agents-can-communicate 0.7.1 → 0.8.1

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/delivery/claude-code-2.1.282-product-evidence.json

@@ -0,0 +1,161 @@
+{
+  "schemaVersion": 1,
+  "source": "real-client-capture",
+  "client": "claude-code",
+  "phase": "product",
+  "clientVersion": "2.1.282",
+  "platform": "darwin-arm64",
+  "packageSha256": "fa81c55588988ed7274636c564a0adb5c442110f014f82e7a3f94da26fdd8891",
+  "startedAt": "2026-09-25T21:31:56.000Z",
+  "finishedAt": "2026-09-25T21:35:56.792Z",
+  "scenarioCount": 6,
+  "passedCount": 6,
+  "failedCount": 0,
+  "cleanup": {
+    "attempted": true,
+    "outcome": "passed",
+    "ownedProcesses": "stopped",
+    "temporaryState": "removed"
+  },
+  "scenarios": [
+    {
+      "caseId": "C01",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:31:56.000Z",
+      "finishedAt": "2026-09-25T21:32:44.339Z",
+      "messageId": "message_EaLKeCerBFIR_o0gQpT4vQ",
+      "observations": [
+        {
+          "kind": "delivery",
+          "at": "2026-09-25T21:32:44.339Z",
+          "outcome": "woken"
+        },
+        {
+          "kind": "wake",
+          "at": "2026-09-25T21:31:56.373Z",
+          "outcome": "started-turn"
+        },
+        {
+          "kind": "projection",
+          "at": "2026-09-25T21:31:56.808Z",
+          "outcome": "body-shown"
+        },
+        {
+          "kind": "offer",
+          "at": "2026-09-25T21:31:56.724Z",
+          "outcome": "next-turn"
+        }
+      ]
+    },
+    {
+      "caseId": "C02",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:33:05.000Z",
+      "finishedAt": "2026-09-25T21:34:19.560Z",
+      "messageId": "message_YFDLjj4jtNLDsC67GV9Y1g",
+      "observations": [
+        {
+          "kind": "delivery",
+          "at": "2026-09-25T21:34:19.560Z",
+          "outcome": "woken"
+        },
+        {
+          "kind": "wake",
+          "at": "2026-09-25T21:33:05.316Z",
+          "outcome": "between-tool-calls"
+        },
+        {
+          "kind": "projection",
+          "at": "2026-09-25T21:33:17.285Z",
+          "outcome": "body-shown"
+        },
+        {
+          "kind": "offer",
+          "at": "2026-09-25T21:33:17.207Z",
+          "outcome": "next-turn"
+        }
+      ]
+    },
+    {
+      "caseId": "C03",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:31:56.000Z",
+      "finishedAt": "2026-09-25T21:32:44.370Z",
+      "messageId": "message_EaLKeCerBFIR_o0gQpT4vQ",
+      "observations": [
+        {
+          "kind": "answer",
+          "at": "2026-09-25T21:32:16.968Z",
+          "outcome": "recorded"
+        },
+        {
+          "kind": "receipt",
+          "at": "2026-09-25T21:32:16.968Z",
+          "outcome": "acknowledged"
+        }
+      ]
+    },
+    {
+      "caseId": "C04",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:34:28.000Z",
+      "finishedAt": "2026-09-25T21:34:56.510Z",
+      "messageId": "message_zzo8wi26wFyq8hfGvAsWIw",
+      "observations": [
+        {
+          "kind": "logical-message",
+          "at": "2026-09-25T21:34:56.510Z",
+          "outcome": "same-message-id"
+        },
+        {
+          "kind": "wake",
+          "at": "2026-09-25T21:34:28.385Z",
+          "outcome": "delivered-once"
+        }
+      ]
+    },
+    {
+      "caseId": "C05",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:35:44.000Z",
+      "finishedAt": "2026-09-25T21:35:56.792Z",
+      "messageId": "message_owEZDIuuC0KygynZk-b0Hg",
+      "observations": [
+        {
+          "kind": "delivery",
+          "at": "2026-09-25T21:35:56.792Z",
+          "outcome": "queued"
+        },
+        {
+          "kind": "client",
+          "outcome": "exited",
+          "at": "2026-09-25T21:35:47.000Z"
+        }
+      ]
+    },
+    {
+      "caseId": "C06",
+      "outcome": "passed",
+      "startedAt": "2026-09-25T21:35:05.000Z",
+      "finishedAt": "2026-09-25T21:35:34.783Z",
+      "messageId": "message_tDm0K7jQWFVKmVhs_t_29Q",
+      "observations": [
+        {
+          "kind": "delivery",
+          "at": "2026-09-25T21:35:34.783Z",
+          "outcome": "woken"
+        },
+        {
+          "kind": "wake",
+          "at": "2026-09-25T21:35:05.754Z",
+          "outcome": "started-turn"
+        },
+        {
+          "kind": "other-session",
+          "at": "2026-09-25T21:35:34.783Z",
+          "outcome": "not-woken"
+        }
+      ]
+    }
+  ]
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/delivery/claude-code-2.1.282.json

