keeps running
+through the switch. When a verified Codex service needs a restart,
 `acc update` asks once, then completes maintenance in a separate process. Open clients
 disconnect; `acc doctor` reports progress and the result. See [update and recovery details](docs/UPGRADING.md#confirmed-client-service-maintenance).
 Restart or resume clients afterward and complete any requested hook or plugin trust review.

package/bin/entrypoints/acc-hook.mjs

@@ -6,9 +6,11 @@
 // someone's session stops working. Unknown adapter, malformed payload, broken
 // store, missing binding - all of them end in "allow, exit 0".
 import { randomBytes } from "node:crypto";
+import { pathToFileURL } from "node:url";
 
 import { createId } from "@agents-can-communicate/protocol";
 import { runHook } from "@agents-can-communicate/hook-runner";
+import { hookEntrypointFor, resolvePinnedGeneration } from "@agents-can-communicate/cli";
 
 import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
 import { createCodexAdapter } from "@agents-can-communicate/adapter-codex";
@@ -38,15 +40,66 @@ const readStdin = () => new Promise(resolve => {
 
 import { completeHookOutput } from "./hook-output.mjs";
 
-export async function main() {
-  const [adapterId] = process.argv.slice(2);
+// A pin is keyed by harness session id, which only an adapter's own
+// normalisation can find inside a payload. This runs the same normalisation
+// `runHook` will run a moment later - cheap, in-memory, no store touched - so
+// a hook that has no pin to look up pays nothing beyond it. Any adapter or
+// payload that will not yield a session id simply has no pin to find, same as
+// today's no-pin behaviour.
+async function harnessSessionIdFor(adapterId, payload) {
+  try {
+    const event = await adapters[adapterId]?.normalizeHook(payload);
+    return typeof event?.sessionId === "string" ? event.sessionId : null;
+  } catch {
+    return null;
+  }
+}
 
-  let payload = null;
+// A pinned generation is only ever another build of this same codebase, but
+// it can still be broken on disk - deleted mid-write, a corrupt install. This
+// tries it and reports failure rather than letting an import error or a
+// throwing `main` escape: the caller then runs the turn on the active
+// generation instead, exactly as if there had been no pin.
+//
+// `delegated` is the circuit breaker on chaining: a hook already running
+// because it was delegated to never looks for a pin of its own. Ordinary
+// resolution already stops itself after one hop - the generation a pin names
+// compares its own pin against the exact root it was just handed, so they
+// match and it returns null - but that self-termination leans on a single
+// pin record staying the value both reads saw. `delegated` does not: it
+// forbids a second hop outright, independent of anything a pin (rewritten
+// mid-resolution by another hook for the same session, or simply wrong)
+// could say. Unbounded delegation would be a hang, worse than any of the
+// failures this file already falls open from.
+async function delegateToPin({ managerRoot, packageRoot, adapterId, payload, delegated }) {
+  if (delegated || managerRoot === null || packageRoot === null) return false;
+  const harnessSessionId = await harnessSessionIdFor(adapterId, payload);
+  if (harnessSessionId === null) return false;
+  const pinned = await resolvePinnedGeneration({ root: managerRoot, harnessSessionId, active: packageRoot });
+  if (pinned === null) return false;
   try {
-    payload = JSON.parse(await readStdin());
+    const runtime = await import(pathToFileURL(hookEntrypointFor(pinned)).href);
+    await runtime.main({ managerRoot, packageRoot: pinned, payload, delegated: true });
+    return true;
   } catch {
-    payload = null;
+    return false;
   }
+}
+
+export async function main({ managerRoot = null, packageRoot = null, payload, delegated = false } = {}) {
+  const [adapterId] = process.argv.slice(2);
+
+  // A delegating caller already read stdin once for the whole process and
+  // hands its parsed payload down; only the outermost call reads it here.
+  if (payload === undefined) {
+    try {
+      payload = JSON.parse(await readStdin());
+    } catch {
+      payload = null;
+    }
+  }
+
+  if (await delegateToPin({ managerRoot, packageRoot, adapterId, payload, delegated })) return;
 
