agents-can-communicate 0.8.0 → 0.8.2

package/node_modules/@agents-can-communicate/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/installer",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/installer/src/delivery-diagnostics.mjs

@@ -2,9 +2,7 @@
 // reasons; installation and doctor must not turn a version floor into readiness.
 const REASONS = Object.freeze({
   native_delivery_unsupported: "this adapter has no native delivery channel",
-  platform_not_captured: "native delivery is not verified on this platform",
   version_unavailable: "the client version could not be verified",
-  prerelease_not_captured: "this client version is not a verified stable release",
   below_minimum_version: "the client is below the native delivery minimum version",
   known_bad_version: "this client version has a known native delivery failure",
   native_endpoint_unavailable: "the client's local delivery service is unavailable",

package/node_modules/@agents-can-communicate/installer/src/detect.mjs

@@ -13,9 +13,8 @@ const run = promisify(execFile);
 
 // Reasons the client itself will not change within an install: unsupported,
 // as opposed to degraded, which a repaired probe or shell may lift.
-const STATIC_REASONS = new Set(["native_delivery_unsupported", "platform_not_captured",
-  "version_unavailable", "prerelease_not_captured", "below_minimum_version",
-  "known_bad_version"]);
+const STATIC_REASONS = new Set(["native_delivery_unsupported", "version_unavailable",
+  "below_minimum_version", "known_bad_version"]);
 
 const DEFAULT_PROBE_TIMEOUT_MS = 3_000;
 
@@ -32,8 +31,10 @@ const VERSION = /(?:^|[^0-9A-Za-z])v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)(?:\b
  * has: nothing is written, and a client that is not installed simply fails to
  * start.
  */
-export const spawnProbe = async (command, args) => {
-  const { stdout, stderr } = await run(command, args);
+// `env` decides where the command is looked up, so detection given an
+// environment finds the client on that environment's PATH.
+export const spawnProbe = async (command, args, { env } = {}) => {
+  const { stdout, stderr } = await run(command, args, env === undefined ? {} : { env });
   return `${stdout}${stderr}`.trim();
 };
 
@@ -76,7 +77,7 @@ async function detectNative(adapter, entry, { context, platform, probeTimeoutMs,
     }
     try {
       facts.eligibility = evaluateNativeEligibility(adapter,
-        { clientVersion: entry.version, platform, probe: facts.probe });
+        { clientVersion: entry.version, probe: facts.probe });
     } catch {
       facts.eligibility = { eligible: false, reasonCode: "feature_probe_failed" };
     }
@@ -123,8 +124,11 @@ export async function detectInstallation({ adapters, context, probe = spawnProbe
         const output = await withTimeout(
           // The declared binary, never the adapter id. Guessing the id made
           // every client whose command differs from it look uninstalled.
+          // On the PATH the native probes below use: a caller that passes its
+          // own environment must not find a different client, or none.
           Promise.resolve(probe(adapter.client.command,
-            adapter.client.versionArgs ?? ["--version"])),
+            adapter.client.versionArgs ?? ["--version"],
+            { env: context?.env === undefined ? undefined : { ...process.env, ...context.env } })),
           probeTimeoutMs, `${adapter.id} version probe`);
         if (typeof output === "string" && output !== "") {
           entry.present = true;
@@ -161,6 +165,8 @@ export async function detectInstallation({ adapters, context, probe = spawnProbe
         if (detected.blocked) entry.blocked = detected.blocked;
         if (detected.outgoingDelivery) entry.outgoingDelivery = detected.outgoingDelivery;
         if (detected.inboundDelivery) entry.inboundDelivery = detected.inboundDelivery;
+        // Whether the client asks before each ACC command, and what would stop it.
+        if (detected.commandApproval) entry.commandApproval = detected.commandApproval;
         if (detected.nativeSetup) entry.nativeSetup = detected.nativeSetup;
         entry.diagnostics = [...(detected.diagnostics ?? [])];
         // What a person has to do, as opposed to what is true. Adapters that

package/node_modules/@agents-can-communicate/installer/src/index.mjs

@@ -1,6 +1,7 @@
 // Detection, planning, application, and the record of what was installed.
 export { detectInstallation, spawnProbe } from "./detect.mjs";
 export { planInstallation } from "./plan.mjs";
+export { receiverSockets } from "./receiver-sockets.mjs";
 export { applyPlan } from "./apply.mjs";
 export { finalizeRemoval, fingerprint, loadOwnership, missingArtifactParents, recordInstall,
   removeEmptyOwnedDirectories, removeOwned, removeOwnedArtifacts, treeFingerprint, verifyOwned }