@@ -0,0 +1,28 @@
+{
+  "client": "claude-code",
+  "version": "2.1.282",
+  "platform": "darwin-arm64",
+  "observedAt": "2026-09-25T21:35:56.792Z",
+  "capability": "native_delivery",
+  "result": "pass",
+  "fixture": "claude-code-2.1.282",
+  "launchMode": "ordinary-command-with-installed-hooks",
+  "protocolContract": "claude-code-inbox-socket-v1",
+  "idle": "offered",
+  "busy": "presented_between_tool_calls",
+  "reply": "routed",
+  "duplicate": "same_message_id",
+  "fallback": "queued",
+  "limitations": [
+    "Observed on darwin-arm64 with Claude Code 2.1.282 in the TUI, model Sonnet 5, auto permission mode, through a private candidate built from this branch and installed with an isolated ACC data home; the plugin registration in the real Claude config directory was restored byte for byte afterwards.",
+    "Every wake carried ACC wording and the message id only. The body reached the model through the UserPromptSubmit projection that each delivered wake fired, inside the untrusted acc-peer-message block.",
+    "An idle session started a turn with no user input. A wake sent while a Bash tool call ran was taken after that call returned and before the next one, and the turn continued.",
+    "The observed reply loop uses the installed acc reply CLI; native delivery.replyRoute remains false. The router reports a wake as outcome woken via claude-inbox and leaves the receipt queued until the hook's output carried the body, which records it offered via next-turn.",
+    "A repeated logical send kept its message id, took the durable path because the receipt was already acknowledged, and produced exactly one wake.",
+    "Two sessions in one workspace each bound their own inbox; a message addressed to one never woke the other.",
+    "An exited session left no registry entry; the next message stayed queued as recipient_unavailable.",
+    "A receiving session in bypassPermissions mode was not captured; Claude Code documents that such a session holds each wake whose sender does not attest bypass, and ACC never attests a mode.",
+    "Linux and native Windows remain uncaptured."
+  ],
+  "packageSha256": "fa81c55588988ed7274636c564a0adb5c442110f014f82e7a3f94da26fdd8891"
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/fixtures/inbox-wake-2.1.282.json

