agents-can-communicate 0.5.3 → 0.5.4

package/README.md

@@ -67,9 +67,11 @@ review the current ACC definitions in `/hooks`; changed hooks may need fresh tru
 
 For Codex live delivery on Apple Silicon macOS, installation also configures outgoing
 local socket access on Codex 0.153.4 or newer when using default workspace permissions.
-Custom policies are preserved. If its local service is missing, doctor gives the command
-`codex app-server daemon start`; then open a new Codex session. Doctor reports receiving
-channel state and outgoing permission configuration separately.
+Custom policies are preserved. One default-No choice covers all selected clients that need
+live-delivery consent. On Codex 0.154.0 or newer, an accepted choice can start a missing
+service when the managed standalone installation is present. The client still owns session
+startup, hook trust, and Claude Channels approval. Doctor reports service infrastructure,
+session binding, and outgoing permissions separately.
 
 Open two sessions and give them ordinary tasks, as above. Look for an agent discovering a
 peer, checking who is changing a file, asking about a shared dependency, or replying to a
@@ -100,14 +102,15 @@ mutations. It adds no automatic peer-message injection or idle delivery. A reloc
 
 **Optional live delivery can start a turn in an idle Codex or Claude Code session.** It is
 experimental, off by default, and can spend model tokens. On Apple Silicon Macs, Codex
-0.152.1 or newer requires an already-running LocalDaemon and a verified session;
+0.152.1 or newer requires LocalDaemon infrastructure and a verified session;
 Claude Code 2.1.258 or newer requires zsh and client-side Channels activation; check its
 startup notice for ACC and accept the development warning when shown. An MCP connection
 alone does not verify inbound delivery. Messages arriving mid-turn wait for the turn to
 finish. The receiving session's
 opt-in policy and current reachability determine whether delivery can proceed.
 `acc install` reports each client's delivery state and can save Codex consent before its
-service is available. `acc doctor` also names each session’s last native binding result,
+service is available. Use `--delivery actionable|all` for explicit automation and
+`--delivery off` to disable incoming automatic requests. `acc doctor` also names each session’s last native binding result,
 including missing launch consent, an unidentified client process or a failed handshake.
 It distinguishes a disabled policy from an unavailable service or a missing live channel
 in the current project.

package/docs/CLI.md

@@ -250,7 +250,7 @@ before leaving, request the concrete continuation and obtain a substantive reply
 `--delivery off|actionable|all` is a per-client recipient policy request, not a capability
 switch, and the default is `off`. `--adapter` is repeatable to name several clients. An
 explicit `--delivery` applies uniformly and never prompts; omitting it on an interactive
-terminal asks one default-No question per supported client. Codex can save consent while
+terminal asks one default-No question for all selected clients that need a decision. Codex can save consent while
 its local service is unavailable or has no loaded session; this does not activate delivery.
 A non-interactive run or a `--dry-run` keeps fresh clients off. A recorded opt-in is kept on upgrade. If the detected
 client cannot receive native delivery - unsupported, below the captured minimum, a
@@ -259,8 +259,10 @@ effective policy off and prints the reason. Claude Code shell activation writes
 zsh PATH block and a shim that `exec`s the real client; `ACC_BYPASS=1` bypasses that
 activation. Codex LocalDaemon delivery uses recorded installation consent without changing
 ordinary launch arguments. Its opt-in remains active when shim variables are absent or
-bypassed; `acc install --adapter codex --delivery off` disables new native offers. Installation
-and message delivery do not start or stop the vendor daemon. The install summary names each client's requested policy,
+bypassed; `acc install --adapter codex --delivery off` disables new native offers. On a
+supported explicit install, complete consent can prepare a missing Codex service from an
+existing managed standalone installation. Dry runs, delivery off, automatic refresh, and
+message delivery do not start it. Uninstall does not stop the shared vendor daemon. The install summary names each client's requested policy,
 activation state and verified fallback. `doctor` separates protocol readiness, recorded
 consent and a live channel in the current workspace, with a next step for missing activation.
 A supported version or an installed plugin alone is not an active delivery channel.
@@ -269,7 +271,8 @@ block inbound Channels messages while its MCP server and tools remain connected;
 doctor therefore also names the client-side startup check.
 In doctor JSON, `nativeDelivery.activation` distinguishes missing launch setup from a
 recorded setup (or `not_required` for a pre-existing service). `policy` is the installed
-choice; `sessionPolicy` describes a native binding when one is visible. Existing Claude
+choice. `deliveryDecision` gives its known source and reports legacy provenance as unknown.
+`nativeServiceSetup` reports service infrastructure separately. `sessionPolicy` describes a native binding when one is visible. Existing Claude
 sessions can retain their launch policy after a different choice is installed for new
 sessions; Codex checks current recorded consent before new offers.
 `nativeDelivery.sessions` lists each current session's identity, present transport state

