agents-can-communicate 0.7.0 → 0.8.0

package/README.md

@@ -98,7 +98,9 @@ provide messages at the next normal turn; other sessions read their ACC inbox ex
 
 Experimental live delivery can wake eligible Claude Code and Codex sessions on Apple Silicon
 macOS. It requires opt-in and an active verified connection, is off by default, and can spend
-model tokens. Messages for busy sessions queue until the current turn ends.
+model tokens. Claude Code sessions wake through the inbox that Claude Code itself opens, so
+you start Claude Code with your ordinary command. A busy Claude Code session gets the message
+between two tool calls. A busy Codex session gets it when the current turn ends.
 
 See [client capabilities](docs/CAPABILITIES.md) for exact support. Run `acc doctor` from your
 project if a peer is missing or delivery differs from what you expect; see

package/bin/entrypoints/acc-bootstrap.mjs

@@ -1,51 +1,9 @@
 #!/usr/bin/env node
-// Internal entry point behind an ACC-owned shell shim: is this exact vendor
-// executable eligible for native delivery right now? Exit 0 means yes and the
-// shim exports its owned policy before `exec`; any other exit - including a
-// crash, a missing adapter, or a damaged install - means the shim launches the
-// vendor command untouched. Nothing is ever written to stdout, and stderr stays
-// empty unless ACC_BOOTSTRAP_DEBUG=1 asks for one safe line.
-import { checkNativeBootstrap } from "@agents-can-communicate/installer";
-
-import { createAntigravityAdapter } from "@agents-can-communicate/adapter-antigravity";
-import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
-import { createCodexAdapter } from "@agents-can-communicate/adapter-codex";
-import { createGeminiCliAdapter } from "@agents-can-communicate/adapter-gemini-cli";
-import { createGrokAdapter } from "@agents-can-communicate/adapter-grok";
-import { createKimiAdapter } from "@agents-can-communicate/adapter-kimi";
-
-import { parseBootstrapOptions } from "@agents-can-communicate/cli/managed-entry";
-
-function debug(line) {
-  if (process.env.ACC_BOOTSTRAP_DEBUG === "1") process.stderr.write(`acc-bootstrap: ${line}\n`);
-}
-
+// Kept only for installs made by ACC 0.7.x or earlier. A 0.7.x updater refuses a
+// downloaded package without this file, and a `claude` shell shim written by
+// 0.7.x still runs it through its launcher until `acc install` or `acc update`
+// retires the shim. A shim reads any exit other than 0 as "launch the vendor
+// command untouched", so this answers 1 and writes nothing.
 export async function main() {
-try {
-  const options = parseBootstrapOptions(process.argv.slice(2));
-  if (options === null) {
-    debug("usage: --adapter <id> --real-executable <path> --data-home <path>");
-    process.exit(2);
-  }
-  const registry = {
-    claude_code: createClaudeCodeAdapter, codex: createCodexAdapter,
-    gemini_cli: createGeminiCliAdapter, grok: createGrokAdapter, kimi: createKimiAdapter,
-    // No native delivery contract: this reports the client unsupported rather
-    // than unknown, which is a different and more useful thing to read.
-    antigravity: createAntigravityAdapter,
-  };
-  const adapter = registry[options.adapter]?.();
-  if (adapter === undefined) {
-    debug(`${options.adapter}: unknown adapter`);
-    process.exit(1);
-  }
-  const result = await checkNativeBootstrap({ adapter, realExecutable: options.realExecutable,
-    platform: `${process.platform}-${process.arch}`, dataHome: options.dataHome, timeoutMs: 750 });
-  debug(`${options.adapter}: ${result.supported ? "supported" : result.reasonCode}`);
-  process.exit(result.supported ? 0 : 1);
-} catch (error) {
-  debug(`failed: ${String(error?.code ?? error?.name ?? "error")}`);
-  process.exit(1);
-}
-
+  process.exitCode = 1;
 }

