agents-can-communicate 0.5.4 → 0.5.6

package/README.md

@@ -68,8 +68,9 @@ review the current ACC definitions in `/hooks`; changed hooks may need fresh tru
 For Codex live delivery on Apple Silicon macOS, installation also configures outgoing
 local socket access on Codex 0.153.4 or newer when using default workspace permissions.
 Custom policies are preserved. One default-No choice covers all selected clients that need
-live-delivery consent. On Codex 0.154.0 or newer, an accepted choice can start a missing
-service when the managed standalone installation is present. The client still owns session
+live-delivery consent. On Codex 0.154.0 or newer, the choice includes downloading a missing
+standalone package from OpenAI and starting its local service. ACC installs the matching
+version and preserves your existing `codex` command and shell profiles. The client still owns session
 startup, hook trust, and Claude Channels approval. Doctor reports service infrastructure,
 session binding, and outgoing permissions separately.
 

package/docs/ARCHITECTURE.md

@@ -174,7 +174,12 @@ The CLI owns installation generations under `<dataHome>/acc/runtime`, outside wo
 All five launch paths select a generation and publish an actual-process lease under one
 admission mutex before loading workspace-capable code. Immutable launcher modules and
 runtime directories preserve in-progress imports. Leases survive `main()` returning and
-are removed only after confirmed process death. A session is also pinned to the generation
+are removed only after confirmed process death. Older updaters can omit the store contract
+when publishing a newer generation. The reader recovers missing contracts only from the
+referenced generation, after checking its package identity and content hash, including file
+modes. It preserves explicit declarations and does not rewrite live leases. Missing or
+changed generation files and unknown native bindings remain unverified holds.
+A session is also pinned to the generation
 it started with: its hooks delegate to that generation while the pin declares the same
 store contract this one does, and run the active generation otherwise. A generation
 directory is reclaimed once no control pointer, live lease, live pin or staging hold names

package/docs/CLI.md

@@ -260,9 +260,18 @@ zsh PATH block and a shim that `exec`s the real client; `ACC_BYPASS=1` bypasses
 activation. Codex LocalDaemon delivery uses recorded installation consent without changing
 ordinary launch arguments. Its opt-in remains active when shim variables are absent or
 bypassed; `acc install --adapter codex --delivery off` disables new native offers. On a
-supported explicit install, complete consent can prepare a missing Codex service from an
-existing managed standalone installation. Dry runs, delivery off, automatic refresh, and
-message delivery do not start it. Uninstall does not stop the shared vendor daemon. The install summary names each client's requested policy,
+supported explicit install, complete consent can prepare a missing Codex service. On macOS
+arm64 with Codex 0.154.0 or newer, the same choice includes downloading a missing standalone
+package from OpenAI. ACC selects the installed CLI version and verifies the official
+installer's pinned checksum. The installer uses the selected `HOME` and `CODEX_HOME`.
+Your existing npm or Homebrew command and shell profiles remain unchanged.
+An older consent that covered service start receives one expanded choice for the download.
+An accepted or declined answer persists. To change a declined answer, use
+`acc install --adapter codex --delivery actionable` (or `all` for that policy).
+Explicit `--delivery actionable|all` also approves a required download on supported clients.
+Dry runs, delivery off, doctor, automatic refresh, and message delivery do not download
+Codex or start its service. Uninstall does not remove Codex or stop the shared vendor daemon.
+The install summary names each client's requested policy,
 activation state and verified fallback. `doctor` separates protocol readiness, recorded
 consent and a live channel in the current workspace, with a next step for missing activation.
 A supported version or an installed plugin alone is not an active delivery channel.

package/docs/CONFIGURATION.md

@@ -139,9 +139,11 @@ reports degraded reachability; it does not rewrite the installed consent.
 
 Codex LocalDaemon delivery separately requires macOS arm64, Codex 0.152.1 or newer, a
 current feature probe, and exact thread, canonical cwd, process, version and protocol
-checks. Explicit complete setup can prepare a definitely absent service on Codex 0.154.0
-or newer when the managed standalone installation is present. Message delivery does not
-start or stop it.
+checks. On Codex 0.154.0 or newer, explicit complete setup can download a missing matching
+standalone package and prepare a definitely absent service. The setup choice names the
+download. Existing service-start consent alone does not permit it. Codex files remain
+under the selected `CODEX_HOME`; the existing CLI command and shell profiles are preserved.
+Message delivery does not install Codex, start it, or stop it.
 Explicit update maintenance can restart a verified service after separate confirmation. Codex reads
 consent from the installation record, not a shell-shim variable. Unavailable or ineligible
 sessions retain durable inbox fallback. Use `acc install --adapter codex --delivery off`

package/docs/GETTING_STARTED.md

@@ -58,10 +58,13 @@ hooks only where the exact client version and platform are certified.
 An interactive install asks one default-No question for all selected clients that need a
 choice. Use `--delivery actionable|all` for explicit noninteractive consent. Use
 `--delivery off` to disable incoming automatic requests. A dry run does not ask, write
-configuration, or start a service. When supported Codex service preparation succeeds, it
+configuration, download Codex, or start a service. On macOS arm64 with Codex 0.154.0 or newer,
+the choice includes downloading a missing standalone package from OpenAI. ACC selects the
+matching version and keeps your existing npm or Homebrew command and shell profiles.
+When supported Codex service preparation succeeds, it
 means the infrastructure is ready. Start a Codex session and complete the client's hook and
-trust review to establish a session-bound channel. If the managed standalone prerequisite
-is missing, install reports that prerequisite instead of claiming readiness.
+trust review to establish a session-bound channel. An incomplete existing standalone
+installation or unsupported CLI version still needs the vendor action named by install.
 