package/docs/CONFIGURATION.md

@@ -139,7 +139,9 @@ reports degraded reachability; it does not rewrite the installed consent.
 
 Codex LocalDaemon delivery separately requires macOS arm64, Codex 0.152.1 or newer, a
 current feature probe, and exact thread, canonical cwd, process, version and protocol
-checks. Its daemon must already be running; installation and delivery do not start or stop it.
+checks. Explicit complete setup can prepare a definitely absent service on Codex 0.154.0
+or newer when the managed standalone installation is present. Message delivery does not
+start or stop it.
 Explicit update maintenance can restart a verified service after separate confirmation. Codex reads
 consent from the installation record, not a shell-shim variable. Unavailable or ineligible
 sessions retain durable inbox fallback. Use `acc install --adapter codex --delivery off`
@@ -165,8 +167,10 @@ not merge arbitrary security policies or verify overrides in an already running
 For a custom policy, grant the same state and socket access through the proxy in the
 client's effective workspace profile; do not combine it with legacy sandbox settings.
 
-Restart Codex after changing permissions. Explicit delivery `off` or uninstall restores
-the previous configuration only while every generated permission component is unchanged.
+Restart Codex after changing permissions. Disabling incoming delivery retains unchanged
+ACC-owned outgoing grants that you approved earlier. A fresh `--delivery off` install does
+not add live socket grants. Uninstall restores the previous configuration only while every
+generated permission component is unchanged.
 If any component was edited or another setting depends on it, ACC preserves the entire
 bundle and reports it for review. Plugin registration can still be removed independently.
 

package/docs/GETTING_STARTED.md

@@ -55,6 +55,14 @@ verified channel in the current session. Codex can save your choice even when it
 service is not running yet. Declining uses the reported fallback: `acc inbox`, or next-turn
 hooks only where the exact client version and platform are certified.
 
+An interactive install asks one default-No question for all selected clients that need a
+choice. Use `--delivery actionable|all` for explicit noninteractive consent. Use
+`--delivery off` to disable incoming automatic requests. A dry run does not ask, write
+configuration, or start a service. When supported Codex service preparation succeeds, it
+means the infrastructure is ready. Start a Codex session and complete the client's hook and
+trust review to establish a session-bound channel. If the managed standalone prerequisite
+is missing, install reports that prerequisite instead of claiming readiness.
+
 If you opt into Claude Code's experimental idle delivery, check Claude's Channels startup
 notice for ACC and accept its development-channel warning when shown. If it reports Channels
 unavailable or blocked, a connected MCP server does not make inbound delivery work;
@@ -127,9 +135,10 @@ durable inbox instead.
 
 Codex LocalDaemon and Claude Code Channel offer optional native delivery on
 Apple Silicon macOS. They are experimental, can spend tokens, and queue messages
-until a running turn finishes. Codex requires 0.152.1 or newer, an already-running
-LocalDaemon, recorded opt-in and a verified session; start it with your normal
-command. A loaded daemon thread can receive messages after its terminal exits.
+until a running turn finishes. Codex requires 0.152.1 or newer, LocalDaemon infrastructure,
+recorded opt-in, and a verified session. Supported explicit setup can prepare a missing
+service. Start the client with your normal command. A loaded daemon thread can receive
+messages after its terminal exits.
 [Capabilities](CAPABILITIES.md) explains policy, versions and fallback.
 
 Delivery evidence is deliberately narrow: `queued -> offered -> retrieved -> acknowledged`.

package/docs/TROUBLESHOOTING.md

@@ -91,24 +91,24 @@ supported platform, current probe and exact session binding. Under `actionable`,
 a `note` stays queued with `delivery_disabled`.
 