@@ -0,0 +1,44 @@
+{
+  "note": "Transport capture of the Claude Code session inbox, run on Claude Code 2.1.282, macOS arm64, 2026-09-25, before any ACC code used it. A receiving interactive TUI session ran from the real executable in auto mode with ACC 0.7.0 hooks installed and no Channel. A separate process, not a child of the receiver, wrote one JSON line per connection to the socket the session registry named, with no auth line and no token. Session ids, paths, pids and message text are redacted; outcomes are read from the receiver's own transcript records and ACC's store events.",
+  "clientVersion": "2.1.282",
+  "platform": "darwin-arm64",
+  "observedAt": "2026-09-25T19:40:41.000Z",
+  "registry": {
+    "file": "<config>/sessions/<pid>.json",
+    "fieldsRead": ["pid", "sessionId", "messagingSocketPath"],
+    "sessionIdEqualsHookSessionId": true,
+    "statusValuesSeen": ["idle", "busy", "waiting"]
+  },
+  "frame": {
+    "shape": { "type": "user", "message": { "role": "user", "content": "<text>" }, "msg_id": "<id>" },
+    "authLine": "absent",
+    "socketAnswer": "none"
+  },
+  "idle": {
+    "result": "new turn started without user input",
+    "transcriptRecord": "user, isMeta, origin.kind peer, verifiedPeerPid set",
+    "userPromptSubmitFired": true
+  },
+  "busy": {
+    "result": "queued while a Bash tool call ran; delivered after its tool_result, before the next tool call; the turn continued",
+    "transcriptRecord": "attachment queued_command, origin.kind peer",
+    "userPromptSubmitFired": true
+  },
+  "accWake": {
+    "frameCarried": "ACC wording and the message id only",
+    "idle": "the beforeTurn projection showed the queued ACC question in its untrusted block; the model answered with acc reply; the store recorded the answer and acknowledged",
+    "midTurn": "the same projection arrived with the UserPromptSubmit that the mid-turn frame fired; the model answered after its running commands",
+    "offerRecordedAs": "next-turn"
+  },
+  "inbound": {
+    "promptingReceiverUnattestedSender": "delivered",
+    "promptingReceiverSenderAttestsBypass": "held with an approval dialog; registry status waiting; deny dropped it",
+    "bypassReceiver": "unobserved"
+  },
+  "burst": {
+    "framesFromSeparateProcesses": 6,
+    "delivered": 6,
+    "queuedFramesDeliveredInOneTurn": 5,
+    "userPromptSubmitPerFrame": true
+  }
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.7.1",
+  "version": "0.8.1",
   "private": true,
   "type": "module",
   "exports": {
     ".": "./src/adapter.mjs",
-    "./channel": "./src/channel.mjs"
+    "./inbox-delivery": "./src/inbox-delivery.mjs"
   },
   "files": [
     "certification.json",
@@ -18,6 +18,9 @@
     "fixtures/delivery/claude-code-2.1.252.json",
     "fixtures/delivery/claude-code-2.1.258.json",
     "fixtures/delivery/claude-code-2.1.260.json",
+    "fixtures/delivery/claude-code-2.1.282.json",
+    "fixtures/delivery/claude-code-2.1.282-product-evidence.json",
+    "fixtures/inbox-wake-2.1.282.json",
     "src/",
     "plugin/"
   ]

package/node_modules/@agents-can-communicate/adapter-claude-code/src/adapter.mjs

@@ -2,18 +2,15 @@ import { defineAdapter, projectContext, projectContextResult }
   from "@agents-can-communicate/adapter-sdk";
 import certification from "../certification.json" with { type: "json" };
 
-import { PROTOCOL_CONTRACT } from "./channel.mjs";
 import { denyOutcome, injectOutcome, injectStartOwnerOutcome, normalizeClaudeHook } from "./hooks.mjs";
+import { MIN_VERSION, PROTOCOL_CONTRACT, bindNativeSession, offerMessage, planNativeActivation,
+  probeNativeDelivery, refreshNativeSession, retireNativeSession } from "./inbox-delivery.mjs";
 import { planClaudeInstall, detectClaude, installClaudePlugin, uninstallClaudePlugin } from "./install.mjs";
-import { bindNativeSession, offerMessage, planNativeActivation, probeNativeDelivery, routeReply }
-  from "./native-delivery.mjs";
 
 export const CLAUDE_CODE_VERSION = "2.1.233";
-export const CLAUDE_CHANNEL_MINIMUM = "2.1.258";
 export const CLAUDE_DELIVERY_FALLBACK = Object.freeze({
-  diagnostic: "Claude Code native delivery requires client-side Channels activation; "
-    + "a successful bootstrap or connected ACC MCP server does not prove inbound delivery "
-    + "is enabled. Messages remain durable for certified next-turn delivery or acc inbox",
+  diagnostic: `Claude Code live delivery wakes a session through its inbox socket from ${MIN_VERSION}; `
+    + "fallback: next-turn hooks or acc inbox",
 });
 
