agents-can-communicate 0.5.3 → 0.5.5

package/README.md

@@ -67,9 +67,11 @@ review the current ACC definitions in `/hooks`; changed hooks may need fresh tru
 
 For Codex live delivery on Apple Silicon macOS, installation also configures outgoing
 local socket access on Codex 0.153.4 or newer when using default workspace permissions.
-Custom policies are preserved. If its local service is missing, doctor gives the command
-`codex app-server daemon start`; then open a new Codex session. Doctor reports receiving
-channel state and outgoing permission configuration separately.
+Custom policies are preserved. One default-No choice covers all selected clients that need
+live-delivery consent. On Codex 0.154.0 or newer, an accepted choice can start a missing
+service when the managed standalone installation is present. The client still owns session
+startup, hook trust, and Claude Channels approval. Doctor reports service infrastructure,
+session binding, and outgoing permissions separately.
 
 Open two sessions and give them ordinary tasks, as above. Look for an agent discovering a
 peer, checking who is changing a file, asking about a shared dependency, or replying to a
@@ -100,14 +102,15 @@ mutations. It adds no automatic peer-message injection or idle delivery. A reloc
 
 **Optional live delivery can start a turn in an idle Codex or Claude Code session.** It is
 experimental, off by default, and can spend model tokens. On Apple Silicon Macs, Codex
-0.152.1 or newer requires an already-running LocalDaemon and a verified session;
+0.152.1 or newer requires LocalDaemon infrastructure and a verified session;
 Claude Code 2.1.258 or newer requires zsh and client-side Channels activation; check its
 startup notice for ACC and accept the development warning when shown. An MCP connection
 alone does not verify inbound delivery. Messages arriving mid-turn wait for the turn to
 finish. The receiving session's
 opt-in policy and current reachability determine whether delivery can proceed.
 `acc install` reports each client's delivery state and can save Codex consent before its
-service is available. `acc doctor` also names each session’s last native binding result,
+service is available. Use `--delivery actionable|all` for explicit automation and
+`--delivery off` to disable incoming automatic requests. `acc doctor` also names each session’s last native binding result,
 including missing launch consent, an unidentified client process or a failed handshake.
 It distinguishes a disabled policy from an unavailable service or a missing live channel
 in the current project.

package/docs/ARCHITECTURE.md

@@ -174,7 +174,12 @@ The CLI owns installation generations under `<dataHome>/acc/runtime`, outside wo
 All five launch paths select a generation and publish an actual-process lease under one
 admission mutex before loading workspace-capable code. Immutable launcher modules and
 runtime directories preserve in-progress imports. Leases survive `main()` returning and
-are removed only after confirmed process death. A session is also pinned to the generation
+are removed only after confirmed process death. Older updaters can omit the store contract
+when publishing a newer generation. The reader recovers missing contracts only from the
+referenced generation, after checking its package identity and content hash, including file
+modes. It preserves explicit declarations and does not rewrite live leases. Missing or
+changed generation files and unknown native bindings remain unverified holds.
+A session is also pinned to the generation
 it started with: its hooks delegate to that generation while the pin declares the same
 store contract this one does, and run the active generation otherwise. A generation
 directory is reclaimed once no control pointer, live lease, live pin or staging hold names

package/docs/CLI.md

@@ -250,7 +250,7 @@ before leaving, request the concrete continuation and obtain a substantive reply
 `--delivery off|actionable|all` is a per-client recipient policy request, not a capability
 switch, and the default is `off`. `--adapter` is repeatable to name several clients. An
 explicit `--delivery` applies uniformly and never prompts; omitting it on an interactive
-terminal asks one default-No question per supported client. Codex can save consent while
+terminal asks one default-No question for all selected clients that need a decision. Codex can save consent while
 its local service is unavailable or has no loaded session; this does not activate delivery.
 A non-interactive run or a `--dry-run` keeps fresh clients off. A recorded opt-in is kept on upgrade. If the detected
 client cannot receive native delivery - unsupported, below the captured minimum, a
@@ -259,8 +259,10 @@ effective policy off and prints the reason. Claude Code shell activation writes
 zsh PATH block and a shim that `exec`s the real client; `ACC_BYPASS=1` bypasses that
 activation. Codex LocalDaemon delivery uses recorded installation consent without changing
 ordinary launch arguments. Its opt-in remains active when shim variables are absent or
-bypassed; `acc install --adapter codex --delivery off` disables new native offers. Installation
-and message delivery do not start or stop the vendor daemon. The install summary names each client's requested policy,
+bypassed; `acc install --adapter codex --delivery off` disables new native offers. On a
+supported explicit install, complete consent can prepare a missing Codex service from an
+existing managed standalone installation. Dry runs, delivery off, automatic refresh, and
+message delivery do not start it. Uninstall does not stop the shared vendor daemon. The install summary names each client's requested policy,
 activation state and verified fallback. `doctor` separates protocol readiness, recorded
 consent and a live channel in the current workspace, with a next step for missing activation.
 A supported version or an installed plugin alone is not an active delivery channel.
@@ -269,7 +271,8 @@ block inbound Channels messages while its MCP server and tools remain connected;
 doctor therefore also names the client-side startup check.
 In doctor JSON, `nativeDelivery.activation` distinguishes missing launch setup from a
 recorded setup (or `not_required` for a pre-existing service). `policy` is the installed
-choice; `sessionPolicy` describes a native binding when one is visible. Existing Claude
+choice. `deliveryDecision` gives its known source and reports legacy provenance as unknown.
+`nativeServiceSetup` reports service infrastructure separately. `sessionPolicy` describes a native binding when one is visible. Existing Claude
 sessions can retain their launch policy after a different choice is installed for new
 sessions; Codex checks current recorded consent before new offers.
 `nativeDelivery.sessions` lists each current session's identity, present transport state

