agents-can-communicate 0.8.1 → 0.8.3

package/node_modules/@agents-can-communicate/adapter-antigravity/src/install.mjs

@@ -5,11 +5,13 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
-import { bakeSkillCommand, blankJson, defaultAntigravityRelay, ownVersion, removeIfEmpty,
-  stampPluginVersion, writeCliShim, writeForeignJson, writeHookShim }
+import { bakeSkillCommand, blankJson, defaultAntigravityRelay, isShellWord, ownVersion,
+  removeIfEmpty, stampPluginVersion, writeCliShim, writeForeignJson, writeHookShim }
   from "@agents-can-communicate/adapter-sdk";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 
+import { agySettingsPath, cliWrapperPath, ensureAllowRule, inspectAllowRule,
+  withdrawAllowRule } from "./allow-rule.mjs";
 import { relayShimPath, runningRelays, stopRelays } from "./relays.mjs";
 
 const run = promisify(execFile);
@@ -349,7 +351,9 @@ async function installSkillPlugin(context) {
     await cp(bundle, plugin, { recursive: true });
     await stampPluginVersion({ file: path.join(plugin, "plugin.json"),
       version: await ownVersion(import.meta.url), io: { readFile, writeFile } });
-    await bakeSkillCommand({ root: plugin, cliShim });
+    // Bare when the path allows it: 1.2.12 matched no allow rule against a
+    // command whose first word was quoted (issue #214).
+    await bakeSkillCommand({ root: plugin, cliShim, bareWhenSafe: true });
     await agyFor(context)(["plugin", "install", plugin], { home, env: context.env });
   } finally {
     await rm(stage, { recursive: true, force: true });
@@ -399,10 +403,13 @@ export async function installAntigravity(context) {
     await writeFile(createdMarker(context, file), `${file}\n`);
   }
   await installSkillPlugin(context);
-  const changes = [shimDir(home), file, pluginInstallPath(home), vendorManifestPath(home)];
+  // After the skill, whose wrapper the rule names. Always on (#214, 2026-09-27).
+  const allow = await ensureAllowRule(context);
+  const changes = [shimDir(home), file, pluginInstallPath(home), vendorManifestPath(home),
+    ...allow.changes];
 
-  const diagnostics = [];
-  const needsAction = [];
+  const diagnostics = [...allow.diagnostics];
+  const needsAction = [...allow.needsAction];
   if (locationOf(context) === "workspace") {
     diagnostics.push("a workspace registration loads only while this project is an open "
       + `Antigravity workspace; in print mode pass --add-dir ${context.antigravityWorkspace}`);
@@ -524,8 +531,14 @@ export async function uninstallAntigravity(context) {
     await rm(manifestMarker, { force: true });
   }
 
+  // The allow rule ACC recorded adding, and nothing else in the operator's file.
+  const allow = await withdrawAllowRule(context);
+  changes.push(...allow.changes);
+  diagnostics.push(...allow.diagnostics);
+
   if (!keep.includes(shimDir(home))) await rm(shimDir(home), { recursive: true, force: true });
-  return { ok: true, changes, diagnostics };
+  return { ok: true, changes, diagnostics,
+    ...(allow.needsAction.length > 0 ? { needsAction: allow.needsAction } : {}) };
 }
 