   const result = await runHook({ adapterId, payload, adapters,
     runtime: { clock: { now: () => new Date().toISOString() },

package/docs/ARCHITECTURE.md

@@ -174,14 +174,19 @@ The CLI owns installation generations under `<dataHome>/acc/runtime`, outside wo
 All five launch paths select a generation and publish an actual-process lease under one
 admission mutex before loading workspace-capable code. Immutable launcher modules and
 runtime directories preserve in-progress imports. Leases survive `main()` returning and
-are removed only after confirmed process death. Parsed help, version, and update recovery
-remain available when workspace admission is unavailable.
+are removed only after confirmed process death. A session is also pinned to the generation
+it started with: its hooks delegate to that generation while the pin declares the same
+store contract this one does, and run the active generation otherwise. A generation
+directory is reclaimed once no control pointer, live lease, live pin or staging hold names
+it. Parsed help, version, and update recovery remain available when workspace admission is
+unavailable.
 
 An independent worker downloads npm packages with lifecycle scripts disabled, checks exact
 stable package identity and the discovered integrity, and health-checks the staged runtime.
 Installer detection and planning happen before exclusive admission. The worker then checks
-ACC process leases and native binding PIDs, records `activating`, applies every integration,
-and only publishes the new active pointer after all applications succeed. Partial refresh
+ACC process leases and native binding PIDs and waits only for those whose declared store
+contract differs from the incoming generation's or is absent, records `activating`, applies
+every integration, and only publishes the new active pointer after all applications succeed. Partial refresh
 remains fenced and repairs forward, with the old active pointer retained but normal
 workspace admission unavailable until recovery completes. Native bindings cease holding
 after observed SessionEnd cleanup or confirmed process death; the vendor daemon may remain

package/docs/CLI.md

@@ -274,17 +274,21 @@ An initial `acc install` enables automatic updates. Reinstalling preserves an ex
 `acc update --auto off` choice. A full uninstall pauses updates; reinstalling restores
 the remembered setting. A background worker checks stable releases
 at most once a day, downloads and verifies a separate runtime, then refreshes installed
-integrations and skills after ACC process leases and native binding holds clear. ACC leases
-require confirmed process exit; a native binding can clear on observed SessionEnd even
-while its vendor daemon remains alive, or on confirmed process death. Unknown PIDs remain
-holds. `finish`, presence TTL, and delivery off are not observed native end. Hooks do not
+integrations and skills once no hold blocks. A runtime lease or native binding blocks only
+while the store contract it declares differs from the incoming version's, or while it
+declares none; records written before 0.5.0 declare none, so the first update after
+upgrading still waits for them. ACC leases end on confirmed process exit; a native binding
+can clear on observed SessionEnd even while its vendor daemon remains alive, or on
+confirmed process death. Unknown PIDs remain holds. `finish`, presence TTL, and delivery off are not observed native end. Hooks do not
 wait for network work. `ACC_NO_UPDATE_CHECK=1` disables update networking and background
 scheduling.
 
-`acc update` requests the update immediately. If a verified Codex service blocks activation
-or runs an older version than the installed CLI, it asks once to restart that service.
-After confirmation, a detached worker waits for idle work and other ACC processes, refreshes
-integrations, restarts the service and verifies the result. Open clients disconnect; use
+`acc update` requests the update immediately. If a verified Codex service holds a native
+binding that blocks activation, or serves a version its captured native-delivery contract
+refuses, it asks once to restart that service.
+After confirmation, a detached worker waits for idle work and for any ACC process whose
+declared store contract still holds the update, refreshes integrations, restarts the
+service and verifies the result. Open clients disconnect; use
 `acc doctor` for progress and resume the clients afterward. `--yes` supplies explicit
 noninteractive restart consent. Without consent, or with unknown ownership, the update
 remains pending. See [maintenance limits and recovery](UPGRADING.md#confirmed-client-service-maintenance). `--check` only checks and cannot be combined with

package/docs/GETTING_STARTED.md

@@ -15,7 +15,7 @@ pair or session-bound ACC MCP tools. See [CLI ownership](CLI.md#coordinate-from-
 
 ACC requires macOS or Linux and Node.js 24 or newer.
 