package/docs/CONFIGURATION.md

@@ -139,7 +139,9 @@ reports degraded reachability; it does not rewrite the installed consent.
 
 Codex LocalDaemon delivery separately requires macOS arm64, Codex 0.152.1 or newer, a
 current feature probe, and exact thread, canonical cwd, process, version and protocol
-checks. Its daemon must already be running; installation and delivery do not start or stop it.
+checks. Explicit complete setup can prepare a definitely absent service on Codex 0.154.0
+or newer when the managed standalone installation is present. Message delivery does not
+start or stop it.
 Explicit update maintenance can restart a verified service after separate confirmation. Codex reads
 consent from the installation record, not a shell-shim variable. Unavailable or ineligible
 sessions retain durable inbox fallback. Use `acc install --adapter codex --delivery off`
@@ -165,8 +167,10 @@ not merge arbitrary security policies or verify overrides in an already running
 For a custom policy, grant the same state and socket access through the proxy in the
 client's effective workspace profile; do not combine it with legacy sandbox settings.
 
-Restart Codex after changing permissions. Explicit delivery `off` or uninstall restores
-the previous configuration only while every generated permission component is unchanged.
+Restart Codex after changing permissions. Disabling incoming delivery retains unchanged
+ACC-owned outgoing grants that you approved earlier. A fresh `--delivery off` install does
+not add live socket grants. Uninstall restores the previous configuration only while every
+generated permission component is unchanged.
 If any component was edited or another setting depends on it, ACC preserves the entire
 bundle and reports it for review. Plugin registration can still be removed independently.
 

package/docs/GETTING_STARTED.md

@@ -55,6 +55,14 @@ verified channel in the current session. Codex can save your choice even when it
 service is not running yet. Declining uses the reported fallback: `acc inbox`, or next-turn
 hooks only where the exact client version and platform are certified.
 
+An interactive install asks one default-No question for all selected clients that need a
+choice. Use `--delivery actionable|all` for explicit noninteractive consent. Use
+`--delivery off` to disable incoming automatic requests. A dry run does not ask, write
+configuration, or start a service. When supported Codex service preparation succeeds, it
+means the infrastructure is ready. Start a Codex session and complete the client's hook and
+trust review to establish a session-bound channel. If the managed standalone prerequisite
+is missing, install reports that prerequisite instead of claiming readiness.
+
 If you opt into Claude Code's experimental idle delivery, check Claude's Channels startup
 notice for ACC and accept its development-channel warning when shown. If it reports Channels
 unavailable or blocked, a connected MCP server does not make inbound delivery work;
@@ -127,9 +135,10 @@ durable inbox instead.
 
 Codex LocalDaemon and Claude Code Channel offer optional native delivery on
 Apple Silicon macOS. They are experimental, can spend tokens, and queue messages
-until a running turn finishes. Codex requires 0.152.1 or newer, an already-running
-LocalDaemon, recorded opt-in and a verified session; start it with your normal
-command. A loaded daemon thread can receive messages after its terminal exits.
+until a running turn finishes. Codex requires 0.152.1 or newer, LocalDaemon infrastructure,
+recorded opt-in, and a verified session. Supported explicit setup can prepare a missing
+service. Start the client with your normal command. A loaded daemon thread can receive
+messages after its terminal exits.
 [Capabilities](CAPABILITIES.md) explains policy, versions and fallback.
 