 /**
@@ -25,7 +22,9 @@ export const CLAUDE_DELIVERY_FALLBACK = Object.freeze({
  * and a parent/child mapping claimed without observation is the kind of thing
  * that quietly maps every child onto its parent. `startupInjection` and
  * `safePointInjection` were not exercised - only the before-turn path was.
- * Native live delivery and reply routing are not certified for this harness.
+ * Native live delivery is the inbox wake, certified from 2.1.282 (captured on
+ * darwin-arm64, applied on every platform the probe admits); reply routing
+ * through the transport is not claimed.
  */
 export function createClaudeCodeAdapter() {
   return defineAdapter({
@@ -44,28 +43,22 @@ export function createClaudeCodeAdapter() {
       context: { beforeTurnInjection: true },
       // PreToolUse denied both a Write and a Bash call; neither ran.
       guards: { beforeWrite: true, beforeShell: true },
-      // nextTurn is the certified 2.1.233 hook projection; livePush and
-      // replyRoute rest on the 2.1.258 Channel capture and the native contract
-      // below. effectiveCapabilities() carries each of those captures forward
-      // to later clients; the native contract is the separate live rule.
-      delivery: { nextTurn: true, livePush: true, replyRoute: true },
+      // nextTurn is the certified 2.1.233 hook projection. livePush rests on
+      // the 2.1.282 product capture of the inbox wake; the reply is the
+      // ordinary `acc reply` every adapter has, so replyRoute stays false.
+      delivery: { nextTurn: true, livePush: true },
     },
-    // The first passing capture is the shipped minimum; the research lower
-    // bound (2.1.80) is documented but not admitted without its own capture.
-    //
-    // The 2.1.260 release capture is passing evidence beside this, deliberately
-    // not a second anchor: an anchor is the minimum's proof, one per platform,
-    // and this contract has no maximum precisely so a newer stable client is
-    // admitted by probe and a generation-bound handshake instead of by another
-    // anchor. That capture is what exercised the rule - every branch observed
-    // on 2.1.260 while the minimum stayed here. Two minor versions of drift,
-    // served without a capture at either of them, is the rule working.
+
+    // The first passing capture is the minimum, and there is no maximum: a
+    // newer stable client is admitted by the probe and the per-session
+    // handshake. The offer is a wake; see src/inbox-delivery.mjs.
     nativeDelivery: {
-      minimumByPlatform: { "darwin-arm64": CLAUDE_CHANNEL_MINIMUM },
-      anchors: [{ platform: "darwin-arm64", version: CLAUDE_CHANNEL_MINIMUM,
-        protocolContract: PROTOCOL_CONTRACT }],
+      minimum: MIN_VERSION,
+      anchors: [{ version: MIN_VERSION, protocolContract: PROTOCOL_CONTRACT }],
       knownBad: [],
-      activationKinds: ["shell-bootstrap", "native-config"],
+      activationKinds: ["native-service"],
+      policySource: "installation-record",
+      offerKind: "wake",
     },
 
     startSession: async () => ({ ok: true, changes: [], diagnostics: [] }),
@@ -75,8 +68,7 @@ export function createClaudeCodeAdapter() {
 
     planInstall: context => planClaudeInstall(context),
     detect: context => detectClaude(context),
-    install: context => installClaudePlugin({ ...context,
-      livePolicy: context.livePolicy ?? "off" }),
+    install: context => installClaudePlugin(context),
     uninstall: context => uninstallClaudePlugin(context),
 