-Already using ACC? Follow the [upgrade guide](UPGRADING.md) for the 0.4.x → 0.4.4
+Already using ACC? Follow the [upgrade guide](UPGRADING.md) for the 0.4.x → 0.5.0
 update or the data-format boundary when upgrading from 0.3.1.
 
 ```bash

package/docs/PROTOCOL.md

@@ -238,6 +238,13 @@ sessionId · generation · adapterId · clientVersion · availableModes
 livePolicy · opaqueEndpointRef · leaseUntil
 ```
 
+`clientVersion` is the version that answered the handshake and was admitted by the
+adapter's captured contract — the process that will serve this binding's live pushes,
+which is not always the version the client's own executable reports. A background
+service that updated under its CLI serves the updated build, and the binding names that
+build. The version the executable reported is recorded separately, beside the session's
+owner record.
+
 The recipient owns `livePolicy` because native push may start a model turn:
 
 - `off`: inbox and normal next-turn paths only;

package/docs/RELEASING.md

@@ -1,7 +1,7 @@
 # Releasing
 
 Use this procedure to build one auditable npm artifact, verify that exact tarball, and keep
-its evidence tied to the commit that supplied its bytes. The package is currently `0.4.4`;
+its evidence tied to the commit that supplied its bytes. The package is currently `0.5.0`;
 the commands derive the version from `package.json` so the filename cannot drift.
 
 ```mermaid

package/docs/SECURITY_MODEL.md

@@ -121,8 +121,10 @@ sha512 integrity against registry metadata, installs with lifecycle scripts disa
 validates the staged runtime before activation. These checks retain the registry and package
 author as a software-supply trust boundary; they do not establish that package code is safe.
 
-ACC process leases hold activation until confirmed exit. Native bindings hold until observed
-SessionEnd cleanup or confirmed process death; unknown PIDs remain conservative holds.
+ACC process leases and native bindings record the store contract they speak, and hold
+activation while that contract differs from the incoming version's or is absent. A lease
+ends on confirmed exit, a native binding on observed SessionEnd cleanup or confirmed process
+death; unknown PIDs and undeclared contracts remain conservative holds.
 `acc finish`, presence TTL, and delivery off do not establish native lifecycle end.
 Normal installation and message delivery do not manage vendor services. Explicit
 `acc update` maintenance requires one separate confirmation (or `--yes`) for the recorded

package/docs/TROUBLESHOOTING.md

@@ -236,11 +236,15 @@ Next: [Getting started](GETTING_STARTED.md) · [Capabilities](CAPABILITIES.md)
 
 ## An automatic update is pending
 
-Run `acc doctor` to see the update policy and pending notice. ACC process leases, including
-persistent MCP servers, require confirmed process exit. Native bindings clear on observed
-SessionEnd or confirmed process death; a vendor daemon may remain alive after SessionEnd.
-Unknown PIDs remain holds until lifecycle cleanup. Close the relevant client sessions and
-ACC processes; `finish`, presence TTL, and delivery off do not prove native end.
+Run `acc doctor` to see the update policy and pending notice. A hold keeps an update
+pending only while the store contract it declares differs from the incoming version's or
+is unknown; records written before 0.5.0 declare none, so the first update after upgrading
+still waits for all of them. `acc update` names each remaining hold with its process and
+its declared contract. ACC process leases, including persistent MCP servers, end on
+confirmed process exit. Native bindings clear on observed SessionEnd or confirmed process
+death; a vendor daemon may remain alive after SessionEnd. Unknown PIDs remain holds until
+lifecycle cleanup. Close the client sessions and ACC processes the notice names;
+`finish`, presence TTL, and delivery off do not prove native end.
 `acc update` can offer a confirmed restart of an eligible Codex service. Unknown or
 unrelated holds still require lifecycle cleanup or confirmed process exit; safety holds
 do not expire merely by elapsed time. See

package/docs/UPGRADING.md

@@ -1,14 +1,14 @@
-# Upgrading to 0.4.4
+# Upgrading to 0.5.0
 
-## From 0.4.3, 0.4.2, 0.4.1 or 0.4.0
+## From 0.4.4, 0.4.3, 0.4.2, 0.4.1 or 0.4.0
 
-This patch keeps the existing workspace data format. It adds confirmed service maintenance
-to the updater, preserves native delivery setup when readiness probes are unavailable,
-and names the actual processes blocking activation. It includes the previous 0.4.x
-outgoing sandbox permissions, delivery diagnostics, session recovery and integration fixes.
-
-Run the update command; it can offer a confirmed restart for an eligible Codex service.
-Other active clients and persistent ACC MCP processes still need to finish before activation:
+This release keeps the existing workspace data format. It changes when an update is
+allowed to take effect: activation is gated on the store contract a running process
+declares rather than on which version it happens to be, sessions finish on the generation
+they started with, unreferenced generation directories are reclaimed, and `acc uninstall`
+retires the holds its own install published. It carries the previous 0.4.x confirmed
+service maintenance, outgoing sandbox permissions, delivery diagnostics, session recovery
+and integration fixes.
 