 Delivery evidence is deliberately narrow: `queued -> offered -> retrieved -> acknowledged`.

package/docs/TROUBLESHOOTING.md

@@ -91,24 +91,24 @@ supported platform, current probe and exact session binding. Under `actionable`,
 a `note` stays queued with `delivery_disabled`.
 
 For Codex, use your ordinary launch command with 0.152.1 or newer on Apple Silicon
-macOS. Its LocalDaemon must already be running, and trusted hooks must establish
+macOS. Its LocalDaemon infrastructure and trusted hooks must establish
 the receiver's exact thread and workspace. Embedded sessions, an absent socket,
 ambiguous recipients or failed identity checks retain durable inbox access.
 `acc doctor` reports readiness, consent and the current workspace's live channel separately.
 `native_endpoint_unavailable` means the local service endpoint is missing or is not a safe socket;
 `native_session_unavailable` means the service answered but has no loaded thread to probe.
 An interactive install can save consent in either case. ACC preserves it through a temporary
-outage and does not start the daemon for you.
-
-On a supported Codex CLI, a missing daemon can be started with
-`codex app-server daemon start`; open a new Codex session afterward. Doctor includes this
-command when it detects the missing endpoint.
+outage. On Codex 0.154.0 or newer, an explicit install with complete consent can prepare a
+missing service when the managed standalone installation is present. If that prerequisite
+is missing or unsafe, doctor names the vendor action and does not claim readiness. A ready
+service is infrastructure only. Open a new Codex session afterward and complete the
+client-owned hook and trust review.
 
 If a reply stays queued with `transport_permission_denied`, the sender's permissions
 blocked local transport. This is distinct from an unavailable recipient. The message was
 recorded successfully; the error does not mean it was read or acknowledged.
 On Codex 0.153.4 or newer on macOS arm64, rerun `acc install --adapter codex` with existing
-live consent (or add `--delivery actionable` to opt in), then start a new session.
+live consent. Add `--delivery actionable` when new consent is required, then start a new session.
 Doctor's `outgoingDelivery` reports the installed permission configuration separately
 from `nativeDelivery.runtime`: an active receiving channel does not establish outgoing
 access. Custom policies and active-session overrides remain unverified; inspect the config
@@ -238,8 +238,9 @@ Next: [Getting started](GETTING_STARTED.md) · [Capabilities](CAPABILITIES.md)
 
 Run `acc doctor` to see the update policy and pending notice. A hold keeps an update
 pending only while the store contract it declares differs from the incoming version's or
-is unknown; records written before 0.5.0 declare none, so the first update after upgrading
-still waits for all of them. `acc update` names each remaining hold with its process and
+is unknown. ACC can recover a missing contract from the process's unchanged managed
+generation when that generation declares one. A generation that predates the declaration
+still needs its processes to exit. `acc update` names each remaining hold with its process and
 its declared contract. ACC process leases, including persistent MCP servers, end on
 confirmed process exit. Native bindings clear on observed SessionEnd or confirmed process
 death; a vendor daemon may remain alive after SessionEnd. Unknown PIDs remain holds until
@@ -250,6 +251,21 @@ unrelated holds still require lifecycle cleanup or confirmed process exit; safet
 do not expire merely by elapsed time. See
 [maintenance and recovery](UPGRADING.md#confirmed-client-service-maintenance).
 
+If ACC 0.5.3 or 0.5.4 reports `acc-claude-channel; contract unknown` after an earlier
+0.4.x upgrade, its active pointer may have lost the contract field. This can affect newly
+opened Channels too. A pending old updater retries its downloaded release without looking
+for a newer fix. Install the current global CLI, then use that CLI to complete the update:
+
+```bash
+npm install -g agents-can-communicate@latest
+acc update
+acc doctor
+```
+
+The new reader can activate a compatible release while those Channels remain open.
+It still waits for different contracts, unknown native bindings, or generation files it
+cannot verify. See [legacy contract recovery](UPGRADING.md#recover-missing-runtime-contracts).
+
 Use `acc update` to retry a failed download or finish an interrupted integration refresh.
 A download failure keeps the working version. A partial integration refresh blocks
 workspace commands until recovery completes, while hooks let the client continue without

