agents-can-communicate 0.8.0 → 0.8.2

package/docs/UPGRADING.md

@@ -1,5 +1,33 @@
 # Upgrading to 0.5.0
 
+## From 0.8.x
+
+Update as usual:
+
+```bash
+acc update
+acc version
+acc doctor
+```
+
+The update refreshes every installed integration with its recorded policy. Two of them change
+a client's own settings:
+
+- **Codex.** ACC's permission profile in `~/.codex/config.toml` also allows the Claude Code
+  inbox socket directories, so a Codex session can wake a Claude Code session live. Grants are
+  written in their resolved form, such as `/private/tmp/cc-socks` on macOS. A profile you
+  edited stays yours: doctor then names the missing grants and `acc install --adapter codex`.
+  Start a new Codex session after the update; a session already open keeps its old policy.
+- **Antigravity CLI.** The install adds `command(<wrapper>)` to `permissions.allow` in
+  `~/.gemini/antigravity-cli/settings.json`, and the skill calls the wrapper without quotes, so
+  a woken session runs its ACC commands without an approval prompt. Restart `agy`: it reads
+  the file only at startup. `acc uninstall` removes every copy of that rule.
+
+`acc doctor` and `acc status` describe an idle session by what a message sent to it meets
+(`idle, wake on send`, `idle until next turn`, `idle, inbox only`), and each status row carries
+`processTracked`, `liveDelivery` and `liveLeaseCurrent`. This release adds no store event type
+or field, so a store it writes stays readable by 0.8.x.
+
 ## From 0.7.x
 
 Claude Code live delivery wakes each session through the inbox socket that Claude Code opens
@@ -165,7 +193,7 @@ keeps holding activation across an uninstall until it exits.
 
 ## Confirmed client service maintenance
 
-On macOS arm64, `acc update` can ask once to restart a verified Codex service that holds a
+`acc update` can ask once to restart a verified Codex service that holds a
 native binding blocking activation, or that is serving a version outside the captured
 native-delivery contract. A serving version that satisfies that contract is left alone,
 even when the installed CLI has moved to a newer build. The captured maintenance contract

package/node_modules/@agents-can-communicate/adapter-antigravity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-antigravity",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-antigravity/plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "acc",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Coordinate this Antigravity CLI session with other AI agent sessions working in the same workspace."
 }

package/node_modules/@agents-can-communicate/adapter-antigravity/plugin/skills/acc/SKILL.md

@@ -41,6 +41,13 @@ work. An MCP connection can have a different participant from the hook session;
 use inbox/reply only for the participant the message addresses. Do not borrow a
 peer's ID, read runtime bindings, or improvise credentials.
 
+### Run each command as written
+
+Start every ACC command with `{{ACC}}` exactly as this skill writes it: add no
+quotes around it and no `sh -c` wrapper. Antigravity CLI decides from a command's
+first word whether it needs approval, and the rule that lets ACC commands run
+without a prompt matches only that form.
+
 ## Start shared work once
 
 After understanding the request, publish one concise intent:

package/node_modules/@agents-can-communicate/adapter-antigravity/src/adapter.mjs

@@ -1,4 +1,4 @@
-import { defineAdapter, projectContext, projectContextResult }
+import { channelSocketDirectory, defineAdapter, projectContext, projectContextResult }
   from "@agents-can-communicate/adapter-sdk";
 import certification from "../certification.json" with { type: "json" };
 
@@ -76,13 +76,14 @@ export function createAntigravityAdapter() {
     // no retireNativeSession here: the hook runner retires and re-publishes the
     // binding on every turn, and must not take the relay with it.
     nativeDelivery: {
-      minimumByPlatform: { "darwin-arm64": ANTIGRAVITY_CLI_VERSION },
-      anchors: [{ platform: "darwin-arm64", version: ANTIGRAVITY_CLI_VERSION,
-        protocolContract: PROTOCOL_CONTRACT }],
+      minimum: ANTIGRAVITY_CLI_VERSION,
+      anchors: [{ version: ANTIGRAVITY_CLI_VERSION, protocolContract: PROTOCOL_CONTRACT }],
       knownBad: [], activationKinds: ["native-config"], policySource: "installation-record",
     },
     probeNativeDelivery, planNativeActivation, bindNativeSession, refreshNativeSession,
     offerMessage,
+    // The relay binds in ACC's own channel directory; a sandboxed sender is allowed it.
+    inboundSockets: () => [channelSocketDirectory()],
     deliveryFallback: { diagnostic:
       `Antigravity CLI next-turn and live delivery are certified from ${ANTIGRAVITY_CLI_VERSION} `
       + "onward; live delivery also needs the agent to start ACC's relay once per conversation, "

package/node_modules/@agents-can-communicate/adapter-antigravity/src/allow-rule.mjs