package/bin/entrypoints/acc-claude-channel.mjs

@@ -1,166 +1,56 @@
 #!/usr/bin/env node
-// The ACC Channel binary Claude Code spawns as a stdio MCP child. It composes
-// the same workspace discovery, session binding, core service, and local
-// data-home rules as acc-hook, opens a session-scoped endpoint for the delivery
-// router, and turns the model's explicit acc_reply / acc_ack into real ACC
-// records. It never collects a transcript or runs a model, and it fails open:
-// any composition error leaves Claude a plain MCP server that simply offers no
-// tools rather than crashing the session.
-import { randomBytes } from "node:crypto";
-
-import { createClaudeCodeAdapter } from "@agents-can-communicate/adapter-claude-code";
-import { listSessionBindings } from "@agents-can-communicate/adapter-sdk";
-import { createCoordinationService } from "@agents-can-communicate/core";
-import { createDeliveryRouter } from "@agents-can-communicate/delivery-router";
-import { readInstalledLivePolicy } from "@agents-can-communicate/installer";
-import { recordAndOffer } from "@agents-can-communicate/mcp-server";
-import { resolveClientPid } from "@agents-can-communicate/hook-runner/client-pid";
-import { readProcessTable } from "@agents-can-communicate/hook-runner/process-table";
-import { createId } from "@agents-can-communicate/protocol";
-import { openFilesystemStore } from "@agents-can-communicate/storage-filesystem";
-import { ALL_ADAPTERS, createGitProbe, discoverWorkspace, platformDataHome, runtimePaths }
-  from "@agents-can-communicate/cli";
-
-import { createAccChannel, endpointDir, routeAck, routeReply }
-  from "@agents-can-communicate/adapter-claude-code/channel";
-
-import { pump, startInertChannel } from "./claude-channel-stdio.mjs";
-import { activateClaudeChannel } from "./claude-channel-binding.mjs";
-
-const clock = { now: () => new Date().toISOString() };
-const ids = { next: kind => createId(kind, randomBytes) };
-
-/**
- * The ACC session this Claude process opened - decided by which client process
- * this Channel is running under, never by how many sessions happen to be
- * visible.
- *
- * There used to be a fallback here: if exactly one session was live, it was
- * taken to be this one. On a single-session machine that looked safe, and with
- * two sessions it silently handed one client the other's identity. The Channel
- * starts while its own SessionStart hook is still writing its binding, so the
- * only binding a second client can see at that moment is the *first* client's -
- * and the wait that was added to survive that race then locks the wrong answer
- * in on the first attempt, because it is a complete, live, plausible binding.
- *
- * Measured on two real 2.1.259 sessions: both Channels registered an endpoint
- * under the first client's pid. `bindNativeSession` refuses two registrations
- * for one pid, so the session that had been receiving live messages dropped
- * back to the durable inbox - and an `acc_reply` from the second window would
- * have been recorded as the first session's answer, which is a false record
- * rather than a lost message.
- *
- * This process was spawned by its client, so its own ancestry names that
- * client, and no race can change that. Ownership is decided by it.
- */
-export async function resolveSession({ runtimeDir, service, env, ownClientPid,
-  listBindings = listSessionBindings }) {
-  if (!Number.isInteger(ownClientPid)) return null;
-  const bindings = await listBindings({ runtimeDir });
-  if (bindings.length === 0) return null;
-  const status = await service.collectStatus({});
-  const live = new Set(status.participants
-    .filter(participant => participant.presence !== "offline")
-    .map(participant => participant.sessionId));
-  const mine = bindings.filter(binding => live.has(binding.accSessionId)
-    && binding.clientPid === ownClientPid);
-  // One client process can outlive a session and open another, so the pid alone
-  // can still name two. The harness session id the client exports separates
-  // them; with nothing to separate them the answer is nobody, as before.
-  const exported = new Set(Object.values(env ?? {}).filter(value => typeof value === "string"));
-  const matched = mine.filter(binding => exported.has(binding.harnessSessionId));
-  const chosen = mine.length === 1 ? mine[0] : matched.length === 1 ? matched[0] : null;
-  return chosen === null ? null
-    : { sessionId: chosen.accSessionId, generation: chosen.generation, clientPid: chosen.clientPid,
-      harnessSessionId: chosen.harnessSessionId };
-}
-
-/** The client process this Channel was spawned by, or null when nobody knows. */
-export async function ownClient({ table = null, from = process.pid,
-  command = createClaudeCodeAdapter().client.command } = {}) {
-  return resolveClientPid({ table: table ?? await readProcessTable(), from, command });
-}
-
-// How long the Channel will wait for the hook to publish this session's
-// binding. Claude spawns this child while SessionStart is still running - both
-// landed in the same second on a real 2.1.259 launch - and a single lookup
-// loses that race often enough to make native delivery activate or not per
-// launch. Bounded, because a session with no ACC binding must still be answered.
-const BINDING_WAIT_MS = 5_000;
-const BINDING_POLL_MS = 100;
-
-/**
- * The session binding, once it exists - or null when the wait runs out.
- *
- * A binding with no `clientPid` names no process, and the Channel binds an
- * exact one, so it does not count as resolved: the hook writes the identity
- * first and the certified facts after, and reading in between must keep waiting
- * rather than settle for the half-written answer.
- */
-export async function resolveWithin({ resolve, deadline, intervalMs = BINDING_POLL_MS,
-  now = () => Date.now(), sleep = ms => new Promise(resolve_ => setTimeout(resolve_, ms)) }) {
-  for (;;) {
-    const session = await resolve();
-    if (session !== null && Number.isInteger(session?.clientPid)) return session;
-    if (now() >= deadline) return null;
-    await sleep(intervalMs);
+// Kept only for installs made by ACC 0.7.x or earlier, which wired a Claude Channel MCP
+// server. A 0.7.x updater refuses a downloaded package without this file, and a
+// plugin copy written by 0.7.x can still ask Claude Code to spawn it until
+// `acc install` or `acc update` lays the plugin out again.
+//
+// A child that answers nothing is reported to the user as a server that failed
+// to connect, so this finishes the MCP handshake, declares no Channel and
+// offers no tools, and exits when Claude closes its stdin or stops it with a signal.
+
+function answer(message) {
+  if (message.method === "initialize") {
+    return { protocolVersion: message.params?.protocolVersion, capabilities: { tools: {} },
+      serverInfo: { name: "agents-can-communicate", version: "0.2.0" } };
   }
+  if (message.method === "tools/list") return { tools: [] };
+  if (message.method === "ping") return {};
+  return undefined;
 }
 