 For Codex, use your ordinary launch command with 0.152.1 or newer on Apple Silicon
-macOS. Its LocalDaemon must already be running, and trusted hooks must establish
+macOS. Its LocalDaemon infrastructure and trusted hooks must establish
 the receiver's exact thread and workspace. Embedded sessions, an absent socket,
 ambiguous recipients or failed identity checks retain durable inbox access.
 `acc doctor` reports readiness, consent and the current workspace's live channel separately.
 `native_endpoint_unavailable` means the local service endpoint is missing or is not a safe socket;
 `native_session_unavailable` means the service answered but has no loaded thread to probe.
 An interactive install can save consent in either case. ACC preserves it through a temporary
-outage and does not start the daemon for you.
-
-On a supported Codex CLI, a missing daemon can be started with
-`codex app-server daemon start`; open a new Codex session afterward. Doctor includes this
-command when it detects the missing endpoint.
+outage. On Codex 0.154.0 or newer, an explicit install with complete consent can prepare a
+missing service when the managed standalone installation is present. If that prerequisite
+is missing or unsafe, doctor names the vendor action and does not claim readiness. A ready
+service is infrastructure only. Open a new Codex session afterward and complete the
+client-owned hook and trust review.
 
 If a reply stays queued with `transport_permission_denied`, the sender's permissions
 blocked local transport. This is distinct from an unavailable recipient. The message was
 recorded successfully; the error does not mean it was read or acknowledged.
 On Codex 0.153.4 or newer on macOS arm64, rerun `acc install --adapter codex` with existing
-live consent (or add `--delivery actionable` to opt in), then start a new session.
+live consent. Add `--delivery actionable` when new consent is required, then start a new session.
 Doctor's `outgoingDelivery` reports the installed permission configuration separately
 from `nativeDelivery.runtime`: an active receiving channel does not establish outgoing
 access. Custom policies and active-session overrides remain unverified; inspect the config

package/docs/UPGRADING.md

@@ -23,8 +23,9 @@ clients again and complete any hook/trust review they request. With existing liv
 Codex 0.153.4 or newer on macOS arm64 receives local socket permissions when its workspace
 policy is default or contains only ACC's legacy state root. Custom policies are preserved
 and reported as unverified. See [outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions).
-If doctor names a missing local service, run `codex app-server daemon start` before opening
-the new session.
+If doctor names a missing local service, follow its prerequisite or explicit install action
+before opening the new session. A supported explicit install can prepare the service. It
+does not make a session-bound channel ready.
 
 Run `acc doctor` in the project after the new clients have started (or submitted a normal
 turn). Its per-session lines now explain missing launch consent, an unidentified client
@@ -37,8 +38,10 @@ Claude admitted inbound Channels messages. See [delivery troubleshooting](TROUBL
 Upgrading preserves delivery consent. If doctor reports native delivery off and you want
 automatic peer requests, use `acc install --adapter codex --delivery actionable` (or the
 relevant adapter); this can spend model tokens. Codex can save that consent before its
-local service/session becomes available. Installation does not start the vendor daemon; ACC
-keeps durable inbox access when no verified live channel is bound.
+local service/session becomes available. Ordinary installation keeps durable inbox access
+when no verified live channel is bound. Explicit complete setup can prepare a definitely
+absent supported service. Automatic refresh, delivery off, dry runs, and uninstall do not
+start or stop that shared service.
 
 In Grok, public status supplies the session's own CLI arguments through the next tool
 hook. Grok still uses explicit inbox reads; this patch adds no external wake or guards.

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/adapter.mjs

@@ -2,6 +2,7 @@ import { defineAdapter, projectContext, projectContextResult }
   from "@agents-can-communicate/adapter-sdk";
 import { probeNativeDelivery, planNativeActivation, bindNativeSession, refreshNativeSession, retireNativeSession, offerMessage } from "./native-delivery.mjs";
 import certification from "../certification.json" with { type: "json" };
+import { createCodexServiceSetup } from "./service-setup.mjs";
 import { createCodexMaintenance } from "./maintenance.mjs";
 export { sameMaintenanceIdentity } from "./maintenance.mjs";
 