package/node_modules/@agents-can-communicate/installer/src/receiver-sockets.mjs

@@ -0,0 +1,19 @@
+import path from "node:path";
+
+/**
+ * Every Unix socket path ACC can deliver to on this machine.
+ *
+ * A sender whose client sandboxes its shell - Codex - has to be allowed to
+ * connect to the recipient's socket, and the recipient's adapter is the only
+ * one that knows where that socket lives. Each adapter declares its own through
+ * `inboundSockets(context)`; the sender's adapter receives the composed list as
+ * `context.receiverSockets` and never names another vendor's paths itself.
+ *
+ * Composed from every known adapter, not the ones an install names: installing
+ * Codex alone must still allow a Claude Code session installed before or after.
+ */
+export function receiverSockets(adapters, context) {
+  const paths = [...adapters].flatMap(adapter =>
+    typeof adapter.inboundSockets === "function" ? adapter.inboundSockets(context) ?? [] : []);
+  return [...new Set(paths.filter(item => typeof item === "string" && path.isAbsolute(item)))].sort();
+}

package/node_modules/@agents-can-communicate/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/mcp-server",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/protocol/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/protocol",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/storage-filesystem/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/storage-filesystem",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/storage-filesystem/src/atomic-json.mjs

@@ -64,7 +64,8 @@ async function replaceHandleBytes(handle, bytes) {
  * @returns {Promise<"published" | "already_published">}
  */
 export async function publishAtomic(destination, bytes,
-  { root, tmpDir, stageDir, replace = false, deadlineAt, afterAccepted }) {
+  { root, tmpDir, stageDir, replace = false, deadlineAt, afterAccepted, afterStageEnsured,
+    afterStageRenamed }) {
   assertPublicationDeadline(deadlineAt);
   // The accepted stage lives apart from the partial a failed publication
   // leaves, so what a file is follows from the directory it was created in
@@ -145,9 +146,8 @@ export async function publishAtomic(destination, bytes,
       // The seam the race test uses, in the manner retainFile already
       // establishes: the window this closes is invisible without one.
       await afterAccepted?.();
-      await ensureManagedDirectory(root, stageDir);
-      await rename(temporary, stage);
-      await syncDirectory(stageDir);
+      await retainAcceptedStage({ root, stageDir, temporary, stage, afterStageEnsured,
+        afterStageRenamed });
     } else {
       // A crash/error before immutable acceptance keeps its unique partial.
       // Retention avoids the unsafe parent-check/unlink pathname window, while
@@ -157,6 +157,32 @@ export async function publishAtomic(destination, bytes,
   }
 }
 
+// The sweep can take `stage` between any two of these steps: it renames the
+// directory aside, and a store still opening publishes here without the writer
+// mutex the sweep holds (CI on #217). The bytes are already published, so the
+// retained copy goes to whichever directory carries the name when it moves, and
+// a copy the sweep took along with the directory needs no sync here - the sweep
+// discards that directory. The two callbacks are seams for the race tests.
+const STAGE_RETRIES = 4;
+
+async function retainAcceptedStage({ root, stageDir, temporary, stage, afterStageEnsured,
+  afterStageRenamed }) {
+  for (let attempt = 0; ; attempt += 1) {
+    await ensureManagedDirectory(root, stageDir);
+    await afterStageEnsured?.();
+    try {
+      await rename(temporary, stage);
+      break;
+    } catch (error) {
+      if (error.code !== "ENOENT" || attempt >= STAGE_RETRIES) throw error;
+    }
+  }
+  await afterStageRenamed?.();
+  await syncDirectory(stageDir).catch(error => {
+    if (error.code !== "ENOENT") throw error;
+  });
+}
+
 // The opener is the seam the race tests use, and stays last so callers that do
 // not care never see it.
 export async function readJsonIfPresent(filePath, root, openFile) {

package/node_modules/@agents-can-communicate/storage-filesystem/src/safe-directory.mjs

@@ -29,32 +29,42 @@ function absolutePath(value, name, root = value) {
   return path.normalize(value);
 }
 
+// How many more times a create-mode check takes a directory that left its name
+// while being checked. The stage sweep renames `stage` aside and recreates it,
+// without regard to a store that is still opening beside it, so one more try is
+// the real case; the bound only stops a directory that never stays put from
+// holding its caller (CI on #217).
+const VANISHED_RETRIES = 4;
+
 async function inspectRealDirectory(directory, root, create) {
-  let details;
-  try {
-    details = await lstat(directory);
-  } catch (error) {
-    if (error.code === "ENOENT" && !create) throw error;
-    if (error.code !== "ENOENT") {
-      throw invalidDirectory("cannot inspect managed directory", directory, root, error.message);
-    }
+  for (let attempt = 0; ; attempt += 1) {
+    let details;
     try {
-      await mkdir(directory);
-    } catch (mkdirError) {
-      if (mkdirError.code !== "EEXIST") {
-        throw invalidDirectory("cannot create managed directory", directory, root,
-          mkdirError.message);
+      details = await lstat(directory);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw invalidDirectory("cannot inspect managed directory", directory, root, error.message);
       }
+      // Missing again right after it was created means a rename took it.
+      if (!create || attempt > VANISHED_RETRIES) throw error;
+      try {
+        await mkdir(directory);
+      } catch (mkdirError) {
+        if (mkdirError.code !== "EEXIST") {
+          throw invalidDirectory("cannot create managed directory", directory, root,
+            mkdirError.message);
+        }
+      }
+      continue;
     }
-    details = await lstat(directory);
-  }
-  if (!details.isDirectory() || details.isSymbolicLink()) {
-    throw invalidDirectory("managed directory is not a real directory", directory, root);
+    if (!details.isDirectory() || details.isSymbolicLink()) {
+      throw invalidDirectory("managed directory is not a real directory", directory, root);
+    }
+    return details;
   }
-  return details;
 }
 