-async function compose() {
-  const descriptor = await discoverWorkspace({ cwd: process.cwd(), env: process.env,
-    gitProbe: createGitProbe() });
-  const dataHome = platformDataHome({ platform: process.platform, env: process.env });
-  const paths = runtimePaths({ dataHome, workspaceId: descriptor.id, workspaceRoots: descriptor.roots });
-  const store = await openFilesystemStore({ root: paths.root, clock, ids,
-    workspaceId: descriptor.id });
-  const service = createCoordinationService({ store, clock, ids });
-  const write = payload => process.stdout.write(`${JSON.stringify(payload)}\n`);
-  // Read once: the ancestry that decides ownership cannot change while this
-  // process runs, and re-reading it on every poll would spawn `ps` in a loop.
-  const clientPid = await ownClient();
-  const session = await resolveWithin({
-    resolve: () => resolveSession({ runtimeDir: paths.root, service, env: process.env,
-      ownClientPid: clientPid }),
-    deadline: Date.now() + BINDING_WAIT_MS });
-  // No binding to serve - but Claude is already speaking MCP to this child, and
-  // returning here left the event loop empty: the process exited in 75ms
-  // without answering `initialize`, and Claude reported the server as failed to
-  // connect on every session that enables the plugin without ACC's shim.
-  if (session === null || !Number.isInteger(session.clientPid)) {
-    return startInertChannel({ write });
+function handle(line) {
+  let message;
+  try { message = JSON.parse(line); } catch {
+    return { jsonrpc: "2.0", error: { code: -32700, message: "parse error" } };
   }
-
-  const deliveryRouter = createDeliveryRouter({ service, adapters: ALL_ADAPTERS(), clock,
-    readLivePolicy: ({ adapter }) => readInstalledLivePolicy({ dataHome, adapterId: adapter.id }) });
-  const channel = createAccChannel({
-    endpointDir: endpointDir(paths.root),
-    clientPid: session.clientPid,
-    write,
-    // The Channel tool records through its own bound session, then uses the
-    // same durable-first offer as ordinary MCP. A successful reply record alone
-    // does not deliver it to the peer, and a failed offer must not lose it.
-    routeReply: ({ messageId, body }) => recordAndOffer({ router: deliveryRouter,
-      selectMessage: value => value.reply,
-      record: () => routeReply({ service, session, messageId, body }) }),
-    routeAck: ({ messageId }) => routeAck({ service, session, messageId }),
-    // This process is the only party that knows the endpoint is still being
-    // served, and Claude publishes no heartbeat, so nothing else would move
-    // ACC's lease while the session sits idle - which is when live delivery is
-    // worth having.
-    refreshBinding: leaseUntil => service.refreshDeliveryBinding({
-      sessionId: session.sessionId, generation: session.generation, leaseUntil }),
-  });
-  await channel.listen();
-  pump(channel.handleLine, () => { channel.close(); process.exit(0); });
-  // Serve MCP immediately; a slow or failed ACC binding must not stop the
-  // client connecting. The listening endpoint lets an in-flight hook finish
-  // before this owner acquires the same lifecycle lock and completes startup.
-  await activateClaudeChannel({ session, service, runtimeDir: paths.root, dataHome,
-    env: process.env }).catch(() => {});
-  return channel;
+  if (message.id === undefined || message.id === null) return null;
+  const result = answer(message);
+  return result === undefined
+    ? { jsonrpc: "2.0", id: message.id, error: { code: -32601, message: `unknown method: ${message.method}` } }
+    : { jsonrpc: "2.0", id: message.id, result };
 }
 