@@ -0,0 +1,204 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+import { blankJson, isShellWord, removeIfEmpty, writeForeignJson }
+  from "@agents-can-communicate/adapter-sdk";
+
+/**
+ * The one allow rule ACC may add to Antigravity CLI's settings, with consent.
+ *
+ * Antigravity CLI asks before every shell command. On 1.2.12 a live push woke an
+ * idle session and its first ACC command waited at an approval prompt with
+ * nobody there, so the peer never got an answer (issue #214). A rule under
+ * `permissions.allow` removes the prompt. What 1.2.12 was captured doing:
+ *
+ * - The file is `~/.gemini/antigravity-cli/settings.json`, read once at startup.
+ *   `~/.gemini/settings.json` belongs to Gemini CLI and is never touched here.
+ * - A one-word rule is a prefix: `command("<wrapper>")` let `<wrapper> help`
+ *   run unasked.
+ * - A command whose first word is quoted matched no rule at all, quoted or not;
+ *   quotes around an argument are fine. So the skill names the wrapper bare,
+ *   and a wrapper path that only stays one word inside quotes cannot be allowed.
+ *
+ * ACC writes the bare form, `command(<wrapper>)`, on every install of this
+ * adapter: the user decided on 2026-09-27 that it is always on, with no
+ * question and no dependence on the delivery policy. The file is still the
+ * operator's: one that does not parse, or whose `permissions.allow` is not a
+ * list, is never rewritten. What ACC added is recorded in its own data home -
+ * the rule and the containers it had to create - and uninstall takes back
+ * exactly that, and always ends the claim, so the same words added later by
+ * the operator stay theirs.
+ */
+export const agySettingsPath = home => path.join(home, ".gemini", "antigravity-cli",
+  "settings.json");
+export const cliWrapperPath = home => path.join(home, ".gemini", "config", "acc", "acc-cli.sh");
+export const accAllowRule = wrapper => `command(${wrapper})`;
+
+// Forms that already allow every command starting with the bare wrapper: the
+// one ACC writes, and the quoted one-word form 1.2.12 was captured matching.
+const allowingForms = wrapper => [accAllowRule(wrapper), `command("${wrapper}")`];
+
+// Beside the `created-*` markers, for the same reason: the installer removes the
+// shim directory before uninstall runs. `acc doctor` passes the state root.
+const claimDir = ({ dataHome, stateRoot, home }) => typeof dataHome === "string" && dataHome !== ""
+  ? path.join(dataHome, "acc", "adapter-antigravity")
+  : typeof stateRoot === "string" && stateRoot !== ""
+    ? path.join(stateRoot, "adapter-antigravity")
+    : path.join(home, ".gemini", "config", "acc");
+const claimPath = (context, file) => path.join(claimDir(context),
+  `allow-rule-${Buffer.from(file).toString("base64url")}`);
+
+const isObject = value => value !== null && typeof value === "object" && !Array.isArray(value);
+
+async function readClaim(file) {
+  try {
+    const claim = JSON.parse(await readFile(file, "utf8"));
+    return typeof claim?.rule === "string" ? claim : null;
+  } catch {
+    return null;
+  }
+}
+
+/** The settings as the client would read them, or why ACC must not edit them. */
+async function readSettings(file) {
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return { state: "missing", value: {}, allow: [] };
+    return { state: "unreadable", reason: `could not be read (${error.code ?? error.message})` };
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    return { state: "unreadable", reason: "is not valid JSON" };
+  }
+  if (!isObject(value)) return { state: "unreadable", reason: "does not hold a JSON object" };
+  if (value.permissions !== undefined && !isObject(value.permissions)) {
+    return { state: "unreadable", reason: "has a permissions value that is not an object" };
+  }
+  const allow = value.permissions?.allow;
+  if (allow !== undefined && !Array.isArray(allow)) {
+    return { state: "unreadable", reason: "has a permissions.allow value that is not a list" };
+  }
+  return { state: "read", value, allow: allow ?? [] };
+}
+
+const RESTART = "Antigravity CLI reads it at startup, so a session started before it was "
+  + "added still asks until agy restarts";
+
+/** What the rule's state is on this machine, in words doctor can print. */
+export async function inspectAllowRule(context) {
+  const file = agySettingsPath(context.home);
+  const wrapper = cliWrapperPath(context.home);
+  const rule = accAllowRule(wrapper);
+  const base = { file, wrapper, rule, owned: false };
+  if (!isShellWord(wrapper)) {
+    return { ...base, state: "unmatchable", diagnostic: "each ACC command waits for approval, "
+      + "so a live wake stops at the agent's first ACC command until someone answers the "
+      + `approval prompt. No allow rule can remove it here: the wrapper ${wrapper} stays one `
+      + "shell word only inside quotes, and Antigravity CLI matches no rule against a command "
+      + "whose first word is quoted. ACC adds the prefix rule to permissions.allow in "
+      + `${file} when the wrapper path holds only letters, digits and . _ - /` };
+  }
+  const settings = await readSettings(file);
+  if (settings.state === "unreadable") {