 /**
@@ -560,6 +573,12 @@ export async function detectAntigravity(context) {
   const needsAction = [];
   const blocked = locationChoice(context);
   const imported = await exists(importedPluginPath(context.home));
+  // Read from files only, so it is known for a client ACC did not run. It is
+  // the client's own approval control over what a woken session can answer.
+  const commandApproval = await inspectAllowRule(context);
+  const approval = { commandApproval,
+    inboundDelivery: { state: commandApproval.state, diagnostic: commandApproval.diagnostic } };
+  diagnostics.push(commandApproval.diagnostic);
   // The installer runs every adapter's detect and passes a null version for a
   // client it did not find. Asking agy then would spawn a binary the installer
   // could not run a moment ago, or - where it does exist but did not answer -
@@ -568,7 +587,8 @@ export async function detectAntigravity(context) {
     diagnostics.push("acc hooks not registered: Antigravity CLI was not found, so it was "
       + "not asked what it has loaded");
     if (blocked !== null) diagnostics.push(blocked.reason);
-    return { ok: true, changes: [], diagnostics, ...(blocked === null ? {} : { blocked }) };
+    return { ok: true, changes: [], diagnostics, ...approval,
+      ...(blocked === null ? {} : { blocked }) };
   }
   let readback = null;
   try {
@@ -622,11 +642,22 @@ export async function detectAntigravity(context) {
       + "first run and loads its skill, but none of its hook names, so no ACC hook runs here "
       + "(issue #176)");
   }
+  // Every install writes the rule, so where ACC's wrapper is on disk a missing
+  // or unreadable rule is an install to finish, whatever the delivery policy.
+  if (await exists(cliWrapperPath(context.home))) {
+    if (commandApproval.state === "prompts") {
+      needsAction.push(`acc install --adapter antigravity  # ${commandApproval.rule} is missing `
+        + `from permissions.allow in ${commandApproval.file}, so each ACC command waits for `
+        + "approval");
+    } else if (commandApproval.state === "unreadable") {
+      needsAction.push(commandApproval.diagnostic);
+    }
+  }
   if (blocked !== null) {
     diagnostics.push(blocked.reason);
     needsAction.push(blocked.reason);
   }
-  return { ok: true, changes: [], diagnostics,
+  return { ok: true, changes: [], diagnostics, ...approval,
     ...(blocked === null ? {} : { blocked }),
     ...(needsAction.length > 0 ? { needsAction } : {}) };
 }
@@ -678,8 +709,12 @@ export function planAntigravityInstall(context) {
   // installer leaves to the adapter - so the installer never deletes the copy
   // ahead of `agy plugin uninstall` and strands its manifest entry. That exact
   // ordering, with the shim directory, once left `{}` behind in the user's home.
+  // The operator's own settings, edited for ACC's allow rule wherever one can
+  // match: a wrapper path that needs quotes gets none.
   const plugin = [{ path: pluginInstallPath(context.home), kind: "merge" },
-    { path: vendorManifestPath(context.home), kind: "merge" }];
+    { path: vendorManifestPath(context.home), kind: "merge" },
+    ...(isShellWord(cliWrapperPath(context.home))
+      ? [{ path: agySettingsPath(context.home), kind: "merge" }] : [])];
   if (locationChoice(context) !== null) {
     return [shim, ...plugin,
       { path: globalHooksPath(context.home), kind: "merge" },

package/node_modules/@agents-can-communicate/adapter-claude-code/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-claude-code",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/adapter.mjs

@@ -5,6 +5,8 @@ import certification from "../certification.json" with { type: "json" };
 import { denyOutcome, injectOutcome, injectStartOwnerOutcome, normalizeClaudeHook } from "./hooks.mjs";
 import { MIN_VERSION, PROTOCOL_CONTRACT, bindNativeSession, offerMessage, planNativeActivation,
   probeNativeDelivery, refreshNativeSession, retireNativeSession } from "./inbox-delivery.mjs";
+import { observedInboxDirectories } from "./inbox-observed-directories.mjs";
+import { inboxSocketDirectories } from "./inbox-socket-directories.mjs";
 import { planClaudeInstall, detectClaude, installClaudePlugin, uninstallClaudePlugin } from "./install.mjs";
 
 export const CLAUDE_CODE_VERSION = "2.1.233";
@@ -92,6 +94,13 @@ export function createClaudeCodeAdapter() {
     refreshNativeSession,
     retireNativeSession,
     offerMessage,
+    // Where a sender connects to wake a session; a sandboxed sender is allowed these:
+    // the directories this environment implies, and those of every inbox bound here.
+    inboundSockets: context => [
+      ...inboxSocketDirectories({ env: context?.env, platform: context?.platform, uid: context?.uid }),
+      // Ownership is this process's own uid, never the context's naming override.
+      ...observedInboxDirectories({ stateRoot: context?.stateRoot }),
+    ],
 
     denyOutcome,
     injectOutcome,

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-endpoint.mjs

@@ -21,6 +21,8 @@ const own = info => typeof process.getuid !== "function" || info.uid === process
 const invalid = () => new Error("invalid Claude inbox endpoint registration");
 
 export const newEndpointId = () => `claude_inbox_${randomBytes(16).toString("hex")}`;
+// Where, under a workspace runtime directory, the records live.
+export const ENDPOINTS_DIRECTORY = "claude-inbox-endpoints";
 
 function valid(record) {
   return record !== null && typeof record === "object" && !Array.isArray(record)
@@ -41,7 +43,7 @@ async function directory(runtimeDir, create = false) {
   if (!absolute(runtimeDir)) throw invalid();
   if (create) await mkdir(runtimeDir, { recursive: true, mode: 0o700 });
   const root = await realpath(runtimeDir);
-  const dir = path.join(root, "claude-inbox-endpoints");
+  const dir = path.join(root, ENDPOINTS_DIRECTORY);
   if (create) await mkdir(dir, { mode: 0o700 }).catch(error => {
     if (error.code !== "EEXIST") throw error;
   });