 export async function main() {
-  await compose().catch(() => startInertChannel());
+  let buffer = "";
+  process.stdin.setEncoding("utf8");
+  process.stdin.on("data", chunk => {
+    buffer += chunk;
+    let newline = buffer.indexOf("\n");
+    while (newline !== -1) {
+      const line = buffer.slice(0, newline).trim();
+      buffer = buffer.slice(newline + 1);
+      newline = buffer.indexOf("\n");
+      const reply = line === "" ? null : handle(line);
+      if (reply !== null) process.stdout.write(`${JSON.stringify(reply)}\n`);
+    }
+  });
+  await new Promise(resolve => {
+    process.stdin.once("end", resolve);
+    process.once("SIGTERM", resolve);
+    process.once("SIGINT", resolve);
+    process.stdin.resume();
+  });
+  // A signal can arrive while Claude still holds the pipe open; a stdin left
+  // reading would keep this process alive after main() returns.
+  process.stdin.destroy();
 }

package/docs/ADAPTER_AUTHORING.md

@@ -148,11 +148,12 @@ to its capabilities:
 
 ```js
 nativeDelivery: {
-  minimumByPlatform: { "darwin-arm64": "2.1.258" },
-  anchors: [{ platform: "darwin-arm64", version: "2.1.258",
-    protocolContract: "claude-code-channel-mcp-v1" }],
+  minimumByPlatform: { "darwin-arm64": "2.1.282" },
+  anchors: [{ platform: "darwin-arm64", version: "2.1.282",
+    protocolContract: "claude-code-inbox-socket-v1" }],
   knownBad: [],
-  activationKinds: ["shell-bootstrap"],
+  activationKinds: ["native-service"],
+  offerKind: "wake",
 }
 ```
 
@@ -172,11 +173,32 @@ The rules `defineAdapter` enforces, and the ones the runtime applies:
 - Native methods return closed facts (`validateNativeActivationPlan()` closes the
   activation plan) and never put vendor data - endpoints, sockets, raw errors - into core.
 