 ```bash
 acc update
@@ -16,8 +16,8 @@ acc version
 acc doctor
 ```
 
-After publication, `acc version` should report 0.4.4. If a pin keeps an older version,
-select 0.4.4 or clear it first. A managed update refreshes installed integrations and
+After publication, `acc version` should report 0.5.0. If a pin keeps an older version,
+select 0.5.0 or clear it first. A managed update refreshes installed integrations and
 skills; use the npm instructions below for unmanaged or pre-0.4 installations. Start
 clients again and complete any hook/trust review they request. With existing live consent,
 Codex 0.153.4 or newer on macOS arm64 receives local socket permissions when its workspace
@@ -44,16 +44,70 @@ In Grok, public status supplies the session's own CLI arguments through the next
 hook. Grok still uses explicit inbox reads; this patch adds no external wake or guards.
 Start clients in a project directory, rather than a home directory containing ACC state.
 
+## What still waits for a process to exit, and what no longer does
+
+Earlier releases held a verified update until every live ACC process and every native
+client binding was gone. Each of those holds now states the store contract it speaks, and
+only two kinds keep an update pending:
+
+- A hold whose declared store contract differs from the incoming version's. This is the
+  case the gate exists for, and a release that changes the store contract still needs
+  every live process to exit.
+- A hold that declares no contract, which includes every record written by a release
+  before this one. Unknown cannot be compared, so it stays a conservative wait.
+
+A hold declaring the same store contract as the incoming version proceeds. Several open
+Claude Code sessions, a Codex daemon and an idle ACC MCP server no longer have to be
+closed together to move between releases that share a contract.
+
+The first update after installing this release still waits for every process, because the
+holds it has to judge were written before the contract field existed. Close the relevant
+clients and persistent ACC processes once, or accept the eligible Codex service
+maintenance offer described below. Updates after that do not need it.
+
+`acc update` names each remaining hold with its process and its declared contract, so a
+wait now states its reason rather than only the PID. `acc doctor` reports the same
+pending notice.
+
+A session that is open while an activation completes keeps running the generation it
+started with, including its hooks, until it ends; it does not get half of one version and
+half of another. A session whose pin names a generation with a different store contract
+runs the active generation instead, which is the same behaviour as having no pin.
+
+A restart offer for a client's background service is now made only when the version that
+service is actually running fails that client's captured contract, or when it still holds
+a native binding. A Codex CLI that updated while its daemon kept serving the previous
+build is an ordinary state, and it no longer produces a prompt to disconnect open clients.
+
+Generation directories that nothing references are removed after an activation instead of
+accumulating. A directory is kept while any control pointer, live runtime lease, live
+session pin or in-flight staging hold names it, and an unreadable holder postpones the
+whole sweep rather than being assumed dead.
+
+`acc uninstall` retires the binding records and session pins its own install published,
+so they stop holding a later activation, when the removal leaves no client installed. It
+never signals or terminates a client process. Removing one client while another stays
+installed retires nothing, because a binding record names the generation that published
+it and no client id. Runtime leases are left in place on purpose: a lease is also what
+protects the generation a running process is executing from, and clearing it would let
+that directory be reclaimed out from under the process. A live ACC process therefore
+keeps holding activation across an uninstall until it exits.
+
 ## Confirmed client service maintenance
 
-On macOS arm64, `acc update` can ask once to restart a verified Codex service that blocks
-activation or runs a different version from the installed CLI. The captured maintenance
-contract uses Codex CLI 0.154.0 and its `pid` backend, with compatible commands and protocol
+On macOS arm64, `acc update` can ask once to restart a verified Codex service that holds a
+native binding blocking activation, or that is serving a version outside the captured