     doctor: async context => {
@@ -85,6 +77,9 @@ export function createClaudeCodeAdapter() {
         ...detected.diagnostics,
         "hook payloads captured from Claude Code 2.1.233",
         CLAUDE_DELIVERY_FALLBACK.diagnostic,
+        // Claude Code's own inbound control decides whether a wake reaches the
+        // model; ACC never attests a permission mode. Said only when it matters.
+        ...(detected.inboundDelivery.diagnostic === null ? [] : [detected.inboundDelivery.diagnostic]),
         // SessionEnd is advisory and cannot summarise a conversation that has
         // already stopped, so the handoff is written from Stop or the skill.
         "handoff is written while the model is active, not at SessionEnd",
@@ -94,8 +89,9 @@ export function createClaudeCodeAdapter() {
     probeNativeDelivery,
     planNativeActivation,
     bindNativeSession,
+    refreshNativeSession,
+    retireNativeSession,
     offerMessage,
-    routeReply,
 
     denyOutcome,
     injectOutcome,

package/node_modules/@agents-can-communicate/adapter-claude-code/src/hooks.mjs

@@ -50,6 +50,12 @@ export function normalizeClaudeHook(payload) {
     parentSessionId: typeof payload.agent_id === "string" ? payload.session_id : null,
     tool,
     targets: writeTargets(tool, payload.tool_input),
+    // Documented as conditional; SessionStart carried none on 2.1.233.
+    permissionMode: typeof payload.permission_mode === "string" && payload.permission_mode !== ""
+      ? payload.permission_mode : null,
+    // SessionEnd says why: "clear", "logout", "prompt_input_exit", "other".
+    endReason: event === "SessionEnd" && typeof payload.reason === "string" && payload.reason !== ""
+      ? payload.reason : null,
   });
 }
 

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-contract.mjs

@@ -0,0 +1,10 @@
+// The facts of the inbox transport every module of it shares, kept apart so
+// the endpoint record and the delivery methods import them without a cycle.
+
+export const PROTOCOL_CONTRACT = "claude-code-inbox-socket-v1";
+// The first release the inbox wake was captured on. 2.1.224 binds the socket,
+// but only 2.1.282 was observed firing UserPromptSubmit for a delivered frame,
+// and that is what brings the message body in with the wake.
+export const MIN_VERSION = "2.1.282";
+export const INBOX_MODES = Object.freeze(["livePush", "idleWake", "busyQueue"]);
+export const TRANSPORT = "claude-inbox";