package/docs/UPGRADING.md

@@ -1,5 +1,31 @@
 # Upgrading to 0.5.0
 
+## Recover missing runtime contracts
+
+ACC 0.5.5 fixes an upgrade defect that can leave 0.5.3 or 0.5.4 waiting for
+`acc-claude-channel` processes with `contract unknown`. The 0.4.x updater can activate
+a newer generation without copying its store contract into the active pointer. Channels
+started afterward copy that incomplete pointer even though their runtime declares a contract.
+
+For an installation already waiting on an older pending release, run:
+
+```bash
+npm install -g agents-can-communicate@latest
+acc update
+acc version
+acc doctor
+```
+
+The global CLI supplies the new management reader before runtime activation. This step is
+needed because the older updater retries its pending release before checking npm for another
+version. If a version pin selects an older release, clear it or select 0.5.5 first.
+
+The reader verifies the referenced generation's package identity, complete contents and
+file modes before recovering a missing contract. Compatible Channels can keep running on
+their original generation during activation. Explicit differing contracts and unknown
+native bindings still block. A generation without a contract, missing files, or changed
+contents remains unknown. ACC does not terminate these processes or edit their lease records.
+
 ## From 0.4.4, 0.4.3, 0.4.2, 0.4.1 or 0.4.0
 
 This release keeps the existing workspace data format. It changes when an update is
@@ -23,8 +49,9 @@ clients again and complete any hook/trust review they request. With existing liv
 Codex 0.153.4 or newer on macOS arm64 receives local socket permissions when its workspace
 policy is default or contains only ACC's legacy state root. Custom policies are preserved
 and reported as unverified. See [outgoing permissions](CONFIGURATION.md#codex-outgoing-permissions).
-If doctor names a missing local service, run `codex app-server daemon start` before opening
-the new session.
+If doctor names a missing local service, follow its prerequisite or explicit install action
+before opening the new session. A supported explicit install can prepare the service. It
+does not make a session-bound channel ready.
 
 Run `acc doctor` in the project after the new clients have started (or submitted a normal
 turn). Its per-session lines now explain missing launch consent, an unidentified client
@@ -37,8 +64,10 @@ Claude admitted inbound Channels messages. See [delivery troubleshooting](TROUBL
 Upgrading preserves delivery consent. If doctor reports native delivery off and you want
 automatic peer requests, use `acc install --adapter codex --delivery actionable` (or the
 relevant adapter); this can spend model tokens. Codex can save that consent before its
-local service/session becomes available. Installation does not start the vendor daemon; ACC
-keeps durable inbox access when no verified live channel is bound.
+local service/session becomes available. Ordinary installation keeps durable inbox access
+when no verified live channel is bound. Explicit complete setup can prepare a definitely
+absent supported service. Automatic refresh, delivery off, dry runs, and uninstall do not
+start or stop that shared service.
 
 In Grok, public status supplies the session's own CLI arguments through the next tool
 hook. Grok still uses explicit inbox reads; this patch adds no external wake or guards.
@@ -53,17 +82,17 @@ only two kinds keep an update pending:
 - A hold whose declared store contract differs from the incoming version's. This is the
   case the gate exists for, and a release that changes the store contract still needs
   every live process to exit.
-- A hold that declares no contract, which includes every record written by a release
-  before this one. Unknown cannot be compared, so it stays a conservative wait.
+- A hold with no verifiable contract. Older native bindings and generations that predate
+  the declaration remain unknown. A missing field can be recovered when the referenced
+  managed generation declares its contract and passes integrity verification.
 
 A hold declaring the same store contract as the incoming version proceeds. Several open
 Claude Code sessions, a Codex daemon and an idle ACC MCP server no longer have to be
 closed together to move between releases that share a contract.
 
-The first update after installing this release still waits for every process, because the
-holds it has to judge were written before the contract field existed. Close the relevant
-clients and persistent ACC processes once, or accept the eligible Codex service
-maintenance offer described below. Updates after that do not need it.
+Processes still running a generation from before the contract field existed must exit once.
+Close the relevant clients and persistent ACC processes, or accept the eligible Codex service
+maintenance offer described below. Later compatible runtimes do not require that restart.
 
 `acc update` names each remaining hold with its process and its declared contract, so a
 wait now states its reason rather than only the PID. `acc doctor` reports the same

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/adapter.mjs

@@ -2,6 +2,7 @@ import { defineAdapter, projectContext, projectContextResult }
   from "@agents-can-communicate/adapter-sdk";
 import { probeNativeDelivery, planNativeActivation, bindNativeSession, refreshNativeSession, retireNativeSession, offerMessage } from "./native-delivery.mjs";
 import certification from "../certification.json" with { type: "json" };
+import { createCodexServiceSetup } from "./service-setup.mjs";
 import { createCodexMaintenance } from "./maintenance.mjs";
 export { sameMaintenanceIdentity } from "./maintenance.mjs";
 