@@ -20,9 +21,10 @@ export const CODEX_DELIVERY_FALLBACK = Object.freeze({
   diagnostic: "Codex native delivery requires codex-cli 0.152.1 or newer on darwin-arm64, "
     + "recorded recipient consent and a reachable LocalDaemon session with exact thread, cwd, "
     + "process, version and protocol verification. Embedded or unreachable sessions retain "
-    + "durable messages. Native delivery does not start, restart or stop the vendor daemon and adds no "
+    + "durable messages. Message delivery does not start, restart or stop the vendor daemon and adds no "
     + "launch arguments; fallback is exact-certified next-turn delivery or acc inbox. "
-    + "Explicitly confirmed acc update maintenance has a separate daemon restart check",
+    + "Explicit install with complete setup consent can prepare a missing supported service; "
+    + "explicitly confirmed acc update maintenance has a separate daemon restart check",
 });
 
 /**
@@ -67,6 +69,7 @@ export function createCodexAdapter() {
     probeNativeDelivery, planNativeActivation, bindNativeSession,
     refreshNativeSession, retireNativeSession, offerMessage,
     ...createCodexMaintenance(),
+    ...createCodexServiceSetup(),
     startSession: async () => ({ ok: true, changes: [], diagnostics: [] }),
     endSession: async () => ({ ok: true, changes: [], diagnostics: [] }),
     guardWrite: async () => ({ ok: true, changes: [], diagnostics: [] }),

package/node_modules/@agents-can-communicate/adapter-codex/src/app-server-client.mjs

@@ -67,7 +67,8 @@ export async function probeCodexQueue(peer, { threadId, minimum = MINIMUM_VERSIO
   try {
     if (threadId === undefined) {
       const loaded = await pageAll(peer, "thread/loaded/list", {});
-      threadId = loaded.find(id => typeof id === "string" && id !== "");
+      if (loaded.some(id => typeof id !== "string" || id === "")) throw protocolError();
+      threadId = loaded[0];
       if (threadId === undefined) return { supported: false, serverVersion,
         reasonCode: "native_session_unavailable" };
     }

package/node_modules/@agents-can-communicate/adapter-codex/src/install.mjs

@@ -350,7 +350,7 @@ export async function detectCodex({ home, agentsHome = home,
   // detection neither invents its hash algorithm nor starts a client service.
   return { ok: true, changes: [], outgoingDelivery,
     nativeSetup: nativeDelivery?.reasonCode === "native_endpoint_unavailable"
-      ? "Codex CLI: run codex app-server daemon start, then open a new Codex session; ACC never starts or restarts the daemon"
+      ? "Codex CLI: run codex app-server daemon start, then open a new Codex session; explicit ACC install with complete setup consent can prepare a missing supported service"
       : null,
     diagnostics: [
     published ? "acc plugin published in the marketplace" : "acc plugin not registered",

package/node_modules/@agents-can-communicate/adapter-codex/src/live-permissions.mjs

@@ -26,6 +26,28 @@ const configured = (source, context) => {
     && sockets(context).every(socket => literal(value(["permissions", profile, "network", "unix_sockets", socket])) === "allow");
 };
 
+const hasCustomPolicy = (source, context) => {
+  const ownership = inspectPermissions(source);
+  if (ownership.state === "customized") return true;
+  if (ownership.state === "owned") return false;
+  const entries = scanConfig(source);
+  const find = keys => entries.filter(entry => equal(entry.keys, keys));
+  const modes = find(["sandbox_mode"]), defaults = find(["default_permissions"]);
+  const legacy = entries.filter(entry => entry.keys[0] === "sandbox_workspace_write");
+  const features = entries.filter(entry => entry.keys[0] === "features");
+  const featureTable = find(["features"]);
+  const proxies = find(["features", "network_proxy"]);
+  return entries.some(entry => ["permissions", "profile", "profiles"].includes(entry.keys[0]))
+    || modes.length > 1 || defaults.length > 1
+    || modes.some(entry => entry.header || literal(entry.value) !== "workspace-write")
+    || defaults.some(entry => entry.header || literal(entry.value) !== ":workspace")
+    || (legacy.length > 0 && (legacy.length !== 2 || !legacy[0].header || legacy[0].array
+      || !equal(legacy[1].keys, ["sandbox_workspace_write", "writable_roots"])
+      || JSON.stringify(literal(legacy[1].value)) !== JSON.stringify([context.stateRoot])))
+    || (features.length > 0 && (featureTable.length !== 1 || !featureTable[0].header || featureTable[0].array))
+    || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
+};
+
 // Match the channel's per-user temporary directory and Codex's actual home.
 // Grants cover only ACC's local channel namespace, never arbitrary Unix sockets.
 const sockets = context => [channelSocketDirectory(),
@@ -33,8 +55,9 @@ const sockets = context => [channelSocketDirectory(),
 