+native-delivery contract. A serving version that satisfies that contract is left alone,
+even when the installed CLI has moved to a newer build. The captured maintenance contract
+uses Codex CLI 0.154.0 and its `pid` backend, with compatible commands and protocol
 checked again at runtime. The installed CLI and managed executable must already match;
 ACC does not replace vendor binaries or install an operating-system service.
 
 After confirmation, a detached ACC worker waits up to 15 minutes for idle Codex turns,
-empty queues and other ACC processes to exit. It rechecks the approved candidate, settings,
+empty queues, the requesting command to exit, and any other ACC process still holding the
+update. It judges those holds by the same contract rule the activation path uses, so a
+process declaring the incoming version's store contract does not delay the restart, and
+one declaring a differing or unknown contract does. It rechecks the approved candidate, settings,
 PID/start time, executable, socket ownership and versions before stopping the service.
 It refreshes integrations, starts the service again and verifies the result. If refreshing
 integrations fails, it still restores the service and reports the incomplete update.
@@ -78,7 +132,7 @@ an update even when a native service or feature probe is temporarily unavailable
 
 An old installation can already be stuck with both a pre-0.4.4 pending runtime and the
 old updater that waits indefinitely. That code cannot discover this fix. Bootstrap the
-new launcher once with `npm install --global agents-can-communicate@0.4.4`, then run
+new launcher once with `npm install --global agents-can-communicate@0.5.0`, then run
 `acc update`. The new launcher stages its verified runtime and retires only an exactly
 identified obsolete ACC background updater while no integrations are being written.
 This does not terminate an unrelated client or bypass its lifetime hold.
@@ -104,7 +158,7 @@ restores access; deleting or editing the record is not a remedy.
 2. Install the released package, then refresh the client integrations:
 
    ```bash
-   npm install --global agents-can-communicate@0.4.4
+   npm install --global agents-can-communicate@0.5.0
    acc version
    acc install
    ```
@@ -139,13 +193,15 @@ an independent background process, normally at most once a day, downloads and ve
 separate runtime copy, and refreshes the installed integrations and skills before switching.
 The global npm package provides a launcher; the active runtime lives under ACC's data home.
 
-Running ACC processes, including idle MCP servers, hold the current version until
-confirmed process exit. Native bindings hold until observed client SessionEnd cleanup or
-confirmed process death; the vendor daemon can remain running after that lifecycle event.
-Unknown PIDs remain conservative holds until lifecycle cleanup. `acc finish`, presence TTL,
-and delivery off alone do not prove native end. Close the relevant client sessions and
-persistent ACC processes to release holds, or accept the eligible Codex service maintenance
-offer in `acc update`. Background updates never request fresh restart consent.
+Running ACC processes, including idle MCP servers, still publish a hold for as long as they
+live, and native bindings still hold until observed client SessionEnd cleanup or confirmed
+process death; the vendor daemon can remain running after that lifecycle event. What
+changed is which of those holds keeps an update pending: only one whose declared store
+contract differs from the incoming version's, or that declares none at all. Unknown PIDs
+remain conservative holds until lifecycle cleanup. `acc finish`, presence TTL, and delivery
+off alone still do not prove native end. When a hold does block, close the relevant client
+sessions and persistent ACC processes to release it, or accept the eligible Codex service
+maintenance offer in `acc update`. Background updates never request fresh restart consent.
 Hooks never wait for a network download. If integration refresh temporarily prevents
 coordination, a hook lets the client continue; its next genuine user turn can restore a
 missing binding.
@@ -155,7 +211,7 @@ acc update                    # download and apply, or report what is keeping it
 acc update --check            # check without installing or changing update settings
 acc update --auto off         # disable background updates
 acc update --auto on          # enable them again
-acc update --pin 0.4.4        # stay on this exact stable version
+acc update --pin 0.5.0        # stay on this exact stable version
 acc update --pin none         # follow stable releases again
 ```
 