 If you opt into Claude Code's experimental idle delivery, check Claude's Channels startup
 notice for ACC and accept its development-channel warning when shown. If it reports Channels

package/docs/TROUBLESHOOTING.md

@@ -98,9 +98,13 @@ ambiguous recipients or failed identity checks retain durable inbox access.
 `native_endpoint_unavailable` means the local service endpoint is missing or is not a safe socket;
 `native_session_unavailable` means the service answered but has no loaded thread to probe.
 An interactive install can save consent in either case. ACC preserves it through a temporary
-outage. On Codex 0.154.0 or newer, an explicit install with complete consent can prepare a
-missing service when the managed standalone installation is present. If that prerequisite
-is missing or unsafe, doctor names the vendor action and does not claim readiness. A ready
+outage. On Codex 0.154.0 or newer, an explicit install can download the missing official
+standalone package and prepare a missing service. The single setup choice covers the
+download. Older consent for service start receives one expanded choice. To change a saved
+download refusal, run `acc install --adapter codex --delivery actionable` (or `all` to retain
+that policy). ACC preserves an existing npm or Homebrew command and shell profiles.
+An unsafe or incomplete existing installation still requires the vendor action named by
+doctor. Download failure keeps the installed integration and its inbox fallback. A ready
 service is infrastructure only. Open a new Codex session afterward and complete the
 client-owned hook and trust review.
 
@@ -238,8 +242,9 @@ Next: [Getting started](GETTING_STARTED.md) · [Capabilities](CAPABILITIES.md)
 
 Run `acc doctor` to see the update policy and pending notice. A hold keeps an update
 pending only while the store contract it declares differs from the incoming version's or
-is unknown; records written before 0.5.0 declare none, so the first update after upgrading
-still waits for all of them. `acc update` names each remaining hold with its process and
+is unknown. ACC can recover a missing contract from the process's unchanged managed
+generation when that generation declares one. A generation that predates the declaration
+still needs its processes to exit. `acc update` names each remaining hold with its process and
 its declared contract. ACC process leases, including persistent MCP servers, end on
 confirmed process exit. Native bindings clear on observed SessionEnd or confirmed process
 death; a vendor daemon may remain alive after SessionEnd. Unknown PIDs remain holds until
@@ -250,6 +255,21 @@ unrelated holds still require lifecycle cleanup or confirmed process exit; safet
 do not expire merely by elapsed time. See
 [maintenance and recovery](UPGRADING.md#confirmed-client-service-maintenance).
 
+If ACC 0.5.3 or 0.5.4 reports `acc-claude-channel; contract unknown` after an earlier
+0.4.x upgrade, its active pointer may have lost the contract field. This can affect newly
+opened Channels too. A pending old updater retries its downloaded release without looking
+for a newer fix. Install the current global CLI, then use that CLI to complete the update:
+
+```bash
+npm install -g agents-can-communicate@latest
+acc update
+acc doctor
+```
+
+The new reader can activate a compatible release while those Channels remain open.
+It still waits for different contracts, unknown native bindings, or generation files it
+cannot verify. See [legacy contract recovery](UPGRADING.md#recover-missing-runtime-contracts).
+
 Use `acc update` to retry a failed download or finish an interrupted integration refresh.
 A download failure keeps the working version. A partial integration refresh blocks
 workspace commands until recovery completes, while hooks let the client continue without

package/docs/UPGRADING.md

@@ -1,5 +1,31 @@
 # Upgrading to 0.5.0
 
+## Recover missing runtime contracts
+
+ACC 0.5.5 fixes an upgrade defect that can leave 0.5.3 or 0.5.4 waiting for
+`acc-claude-channel` processes with `contract unknown`. The 0.4.x updater can activate
+a newer generation without copying its store contract into the active pointer. Channels
+started afterward copy that incomplete pointer even though their runtime declares a contract.
+
+For an installation already waiting on an older pending release, run:
+
+```bash
+npm install -g agents-can-communicate@latest
+acc update
+acc version
+acc doctor
+```
+
+The global CLI supplies the new management reader before runtime activation. This step is
+needed because the older updater retries its pending release before checking npm for another
+version. If a version pin selects an older release, clear it or select 0.5.5 first.
+
+The reader verifies the referenced generation's package identity, complete contents and
+file modes before recovering a missing contract. Compatible Channels can keep running on
+their original generation during activation. Explicit differing contracts and unknown
+native bindings still block. A generation without a contract, missing files, or changed
+contents remains unknown. ACC does not terminate these processes or edit their lease records.
+
 ## From 0.4.4, 0.4.3, 0.4.2, 0.4.1 or 0.4.0
 