-`nativeDelivery.policySource` defaults to the session environment. An adapter may
-declare `"installation-record"` when hooks and senders must read current recorded
-recipient consent independently of the vendor process environment. Installation
-records the requested policy even when current activation is unavailable. An absent
-or invalid record means `off`; a previously published binding cannot override it.
+`nativeDelivery.policySource` accepts only `"installation-record"`, which is also the
+default. Hooks and senders read the current recorded recipient consent, independently of
+the vendor process environment. Installation records the requested policy even when
+current activation is unavailable. An absent or invalid record means `off`. A previously
+published binding cannot override it.
+
+`nativeDelivery.offerKind` says what an accepted offer puts in front of the model. It is
+`"message"` (the default) or `"wake"`:
+
+- `"message"` carries the body. The router records the receipt as `offered` with the
+  transport name and returns the outcome `offered`.
+- `"wake"` carries only a notice that makes the client run a turn. The router records no
+  offer and returns the outcome `woken`. The receipt stays `queued`. The next-turn hook
+  records `offered` via `next-turn` after its output carried the body. Use `"wake"` only
+  where the turn that the wake starts runs the client's next-turn hook, as Claude Code's
+  `UserPromptSubmit` does. When the client takes the wake but holds it for its user's
+  approval, return `pendingApproval: true` with the acceptance; the outcome carries it so
+  the sender is told the truth.
+
+A failed offer of either kind is recorded as a failed offer and leaves the receipt queued.
+
+`nativeDelivery.activationKinds` names the mechanisms the adapter may plan:
+`"native-config"` or `"native-service"`. A `native-service` mechanism with
+`preExisting: true` and no commands describes a service that the client itself runs, such
+as the Claude Code inbox. A `shell-bootstrap` mechanism can no longer be planned. Install
+records of one stay readable, so that `acc install` and `acc update` can retire it.
 
 The optional `refreshNativeSession()` method may revalidate an expired lease before
 an offer. It returns the same closed handshake shape as `bindNativeSession()` and
@@ -204,7 +226,7 @@ earlier failures without duplicating a certification tuple.
 