@@ -20,9 +21,10 @@ export const CODEX_DELIVERY_FALLBACK = Object.freeze({
   diagnostic: "Codex native delivery requires codex-cli 0.152.1 or newer on darwin-arm64, "
     + "recorded recipient consent and a reachable LocalDaemon session with exact thread, cwd, "
     + "process, version and protocol verification. Embedded or unreachable sessions retain "
-    + "durable messages. Native delivery does not start, restart or stop the vendor daemon and adds no "
+    + "durable messages. Message delivery does not start, restart or stop the vendor daemon and adds no "
     + "launch arguments; fallback is exact-certified next-turn delivery or acc inbox. "
-    + "Explicitly confirmed acc update maintenance has a separate daemon restart check",
+    + "Explicit install with complete setup consent can prepare a missing supported service; "
+    + "explicitly confirmed acc update maintenance has a separate daemon restart check",
 });
 
 /**
@@ -67,6 +69,7 @@ export function createCodexAdapter() {
     probeNativeDelivery, planNativeActivation, bindNativeSession,
     refreshNativeSession, retireNativeSession, offerMessage,
     ...createCodexMaintenance(),
+    ...createCodexServiceSetup(),
     startSession: async () => ({ ok: true, changes: [], diagnostics: [] }),
     endSession: async () => ({ ok: true, changes: [], diagnostics: [] }),
     guardWrite: async () => ({ ok: true, changes: [], diagnostics: [] }),

package/node_modules/@agents-can-communicate/adapter-codex/src/app-server-client.mjs

@@ -67,7 +67,8 @@ export async function probeCodexQueue(peer, { threadId, minimum = MINIMUM_VERSIO
   try {
     if (threadId === undefined) {
       const loaded = await pageAll(peer, "thread/loaded/list", {});
-      threadId = loaded.find(id => typeof id === "string" && id !== "");
+      if (loaded.some(id => typeof id !== "string" || id === "")) throw protocolError();
+      threadId = loaded[0];
       if (threadId === undefined) return { supported: false, serverVersion,
         reasonCode: "native_session_unavailable" };
     }

package/node_modules/@agents-can-communicate/adapter-codex/src/install.mjs

@@ -350,7 +350,7 @@ export async function detectCodex({ home, agentsHome = home,
   // detection neither invents its hash algorithm nor starts a client service.
   return { ok: true, changes: [], outgoingDelivery,
     nativeSetup: nativeDelivery?.reasonCode === "native_endpoint_unavailable"
-      ? "Codex CLI: run codex app-server daemon start, then open a new Codex session; ACC never starts or restarts the daemon"
+      ? "Codex CLI: run codex app-server daemon start, then open a new Codex session; explicit ACC install with complete setup consent can prepare a missing supported service"
       : null,
     diagnostics: [
     published ? "acc plugin published in the marketplace" : "acc plugin not registered",

package/node_modules/@agents-can-communicate/adapter-codex/src/live-permissions.mjs

@@ -26,6 +26,28 @@ const configured = (source, context) => {
     && sockets(context).every(socket => literal(value(["permissions", profile, "network", "unix_sockets", socket])) === "allow");
 };
 
+const hasCustomPolicy = (source, context) => {
+  const ownership = inspectPermissions(source);
+  if (ownership.state === "customized") return true;
+  if (ownership.state === "owned") return false;
+  const entries = scanConfig(source);
+  const find = keys => entries.filter(entry => equal(entry.keys, keys));
+  const modes = find(["sandbox_mode"]), defaults = find(["default_permissions"]);
+  const legacy = entries.filter(entry => entry.keys[0] === "sandbox_workspace_write");
+  const features = entries.filter(entry => entry.keys[0] === "features");
+  const featureTable = find(["features"]);
+  const proxies = find(["features", "network_proxy"]);
+  return entries.some(entry => ["permissions", "profile", "profiles"].includes(entry.keys[0]))
+    || modes.length > 1 || defaults.length > 1
+    || modes.some(entry => entry.header || literal(entry.value) !== "workspace-write")
+    || defaults.some(entry => entry.header || literal(entry.value) !== ":workspace")
+    || (legacy.length > 0 && (legacy.length !== 2 || !legacy[0].header || legacy[0].array
+      || !equal(legacy[1].keys, ["sandbox_workspace_write", "writable_roots"])
+      || JSON.stringify(literal(legacy[1].value)) !== JSON.stringify([context.stateRoot])))
+    || (features.length > 0 && (featureTable.length !== 1 || !featureTable[0].header || featureTable[0].array))
+    || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
+};
+
 // Match the channel's per-user temporary directory and Codex's actual home.
 // Grants cover only ACC's local channel namespace, never arbitrary Unix sockets.
 const sockets = context => [channelSocketDirectory(),
@@ -33,8 +55,9 @@ const sockets = context => [channelSocketDirectory(),
 