+    return { ...base, state: "unreadable", diagnostic: `${file} ${settings.reason}, so ACC `
+      + "leaves it as it is and cannot tell whether ACC commands wait for approval; a live "
+      + "wake stops at the agent's first ACC command while they do. Repair the file, then run "
+      + `acc install --adapter antigravity to add ${rule} to permissions.allow` };
+  }
+  const matched = settings.allow.find(entry => allowingForms(wrapper).includes(entry));
+  if (matched !== undefined) {
+    const claim = await readClaim(claimPath(context, file));
+    const owned = claim?.rule === matched;
+    return { ...base, state: "allowed", owned, diagnostic: "ACC commands run without an "
+      + `approval prompt: permissions.allow in ${file} holds ${matched}`
+      + `${owned ? ", added by ACC" : ""}. ${RESTART}` };
+  }
+  // Every install writes the rule, so its absence means one did not run here, or
+  // the rule was taken out since.
+  return { ...base, state: "prompts",
+    diagnostic: "each ACC command waits for approval, so a live wake stops at the agent's "
+      + "first ACC command until someone answers the approval prompt. ACC's install adds "
+      + `${rule} to permissions.allow in ${file}, and it is not there: run acc install `
+      + "--adapter antigravity, then restart agy" };
+}
+
+async function addRule(context, found) {
+  const settings = await readSettings(found.file);
+  const claimFile = claimPath(context, found.file);
+  // Only what this write creates. A file or container that is already there is
+  // the operator's as far as ACC can tell: one ACC made earlier cannot be told
+  // from one they put in its place, and carrying the old flags over deleted
+  // their file at uninstall (review of #218). The cost is an empty container
+  // ACC once made staying after uninstall, never the operator's file going.
+  const created = {
+    file: settings.state === "missing",
+    permissions: settings.value.permissions === undefined,
+    allow: settings.value.permissions?.allow === undefined,
+  };
+  // The claim first: a crash between the two leaves a claim with no rule, which
+  // uninstall drops, rather than a rule nobody can tell is ACC's.
+  await mkdir(path.dirname(claimFile), { recursive: true });
+  await writeFile(claimFile, `${JSON.stringify({ file: found.file, rule: found.rule,
+    created })}\n`);
+  await writeForeignJson(found.file, { ...settings.value, permissions: {
+    ...settings.value.permissions, allow: [...settings.allow, found.rule] } },
+  { readFile, writeFile, mkdir });
+}
+
+/**
+ * Take back the rule ACC recorded adding, and the containers it created if they
+ * are empty. Every copy of it goes: one in the same words cannot be told from
+ * ACC's, and the client itself has duplicated grants across reloads, so taking
+ * one back left ACC commands running unasked after uninstall (review of #218).
+ * Anything else in the file stays, and a rule the operator had before ACC came
+ * was never claimed.
+ */
+export async function withdrawAllowRule(context) {
+  const file = agySettingsPath(context.home);
+  const claimFile = claimPath(context, file);
+  const claim = await readClaim(claimFile);
+  if (claim === null) return { changes: [], diagnostics: [], needsAction: [] };
+  const settings = await readSettings(file);
+  if (settings.state === "unreadable") {
+    // Kept, so the next install or uninstall can finish once the file reads.
+    return { changes: [], diagnostics: [], needsAction: [`${file} ${settings.reason}; ACC `
+      + `left it as it is and still has to remove its ${claim.rule} from permissions.allow`] };
+  }
+  if (!settings.allow.includes(claim.rule)) {
+    await rm(claimFile, { force: true });
+    return { changes: [], diagnostics: [], needsAction: [] };
+  }
+  const permissions = { ...settings.value.permissions,
+    allow: settings.allow.filter(rule => rule !== claim.rule) };
+  if (claim.created?.allow === true && permissions.allow.length === 0) delete permissions.allow;
+  const next = { ...settings.value, permissions };
+  if (claim.created?.permissions === true && Object.keys(permissions).length === 0) {
+    delete next.permissions;
+  }
+  await writeForeignJson(file, next, { readFile, writeFile, mkdir });
+  if (claim.created?.file === true) {
+    await removeIfEmpty(file, { readFile, rm, isEmpty: blankJson() });
+  }
+  await rm(claimFile, { force: true });
+  return { changes: [file], diagnostics: [`removed ACC's ${claim.rule} from ${file}`],
+    needsAction: [] };
+}
+
+/** Put ACC's rule in place, at every install. */
+export async function ensureAllowRule(context) {
+  const found = await inspectAllowRule(context);
+  if (found.state === "unmatchable" || found.state === "unreadable") {
+    return { changes: [], diagnostics: [found.diagnostic], needsAction: [found.diagnostic] };
+  }
+  if (found.state === "allowed") {
+    return { changes: [], diagnostics: [found.diagnostic], needsAction: [] };
+  }
+  await addRule(context, found);
+  return { changes: [found.file], needsAction: [], diagnostics: [`added ${found.rule} to `
+    + `permissions.allow in ${found.file}: ACC commands run without an approval prompt in `
+    + "Antigravity sessions started from now on; restart agy for a session already open"] };
+}