 Installed hook wiring may reach tier 2, but each effective hook capability still
 requires exact client/version/platform evidence. Tier 3 has separate native
-contracts: Claude Code Channel from 2.1.258 and Codex LocalDaemon from 0.152.1 on
+contracts: the Claude Code inbox wake from 2.1.282 and Codex LocalDaemon from 0.152.1 on
 macOS arm64, with current probes and exact session handshakes. Codex's earlier
 remote-wrapper failure remains historical evidence. Ordinary launch now preserves
 workspace identity; the full installed product matrix, including negative controls
@@ -220,9 +242,18 @@ return normalizedEvent({
   kind, sessionId, cwd, model, parentSessionId, tool,
   targets,   // paths this call would WRITE. For a shell call, pass the command to
              // shellWriteTargets() — it reads write positions only, never reads.
+  permissionMode, // the client's own name for the session's permission mode, or null
+  endReason,      // on sessionEnd, the client's own word for why, or null
 });
 ```
 
+`permissionMode` and `endReason` are optional and default to `null`. Pass `permissionMode`
+when the client's hook reports one: a native binding reads it to tell a sender whether the
+client will hold a wake for approval. Claude Code reports it on most hooks but not on
+`SessionStart`. Pass `endReason` on `sessionEnd` when the client says why, as Claude Code's
+`reason` does (`"clear"` after `/clear`). ACC keeps it in the closed session record's
+`extensions`, and a sender is told that the conversation was cleared.
+
 Refuse an unrecognised payload. Inventing a session attaches the wrong one, or a new one
 every hook, and looks like it is working.
 

package/docs/ARCHITECTURE.md

@@ -48,6 +48,11 @@ The order is part of the public guarantee:
 4. ask one adapter to cross its transport boundary;
 5. only after acceptance, commit `offered` and an immutable success event.
 
+An adapter whose contract declares `offerKind: "wake"` puts only a notice in front of the
+client, never the body. The router records no offer for an accepted wake and returns the
+outcome `woken`. The receipt stays `queued` until the recipient's next-turn hook output
+carried the body. That hook then commits `offered` via `next-turn`.
+
 A failed offer records the selected recipient session id and generation with a safe
 diagnostic code, then leaves the receipt queued. Core validates that target provenance and
 derives the event actor from it. A crash after bytes cross the boundary but before the
@@ -78,12 +83,16 @@ or projected into agent context; session restart replaces it and SessionEnd atte
 cleanup. Doctor ignores closed or superseded generations even if cleanup could not finish. Diagnostic disk I/O runs in an
 unreferenced worker, so a stalled write cannot hold the hook process open.
 
-Claude's MCP process can become ready after the bounded SessionStart handshake
-has ended. Once its endpoint listens, the Channel completes the same validated
-binding without a user prompt. It acquires the session lifecycle lock, recovers
-any committed journal, and rechecks its exact owner and current consent before
-publication. The optional diagnostic records `channelReady`; MCP remains responsive
-if registration fails. This does not create a session or revive a closed one.
+Claude Code's inbox binding runs inside ACC's own hooks, with no ACC process in the
+session. Each turn hook reads the session's inbox socket from `CLAUDE_CODE_MESSAGING_SOCKET`
+and verifies it against Claude Code's session registry `<config>/sessions/<pid>.json`. The
+pid and the socket must match; the session id is checked from the first offer on, because
+Claude Code rewrites the entry for a `/resume` only after SessionStart. The hook then writes
+a private endpoint record and publishes the binding with a 120-second lease. The router refreshes an expired
+lease with the same registry check, so an idle session stays reachable between turns. The
+adapter repeats the check before each offer. A registry that disappeared, or that names
+another session or socket, refuses the offer, so a wake never reaches a reused pid. This
+does not create a session or revive a closed one.
 
 ## Certified capability versus current reachability
 
@@ -96,14 +105,15 @@ a third certification check. A binding says what that current generation
 exposes and whether its lease is current, while recipient policy says whether it may spend a
 turn.
 
-Claude Code Channel has installed-client evidence on 2.1.258 and 2.1.260; Codex
-LocalDaemon has it on 0.152.1 and 0.153.4; Antigravity CLI has it on 1.2.7 and later through a relay
+The Claude Code inbox wake has installed-client evidence on 2.1.282. Codex LocalDaemon
+has it on 0.152.1 and 0.153.4. Antigravity CLI has it on 1.2.7 and later through a relay
 the agent starts in its own shell. All three use a captured platform minimum,
-current probe and exact session handshake. Codex preserves the ordinary client
-launch and verifies its registered thread and workspace; native delivery owns no vendor
-daemon lifecycle. Gemini CLI and Kimi Code have exact-version next-turn evidence only; Grok
-and generic MCP use inbox polling. Antigravity CLI additionally attaches
-a session only where the client reports an open workspace.
+current probe and exact session handshake. Claude Code and Codex preserve the ordinary
+client launch. Claude Code verifies its session registry, and Codex verifies its registered