 export function outgoingStatus(source, context) {
   const state = inspectPermissions(source).state;
+  const custom = hasCustomPolicy(source, context);
   const ready = state === "owned" && supported(context) && configured(source, context);
-  const reasonCode = state === "customized" ? "permission_configuration_modified"
+  const reasonCode = custom ? "permission_configuration_modified"
     : !supported(context) ? "permission_configuration_uncaptured"
       : ready ? null : "sender_permissions_unverified";
   return { state: reasonCode === null ? "configured" : "unverified", reasonCode,
@@ -47,14 +70,24 @@ export function outgoingStatus(source, context) {
       : `outgoing live delivery: sender permissions unverified in ${context.file}; `
         + (reasonCode === "permission_configuration_uncaptured"
           ? `automatic setup requires Codex ${MINIMUM} or newer on darwin-arm64`
-          : "existing permissions were preserved; run acc install --adapter codex, then start a new session; "
-            + "custom permission policies must allow ACC state and local sockets through the network proxy") };
+          : custom
+            ? "custom permission policy was preserved; manually allow ACC state and local sockets "
+              + "through the network proxy in the effective workspace profile"
+            : "ACC outgoing grants are absent; run acc install --adapter codex --delivery actionable, "
+              + "then start a new session") };
 }
 
 export function prepareLivePermissions(source, context) {
   const owned = inspectPermissions(source);
   const requested = (context.requestedLivePolicy ?? context.livePolicy ?? "off") !== "off";
   if (owned.state === "customized") return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  // Incoming automatic requests and outgoing local access are separate choices.
+  // Once ACC owns a valid outgoing profile, turning incoming requests off must
+  // not revoke the already approved ability to use ACC from the sandbox. A
+  // fresh off install still creates no grants because it has no owned unit.
+  if (!requested && owned.state === "owned") {
+    return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  }
   if (!requested) return { source: owned.source, skipLegacy: hasPermissions(scanConfig(owned.source)) };
   if (!supported(context) || !context.stateRoot) {
     return { source, skipLegacy: hasPermissions(scanConfig(source)), status: outgoingStatus(source, context) };
@@ -70,15 +103,7 @@ export function prepareLivePermissions(source, context) {
   const features = entries.filter(entry => entry.keys[0] === "features");
   const featureTable = find(["features"]);
   const proxies = find(["features", "network_proxy"]);
-  const customized = entries.some(entry => ["permissions", "profile", "profiles"].includes(entry.keys[0]))
-    || modes.length > 1 || defaults.length > 1
-    || modes.some(entry => entry.header || literal(entry.value) !== "workspace-write")
-    || defaults.some(entry => entry.header || literal(entry.value) !== ":workspace")
-    || (legacy.length > 0 && (legacy.length !== 2 || !legacy[0].header || legacy[0].array
-      || !equal(legacy[1].keys, ["sandbox_workspace_write", "writable_roots"])
-      || JSON.stringify(literal(legacy[1].value)) !== JSON.stringify([context.stateRoot])))
-    || (features.length > 0 && (featureTable.length !== 1 || !featureTable[0].header || featureTable[0].array))
-    || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
+  const customized = hasCustomPolicy(source, context);
   if (customized) return { source, skipLegacy: hasPermissions(entries), status: outgoingStatus(source, context) };
   const edits = [{ id: "selection", start: 0, end: 0, body: `default_permissions = "${PROFILE}"\n` }];
   for (const [id, values] of [["mode", modes], ["default", defaults]]) {

package/node_modules/@agents-can-communicate/adapter-codex/src/maintenance-host.mjs

@@ -17,7 +17,7 @@ export const managedExecutablePaths = codexHome => ["bin/codex", "codex"].map(na
 
 export function runMaintenanceCommand(command, args, options) {
   return new Promise(resolve => execFile(command, args,
-    { ...options, timeout: 20_000, maxBuffer: 131_072, windowsHide: true },
+    { timeout: 20_000, ...options, maxBuffer: 131_072, windowsHide: true },
     (error, stdout, stderr) => resolve({ status: error ?
       (typeof error.code === "number" ? error.code : null) : 0, stdout, stderr })));
 }

package/node_modules/@agents-can-communicate/adapter-codex/src/native-delivery.mjs