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-delivery.mjs

@@ -0,0 +1,249 @@
+import net from "node:net";
+import { compareVersionOrder, versionOrder } from "@agents-can-communicate/adapter-sdk";
+
+import { INBOX_MODES, MIN_VERSION, PROTOCOL_CONTRACT, TRANSPORT } from "./inbox-contract.mjs";
+import { claimWake, newEndpointId, readInboxEndpoint, releaseWake, removeInboxEndpoint,
+  sweepDeadEndpoints, writeInboxEndpoint } from "./inbox-endpoint.mjs";
+import { claudeConfigDir, readSessionRecord, verifyInbox } from "./inbox-registry.mjs";
+import { MANAGED_SETTINGS, permissionModeFromArgs, readInboundSettings, readProcessArgs, receptionOf }
+  from "./inbox-settings.mjs";
+
+// Live delivery into a Claude Code session through the inbox socket the
+// session itself binds (2.1.224 and later, no flag, every provider).
+//
+// The offer is a wake, never the message. Measured on 2.1.282: every frame a
+// session accepts on its inbox fires UserPromptSubmit, idle or between two tool
+// calls, and ACC's beforeTurn hook then projects the queued message inside its
+// untrusted block, with receipts and the `acc reply` route. So the frame
+// carries fixed ACC wording and the ACC message id, and no byte a peer wrote:
+// Claude Code frames every inbox message as a teammate's request to act on,
+// and the only thing a wake gives it to act on is ACC's own notice.
+//
+// The connection sends no auth line, and this module never reads the
+// session's messaging token or key file. A frame carrying that token would
+// pass as the session's own child and skip the inbound controls its user set.
+
+const LEASE_MS = 120_000;
+const MESSAGE_ID = /^[A-Za-z0-9_-]{1,200}$/;
+const PROBE_NEEDLE = Buffer.from("messagingSocketPath");
+const PROBE_MAX_BYTES = 256 * 1024 * 1024;
+
+export { INBOX_MODES, MIN_VERSION, PROTOCOL_CONTRACT, TRANSPORT };
+
+// Claude Code shows the wake as a message from another Claude session, so the
+// text names the ACC route: a model otherwise tries SendMessage first.
+export const wakeText = messageId => `ACC: new peer message ${messageId} for this session. `
+  + "This turn's ACC context shows it. If it does not, it was already shown, or read it with "
+  + `acc inbox --message ${messageId}. Answer it through ACC with acc reply --message ${messageId}; `
+  + "SendMessage cannot deliver to an ACC participant.";
+
+// A version is judged by its release triple: a prerelease of a version above
+// the minimum is not an older client, and the inbox in the executable is what
+// admits it. An unreadable version orders as null.
+const belowMinimum = clientVersion => compareVersionOrder(versionOrder(clientVersion),
+  versionOrder(MIN_VERSION)) < 0;
+
+// The registry field only a build with the inbox writes. Read-only, bounded.
+async function executableHasInbox(realExecutable) {
+  let handle;
+  try {
+    handle = await (await import("node:fs/promises")).open(realExecutable, "r");
+  } catch {
+    return false;
+  }
+  try {
+    const chunk = Buffer.alloc(1024 * 1024);
+    let carry = Buffer.alloc(0);
+    let position = 0;
+    for (;;) {
+      const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+      if (bytesRead === 0) return false;
+      const window = Buffer.concat([carry, chunk.subarray(0, bytesRead)]);
+      if (window.includes(PROBE_NEEDLE)) return true;
+      carry = window.subarray(Math.max(0, window.length - PROBE_NEEDLE.length));
+      position += bytesRead;
+      if (position >= PROBE_MAX_BYTES) return false;
+    }
+  } finally {
+    await handle.close().catch(() => null);
+  }
+}
+
+function defaultReadVersion(realExecutable, timeoutMs) {
+  return new Promise(resolve => {
+    import("node:child_process").then(({ execFile }) => {
+      execFile(realExecutable, ["--version"], { timeout: timeoutMs, windowsHide: true },
+        (error, stdout, stderr) => {
+          if (error !== null) return resolve(null);
+          resolve(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/.exec(`${stdout}${stderr}`)?.[1] ?? null);
+        });
+    });
+  });
+}
+
+function withTimeout(work, ms) {
+  let timer = null;
+  const deadline = new Promise((_resolve, reject) => {
+    timer = setTimeout(() => reject(Object.assign(new Error("native probe timed out"),
+      { code: "ETIMEDOUT" })), ms);
+  });
+  return Promise.race([work, deadline]).finally(() => clearTimeout(timer));
+}
+
+/**