+thread and workspace. Native delivery owns no vendor daemon lifecycle. Gemini CLI and Kimi
+Code have exact-version next-turn evidence only. Grok and generic MCP use inbox polling.
+Antigravity CLI additionally attaches a session only where the client reports an open
+workspace.
 
 ## Storage and workspace identity
 
@@ -181,6 +191,11 @@ Adapters project peer bodies in an attributed untrusted frame. If a complete bod
 fit, the projection keeps the message id and points to `acc inbox --message <id>` instead
 of silently truncating it.
 
+On a client that takes next-turn bodies, a live offer that is still `offered` 15 minutes later
+is projected once more before a turn,
+after the new bodies and marked as a repeat, and never by an end-of-turn continuation; see
+[the protocol contract](PROTOCOL.md#one-repeat-of-a-live-offer).
+
 For this participant's unresolved messages already `offered` or `retrieved`, the standard
 projector combines reply and acknowledgement reminders into a compact count after new
 message bodies. Queued obligations and claim conflicts remain individual attention items.

package/docs/CAPABILITIES.md

@@ -4,7 +4,8 @@ Use this page to set expectations after installation. Integration means ACC can
 peer awareness and coordination instructions; it does not guarantee what a model will do
 with them. Delivery also varies independently from awareness. The durable inbox works for
 every participant, a client at or after a captured version may add next-turn delivery, and the
-experimental Codex LocalDaemon and Claude Code Channel paths can deliver while a session is idle.
+experimental Codex LocalDaemon, Claude Code inbox wake and Antigravity CLI relay paths can
+deliver while a session is idle.
 
 Capability honesty separates four questions that are easy to collapse:
 
@@ -50,11 +51,12 @@ child sessions, startup or safe-point injection, and before-read guards.
 
 The native rows are `no` at the hook versions this matrix names.
 Separate installed-client captures establish Codex `livePush` on 0.152.1 and
-0.153.4, Claude Code `livePush` plus `replyRoute` on 2.1.258 and 2.1.260, and
+0.153.4, Claude Code `livePush` on 2.1.282 through the session inbox, and
 Antigravity CLI `livePush` on 1.2.7 and later through a relay the agent starts in its own shell.
 Native eligibility uses the captured platform minimum, a current feature probe,
 and an exact per-session handshake. It is experimental and requires recipient
-opt-in. Codex and Antigravity CLI reply through `acc reply`; their native `replyRoute` remains false.
+opt-in. Codex, Claude Code and Antigravity CLI reply through `acc reply`. Their native
+`replyRoute` remains false.
 
 The limitations belong next to the adapters they affect:
 
@@ -62,7 +64,7 @@ The limitations belong next to the adapters they affect:
 |---|---|
 | Antigravity CLI | 1.2.7 on darwin-arm64, captured in print mode, and every later release by the forward rule. Only `SessionStart`, `PreInvocation`, `PostInvocation` and `Stop` load; `SessionEnd`, `PreToolUse` and `PostToolUse` are accepted into the config file and silently dropped, so there is no tool guard and no session-end deregistration - a session goes offline by presence age or an explicit `acc finish`. Payloads carry no `hook_event_name`, so each registered command passes its own event name. The end-of-turn `Stop` continuation reaches the model and is a bounded nudge, not a gate: ACC continues a turn at most once and fails open, and the client caps consecutive continuations itself (vendor 1.1.9). `agy agentapi send-message` can wake an idle session - captured - but only with that session's language-server address and CSRF token, which exist in the agent's own shell and in no hook. ACC does not take that token, so live push and reply routing are false. A peer message that arrives while the model writes its last answer is carried by the `Stop` continuation instead. A write that parses can register nothing, so install and doctor read `agy -p "/hooks"` back instead of trusting the file. Live push (1.2.7, darwin-arm64, TUI only, experimental, recorded opt-in) runs through a relay the agent starts once per conversation from its own shell - the only process holding the session endpoint - after ACC's context asks it to, up to three times while none is serving; the operator approves that command at the client's permission prompt. An idle session wakes; a busy one sees the message after its running answer, or at the next model invocation when the turn waits on a tool. Print mode and the first session in a folder trusted at that launch get no relay. |
 | Codex | Next-turn context, captured on 0.147.0, requires plugin trust. The observed stock 0.153.4 upgrade from ACC 0.3.1 to 0.4 required fresh review of five modified hook definitions; a subsequent restart retained all five active (activation evidence, not new event certification). LocalDaemon native delivery was captured through the installed package on 0.152.1 and 0.153.4, darwin-arm64; minimum 0.152.1, recorded opt-in, current feature probe and exact thread/cwd/process/version/protocol checks are required. Ordinary launch preserves the receiver workspace without ACC arguments or daemon ownership. Embedded or unreachable sessions keep their inbox. Native `replyRoute` remains false. |