 This release keeps the existing workspace data format. It changes when an update is
@@ -56,17 +82,17 @@ only two kinds keep an update pending:
 - A hold whose declared store contract differs from the incoming version's. This is the
   case the gate exists for, and a release that changes the store contract still needs
   every live process to exit.
-- A hold that declares no contract, which includes every record written by a release
-  before this one. Unknown cannot be compared, so it stays a conservative wait.
+- A hold with no verifiable contract. Older native bindings and generations that predate
+  the declaration remain unknown. A missing field can be recovered when the referenced
+  managed generation declares its contract and passes integrity verification.
 
 A hold declaring the same store contract as the incoming version proceeds. Several open
 Claude Code sessions, a Codex daemon and an idle ACC MCP server no longer have to be
 closed together to move between releases that share a contract.
 
-The first update after installing this release still waits for every process, because the
-holds it has to judge were written before the contract field existed. Close the relevant
-clients and persistent ACC processes once, or accept the eligible Codex service
-maintenance offer described below. Updates after that do not need it.
+Processes still running a generation from before the contract field existed must exit once.
+Close the relevant clients and persistent ACC processes, or accept the eligible Codex service
+maintenance offer described below. Later compatible runtimes do not require that restart.
 
 `acc update` names each remaining hold with its process and its declared contract, so a
 wait now states its reason rather than only the PID. `acc doctor` reports the same

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/maintenance-host.mjs

@@ -22,13 +22,27 @@ export function runMaintenanceCommand(command, args, options) {
       (typeof error.code === "number" ? error.code : null) : 0, stdout, stderr })));
 }
 
+async function canonicalFuturePath(file) {
+  const missing = []; let current = file;
+  while (true) {
+    try { return path.join(await realpath(current), ...missing); }
+    catch (error) {
+      if (error.code !== "ENOENT") throw error;
+      // A dangling symlink is an existing unknown destination, not a missing directory.
+      if (await metadataExists(current)) failMaintenance("invalid_service_home");
+      const parent = path.dirname(current);
+      if (parent === current) throw error;
+      missing.unshift(path.basename(current)); current = parent;
+    }
+  }
+}
+
 export async function maintenanceContext(context = {}) {
   const env = context.env ?? process.env;
   const home = context.home ?? env.HOME ?? os.homedir();
   let codexHome = env.CODEX_HOME ?? path.join(home, ".codex");
   if (!absolute(home) || !absolute(codexHome)) failMaintenance("invalid_service_home");
-  try { codexHome = await realpath(codexHome); }
-  catch (error) { if (error.code !== "ENOENT") throw error; }
+  codexHome = await canonicalFuturePath(codexHome);
   const [binPath, legacyPath] = managedExecutablePaths(codexHome);
   const managedPath = await metadataExists(binPath) ? binPath : legacyPath;
   return { codexHome, socketPath: path.join(codexHome, "app-server-control/app-server-control.sock"),
@@ -59,7 +73,7 @@ async function resolveCli(pathEnv) {
 const cliVersion = response => response.status === 0
   ? /^codex-cli (\d+\.\d+\.\d+)\s*$/.exec(response.stdout)?.[1] ?? null : null;
 
-export async function probeMaintenanceInstall(paths, run) {
+export async function probeMaintenanceCli(paths, run) {
   const cliPath = await resolveCli(paths.options.env.PATH);
   const version = cliVersion(await run(cliPath, ["--version"], paths.options));
   if (!parseStableVersion(version) || compareStableVersions(version, MINIMUM_MAINTENANCE_CLI) < 0) {
@@ -68,6 +82,11 @@ export async function probeMaintenanceInstall(paths, run) {
   const help = await run(cliPath, ["app-server", "daemon", "--help"], paths.options);
   if (help.status !== 0 || ["start", "stop", "version"].some(command =>
     !new RegExp(`^\\s+${command}\\s+`, "m").test(help.stdout))) failMaintenance("maintenance_cli_unsupported");
+  return { cliPath, cliVersion: version };
+}
+
+export async function probeMaintenanceInstall(paths, run) {
+  const { cliPath, cliVersion: version } = await probeMaintenanceCli(paths, run);
   const managedVersion = cliVersion(await run(paths.managedPath, ["--version"], paths.options));
   if (managedVersion !== version) failMaintenance("managed_binary_mismatch");
   return { cliPath, cliVersion: version, managedVersion };

package/node_modules/@agents-can-communicate/adapter-codex/src/service-setup.mjs

@@ -2,17 +2,24 @@ import { lstat, realpath } from "node:fs/promises";
 import path from "node:path";
 import { socketIsReady } from "./native-endpoint.mjs";
 import { probeNativeDelivery } from "./native-delivery.mjs";
-import { failMaintenance, maintenanceContext, probeMaintenanceInstall,
+import { installCodexStandalone } from "./standalone-install.mjs";
+import { failMaintenance, maintenanceContext, probeMaintenanceCli, probeMaintenanceInstall,
   readMaintenancePid, runMaintenanceCommand, verifyMaintenanceProcess } from "./maintenance-host.mjs";
 