+ * Read-only: a version at or above the capture, a platform whose inbox is a
+ * Unix socket, and an executable that writes the inbox into its session
+ * registry. Never launches a session. Native Windows serves a named pipe that
+ * demands an auth line; nothing there is captured, so it keeps hook delivery.
+ */
+export async function probeNativeDelivery({ realExecutable, timeoutMs = 750, platform = process.platform,
+  hasInbox = executableHasInbox, readVersion = defaultReadVersion } = {}) {
+  const unsupported = (reasonCode, clientVersion = null) => ({ supported: false, clientVersion,
+    protocolContract: PROTOCOL_CONTRACT, executableFingerprint: null, modes: [], reasonCode });
+  if (platform === "win32") return unsupported("native_delivery_unsupported");
+  if (typeof realExecutable !== "string" || realExecutable === "") return unsupported("feature_probe_failed");
+  const clientVersion = await withTimeout(Promise.resolve(readVersion(realExecutable, timeoutMs)), timeoutMs)
+    .catch(() => null);
+  if (versionOrder(clientVersion) === null) return unsupported("feature_probe_failed", clientVersion);
+  if (belowMinimum(clientVersion)) return unsupported("below_minimum_version", clientVersion);
+  const present = await withTimeout(Promise.resolve(hasInbox(realExecutable)), timeoutMs).catch(() => false);
+  if (!present) return unsupported("protocol_mismatch", clientVersion);
+  return { supported: true, clientVersion, protocolContract: PROTOCOL_CONTRACT,
+    executableFingerprint: null, modes: [...INBOX_MODES], reasonCode: null };
+}
+
+// Claude Code runs the inbox itself. ACC starts nothing and rewrites no argument.
+export function planNativeActivation({ detection }) {
+  if (typeof detection?.realExecutable !== "string" || detection.realExecutable === "") {
+    return { eligible: false, reasonCode: "feature_probe_failed", mechanisms: [] };
+  }
+  return { eligible: true, reasonCode: null, mechanisms: [{ kind: "native-service",
+    serviceId: "claude-code-inbox", preExisting: true, applyCommand: null, teardownCommand: null }] };
+}
+
+const closed = (clientVersion, reasonCode) => ({ supported: false, clientVersion: clientVersion ?? null,
+  protocolContract: PROTOCOL_CONTRACT, modes: [], opaqueEndpointRef: null, leaseUntil: null, reasonCode });
+const handshake = (endpoint, now) => ({ supported: true, clientVersion: endpoint.clientVersion,
+  protocolContract: PROTOCOL_CONTRACT, modes: [...INBOX_MODES], opaqueEndpointRef: endpoint.endpointId,
+  leaseUntil: new Date(now() + LEASE_MS).toISOString(), reasonCode: null });
+
+/**
+ * Bind this ACC session to the inbox of the Claude process whose hook is
+ * running. The socket comes from the hook's own environment, which Claude Code
+ * exports per session and never inherits from a parent; the registry must
+ * name this process and this socket before anything is published. The session
+ * id is checked by every offer and refresh, since after /resume the registry
+ * catches up only once the hook has run.
+ */
+export async function bindNativeSession({ event, clientPid, clientVersion, runtimeDir,
+  env = process.env, now = Date.now, managedSettingsPath = MANAGED_SETTINGS[process.platform],
+  readClientArgs = readProcessArgs } = {}) {
+  if (!Number.isInteger(clientPid) || clientPid <= 0) return closed(clientVersion, "client_process_unknown");
+  if (typeof event?.sessionId !== "string" || event.sessionId === "") {
+    return closed(clientVersion, "handshake_failed");
+  }
+  if (versionOrder(clientVersion) === null) return closed(clientVersion, "version_unavailable");
+  // The contract refuses it anyway, after this returns. Refusing here keeps an
+  // older client - which binds again on every turn - from writing an endpoint
+  // record each time.
+  if (belowMinimum(clientVersion)) return closed(clientVersion, "below_minimum_version");
+  const socketPath = env?.CLAUDE_CODE_MESSAGING_SOCKET;
+  if (typeof socketPath !== "string" || socketPath === "") {
+    return closed(clientVersion, "native_endpoint_unavailable");
+  }
+  await sweepDeadEndpoints({ runtimeDir });
+  const configDir = claudeConfigDir(env);
+  const refused = await verifyInbox({ configDir, clientPid, sessionId: event.sessionId, socketPath,
+    anyConversation: true });
+  if (refused !== null) return closed(clientVersion, refused);
+  // Project settings sit where the session was started, which the registry
+  // records; the hook's cwd follows the shell.