-async function inspectManagedDirectory(rootPath, directoryPath, create) {
+async function inspectManagedDirectory(rootPath, directoryPath, create, { afterInspect } = {}) {
   const root = absolutePath(rootPath, "managed root");
   const directory = absolutePath(directoryPath, "managed directory", root);
   const relative = relativeWithin(root, directory);
@@ -67,7 +77,17 @@ async function inspectManagedDirectory(rootPath, directoryPath, create) {
   let canonicalParent = canonicalRoot;
   for (const segment of relative.split(path.sep).filter(Boolean)) {
     current = path.join(current, segment);
-    details = await inspectRealDirectory(current, root, create);
+    let resolved;
+    for (let attempt = 0; ; attempt += 1) {
+      details = await inspectRealDirectory(current, root, create);
+      await afterInspect?.(current);
+      // A create-mode caller uses this name next. A directory renamed away
+      // between the check and the resolution leaves realpath nothing to resolve
+      // (ENOENT), so it is checked and created again, then resolved again; every
+      // check below applies to whichever attempt settles.
+      resolved = await resolveSegment(current, create && attempt < VANISHED_RETRIES);
+      if (resolved !== null) break;
+    }
     // realpath answers with the name the directory carries *now*, which is not
     // always the name that was asked for: on Darwin it resolves by opening the
     // path and asking the kernel for that vnode's current path, so a directory
@@ -86,7 +106,6 @@ async function inspectManagedDirectory(rootPath, directoryPath, create) {
     // swapped in under this name is not. ENOENT on the re-stat means it moved
     // again between the two calls, which cannot redirect anything: whatever
     // the caller opens through this path next fails the same way.
-    const resolved = await realpath(current);
     if (path.dirname(resolved) !== canonicalParent
       || (path.basename(resolved) !== segment
         && !await stillTheSameDirectory(details, resolved, current, root))) {
@@ -97,6 +116,16 @@ async function inspectManagedDirectory(rootPath, directoryPath, create) {
   return { directory, stat: details };
 }
 
+// null when the name went away and the caller may take it again.
+async function resolveSegment(current, retry) {
+  try {
+    return await realpath(current);
+  } catch (error) {
+    if (error.code === "ENOENT" && retry) return null;
+    throw error;
+  }
+}
+
 async function stillTheSameDirectory(details, resolved, current, root) {
   const served = await stat(resolved).then(found => found, error => {
     if (error.code === "ENOENT") return null;
@@ -105,10 +134,12 @@ async function stillTheSameDirectory(details, resolved, current, root) {
   return served === null || (served.dev === details.dev && served.ino === details.ino);
 }
 
-export async function assertManagedDirectory(rootPath, directoryPath) {
-  return inspectManagedDirectory(rootPath, directoryPath, false);
+// `afterInspect` is the seam the race tests use: it runs between a segment's
+// check and its resolution, the window a concurrent rename lands in.
+export async function assertManagedDirectory(rootPath, directoryPath, options) {
+  return inspectManagedDirectory(rootPath, directoryPath, false, options);
 }
 
-export async function ensureManagedDirectory(rootPath, directoryPath) {
-  return (await inspectManagedDirectory(rootPath, directoryPath, true)).directory;
+export async function ensureManagedDirectory(rootPath, directoryPath, options) {
+  return (await inspectManagedDirectory(rootPath, directoryPath, true, options)).directory;
 }

package/node_modules/@agents-can-communicate/storage-filesystem/src/store.mjs

@@ -121,8 +121,12 @@ export async function openFilesystemStore({ root, clock, ids, workspaceId, failA
   // must not roll the same journal forward concurrently.
   await recoverOpenJournals();
 
-  // Sweeping is a write, so it holds the same mutex recovery does and no
-  // publisher is in flight while the stage directory is detached. It is bounded
+  // Sweeping is a write, so it holds the same mutex recovery does, and no
+  // transaction publishes while the stage directory is detached. A store that is
+  // still opening beside it does: the identity record, the directory checks and
+  // the journal's first slot above run without the mutex, so the managed
+  // directory checks and publishAtomic take a `stage` that left its name once
+  // more rather than failing (CI on #217). It is bounded
   // per pass: a store carrying a large accumulation drains over several opens
   // rather than spending one hook's whole budget on it. The mutex is taken only
   // on the opens that actually sweep - see sweepIfDue, which decides before it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "accManagedUpdateProtocol": 2,
   "accStoreVersion": 6,
   "type": "module",