-| Claude Code | 2.1.233 next-turn delivery waits for the next user prompt. A 2.1.258 Channel capture proved idle offer, busy queue-after-turn, explicit reply, duplicate suppression, and durable fallback, so `delivery.livePush` and `delivery.replyRoute` are live capabilities behind the native contract (experimental, off until opted in; Claude's development-channel warning is vendor-owned and visible). |
+| Claude Code | 2.1.233 next-turn delivery waits for the next user prompt. From 2.1.282 on darwin-arm64, `delivery.livePush` is a live capability behind the native contract (experimental, off until opted in). ACC wakes the session through the inbox socket that Claude Code opens for every session, with one line of fixed ACC text and the message id. An idle session starts a turn. A busy session takes the wake between two tool calls. Each delivered wake fires `UserPromptSubmit`, so the next-turn hook shows the body and records the receipt `offered` via `next-turn`. The model answers with `acc reply`, so `delivery.replyRoute` stays false. A session in `bypassPermissions` mode holds each wake for approval unless `crossSessionInbound` is `accept`, and `refuse` drops wakes. Native Windows keeps next-turn delivery: its inbox is a named pipe that requires an auth line, and it is uncaptured. Linux is uncaptured. |
 | Gemini CLI | Package-shipped next-turn certification starts at 0.57.0. Its TUI has no captured external wake or queue interface and `--acp` changes launch ownership, so native delivery is fallback-only; live push and reply routing remain false. |
 | Grok | The Grok 1.0.24 installed-client check observed own CLI arguments after a terminal result, followed by owned work, message, and finish calls. This identity-only path does not certify peer-context injection. Documentation-shaped payloads do not count as real captures. The public leader surface exposed no proven addressed injection into an ordinary TUI session, so native delivery is `awaiting_compatibility_capture`; all capabilities remain false. |
 | Kimi Code | Next-turn and guard evidence was captured on 0.36.1, plus a 60-second heartbeat. Its server/queue APIs do not prove a transparent binding to an independently opened session, so native delivery is fallback-only. |
@@ -81,18 +83,19 @@ with a computed `reachable` boolean while keeping the opaque endpoint private.
 The router requires exactly one current eligible generation. No binding, several live
 sessions for one participant, and an adapter refusal keep delivery on the durable
 fallback. An expired lease may be revalidated by an adapter's optional refresh method;
-failure leaves the message queued. Busy behavior belongs to the transport: Claude's Channel can accept a
-message while the target is busy and queue it until the current turn finishes; an adapter
-that instead refuses with `recipient_busy` leaves the message on the durable path.
+failure leaves the message queued. Busy behavior belongs to the transport. Codex accepts a
+message while the target is busy and holds it until the current turn finishes. Claude Code
+takes a wake between two tool calls of the running turn. An adapter that instead refuses
+with `recipient_busy` leaves the message on the durable path.
 
 An endpoint may renew its lease, or an adapter may revalidate that exact endpoint on
 demand without a client heartbeat. Retirement is final: neither route may revive a
 retired binding, a closed session or an old generation. Delivery lease refresh does
 not renew participant presence.
 
-On darwin-arm64, Codex LocalDaemon and Claude Code Channel have captured
-experimental live delivery. Other adapters retain their separately certified
-next-turn paths or inbox polling. Linux and other uncaptured platforms retain
+On darwin-arm64, Codex LocalDaemon, the Claude Code inbox wake and the Antigravity CLI
+relay have captured experimental live delivery. Other adapters retain their separately
+certified next-turn paths or inbox polling. Linux and other uncaptured platforms retain
 the durable inbox; these captures establish no new hook capabilities there.
 
 Codex's 120-second delivery lease can refresh on demand for the same live endpoint;
@@ -115,13 +118,13 @@ policy:
 The default is `off`. `acc install --delivery actionable|all` records recipient consent.
 Current activation remains off when the platform, captured minimum or feature probe
 does not qualify; that temporary failure does not erase the requested policy. Each
-session must pass its own generation-bound handshake. An adapter using the installation
-record rereads consent at hooks and before offers, so a long-running vendor process
-cannot retain permission through an old environment value or binding snapshot.
+session must pass its own generation-bound handshake. Every adapter reads consent from the
+installation record and rereads it at hooks and before offers, so a long-running vendor
+process cannot retain permission through an old binding snapshot.
 
-For an adapter using recorded consent, `--delivery off` and uninstall prevent new
-native offers. They cannot withdraw a submission already accepted by the vendor queue. Ordinary hook capabilities still
-require exact-version certification. Room messages are never live-push candidates.
+`--delivery off` and uninstall prevent new native offers. They cannot withdraw a submission
+already accepted by the vendor queue. Ordinary hook capabilities still require exact-version
+certification. Room messages are never live-push candidates.
 
 ## Fallback