package/node_modules/@agents-can-communicate/adapter-antigravity/src/install.mjs

@@ -5,11 +5,13 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
-import { bakeSkillCommand, blankJson, defaultAntigravityRelay, ownVersion, removeIfEmpty,
-  stampPluginVersion, writeCliShim, writeForeignJson, writeHookShim }
+import { bakeSkillCommand, blankJson, defaultAntigravityRelay, isShellWord, ownVersion,
+  removeIfEmpty, stampPluginVersion, writeCliShim, writeForeignJson, writeHookShim }
   from "@agents-can-communicate/adapter-sdk";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 
+import { agySettingsPath, cliWrapperPath, ensureAllowRule, inspectAllowRule,
+  withdrawAllowRule } from "./allow-rule.mjs";
 import { relayShimPath, runningRelays, stopRelays } from "./relays.mjs";
 
 const run = promisify(execFile);
@@ -349,7 +351,9 @@ async function installSkillPlugin(context) {
     await cp(bundle, plugin, { recursive: true });
     await stampPluginVersion({ file: path.join(plugin, "plugin.json"),
       version: await ownVersion(import.meta.url), io: { readFile, writeFile } });
-    await bakeSkillCommand({ root: plugin, cliShim });
+    // Bare when the path allows it: 1.2.12 matched no allow rule against a
+    // command whose first word was quoted (issue #214).
+    await bakeSkillCommand({ root: plugin, cliShim, bareWhenSafe: true });
     await agyFor(context)(["plugin", "install", plugin], { home, env: context.env });
   } finally {
     await rm(stage, { recursive: true, force: true });
@@ -399,10 +403,13 @@ export async function installAntigravity(context) {
     await writeFile(createdMarker(context, file), `${file}\n`);
   }
   await installSkillPlugin(context);
-  const changes = [shimDir(home), file, pluginInstallPath(home), vendorManifestPath(home)];
+  // After the skill, whose wrapper the rule names. Always on (#214, 2026-09-27).
+  const allow = await ensureAllowRule(context);
+  const changes = [shimDir(home), file, pluginInstallPath(home), vendorManifestPath(home),
+    ...allow.changes];
 