 export function outgoingStatus(source, context) {
   const state = inspectPermissions(source).state;
+  const custom = hasCustomPolicy(source, context);
   const ready = state === "owned" && supported(context) && configured(source, context);
-  const reasonCode = state === "customized" ? "permission_configuration_modified"
+  const reasonCode = custom ? "permission_configuration_modified"
     : !supported(context) ? "permission_configuration_uncaptured"
       : ready ? null : "sender_permissions_unverified";
   return { state: reasonCode === null ? "configured" : "unverified", reasonCode,
@@ -47,14 +70,24 @@ export function outgoingStatus(source, context) {
       : `outgoing live delivery: sender permissions unverified in ${context.file}; `
         + (reasonCode === "permission_configuration_uncaptured"
           ? `automatic setup requires Codex ${MINIMUM} or newer on darwin-arm64`
-          : "existing permissions were preserved; run acc install --adapter codex, then start a new session; "
-            + "custom permission policies must allow ACC state and local sockets through the network proxy") };
+          : custom
+            ? "custom permission policy was preserved; manually allow ACC state and local sockets "
+              + "through the network proxy in the effective workspace profile"
+            : "ACC outgoing grants are absent; run acc install --adapter codex --delivery actionable, "
+              + "then start a new session") };
 }
 
 export function prepareLivePermissions(source, context) {
   const owned = inspectPermissions(source);
   const requested = (context.requestedLivePolicy ?? context.livePolicy ?? "off") !== "off";
   if (owned.state === "customized") return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  // Incoming automatic requests and outgoing local access are separate choices.
+  // Once ACC owns a valid outgoing profile, turning incoming requests off must
+  // not revoke the already approved ability to use ACC from the sandbox. A
+  // fresh off install still creates no grants because it has no owned unit.
+  if (!requested && owned.state === "owned") {
+    return { source, skipLegacy: true, status: outgoingStatus(source, context) };
+  }
   if (!requested) return { source: owned.source, skipLegacy: hasPermissions(scanConfig(owned.source)) };
   if (!supported(context) || !context.stateRoot) {
     return { source, skipLegacy: hasPermissions(scanConfig(source)), status: outgoingStatus(source, context) };
@@ -70,15 +103,7 @@ export function prepareLivePermissions(source, context) {
   const features = entries.filter(entry => entry.keys[0] === "features");
   const featureTable = find(["features"]);
   const proxies = find(["features", "network_proxy"]);
-  const customized = entries.some(entry => ["permissions", "profile", "profiles"].includes(entry.keys[0]))
-    || modes.length > 1 || defaults.length > 1
-    || modes.some(entry => entry.header || literal(entry.value) !== "workspace-write")
-    || defaults.some(entry => entry.header || literal(entry.value) !== ":workspace")
-    || (legacy.length > 0 && (legacy.length !== 2 || !legacy[0].header || legacy[0].array
-      || !equal(legacy[1].keys, ["sandbox_workspace_write", "writable_roots"])
-      || JSON.stringify(literal(legacy[1].value)) !== JSON.stringify([context.stateRoot])))
-    || (features.length > 0 && (featureTable.length !== 1 || !featureTable[0].header || featureTable[0].array))
-    || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
+  const customized = hasCustomPolicy(source, context);
   if (customized) return { source, skipLegacy: hasPermissions(entries), status: outgoingStatus(source, context) };
   const edits = [{ id: "selection", start: 0, end: 0, body: `default_permissions = "${PROFILE}"\n` }];
   for (const [id, values] of [["mode", modes], ["default", defaults]]) {

package/node_modules/@agents-can-communicate/adapter-codex/src/maintenance-host.mjs

@@ -17,7 +17,7 @@ export const managedExecutablePaths = codexHome => ["bin/codex", "codex"].map(na
 
 export function runMaintenanceCommand(command, args, options) {
   return new Promise(resolve => execFile(command, args,
-    { ...options, timeout: 20_000, maxBuffer: 131_072, windowsHide: true },
+    { timeout: 20_000, ...options, maxBuffer: 131_072, windowsHide: true },
     (error, stdout, stderr) => resolve({ status: error ?
       (typeof error.code === "number" ? error.code : null) : 0, stdout, stderr })));
 }

package/node_modules/@agents-can-communicate/adapter-codex/src/native-delivery.mjs