@@ -51,7 +51,8 @@ export async function probeNativeDelivery({ timeoutMs = 750, env = process.env,
 }
 
 // Ordinary Codex chooses its own cwd and launch mode; ACC only reuses a
-// verified pre-existing service and never starts a daemon or rewrites argv.
+// verified service here and never rewrites argv. Explicit installer service
+// preparation has its own consent and identity checks in service-setup.mjs.
 export function planNativeActivation({ detection }) {
   const realExecutable = detection?.realExecutable;
   if (typeof realExecutable !== "string" || realExecutable === "") {

package/node_modules/@agents-can-communicate/adapter-codex/src/service-setup.mjs

@@ -0,0 +1,135 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { socketIsReady } from "./native-endpoint.mjs";
+import { probeNativeDelivery } from "./native-delivery.mjs";
+import { failMaintenance, maintenanceContext, probeMaintenanceInstall,
+  readMaintenancePid, runMaintenanceCommand, verifyMaintenanceProcess } from "./maintenance-host.mjs";
+
+const keys = ["home", "codexHome", "cliPath", "cliVersion", "managedPath", "managedVersion",
+  "managedRealPath", "cliIdentity", "managedIdentity", "socketPath", "pidPath", "platform"];
+const same = (a, b, fields = keys) => fields.every(key => a?.[key] === b?.[key]);
+const own = info => typeof process.getuid !== "function" || info.uid === process.getuid();
+const sessionNeeded = "Codex service ready; open a new Codex session to establish its delivery binding and review client hooks and permissions";
+const diagnostics = {
+  native_endpoint_unavailable: "Prepare the missing Codex service with codex app-server daemon start, then open a new Codex session",
+  managed_install_missing: "Codex service requires the managed standalone installation; install it with curl -fsSL https://chatgpt.com/codex/install.sh | sh using the selected HOME and CODEX_HOME, then retry acc install",
+  managed_binary_mismatch: "Codex CLI and managed standalone versions differ; repair the vendor installation, then retry acc install",
+  maintenance_platform_unsupported: "Codex service preparation is captured only on darwin-arm64; configure the vendor service manually",
+  maintenance_cli_unsupported: "Codex cold service preparation requires codex-cli 0.154.0 or newer with daemon commands; update the vendor installation, then retry acc install",
+};
+function report(state, reasonCode, facts = {}) {
+  return { ...facts, state, reasonCode, diagnostic: state === "ready"
+    ? reasonCode === "native_session_unavailable" ? sessionNeeded
+      : "Codex service infrastructure is ready; current session binding is reported separately"
+    : diagnostics[reasonCode] ?? `Codex service preparation could not verify ${reasonCode}; inspect the vendor service and retry acc install` };
+}
+
+export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = probeNativeDelivery,
+  fs = { lstat, realpath }, contextPaths = maintenanceContext } = {}) {
+  async function info(file) {
+    try { return await fs.lstat(file); }
+    catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  }
+  async function safeDirectories(paths) {
+    for (const dir of [paths.codexHome, path.dirname(paths.socketPath), path.dirname(paths.pidPath)]) {
+      const stat = await info(dir);
+      if (stat && (!stat.isDirectory() || stat.isSymbolicLink() || !own(stat) || (stat.mode & 0o022))) {
+        failMaintenance("unsafe_service_directory");
+      }
+    }
+  }
+  async function executableIdentity(file) {
+    const resolved = await fs.realpath(file), stat = await fs.lstat(resolved);
+    if (!stat.isFile() || !own(stat) || (stat.mode & 0o022)) failMaintenance("unsafe_service_executable");
+    return { resolved, identity: `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}` };
+  }
+  async function installed(paths) {
+    await safeDirectories(paths);
+    if (!await info(paths.managedPath)) failMaintenance("managed_install_missing");
+    const installation = await probeMaintenanceInstall(paths, run);
+    const cli = await executableIdentity(installation.cliPath);
+    const managed = await executableIdentity(paths.managedPath);
+    return { home: paths.options.env.HOME, codexHome: paths.codexHome,
+      managedPath: paths.managedPath, managedRealPath: managed.resolved,
+      cliIdentity: cli.identity, managedIdentity: managed.identity,
+      socketPath: paths.socketPath, pidPath: paths.pidPath, platform: paths.platform, ...installation };
+  }
+  async function verify(paths, facts) {
+    if (!await socketIsReady(paths.socketPath)) failMaintenance("daemon_socket_unproven");