-  const diagnostics = [];
-  const needsAction = [];
+  const diagnostics = [...allow.diagnostics];
+  const needsAction = [...allow.needsAction];
   if (locationOf(context) === "workspace") {
     diagnostics.push("a workspace registration loads only while this project is an open "
       + `Antigravity workspace; in print mode pass --add-dir ${context.antigravityWorkspace}`);
@@ -524,8 +531,14 @@ export async function uninstallAntigravity(context) {
     await rm(manifestMarker, { force: true });
   }
 
+  // The allow rule ACC recorded adding, and nothing else in the operator's file.
+  const allow = await withdrawAllowRule(context);
+  changes.push(...allow.changes);
+  diagnostics.push(...allow.diagnostics);
+
   if (!keep.includes(shimDir(home))) await rm(shimDir(home), { recursive: true, force: true });
-  return { ok: true, changes, diagnostics };
+  return { ok: true, changes, diagnostics,
+    ...(allow.needsAction.length > 0 ? { needsAction: allow.needsAction } : {}) };
 }
 
 /**
@@ -560,6 +573,12 @@ export async function detectAntigravity(context) {
   const needsAction = [];
   const blocked = locationChoice(context);
   const imported = await exists(importedPluginPath(context.home));
+  // Read from files only, so it is known for a client ACC did not run. It is
+  // the client's own approval control over what a woken session can answer.
+  const commandApproval = await inspectAllowRule(context);
+  const approval = { commandApproval,
+    inboundDelivery: { state: commandApproval.state, diagnostic: commandApproval.diagnostic } };
+  diagnostics.push(commandApproval.diagnostic);
   // The installer runs every adapter's detect and passes a null version for a
   // client it did not find. Asking agy then would spawn a binary the installer
   // could not run a moment ago, or - where it does exist but did not answer -
@@ -568,7 +587,8 @@ export async function detectAntigravity(context) {
     diagnostics.push("acc hooks not registered: Antigravity CLI was not found, so it was "
       + "not asked what it has loaded");
     if (blocked !== null) diagnostics.push(blocked.reason);
-    return { ok: true, changes: [], diagnostics, ...(blocked === null ? {} : { blocked }) };
+    return { ok: true, changes: [], diagnostics, ...approval,
+      ...(blocked === null ? {} : { blocked }) };
   }
   let readback = null;
   try {
@@ -622,11 +642,22 @@ export async function detectAntigravity(context) {
       + "first run and loads its skill, but none of its hook names, so no ACC hook runs here "
       + "(issue #176)");
   }
+  // Every install writes the rule, so where ACC's wrapper is on disk a missing
+  // or unreadable rule is an install to finish, whatever the delivery policy.
+  if (await exists(cliWrapperPath(context.home))) {
+    if (commandApproval.state === "prompts") {
+      needsAction.push(`acc install --adapter antigravity  # ${commandApproval.rule} is missing `
+        + `from permissions.allow in ${commandApproval.file}, so each ACC command waits for `
+        + "approval");
+    } else if (commandApproval.state === "unreadable") {
+      needsAction.push(commandApproval.diagnostic);
+    }
+  }
   if (blocked !== null) {
     diagnostics.push(blocked.reason);
     needsAction.push(blocked.reason);
   }
-  return { ok: true, changes: [], diagnostics,
+  return { ok: true, changes: [], diagnostics, ...approval,
     ...(blocked === null ? {} : { blocked }),
     ...(needsAction.length > 0 ? { needsAction } : {}) };
 }
@@ -678,8 +709,12 @@ export function planAntigravityInstall(context) {
   // installer leaves to the adapter - so the installer never deletes the copy
   // ahead of `agy plugin uninstall` and strands its manifest entry. That exact
   // ordering, with the shim directory, once left `{}` behind in the user's home.
+  // The operator's own settings, edited for ACC's allow rule wherever one can
+  // match: a wrapper path that needs quotes gets none.
   const plugin = [{ path: pluginInstallPath(context.home), kind: "merge" },
-    { path: vendorManifestPath(context.home), kind: "merge" }];
+    { path: vendorManifestPath(context.home), kind: "merge" },
+    ...(isShellWord(cliWrapperPath(context.home))
+      ? [{ path: agySettingsPath(context.home), kind: "merge" }] : [])];
   if (locationChoice(context) !== null) {
     return [shim, ...plugin,
       { path: globalHooksPath(context.home), kind: "merge" },