 const keys = ["home", "codexHome", "cliPath", "cliVersion", "managedPath", "managedVersion",
   "managedRealPath", "cliIdentity", "managedIdentity", "socketPath", "pidPath", "platform"];
+const prerequisiteKeys = ["home", "codexHome", "cliPath", "cliVersion", "cliIdentity", "socketPath", "pidPath", "platform"];
 const same = (a, b, fields = keys) => fields.every(key => a?.[key] === b?.[key]);
 const own = info => typeof process.getuid !== "function" || info.uid === process.getuid();
 const sessionNeeded = "Codex service ready; open a new Codex session to establish its delivery binding and review client hooks and permissions";
 const diagnostics = {
   native_endpoint_unavailable: "Prepare the missing Codex service with codex app-server daemon start, then open a new Codex session",
-  managed_install_missing: "Codex service requires the managed standalone installation; install it with curl -fsSL https://chatgpt.com/codex/install.sh | sh using the selected HOME and CODEX_HOME, then retry acc install",
+  managed_install_missing: "Codex service needs its standalone package; run acc install to download the matching official Codex release and prepare the service",
+  managed_install_incomplete: "Codex standalone installation is incomplete; repair it with the official Codex installer, then retry acc install",
+  prerequisite_consent_required: "Codex standalone download was not approved. Run acc install --adapter codex --delivery actionable to allow the download and automatic peer requests",
+  prerequisite_download_failed: "Could not download the official Codex installer; check your connection and retry acc install",
+  prerequisite_integrity_failed: "The Codex installer checksum did not match the reviewed version; no installer was run",
+  prerequisite_install_failed: "The official Codex installation did not complete; check connectivity and the selected Codex home, then retry acc install",
   managed_binary_mismatch: "Codex CLI and managed standalone versions differ; repair the vendor installation, then retry acc install",
   maintenance_platform_unsupported: "Codex service preparation is captured only on darwin-arm64; configure the vendor service manually",
   maintenance_cli_unsupported: "Codex cold service preparation requires codex-cli 0.154.0 or newer with daemon commands; update the vendor installation, then retry acc install",
@@ -25,7 +32,8 @@ function report(state, reasonCode, facts = {}) {
 }
 
 export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = probeNativeDelivery,
-  fs = { lstat, realpath }, contextPaths = maintenanceContext } = {}) {
+  fs = { lstat, realpath }, contextPaths = maintenanceContext,
+  installStandalone = installCodexStandalone } = {}) {
   async function info(file) {
     try { return await fs.lstat(file); }
     catch (error) { if (error.code === "ENOENT") return null; throw error; }
@@ -54,6 +62,22 @@ export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = p
       cliIdentity: cli.identity, managedIdentity: managed.identity,
       socketPath: paths.socketPath, pidPath: paths.pidPath, platform: paths.platform, ...installation };
   }
+  async function missingPrerequisite(paths) {
+    for (const name of ["packages", "packages/standalone", "packages/standalone/bin", "packages/standalone/releases"]) {
+      const stat = await info(path.join(paths.codexHome, name));
+      if (stat && (!stat.isDirectory() || stat.isSymbolicLink() || !own(stat) || (stat.mode & 0o022))) {
+        failMaintenance("unsafe_service_directory");
+      }
+    }
+    if (await info(path.join(paths.codexHome, "packages/standalone/current"))) failMaintenance("managed_install_incomplete");
+    if (await info(paths.pidPath) || await info(paths.socketPath)) failMaintenance("daemon_identity_unavailable");
+    const installation = await probeMaintenanceCli({ ...paths,
+      options: { ...paths.options, cwd: paths.options.env.HOME } }, run);
+    const cli = await executableIdentity(installation.cliPath);
+    return report("needed", "managed_install_missing", { requiresInstall: true,
+      home: paths.options.env.HOME, codexHome: paths.codexHome, cliIdentity: cli.identity,
+      socketPath: paths.socketPath, pidPath: paths.pidPath, platform: paths.platform, ...installation });
+  }
   async function verify(paths, facts) {
     if (!await socketIsReady(paths.socketPath)) failMaintenance("daemon_socket_unproven");
     const version = await run(facts.cliPath, ["app-server", "daemon", "version"], paths.options);
@@ -86,6 +110,8 @@ export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = p
         // service needs no new managed-install or cold-start prerequisite.
         if (native.supported) return report("ready", native.reasonCode ?? null);
       }
+      await safeDirectories(paths);
+      if (!await info(paths.managedPath)) return await missingPrerequisite(paths);
       const facts = await installed(paths);
       if (!await info(paths.socketPath) && !await info(paths.pidPath)) {
         return report("needed", "native_endpoint_unavailable", facts);
@@ -96,7 +122,33 @@ export function createCodexServiceSetup({ run = runMaintenanceCommand, probe = p
       return report(reason.endsWith("_unsupported") ? "unsupported" : "blocked", reason);
     }
   }
-  async function prepareNativeServiceSetup({ context, plan } = {}) {
+  async function preparePrerequisite(context, plan, consent, download) {
+    let attempted = false;
+    try {
+      if (consent !== true) failMaintenance("prerequisite_consent_required");
+      if (plan.state !== "needed" || !prerequisiteKeys.every(key => typeof plan[key] === "string")) {
+        failMaintenance("invalid_service_setup_plan");
+      }
+      const beforeInstall = async () => {
+        const current = await inspect(context, { strict: true });
+        if (current.state !== "needed" || current.requiresInstall !== true
+          || !same(plan, current, prerequisiteKeys)) failMaintenance("service_identity_changed");
+      };
+      await beforeInstall();
+      attempted = true;
+      await installStandalone(plan, { env: context?.env ?? process.env, beforeInstall, download });
+      const next = await inspect(context, { strict: true });
+      if (!["needed", "ready"].includes(next.state) || next.requiresInstall
+        || !same(plan, next, prerequisiteKeys)) failMaintenance("service_identity_changed");
+      const result = await prepareNativeServiceSetup({ context, plan: next });
+      return { ...result, installedPrerequisite: true };
+    } catch (error) {
+      return { ...report(attempted ? "failed" : "blocked", error.reasonCode ?? "prerequisite_install_failed"),
+        started: false, installedPrerequisite: false };
+    }
+  }
+  async function prepareNativeServiceSetup({ context, plan, installPrerequisites, download } = {}) {
+    if (plan?.requiresInstall === true) return preparePrerequisite(context, plan, installPrerequisites, download);
     let started = false;
     try {
       if (plan?.state === "ready") {