+    const version = await run(facts.cliPath, ["app-server", "daemon", "version"], paths.options);
+    if (version.status !== 0) failMaintenance("daemon_version_unavailable");
+    const observed = JSON.parse(version.stdout);
+    if (observed.status !== "running" || observed.backend !== "pid") failMaintenance("maintenance_backend_unsupported");
+    if (observed.managedCodexPath !== facts.managedPath || observed.socketPath !== facts.socketPath
+      || observed.cliVersion !== facts.cliVersion || observed.managedCodexVersion !== facts.managedVersion
+      || observed.appServerVersion !== facts.cliVersion) failMaintenance("daemon_identity_unavailable");
+    const pid = await readMaintenancePid(paths.pidPath);
+    await verifyMaintenanceProcess(pid, paths, run);
+    const native = await probe({ env: paths.options.env, timeoutMs: 1_500 });
+    // native_session_unavailable is emitted only after initialize and a valid,
+    // empty loaded-thread list. It proves infrastructure, never a bound recipient.
+    if ((!native.supported && native.reasonCode !== "native_session_unavailable")
+      || native.clientVersion !== facts.cliVersion) failMaintenance("daemon_protocol_unverified");
+    if (!same(pid, await readMaintenancePid(paths.pidPath), ["pid", "processStartTime"])) {
+      failMaintenance("service_identity_changed");
+    }
+    await verifyMaintenanceProcess(pid, paths, run);
+    return report("ready", native.reasonCode ?? null, { ...facts, ...pid });
+  }
+  async function inspect(context, { strict = false } = {}) {
+    try {
+      const paths = await contextPaths(context);
+      if (paths.platform !== "darwin-arm64") failMaintenance("maintenance_platform_unsupported");
+      if (!strict) {
+        const native = await probe({ env: paths.options.env, timeoutMs: 1_500 });
+        // Preserve the existing delivery support matrix: a healthy older
+        // service needs no new managed-install or cold-start prerequisite.
+        if (native.supported) return report("ready", native.reasonCode ?? null);
+      }
+      const facts = await installed(paths);
+      if (!await info(paths.socketPath) && !await info(paths.pidPath)) {
+        return report("needed", "native_endpoint_unavailable", facts);
+      }
+      return await verify(paths, facts);
+    } catch (error) {
+      const reason = error.reasonCode ?? "service_inspection_failed";
+      return report(reason.endsWith("_unsupported") ? "unsupported" : "blocked", reason);
+    }
+  }
+  async function prepareNativeServiceSetup({ context, plan } = {}) {
+    let started = false;
+    try {
+      if (plan?.state === "ready") {
+        const current = await inspect(context);
+        return { ...current, state: current.state === "ready" ? "ready" : "blocked", started };
+      }
+      if (plan?.state !== "needed" || !keys.every(key => typeof plan[key] === "string")) {
+        return { ...report("blocked", "invalid_service_setup_plan"), started };
+      }
+      // Do not substitute approved paths into context: detect changed HOME,
+      // CODEX_HOME, PATH or managed-current targets before any start command.
+      const current = await inspect(context, { strict: true });
+      if (!same(plan, current)) return { ...report("blocked", "service_identity_changed"), started };
+      if (current.state === "ready") return { ...current, started };
+      if (current.state !== "needed") return { ...current, state: "blocked", started };
+      const paths = await contextPaths(context);
+      if (!same(plan, await installed(paths))) failMaintenance("service_identity_changed");
+      // Last check immediately before the only mutating command. Never delete
+      // stale metadata or stop/restart a process on this path.
+      if (await info(paths.socketPath) || await info(paths.pidPath)) {
+        return { ...await verify(paths, current), started };
+      }
+      started = true;
+      const result = await run(plan.cliPath, ["app-server", "daemon", "start"], {
+        cwd: plan.codexHome, env: { ...(context?.env ?? process.env), HOME: plan.home, CODEX_HOME: plan.codexHome },
+        timeout: 15_000,
+      });
+      if (result.status !== 0) failMaintenance("daemon_start_failed");
+      if (!same(plan, await installed(paths))) failMaintenance("service_identity_changed");
+      return { ...await verify(paths, current), started };
+    } catch (error) {
+      return { ...report(started ? "failed" : "blocked", error.reasonCode ?? "daemon_start_failed"), started };
+    }
+  }
+  return { inspectNativeServiceSetup: context => inspect(context), prepareNativeServiceSetup };
+}