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/adapter.mjs

@@ -5,6 +5,8 @@ import certification from "../certification.json" with { type: "json" };
 import { denyOutcome, injectOutcome, injectStartOwnerOutcome, normalizeClaudeHook } from "./hooks.mjs";
 import { MIN_VERSION, PROTOCOL_CONTRACT, bindNativeSession, offerMessage, planNativeActivation,
   probeNativeDelivery, refreshNativeSession, retireNativeSession } from "./inbox-delivery.mjs";
+import { observedInboxDirectories } from "./inbox-observed-directories.mjs";
+import { inboxSocketDirectories } from "./inbox-socket-directories.mjs";
 import { planClaudeInstall, detectClaude, installClaudePlugin, uninstallClaudePlugin } from "./install.mjs";
 
 export const CLAUDE_CODE_VERSION = "2.1.233";
@@ -22,8 +24,9 @@ export const CLAUDE_DELIVERY_FALLBACK = Object.freeze({
  * and a parent/child mapping claimed without observation is the kind of thing
  * that quietly maps every child onto its parent. `startupInjection` and
  * `safePointInjection` were not exercised - only the before-turn path was.
- * Native live delivery is the inbox wake, certified from 2.1.282 on
- * darwin-arm64; reply routing through the transport is not claimed.
+ * Native live delivery is the inbox wake, certified from 2.1.282 (captured on
+ * darwin-arm64, applied on every platform the probe admits); reply routing
+ * through the transport is not claimed.
  */
 export function createClaudeCodeAdapter() {
   return defineAdapter({
@@ -52,8 +55,8 @@ export function createClaudeCodeAdapter() {
     // newer stable client is admitted by the probe and the per-session
     // handshake. The offer is a wake; see src/inbox-delivery.mjs.
     nativeDelivery: {
-      minimumByPlatform: { "darwin-arm64": MIN_VERSION },
-      anchors: [{ platform: "darwin-arm64", version: MIN_VERSION, protocolContract: PROTOCOL_CONTRACT }],
+      minimum: MIN_VERSION,
+      anchors: [{ version: MIN_VERSION, protocolContract: PROTOCOL_CONTRACT }],
       knownBad: [],
       activationKinds: ["native-service"],
       policySource: "installation-record",
@@ -91,6 +94,13 @@ export function createClaudeCodeAdapter() {
     refreshNativeSession,
     retireNativeSession,
     offerMessage,
+    // Where a sender connects to wake a session; a sandboxed sender is allowed these:
+    // the directories this environment implies, and those of every inbox bound here.
+    inboundSockets: context => [
+      ...inboxSocketDirectories({ env: context?.env, platform: context?.platform, uid: context?.uid }),
+      // Ownership is this process's own uid, never the context's naming override.
+      ...observedInboxDirectories({ stateRoot: context?.stateRoot }),
+    ],
 
     denyOutcome,
     injectOutcome,

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-delivery.mjs

@@ -1,4 +1,5 @@
 import net from "node:net";
+import { compareVersionOrder, versionOrder } from "@agents-can-communicate/adapter-sdk";
 
 import { INBOX_MODES, MIN_VERSION, PROTOCOL_CONTRACT, TRANSPORT } from "./inbox-contract.mjs";
 import { claimWake, newEndpointId, readInboxEndpoint, releaseWake, removeInboxEndpoint,
@@ -26,7 +27,6 @@ const LEASE_MS = 120_000;
 const MESSAGE_ID = /^[A-Za-z0-9_-]{1,200}$/;
 const PROBE_NEEDLE = Buffer.from("messagingSocketPath");
 const PROBE_MAX_BYTES = 256 * 1024 * 1024;
-const STABLE_VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z.-]+)?$/;
 
 export { INBOX_MODES, MIN_VERSION, PROTOCOL_CONTRACT, TRANSPORT };
 
@@ -37,12 +37,11 @@ export const wakeText = messageId => `ACC: new peer message ${messageId} for thi
   + `acc inbox --message ${messageId}. Answer it through ACC with acc reply --message ${messageId}; `
   + "SendMessage cannot deliver to an ACC participant.";
 