+  const record = await readSessionRecord({ configDir, clientPid });
+  const settings = await readInboundSettings({ configDir, projectDir: record?.cwd ?? event.cwd,
+    managedSettingsPath });
+  // The hook's mode is current. SessionStart carries none, so until the first
+  // prompt the launch flag stands in, then the configured default.
+  const launchMode = event.permissionMode == null
+    ? permissionModeFromArgs(await readClientArgs(clientPid).catch(() => null)) : null;
+  const reception = receptionOf({
+    permissionMode: event.permissionMode ?? launchMode ?? settings.defaultMode,
+    crossSessionInbound: settings.crossSessionInbound });
+  const endpoint = { schemaVersion: 1, endpointId: newEndpointId(), socketPath, configDir, clientPid,
+    sessionId: event.sessionId, clientVersion, protocolContract: PROTOCOL_CONTRACT,
+    leaseUntil: new Date(now() + LEASE_MS).toISOString(), reception };
+  try {
+    await writeInboxEndpoint({ runtimeDir, record: endpoint });
+  } catch {
+    return closed(clientVersion, "handshake_failed");
+  }
+  return handshake(endpoint, now);
+}
+
+async function verifiedEndpoint(binding, runtimeDir) {
+  const endpoint = await readInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef });
+  if (endpoint === null) return null;
+  const refused = await verifyInbox({ configDir: endpoint.configDir, clientPid: endpoint.clientPid,
+    sessionId: endpoint.sessionId, socketPath: endpoint.socketPath });
+  return refused === null ? endpoint : null;
+}
+
+// The router calls this when a lease ran out, so a session that sits idle
+// between turns stays reachable. The id never changes on a refresh.
+export async function refreshNativeSession({ binding, runtimeDir, now = Date.now } = {}) {
+  const endpoint = await verifiedEndpoint(binding, runtimeDir);
+  return endpoint === null ? closed(binding?.clientVersion, "handshake_failed") : handshake(endpoint, now);
+}
+
+export const retireNativeSession = ({ binding, runtimeDir }) =>
+  removeInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef });
+
+/**
+ * Sender side: re-verify the receiver, then write one wake line. The socket
+ * answers nothing, so acceptance is a line written to a verified inbox without
+ * an error inside the timeout. What the model then sees is recorded by the
+ * receiver's own hook.
+ */
+export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 2_000,
+  connect = net.createConnection } = {}) {
+  const rejected = safeErrorCode => ({ accepted: false, transport: TRANSPORT,
+    clientVersion: binding?.clientVersion ?? null, safeErrorCode });
+  if (typeof message?.messageId !== "string" || !MESSAGE_ID.test(message.messageId)) {
+    return rejected("transport_rejected");
+  }
+  const endpoint = await verifiedEndpoint(binding, runtimeDir);
+  if (endpoint === null) return rejected("recipient_unavailable");
+  // The receiver's own crossSessionInbound refuses unattested wakes; one would
+  // be dropped, so none is sent and the message waits for its next turn.
+  if (endpoint.reception === "refused") return rejected("delivery_disabled");
+  const accepted = { accepted: true, transport: TRANSPORT, clientVersion: endpoint.clientVersion,
+    ...(endpoint.reception === "held" ? { pendingApproval: true } : {}) };
+  const wake = { runtimeDir, endpointId: endpoint.endpointId, messageId: message.messageId };
+  // Claude Code delivers a repeated msg_id again, so the dedupe is ours.
+  let first;
+  try {
+    first = await claimWake(wake);
+  } catch {
+    return rejected("transport_error");
+  }
+  if (!first) return accepted;
+  const frame = `${JSON.stringify({ type: "user",
+    message: { role: "user", content: wakeText(message.messageId) },
+    msg_id: `acc-wake-${message.messageId}` })}\n`;
+  const result = await new Promise(resolve => {
+    const socket = connect(endpoint.socketPath);
+    let settled = false;
+    const finish = value => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve(value);
+    };
+    const timer = setTimeout(() => finish(rejected("transport_error")), timeoutMs);
+    socket.once("error", error => finish(rejected(["EPERM", "EACCES"].includes(error?.code)
+      ? "transport_permission_denied" : "recipient_unavailable")));
+    socket.once("connect", () => socket.end(frame, () => finish(accepted)));
+  });
+  if (!result.accepted) await releaseWake(wake);
+  return result;
+}