package/node_modules/@agents-can-communicate/adapter-codex/src/standalone-install.mjs

@@ -0,0 +1,38 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { failMaintenance, runMaintenanceCommand } from "./maintenance-host.mjs";
+
+// Pinned official installer: its noninteractive mode retains other installations.
+// Keep the script and its behavior review separate from the selected CLI version.
+export const CODEX_INSTALLER = Object.freeze({
+  url: "https://raw.githubusercontent.com/openai/codex/rust-v0.154.0/scripts/install/install.sh",
+  sha256: "ba92dd27e5c06f0d3bbc58bfa4b9cfb6599cd2742fbb1f92a2765e6c07dedb5a",
+});
+
+export async function installCodexStandalone(plan, { env, beforeInstall,
+  download, run = runMaintenanceCommand, source = CODEX_INSTALLER } = {}) {
+  let directory;
+  try {
+    if (typeof download !== "function") failMaintenance("prerequisite_download_unavailable");
+    const script = await download(source);
+    directory = await mkdtemp(path.join(os.tmpdir(), "acc-codex-installer-"));
+    const file = path.join(directory, "install.sh");
+    await writeFile(file, script, { mode: 0o600, flag: "wx" });
+    await beforeInstall();
+    const bin = path.join(plan.codexHome, "packages/standalone/bin");
+    const result = await run("/bin/sh", [file, "--release", plan.cliVersion], {
+      cwd: plan.home, timeout: 300_000,
+      env: { ...env, HOME: plan.home, CODEX_HOME: plan.codexHome,
+        CODEX_RELEASE: plan.cliVersion, CODEX_NON_INTERACTIVE: "1",
+        CODEX_INSTALLER_USE_RELEASES_OPENAI_COM: "true", CODEX_INSTALL_DIR: bin,
+        // The official installer skips profile edits when its bin is on PATH.
+        // This PATH belongs only to the installer; the user's command is retained.
+        PATH: `${bin}:/usr/bin:/bin:/usr/sbin:/sbin` },
+    });
+    if (result.status !== 0) failMaintenance("prerequisite_install_failed");
+  } catch (error) {
+    if (error.reasonCode) throw error;
+    failMaintenance("prerequisite_install_failed");
+  } finally { if (directory) await rm(directory, { recursive: true, force: true }); }
+}

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/src/install-delivery-consent.mjs

@@ -20,6 +20,9 @@ function validDecision(record) {
   if (!(decision !== null && typeof decision === "object"
     && DECISION_SOURCES.has(decision.source)
     && typeof decision.completeSetup === "boolean")) return false;
+  if (Object.hasOwn(decision, "installPrerequisites")
+    && (typeof decision.installPrerequisites !== "boolean"
+      || (decision.installPrerequisites && !decision.completeSetup))) return false;
 
   const enabled = livePolicyOf(record) !== "off";
   if (decision.source === "interactive-accepted") return decision.completeSetup && enabled;
@@ -34,7 +37,9 @@ function validDecision(record) {
 export function decisionOf(record) {
   return validDecision(record)
     ? { source: record.deliveryDecision.source,
-      completeSetup: record.deliveryDecision.completeSetup }
+      completeSetup: record.deliveryDecision.completeSetup,
+      ...(Object.hasOwn(record.deliveryDecision, "installPrerequisites")
+        ? { installPrerequisites: record.deliveryDecision.installPrerequisites } : {}) }
     : legacyDecision();
 }
 