-function compare(left, right) {
-  const a = left.split("+")[0].split(".").map(Number);
-  const b = right.split("+")[0].split(".").map(Number);
-  for (let index = 0; index < 3; index += 1) if (a[index] !== b[index]) return a[index] < b[index] ? -1 : 1;
-  return 0;
-}
+// A version is judged by its release triple: a prerelease of a version above
+// the minimum is not an older client, and the inbox in the executable is what
+// admits it. An unreadable version orders as null.
+const belowMinimum = clientVersion => compareVersionOrder(versionOrder(clientVersion),
+  versionOrder(MIN_VERSION)) < 0;
 
 // The registry field only a build with the inbox writes. Read-only, bounded.
 async function executableHasInbox(realExecutable) {
@@ -92,8 +91,8 @@ function withTimeout(work, ms) {
 }
 
 /**
- * Read-only: a stable version at or above the capture, a platform whose inbox
- * is a Unix socket, and an executable that writes the inbox into its session
+ * Read-only: a version at or above the capture, a platform whose inbox is a
+ * Unix socket, and an executable that writes the inbox into its session
  * registry. Never launches a session. Native Windows serves a named pipe that
  * demands an auth line; nothing there is captured, so it keeps hook delivery.
  */
@@ -105,10 +104,8 @@ export async function probeNativeDelivery({ realExecutable, timeoutMs = 750, pla
   if (typeof realExecutable !== "string" || realExecutable === "") return unsupported("feature_probe_failed");
   const clientVersion = await withTimeout(Promise.resolve(readVersion(realExecutable, timeoutMs)), timeoutMs)
     .catch(() => null);
-  if (clientVersion === null || !STABLE_VERSION.test(clientVersion)) {
-    return unsupported("feature_probe_failed", clientVersion);
-  }
-  if (compare(clientVersion, MIN_VERSION) < 0) return unsupported("below_minimum_version", clientVersion);
+  if (versionOrder(clientVersion) === null) return unsupported("feature_probe_failed", clientVersion);
+  if (belowMinimum(clientVersion)) return unsupported("below_minimum_version", clientVersion);
   const present = await withTimeout(Promise.resolve(hasInbox(realExecutable)), timeoutMs).catch(() => false);
   if (!present) return unsupported("protocol_mismatch", clientVersion);
   return { supported: true, clientVersion, protocolContract: PROTOCOL_CONTRACT,
@@ -145,13 +142,11 @@ export async function bindNativeSession({ event, clientPid, clientVersion, runti
   if (typeof event?.sessionId !== "string" || event.sessionId === "") {
     return closed(clientVersion, "handshake_failed");
   }
-  if (typeof clientVersion !== "string" || !STABLE_VERSION.test(clientVersion)) {
-    return closed(clientVersion, "version_unavailable");
-  }
+  if (versionOrder(clientVersion) === null) return closed(clientVersion, "version_unavailable");
   // The contract refuses it anyway, after this returns. Refusing here keeps an
   // older client - which binds again on every turn - from writing an endpoint
   // record each time.
-  if (compare(clientVersion, MIN_VERSION) < 0) return closed(clientVersion, "below_minimum_version");
+  if (belowMinimum(clientVersion)) return closed(clientVersion, "below_minimum_version");
   const socketPath = env?.CLAUDE_CODE_MESSAGING_SOCKET;
   if (typeof socketPath !== "string" || socketPath === "") {
     return closed(clientVersion, "native_endpoint_unavailable");

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-endpoint.mjs

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
 import path from "node:path";
+import { versionOrder } from "@agents-can-communicate/adapter-sdk";
 
 import { PROTOCOL_CONTRACT } from "./inbox-contract.mjs";
 import { inboxSocketIsSafe } from "./inbox-registry.mjs";
@@ -14,13 +15,14 @@ import { isReception } from "./inbox-settings.mjs";
 const KEYS = ["schemaVersion", "endpointId", "socketPath", "configDir", "clientPid", "sessionId",
   "clientVersion", "protocolContract", "leaseUntil", "reception"];
 const ENDPOINT = /^claude_inbox_[a-f0-9]{32}$/;
-const STABLE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:\+[0-9A-Za-z.-]+)?$/;
 const MAX_BYTES = 8_192;
 const absolute = value => typeof value === "string" && path.isAbsolute(value) && !value.includes("\0");
 const own = info => typeof process.getuid !== "function" || info.uid === process.getuid();
 const invalid = () => new Error("invalid Claude inbox endpoint registration");
 