@@ -173,9 +229,11 @@ lifecycle scripts. `acc doctor` reports the automatic-update policy and pending
 A failed download or verification keeps the active runtime. An interrupted integration
 refresh keeps workspace admission closed until `acc update` finishes the refresh. It does
 not roll workspace history back. A failed refresh exits with code `4` and reports the adapter
-and configuration problem to fix before retrying; a verified update waiting for live clients
-remains pending. Previous runtime and plugin cache versions are
-retained so existing launch paths survive the change.
+and configuration problem to fix before retrying; a verified update waiting for a blocking
+hold remains pending. A previous runtime version is retained for as long as anything can
+still reach it — a control pointer, a live ACC process, or an open session pinned to it —
+so existing launch paths survive the change; once nothing references it, its directory is
+reclaimed after the next activation instead of accumulating.
 
 Client trust is still controlled by the client. Follow any reported activation or hook
 review steps; copied files do not prove the client has activated them. The initial

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.4.4",
+  "version": "0.5.1",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.4.4",
+  "version": "0.5.1",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/adapter.mjs

@@ -5,15 +5,17 @@ import certification from "../certification.json" with { type: "json" };
 import { createCodexMaintenance } from "./maintenance.mjs";
 export { sameMaintenanceIdentity } from "./maintenance.mjs";
 
-import { PROTOCOL_CONTRACT } from "./app-server-client.mjs";
+import { CODEX_QUEUE_MINIMUM, PROTOCOL_CONTRACT } from "./app-server-client.mjs";
 import { allowOutcome, denyOutcome, injectOutcome, normalizeCodexHook }
   from "./hooks.mjs";
 import { planCodexInstall, detectCodex, installCodexPlugin, preflightCodexUninstall,
   uninstallCodexPlugin } from "./install.mjs";
 // Public native wiring is enabled only with installed-product capture evidence.
 
+// Re-exported so existing importers of CODEX_QUEUE_MINIMUM keep resolving; the
+// value now lives in app-server-client.mjs alongside the other version rules.
+export { CODEX_QUEUE_MINIMUM };
 export const CODEX_VERSION = "0.147.0";
-export const CODEX_QUEUE_MINIMUM = "0.152.1";
 export const CODEX_DELIVERY_FALLBACK = Object.freeze({
   diagnostic: "Codex native delivery requires codex-cli 0.152.1 or newer on darwin-arm64, "
     + "recorded recipient consent and a reachable LocalDaemon session with exact thread, cwd, "

package/node_modules/@agents-can-communicate/adapter-codex/src/app-server-client.mjs

@@ -12,6 +12,10 @@ import { openWebSocketPeer } from "./ws-json-rpc.mjs";
 
 export const PROTOCOL_CONTRACT = "codex-app-server-thread-queue-v1";
 export const MINIMUM_VERSION = "0.152.1";
+// The captured native-delivery contract's floor. Shared with MINIMUM_VERSION
+// today, but named separately: this is the version a binding was verified
+// against, not the probe's own support floor.
+export const CODEX_QUEUE_MINIMUM = MINIMUM_VERSION;
 export const QUEUE_MODES = Object.freeze(["livePush", "idleWake", "busyQueue"]);
 const CLIENT_INFO = Object.freeze({ name: "agents-can-communicate", version: "0.2.0" });
 const STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;

package/node_modules/@agents-can-communicate/adapter-codex/src/native-delivery.mjs

@@ -1,9 +1,10 @@
 import { realpath } from "node:fs/promises";
 import { decisionBody } from "@agents-can-communicate/adapter-sdk";
 