@@ -51,7 +51,8 @@ export async function probeNativeDelivery({ timeoutMs = 750, env = process.env,
 }
 
 // Ordinary Codex chooses its own cwd and launch mode; ACC only reuses a
-// verified pre-existing service and never starts a daemon or rewrites argv.
+// verified service here and never rewrites argv. Explicit installer service
+// preparation has its own consent and identity checks in service-setup.mjs.
 export function planNativeActivation({ detection }) {
   const realExecutable = detection?.realExecutable;
   if (typeof realExecutable !== "string" || realExecutable === "") {

package/node_modules/@agents-can-communicate/adapter-codex/src/service-setup.mjs

@@ -0,0 +1,135 @@
+import { lstat, realpath } from "node:fs/promises";
+import path from "node:path";
+import { socketIsReady } from "./native-endpoint.mjs";
+import { probeNativeDelivery } from "./native-delivery.mjs";
+import { failMaintenance, maintenanceContext, probeMaintenanceInstall,
+  readMaintenancePid, runMaintenanceCommand, verifyMaintenanceProcess } from "./maintenance-host.mjs";
+
+const keys = ["home", "codexHome", "cliPath", "cliVersion", "managedPath", "managedVersion",
+  "managedRealPath", "cliIdentity", "managedIdentity", "socketPath", "pidPath", "platform"];
+const same = (a, b, fields = keys) => fields.every(key => a?.[key] === b?.[key]);
+const own = info => typeof process.getuid !== "function" || info.uid === process.getuid();
+const sessionNeeded = "Codex service ready; open a new Codex session to establish its delivery binding and review client hooks and permissions";
+const diagnostics = {
+  native_endpoint_unavailable: "Prepare the missing Codex service with codex app-server daemon start, then open a new Codex session",
+  managed_install_missing: "Codex service requires the managed standalone installation; install it with curl -fsSL https://chatgpt.com/codex/install.sh | sh using the selected HOME and CODEX_HOME, then retry acc install",
+  managed_binary_mismatch: "Codex CLI and managed standalone versions differ; repair the vendor installation, then retry acc install",
+  maintenance_platform_unsupported: "Codex service preparation is captured only on darwin-arm64; configure the vendor service manually",
+  maintenance_cli_unsupported: "Codex cold service preparation requires codex-cli 0.154.0 or newer with daemon commands; update the vendor installation, then retry acc install",
+};
+function report(state, reasonCode, facts = {}) {
+  return { ...facts, state, reasonCode, diagnostic: state === "ready"
+    ? reasonCode === "native_session_unavailable" ? sessionNeeded
+      : "Codex service infrastructure is ready; current session binding is reported separately"
+    : diagnostics[reasonCode] ?? `Codex service preparation could not verify ${reasonCode}; inspect the vendor service and retry acc install` };
+}
+
+export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = probeNativeDelivery,
+  fs = { lstat, realpath }, contextPaths = maintenanceContext } = {}) {
+  async function info(file) {
+    try { return await fs.lstat(file); }
+    catch (error) { if (error.code === "ENOENT") return null; throw error; }
+  }
+  async function safeDirectories(paths) {
+    for (const dir of [paths.codexHome, path.dirname(paths.socketPath), path.dirname(paths.pidPath)]) {
+      const stat = await info(dir);
+      if (stat && (!stat.isDirectory() || stat.isSymbolicLink() || !own(stat) || (stat.mode & 0o022))) {
+        failMaintenance("unsafe_service_directory");
+      }
+    }
+  }
+  async function executableIdentity(file) {
+    const resolved = await fs.realpath(file), stat = await fs.lstat(resolved);
+    if (!stat.isFile() || !own(stat) || (stat.mode & 0o022)) failMaintenance("unsafe_service_executable");
+    return { resolved, identity: `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}:${stat.ctimeMs}` };
+  }
+  async function installed(paths) {
+    await safeDirectories(paths);
+    if (!await info(paths.managedPath)) failMaintenance("managed_install_missing");
+    const installation = await probeMaintenanceInstall(paths, run);
+    const cli = await executableIdentity(installation.cliPath);
+    const managed = await executableIdentity(paths.managedPath);
+    return { home: paths.options.env.HOME, codexHome: paths.codexHome,
+      managedPath: paths.managedPath, managedRealPath: managed.resolved,
+      cliIdentity: cli.identity, managedIdentity: managed.identity,
+      socketPath: paths.socketPath, pidPath: paths.pidPath, platform: paths.platform, ...installation };
+  }
+  async function verify(paths, facts) {
+    if (!await socketIsReady(paths.socketPath)) failMaintenance("daemon_socket_unproven");