@@ -43,6 +48,7 @@ const isEligible = entry => entry.nativeDelivery?.state === "eligible"
 
 const needsExpandedSetup = entry => ["needed", "blocked"]
   .includes(entry.nativeServiceSetup?.state);
+const needsPrerequisite = entry => entry.nativeServiceSetup?.requiresInstall === true;
 
 const isInteractive = runtime => typeof runtime.isInteractive === "function"
   && runtime.isInteractive() === true;
@@ -60,6 +66,8 @@ function questionFor(entries) {
     "       Configure the required local permission grants.",
     ...(entries.some(entry => entry.adapterId === "codex")
       ? ["       Start a missing supported Codex service."] : []),
+    ...entries.filter(needsPrerequisite).map(entry =>
+      `       Download the official Codex ${entry.nativeServiceSetup.cliVersion} standalone package for its service; retain your existing codex command.`),
     ...setup.map(note => `       ${note}`),
     ...(channels ? ["       Allow Claude Code development Channels when prompted at startup."] : []),
     "  No: keep current delivery policies and use available next-turn hooks or acc inbox.",
@@ -88,6 +96,7 @@ export async function decideDelivery({ options, detected, recorded, runtime, dry
       deliveryByAdapter[entry.adapterId] = explicit;
       deliveryDecisionByAdapter[entry.adapterId] = {
         source: "explicit-option", completeSetup: explicit !== "off",
+        ...(needsPrerequisite(entry) ? { installPrerequisites: explicit !== "off" } : {}),
       };
       continue;
     }
@@ -107,9 +116,12 @@ export async function decideDelivery({ options, detected, recorded, runtime, dry
     const alreadyDecided = validDecision(record)
       && DELIBERATE_SOURCES.has(record.deliveryDecision.source);
     const expandsLegacyOptIn = previous !== "off" && needsExpandedSetup(entry)
-      && !decisionOf(record).completeSetup;
+      && !decisionOf(record).completeSetup
+      && !(needsPrerequisite(entry) && decisionOf(record).installPrerequisites === false);
     const freshDecision = previous === "off" && !alreadyDecided;
-    if (!freshDecision && !expandsLegacyOptIn) {
+    const expandsPrerequisite = previous !== "off" && needsPrerequisite(entry)
+      && !Object.hasOwn(decisionOf(record), "installPrerequisites");
+    if (!freshDecision && !expandsLegacyOptIn && !expandsPrerequisite) {
       deliveryDecisionByAdapter[entry.adapterId] ??= legacyDecision();
       continue;
     }
@@ -141,6 +153,9 @@ export async function decideDelivery({ options, detected, recorded, runtime, dry
         : previous === "off"
           ? { source: "interactive-declined", completeSetup: false }
           : decisionOf(record);
+      if (needsPrerequisite(entry)) {
+        deliveryDecisionByAdapter[entry.adapterId].installPrerequisites = yes;
+      }
     }
   }
 

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/generation-files.mjs

@@ -0,0 +1,25 @@
+import { createHash } from "node:crypto";
+import { lstat, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+
+export async function collectFile(source, relative, collected) {
+  const stat = await lstat(source);
+  if (stat.isSymbolicLink()) throw new Error(`symbolic link inside runtime files: ${relative}`);
+  if (stat.isDirectory()) {
+    for (const entry of (await readdir(source)).sort()) {
+      await collectFile(path.join(source, entry), path.posix.join(relative, entry), collected);
+    }
+  } else if (stat.isFile()) {
+    collected.set(relative, { bytes: await readFile(source), mode: stat.mode & 0o777 });
+  } else throw new Error(`unsupported runtime file: ${relative}`);
+}
+
+/** This format also names existing generations; keep it stable across upgrades. */
+export function fingerprint(files) {
+  const hash = createHash("sha256");
+  for (const [name, file] of [...files].sort(([a], [b]) => a.localeCompare(b))) {
+    hash.update(JSON.stringify([name, file.mode, file.bytes.length]));
+    hash.update(file.bytes);
+  }
+  return hash.digest("hex");
+}

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/generation.mjs

@@ -1,8 +1,8 @@
-import { createHash } from "node:crypto";
 import { lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm }
   from "node:fs/promises";
 import path from "node:path";
 
+import { collectFile, fingerprint } from "./generation-files.mjs";
 import { attachStagingTemp, holdStagedGeneration, releaseStagingHold } from "./staging.mjs";
 
 const NAME = "agents-can-communicate";
@@ -37,18 +37,6 @@ function declaredPath(value) {
   return value.replace(/\/+$/, "");
 }
 