-import { MINIMUM_VERSION, PROTOCOL_CONTRACT, QUEUE_MODES, addCodexQueueMessage,
-  canonicalCwd, controlSocketPath, locateCodexThread, openCodexAppServer,
-  parseStableVersion, probeCodexQueue, safeReason, serverVersionOf } from "./app-server-client.mjs";
+import { CODEX_QUEUE_MINIMUM, MINIMUM_VERSION, PROTOCOL_CONTRACT, QUEUE_MODES,
+  addCodexQueueMessage, canonicalCwd, compareStableVersions, controlSocketPath,
+  locateCodexThread, openCodexAppServer, parseStableVersion, probeCodexQueue,
+  safeReason, serverVersionOf } from "./app-server-client.mjs";
 import { newEndpointId, readNativeEndpoint, removeNativeEndpoint, socketIsReady,
   writeNativeEndpoint } from "./native-endpoint.mjs";
 
@@ -62,13 +63,35 @@ export function planNativeActivation({ detection }) {
   ] };
 }
 
-async function verifyReceiver(peer, endpoint) {
-  const probe = await probeCodexQueue(peer, { threadId: endpoint.threadId });
-  if (!probe.supported) return probe.reasonCode === "probe_timeout" ? "handshake_timeout" : "protocol_mismatch";
-  if (probe.serverVersion !== endpoint.clientVersion) return "handshake_version_mismatch";
-  const located = await locateCodexThread(peer, { threadId: endpoint.threadId, cwd: endpoint.cwd });
-  return located.found ? null : located.reasonCode === "cwd_mismatch"
-    ? "workspace_identity_unavailable" : "handshake_failed";
+// A daemon that restarted onto a newer build still satisfies the captured
+// contract. The thread it may have lost is reported separately by
+// locateCodexThread, so refusing on the version alone only hides the real
+// reason. Returns the version that actually answered as `servingVersion`
+// (null when refused) instead of mutating the endpoint it was handed, so a
+// caller can decide what to persist on the one path that owns persistence,
+// after its own validation has already run.
+export async function verifyReceiver(peer, endpoint, { probe = probeCodexQueue,
+  locate = locateCodexThread } = {}) {
+  const result = await probe(peer, { threadId: endpoint.threadId });
+  if (!result.supported) {
+    // probeCodexQueue applies the same floor and answers first, so a daemon
+    // serving below the minimum arrives here as a refused probe rather than
+    // reaching the explicit check below. Reporting that as a protocol
+    // mismatch named the wrong condition everywhere it surfaced - doctor,
+    // the offer's safe error code, the recorded failure - and left the
+    // version answer this function already knows how to give unreachable.
+    return { reasonCode: result.reasonCode === "probe_timeout" ? "handshake_timeout"
+      : result.reasonCode === "below_minimum_version" ? "handshake_version_mismatch"
+        : "protocol_mismatch", servingVersion: null };
+  }
+  if (compareStableVersions(result.serverVersion, CODEX_QUEUE_MINIMUM) < 0) {
+    return { reasonCode: "handshake_version_mismatch", servingVersion: null };
+  }
+  const located = await locate(peer, { threadId: endpoint.threadId, cwd: endpoint.cwd });
+  return located.found
+    ? { reasonCode: null, servingVersion: result.serverVersion }
+    : { reasonCode: located.reasonCode === "cwd_mismatch" ? "workspace_identity_unavailable" : "handshake_failed",
+        servingVersion: null };
 }
 
 export async function bindNativeSession({ event, clientPid, clientVersion, runtimeDir,
@@ -86,20 +109,41 @@ export async function bindNativeSession({ event, clientPid, clientVersion, runti
       const endpoint = { schemaVersion: 1, endpointId: newEndpointId(), socketPath,
         threadId: event.sessionId, cwd, clientVersion, protocolContract: PROTOCOL_CONTRACT,
         leaseUntil: new Date(now() + LEASE_MS).toISOString() };
-      const reason = await verifyReceiver(peer, endpoint);
-      if (reason !== null) return rejected(reason);
-      await writeNativeEndpoint({ runtimeDir, record: endpoint });
-      return handshake(endpoint, now);
+      const { reasonCode, servingVersion } = await verifyReceiver(peer, endpoint);
+      if (reasonCode !== null) return rejected(reasonCode);
+      // The daemon may have restarted onto a different build since the
+      // caller's claimed clientVersion was captured; persist what actually
+      // answered so the binding and its later reads reflect the serving
+      // process, not the caller's claim.
+      const verified = { ...endpoint, clientVersion: servingVersion };
+      await writeNativeEndpoint({ runtimeDir, record: verified });
+      return handshake(verified, now);
     });
   } catch (error) {
     return rejected(error?.code === "ETIMEDOUT" ? "handshake_timeout" : "handshake_failed");
   }
 }
 