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/src/doctor-command.mjs

@@ -6,12 +6,12 @@ import { describeDeliveryFallback, detectInstallation, livePolicyOf, loadOwnersh
   from "@agents-can-communicate/installer";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 
-import { describeNative, nativeRemediation, nativeState, updateNativeRuntime } from "./native-delivery-status.mjs";
+import { describeDeliveryDecision, describeNative, nativeRemediation, nativeState,
+  updateNativeRuntime } from "./native-delivery-status.mjs";
 export { describeNative } from "./native-delivery-status.mjs";
-
 import { nativeSessionLines, updateNativeSessions } from "./native-session-diagnostics.mjs";
-
 import { ALL_ADAPTERS, clientContext, probeTimeout } from "./install-command.mjs";
+import { decisionOf } from "./install-delivery-consent.mjs";
 import { describePresence } from "./main.mjs";
 import { platformPaths } from "./platform-paths.mjs";
 import { noticeUpdate } from "./update-check.mjs";
@@ -173,7 +173,9 @@ export async function diagnoseAdapters({ options, runtime, detect = detectInstal
     // is the acc that copied the skills and manifests into it. They diverge after
     // an npm upgrade with no `acc install`, and reporting both is what makes the
     // divergence legible rather than hidden behind a single reassuring number.
-    return { ...entry, stale, wired, bundleVersion, owned: { modified: owned.modified,
+    return { ...entry, stale, wired, bundleVersion,
+      deliveryDecision: installed === undefined ? null : decisionOf(installed),
+      owned: { modified: owned.modified,
       missing: owned.missing, intact: owned.intact.length },
       nativeDelivery: nativeState(entry.nativeDelivery, livePolicyOf(installed), {
         contract: adapters.find(adapter => adapter.id === entry.adapterId)?.nativeDelivery,
@@ -241,6 +243,7 @@ export async function runDoctor({ options, context, runtime }) {
     registry: ALL_ADAPTERS() });
   for (const adapter of adapters) {
     adapter.remediation.push(...nativeRemediation(adapter));
+    adapter.remediation = [...new Set(adapter.remediation)];
   }
 
   const data = {
@@ -276,9 +279,11 @@ export async function runDoctor({ options, context, runtime }) {
   ...adapters.filter(adapter => adapter.present)
     .map(adapter => `  ${adapter.displayName} live delivery: `
       + `${describeNative(adapter.nativeDelivery, { clientVersion: adapter.version })}; `
+      + `${adapter.nativeDelivery.policy === "off" && adapter.deliveryDecision !== null
+        ? `decision: ${describeDeliveryDecision(adapter.deliveryDecision)}; ` : ""}`
       + `fallback: ${describeDeliveryFallback(adapter)}`),
   ...nativeSessionLines(adapters),
-  ...adapters.filter(adapter => adapter.present && adapter.outgoingDelivery)
+  ...adapters.filter(adapter => adapter.present && adapter.outgoingDelivery?.state === "configured")
     .map(adapter => `  ${adapter.displayName} ${adapter.outgoingDelivery.diagnostic}`),
   ...(manager === null ? [] : [`  automatic updates ${manager.auto ? "on" : "off"}; ACC ${manager.active.version}`
     + (manager.pin ? `; pinned to ${manager.pin}` : ""), ...(update.notice ? [`  ${update.notice}`] : [])]),

package/node_modules/@agents-can-communicate/cli/src/help.mjs

@@ -76,6 +76,9 @@ const CHOICES = Object.freeze({
 });
 
 const NOTES = Object.freeze({
+  install: ["Without --delivery, one default-No question covers all selected clients that need a decision.",
+    "--delivery actionable|all gives explicit complete-setup consent; --delivery off disables incoming automatic requests.",
+    "A dry run does not prompt, write configuration, or start a service. Service readiness does not establish a session binding."],
   attach: ["Native hooks already manage their own session. Attach only for a manual CLI session.",
     "Keep the returned session and generation together for subsequent calls.",
     "--cadence is a positive interval in milliseconds."],