-async function collectFile(source, relative, collected) {
-  const stat = await lstat(source);
-  if (stat.isSymbolicLink()) throw new Error(`symbolic link inside runtime files: ${relative}`);
-  if (stat.isDirectory()) {
-    for (const entry of (await readdir(source)).sort()) {
-      await collectFile(path.join(source, entry), path.posix.join(relative, entry), collected);
-    }
-  } else if (stat.isFile()) {
-    collected.set(relative, { bytes: await readFile(source), mode: stat.mode & 0o777 });
-  } else throw new Error(`unsupported runtime file: ${relative}`);
-}
-
 async function checkDeclaredComponents(source, relative) {
   let current = source;
   for (const component of relative.split("/")) {
@@ -84,15 +72,6 @@ async function collectPackage(source, prefix, collected, expectedName, version)
   return manifest;
 }
 
-function fingerprint(files) {
-  const hash = createHash("sha256");
-  for (const [name, file] of [...files].sort(([a], [b]) => a.localeCompare(b))) {
-    hash.update(JSON.stringify([name, file.mode, file.bytes.length]));
-    hash.update(file.bytes);
-  }
-  return hash.digest("hex");
-}
-
 async function existingMatches(target, files) {
   try {
     const actual = new Map();

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/install.mjs

@@ -57,7 +57,11 @@ export async function installManaged({ packageRoot, managerRoot, dataHome, home,
       await writeControl(root, control);
       const paths = await writeLaunchers(root, runtime.root);
       const result = await apply({ ...paths, preserveVersions: true });
-      if (result.failed.length === 0) {
+      // Service readiness is separate from integration installation. Its failure
+      // must not fence a fully installed runtime or make the durable inbox unusable.
+      const integrationFailed = result.failed.some(failure => failure.stage !== "service-setup"
+        || !result.operations?.some(operation => operation.adapterId === failure.adapterId && operation.applied === true));
+      if (!integrationFailed) {
         const ready = await writeControl(root, { ...control, phase: "ready", pending: null });
         await scheduleWorker(root, ready, { env });
       } else {

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/launchers.mjs

@@ -4,7 +4,7 @@ import path from "node:path";
 import { ENTRY_KINDS } from "./entry.mjs";
 import { managedDirectory, syncDirectory } from "./state.mjs";
 
-const MODULES = ["entry.mjs", "state.mjs", "mutex.mjs", "leases.mjs", "schedule.mjs", "policy.mjs"];
+const MODULES = ["entry.mjs", "state.mjs", "generation-files.mjs", "mutex.mjs", "leases.mjs", "schedule.mjs", "policy.mjs"];
 async function durableFile(file, bytes, mode = 0o600) {
   const handle = await open(file, "wx", mode);
   try { await handle.writeFile(bytes); await handle.sync(); }

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/leases.mjs

@@ -49,11 +49,11 @@ export async function listRuntimeHolds(root, { pidIsAlive = defaultPidIsAlive }
       || typeof lease.token !== "string" || name !== `${lease.token}.json`
       || typeof lease.kind !== "string" || !lease.kind
       || !Number.isFinite(Date.parse(lease.createdAt))) throw new Error("invalid runtime lease");
-    await validateRuntime(root, lease.runtime);
+    const runtime = await validateRuntime(root, lease.runtime);
     if (await confirmedDead(lease.pid, pidIsAlive)) {
       await rm(file, { force: true });
       removed = true;
-    } else holds.push(lease);
+    } else holds.push({ ...lease, runtime });
   }
   if (removed) await syncDirectory(directory);
   return holds;

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/state.mjs

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
 import path from "node:path";
+import { collectFile, fingerprint } from "./generation-files.mjs";
 
 /** Resolve existing ancestors without creating an uninitialized manager. */
 export async function canonicalManagerRoot(root) {
@@ -74,6 +75,25 @@ export async function writeManagedJson(file, value) {
 const nonempty = value => typeof value === "string" && value.length > 0;
 const nullableString = value => value === null || nonempty(value);
 
+/** Older updaters dropped the contract while publishing a newer generation.
+ * Recover only from that exact, unchanged generation, never from the active
+ * version or a loose manifest. Explicit lease declarations remain historical
+ * facts. Missing or damaged files leave an unknown hold without failing hooks.
+ */
+async function recoverStoreVersion(generations, runtime) {
+  if (path.dirname(runtime.root) !== generations
+    || !/^\d+\.\d+\.\d+-[a-f0-9]{24}$/.test(path.basename(runtime.root))) return null;
+  try {
+    const files = new Map();
+    await collectFile(runtime.root, "", files);
+    if (path.basename(runtime.root) !== `${runtime.version}-${fingerprint(files).slice(0, 24)}`) return null;
+    const manifest = JSON.parse(files.get("package.json")?.bytes.toString("utf8"));
+    return manifest.name === "agents-can-communicate" && manifest.version === runtime.version
+      && Number.isSafeInteger(manifest.accStoreVersion) && manifest.accStoreVersion > 0
+      ? manifest.accStoreVersion : null;
+  } catch { return null; }
+}
+
 export async function validateRuntime(root, runtime) {
   if (!runtime || !nonempty(runtime.version) || typeof runtime.root !== "string"
     || !path.isAbsolute(runtime.root)) throw new Error("invalid control generation");
@@ -95,7 +115,9 @@ export async function validateRuntime(root, runtime) {
   if (await managedDirectory(generations)) {
     if (await realpath(generations) !== generations) throw new Error("invalid control generations directory");
   }
-  return { version: runtime.version, root: resolved, storeVersion: runtime.storeVersion ?? null };
+  const normalized = { version: runtime.version, root: resolved, storeVersion: runtime.storeVersion ?? null };
+  normalized.storeVersion ??= await recoverStoreVersion(generations, normalized);
+  return normalized;
 }
 