+// Resolving the binding's opaque reference is the whole of the identity check:
+// the endpoint id is 128 random bits minted per bind, readNativeEndpoint
+// re-checks that the record it read carries that exact id, and no two bindings
+// can name the same record.
+//
+// The two records' clientVersion snapshots used to be compared here as well.
+// That was never identity - the id already settles that - it was a third
+// version rule, and the only one applied to a stored snapshot rather than to
+// the process now answering. It is deliberately gone. It cannot refuse
+// anything verifyReceiver does not refuse better two lines on, against the
+// version that actually answers, with the thread and cwd, before anything is
+// queued; and against the snapshot it could only ever be vacuous, because a
+// record is written solely from a serving version that already cleared
+// CODEX_QUEUE_MINIMUM. What it did do was fire on the case 0.5.0 exists to
+// support: the endpoint records what the daemon serves, the binding recorded
+// what `codex --version` printed, and a daemon that had updated under its CLI
+// was refused here on that difference alone.
 async function receiverFor(binding, runtimeDir) {
   const endpoint = await readNativeEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef });
-  return endpoint?.clientVersion === binding?.clientVersion
-    && await socketIsReady(endpoint?.socketPath) ? endpoint : null;
+  return endpoint !== null && await socketIsReady(endpoint.socketPath) ? endpoint : null;
 }
 
 export async function refreshNativeSession({ binding, runtimeDir, timeoutMs = 750,
@@ -109,8 +153,9 @@ export async function refreshNativeSession({ binding, runtimeDir, timeoutMs = 75
   if (endpoint === null) return rejected("handshake_failed");
   try {
     return await usingPeer(endpoint.socketPath, timeoutMs, open, async peer => {
-      const reason = await verifyReceiver(peer, endpoint);
-      return reason === null ? handshake(endpoint, now) : rejected(reason);
+      const { reasonCode, servingVersion } = await verifyReceiver(peer, endpoint);
+      return reasonCode === null
+        ? handshake({ ...endpoint, clientVersion: servingVersion }, now) : rejected(reasonCode);
     });
   } catch (error) {
     return rejected(error?.code === "ETIMEDOUT" ? "handshake_timeout" : "handshake_failed");
@@ -125,12 +170,12 @@ export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 5
   if (endpoint === null) return rejected("recipient_unavailable");
   try {
     return await usingPeer(endpoint.socketPath, timeoutMs, open, async peer => {
-      const reason = await verifyReceiver(peer, endpoint);
-      if (reason !== null) return rejected(reason === "handshake_timeout" ? "transport_error"
-        : reason === "handshake_version_mismatch" ? "unsupported_client_version" : "recipient_unavailable");
+      const { reasonCode, servingVersion } = await verifyReceiver(peer, endpoint);
+      if (reasonCode !== null) return rejected(reasonCode === "handshake_timeout" ? "transport_error"
+        : reasonCode === "handshake_version_mismatch" ? "unsupported_client_version" : "recipient_unavailable");
       await addCodexQueueMessage(peer, { threadId: endpoint.threadId,
         messageId: message.messageId, text: renderText(message) });
-      return { accepted: true, transport: "codex-app-server", clientVersion: endpoint.clientVersion };
+      return { accepted: true, transport: "codex-app-server", clientVersion: servingVersion };
     });
   } catch (error) {
     if (["EPERM", "EACCES"].includes(error?.code)) return rejected("transport_permission_denied");