+    const version = await run(facts.cliPath, ["app-server", "daemon", "version"], paths.options);
+    if (version.status !== 0) failMaintenance("daemon_version_unavailable");
+    const observed = JSON.parse(version.stdout);
+    if (observed.status !== "running" || observed.backend !== "pid") failMaintenance("maintenance_backend_unsupported");
+    if (observed.managedCodexPath !== facts.managedPath || observed.socketPath !== facts.socketPath
+      || observed.cliVersion !== facts.cliVersion || observed.managedCodexVersion !== facts.managedVersion
+      || observed.appServerVersion !== facts.cliVersion) failMaintenance("daemon_identity_unavailable");
+    const pid = await readMaintenancePid(paths.pidPath);
+    await verifyMaintenanceProcess(pid, paths, run);
+    const native = await probe({ env: paths.options.env, timeoutMs: 1_500 });
+    // native_session_unavailable is emitted only after initialize and a valid,
+    // empty loaded-thread list. It proves infrastructure, never a bound recipient.
+    if ((!native.supported && native.reasonCode !== "native_session_unavailable")
+      || native.clientVersion !== facts.cliVersion) failMaintenance("daemon_protocol_unverified");
+    if (!same(pid, await readMaintenancePid(paths.pidPath), ["pid", "processStartTime"])) {
+      failMaintenance("service_identity_changed");
+    }
+    await verifyMaintenanceProcess(pid, paths, run);
+    return report("ready", native.reasonCode ?? null, { ...facts, ...pid });
+  }
+  async function inspect(context, { strict = false } = {}) {
+    try {
+      const paths = await contextPaths(context);
+      if (paths.platform !== "darwin-arm64") failMaintenance("maintenance_platform_unsupported");
+      if (!strict) {
+        const native = await probe({ env: paths.options.env, timeoutMs: 1_500 });
+        // Preserve the existing delivery support matrix: a healthy older
+        // service needs no new managed-install or cold-start prerequisite.
+        if (native.supported) return report("ready", native.reasonCode ?? null);
+      }
+      const facts = await installed(paths);
+      if (!await info(paths.socketPath) && !await info(paths.pidPath)) {
+        return report("needed", "native_endpoint_unavailable", facts);
+      }
+      return await verify(paths, facts);
+    } catch (error) {
+      const reason = error.reasonCode ?? "service_inspection_failed";
+      return report(reason.endsWith("_unsupported") ? "unsupported" : "blocked", reason);
+    }
+  }
+  async function prepareNativeServiceSetup({ context, plan } = {}) {
+    let started = false;
+    try {
+      if (plan?.state === "ready") {
+        const current = await inspect(context);
+        return { ...current, state: current.state === "ready" ? "ready" : "blocked", started };
+      }
+      if (plan?.state !== "needed" || !keys.every(key => typeof plan[key] === "string")) {
+        return { ...report("blocked", "invalid_service_setup_plan"), started };
+      }
+      // Do not substitute approved paths into context: detect changed HOME,
+      // CODEX_HOME, PATH or managed-current targets before any start command.
+      const current = await inspect(context, { strict: true });
+      if (!same(plan, current)) return { ...report("blocked", "service_identity_changed"), started };
+      if (current.state === "ready") return { ...current, started };
+      if (current.state !== "needed") return { ...current, state: "blocked", started };
+      const paths = await contextPaths(context);
+      if (!same(plan, await installed(paths))) failMaintenance("service_identity_changed");
+      // Last check immediately before the only mutating command. Never delete
+      // stale metadata or stop/restart a process on this path.
+      if (await info(paths.socketPath) || await info(paths.pidPath)) {
+        return { ...await verify(paths, current), started };
+      }
+      started = true;
+      const result = await run(plan.cliPath, ["app-server", "daemon", "start"], {
+        cwd: plan.codexHome, env: { ...(context?.env ?? process.env), HOME: plan.home, CODEX_HOME: plan.codexHome },
+        timeout: 15_000,
+      });
+      if (result.status !== 0) failMaintenance("daemon_start_failed");
+      if (!same(plan, await installed(paths))) failMaintenance("service_identity_changed");
+      return { ...await verify(paths, current), started };
+    } catch (error) {
+      return { ...report(started ? "failed" : "blocked", error.reasonCode ?? "daemon_start_failed"), started };
+    }
+  }
+  return { inspectNativeServiceSetup: context => inspect(context), prepareNativeServiceSetup };
+}

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.5.3",
+  "version": "0.5.5",
   "private": true,
   "type": "module",
   "exports": {