 async function validateControl(root, value) {

package/node_modules/@agents-can-communicate/cli/src/native-delivery-status.mjs

@@ -36,15 +36,18 @@ export function nativeRemediation(entry) {
     steps.push(`acc install --adapter ${entry.adapterId}`
       + "  # complete the missing native launch setup from a supported shell");
   } else if (native.configured && native.runtime !== "active"
-    && !["needed", "blocked"].includes(service?.state)) {
+    && !["needed", "blocked", "unsupported"].includes(service?.state)) {
     steps.push(`${entry.displayName}: no verified live channel in this workspace; `
       + "open a new terminal, start a new client session and check its integration/channel prompts; "
       + "then run acc doctor here");
   }
   if (native.reasonCode === "native_endpoint_unavailable") {
-    if (service?.state === "blocked") steps.push(service.diagnostic);
+    if (["blocked", "unsupported"].includes(service?.state)) steps.push(service.diagnostic);
     else if (service?.state === "needed" && native.configured) {
-      steps.push(entry.deliveryDecision?.completeSetup === true
+      steps.push(service.requiresInstall && entry.deliveryDecision?.installPrerequisites === false
+        ? `acc install --adapter ${entry.adapterId} --delivery ${native.policy === "all" ? "all" : "actionable"}`
+          + "  # allow the official Codex download and complete service setup"
+        : entry.deliveryDecision?.completeSetup === true
         ? `acc install --adapter ${entry.adapterId}  # prepare the missing supported local service`
         : `acc install --adapter ${entry.adapterId} --delivery actionable`
           + "  # approve complete automatic peer-request setup");

package/node_modules/@agents-can-communicate/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/core",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/delivery-router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/delivery-router",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/hook-runner/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/hook-runner",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/installer",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/src/service-setup.mjs

@@ -6,7 +6,12 @@ export async function applyServiceSetup({ adapter, context, operation, results }
   let setup = plan;
   if (["needed", "ready"].includes(plan.state)) {
     try {
-      setup = await adapter.prepareNativeServiceSetup({ context, plan });
+      setup = await adapter.prepareNativeServiceSetup({ context, plan,
+        installPrerequisites: operation.deliveryDecision.installPrerequisites === true,
+        download: async source => {
+          const { downloadVerifiedInstaller } = await import("./verified-download.mjs");
+          return downloadVerifiedInstaller(source);
+        } });
       if (!setup || !["ready", "failed", "blocked"].includes(setup.state)) throw new Error("invalid setup result");
     } catch {
       setup = { state: "failed", started: false, reasonCode: "service_setup_failed",
@@ -24,7 +29,7 @@ export async function applyServiceSetup({ adapter, context, operation, results }
   } else {
     operation.needsAction.push(setup.diagnostic);
     if (setup.state === "failed") results.failed.push({ adapterId: operation.adapterId,
-      error: setup.diagnostic, reasonCode: setup.reasonCode });
+      error: setup.diagnostic, reasonCode: setup.reasonCode, stage: "service-setup" });
   }
   operation.diagnostics.push(setup.diagnostic);
 }

package/node_modules/@agents-can-communicate/installer/src/verified-download.mjs

@@ -0,0 +1,22 @@
+import { createHash } from "node:crypto";
+
+const fail = reasonCode => { throw Object.assign(new Error(reasonCode), { reasonCode }); };
+
+// Only the explicit installer supplies this port. Adapters keep vendor metadata
+// and installation behavior, while hook-loaded code has no network implementation.
+export async function downloadVerifiedInstaller(source, { fetch = globalThis.fetch } = {}) {
+  if (new URL(source.url).protocol !== "https:") fail("prerequisite_download_failed");
+  const response = await fetch(source.url, { redirect: "error", signal: AbortSignal.timeout(30_000) });
+  if (!response.ok || !response.body) fail("prerequisite_download_failed");
+  const chunks = []; let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.byteLength;
+    if (size > 131_072) fail("prerequisite_download_failed");
+    chunks.push(Buffer.from(chunk));
+  }
+  const script = Buffer.concat(chunks);
+  if (createHash("sha256").update(script).digest("hex") !== source.sha256) {
+    fail("prerequisite_integrity_failed");
+  }
+  return script;
+}

package/node_modules/@agents-can-communicate/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/mcp-server",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/protocol",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/storage-filesystem/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/storage-filesystem",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "private": true,
   "type": "module",
   "exports": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "accManagedUpdateProtocol": 2,
   "accStoreVersion": 6,
   "type": "module",