 export const newEndpointId = () => `claude_inbox_${randomBytes(16).toString("hex")}`;
+// Where, under a workspace runtime directory, the records live.
+export const ENDPOINTS_DIRECTORY = "claude-inbox-endpoints";
 
 function valid(record) {
   return record !== null && typeof record === "object" && !Array.isArray(record)
@@ -29,7 +31,7 @@ function valid(record) {
     && absolute(record.socketPath) && absolute(record.configDir)
     && Number.isInteger(record.clientPid) && record.clientPid > 0
     && typeof record.sessionId === "string" && record.sessionId !== "" && record.sessionId.length <= 200
-    && typeof record.clientVersion === "string" && STABLE.test(record.clientVersion)
+    && typeof record.clientVersion === "string" && versionOrder(record.clientVersion) !== null
     && record.protocolContract === PROTOCOL_CONTRACT
     && typeof record.leaseUntil === "string"
     && /^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(record.leaseUntil)
@@ -41,7 +43,7 @@ async function directory(runtimeDir, create = false) {
   if (!absolute(runtimeDir)) throw invalid();
   if (create) await mkdir(runtimeDir, { recursive: true, mode: 0o700 });
   const root = await realpath(runtimeDir);
-  const dir = path.join(root, "claude-inbox-endpoints");
+  const dir = path.join(root, ENDPOINTS_DIRECTORY);
   if (create) await mkdir(dir, { mode: 0o700 }).catch(error => {
     if (error.code !== "EEXIST") throw error;
   });

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-observed-directories.mjs

@@ -0,0 +1,62 @@
+import { closeSync, constants, fstatSync, openSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+import { ENDPOINTS_DIRECTORY } from "./inbox-endpoint.mjs";
+
+// The inbox directories of Claude Code sessions ACC has bound on this machine,
+// read from the adapter's own endpoint records in every workspace under ACC's
+// state root (review of #217). The environment-derived directories cover
+// sessions started from the installer's environment; a session started with
+// its own absolute CLAUDE_CODE_TMPDIR or XDG_RUNTIME_DIR binds elsewhere, and
+// the hook that bound it wrote down where.
+//
+// Synchronous: install, doctor and the managed refresh compose the grant list
+// while building one context, once per command. Every workspace and every
+// matching record is read - a count cap dropped whatever sorted past it, and
+// doctor then called the profile configured (review of #217) - and each read
+// is bounded to one small record. Nothing here throws; a record that cannot be
+// read or cannot be a Claude Code inbox adds nothing. A grant widens the Codex sandbox, so a directory is taken only when
+// it is named as Claude Code names its inbox directories (2.1.283:
+// `cc-socks` or `cc-socks-<uid>`), whatever a file on disk says.
+
+const RECORD = /^claude_inbox_[a-f0-9]{32}\.json$/;
+const INBOX_DIRECTORY = /^cc-socks(?:-\d+)?$/;
+const MAX_BYTES = 8_192;
+
+const list = directory => {
+  try {
+    return readdirSync(directory).sort();
+  } catch {
+    return [];
+  }
+};
+
+function socketPathIn(file, uid) {
+  let fd;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const info = fstatSync(fd);
+    if (!info.isFile() || (uid !== null && info.uid !== uid) || info.size > MAX_BYTES) return null;
+    return JSON.parse(readFileSync(fd, "utf8"))?.socketPath ?? null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) try { closeSync(fd); } catch { /* already closed */ }
+  }
+}
+
+export function observedInboxDirectories({ stateRoot, uid = process.getuid?.() ?? null } = {}) {
+  if (typeof stateRoot !== "string" || !path.isAbsolute(stateRoot)) return [];
+  const workspaces = path.join(stateRoot, "workspaces");
+  const found = new Set();
+  for (const workspace of list(workspaces)) {
+    const records = path.join(workspaces, workspace, ENDPOINTS_DIRECTORY);
+    for (const name of list(records).filter(item => RECORD.test(item))) {
+      const socketPath = socketPathIn(path.join(records, name), uid);
+      if (typeof socketPath !== "string" || !path.isAbsolute(socketPath) || socketPath.includes("\0")) continue;
+      const directory = path.dirname(path.normalize(socketPath));
+      if (INBOX_DIRECTORY.test(path.basename(directory))) found.add(directory);
+    }
+  }
+  return [...found].sort();
+}