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-observed-directories.mjs

@@ -0,0 +1,62 @@
+import { closeSync, constants, fstatSync, openSync, readdirSync, readFileSync } from "node:fs";
+import path from "node:path";
+
+import { ENDPOINTS_DIRECTORY } from "./inbox-endpoint.mjs";
+
+// The inbox directories of Claude Code sessions ACC has bound on this machine,
+// read from the adapter's own endpoint records in every workspace under ACC's
+// state root (review of #217). The environment-derived directories cover
+// sessions started from the installer's environment; a session started with
+// its own absolute CLAUDE_CODE_TMPDIR or XDG_RUNTIME_DIR binds elsewhere, and
+// the hook that bound it wrote down where.
+//
+// Synchronous: install, doctor and the managed refresh compose the grant list
+// while building one context, once per command. Every workspace and every
+// matching record is read - a count cap dropped whatever sorted past it, and
+// doctor then called the profile configured (review of #217) - and each read
+// is bounded to one small record. Nothing here throws; a record that cannot be
+// read or cannot be a Claude Code inbox adds nothing. A grant widens the Codex sandbox, so a directory is taken only when
+// it is named as Claude Code names its inbox directories (2.1.283:
+// `cc-socks` or `cc-socks-<uid>`), whatever a file on disk says.
+
+const RECORD = /^claude_inbox_[a-f0-9]{32}\.json$/;
+const INBOX_DIRECTORY = /^cc-socks(?:-\d+)?$/;
+const MAX_BYTES = 8_192;
+
+const list = directory => {
+  try {
+    return readdirSync(directory).sort();
+  } catch {
+    return [];
+  }
+};
+
+function socketPathIn(file, uid) {
+  let fd;
+  try {
+    fd = openSync(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const info = fstatSync(fd);
+    if (!info.isFile() || (uid !== null && info.uid !== uid) || info.size > MAX_BYTES) return null;
+    return JSON.parse(readFileSync(fd, "utf8"))?.socketPath ?? null;
+  } catch {
+    return null;
+  } finally {
+    if (fd !== undefined) try { closeSync(fd); } catch { /* already closed */ }
+  }
+}
+
+export function observedInboxDirectories({ stateRoot, uid = process.getuid?.() ?? null } = {}) {
+  if (typeof stateRoot !== "string" || !path.isAbsolute(stateRoot)) return [];
+  const workspaces = path.join(stateRoot, "workspaces");
+  const found = new Set();
+  for (const workspace of list(workspaces)) {
+    const records = path.join(workspaces, workspace, ENDPOINTS_DIRECTORY);
+    for (const name of list(records).filter(item => RECORD.test(item))) {
+      const socketPath = socketPathIn(path.join(records, name), uid);
+      if (typeof socketPath !== "string" || !path.isAbsolute(socketPath) || socketPath.includes("\0")) continue;
+      const directory = path.dirname(path.normalize(socketPath));
+      if (INBOX_DIRECTORY.test(path.basename(directory))) found.add(directory);
+    }
+  }
+  return [...found].sort();
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-socket-directories.mjs

@@ -0,0 +1,41 @@
+import path from "node:path";
+
+// Where Claude Code binds a session's inbox socket, read from the 2.1.283
+// binary (2026-09-27):
+//
+//   `${XDG_RUNTIME_DIR || CLAUDE_CODE_TMPDIR || "/tmp"}/cc-socks/<pid>.sock`
+//
+// and, when that path is longer than 103 bytes, `/tmp/cc-socks-<uid>/<pid>.sock`
+// (`$PREFIX/tmp` when TERMUX_VERSION is set). Claude Code's own list of default
+// socket directories adds `/run/user/<uid>/cc-socks` on Linux. Observed on
+// macOS: `/tmp/cc-socks/<pid>.sock`.
+//
+// A sender in a sandbox - a Codex shell running `acc reply` - has to be allowed
+// to connect here, or every live offer to a Claude Code session fails with
+// EPERM and waits for the recipient's next turn. The grant is a directory; the
+// adapter still checks Claude Code's session registry before every write, so a
+// wider grant cannot wake a reused pid.
+//
+// A relative override is resolved against the Claude Code process's own working
+// directory, which no installer can know, so it is left out. Native Windows
+// serves the inbox on a named pipe, which no Unix socket grant covers.
+
+const hostOf = platform => String(platform ?? process.platform).split("-")[0];
+const set = value => typeof value === "string" && value !== "";
+
+export function inboxSocketDirectories({ env = {}, platform, uid } = {}) {
+  const host = hostOf(platform);
+  if (host === "win32") return [];
+  const user = Number.isInteger(uid) ? uid : (process.getuid?.() ?? 0);
+  // Claude Code's `||`: an empty value falls through to the next one.
+  const root = [env.XDG_RUNTIME_DIR, env.CLAUDE_CODE_TMPDIR].find(set) ?? "/tmp";
+  const fallbackRoot = set(env.TERMUX_VERSION) && set(env.PREFIX)
+    ? path.join(env.PREFIX, "tmp") : "/tmp";
+  const directories = [
+    path.join(root, "cc-socks"),
+    "/tmp/cc-socks",
+    ...(host === "linux" ? [`/run/user/${user}/cc-socks`] : []),
+    path.join(fallbackRoot, `cc-socks-${user}`),
+  ];
+  return [...new Set(directories.filter(directory => path.isAbsolute(directory)))];
+}

package/node_modules/@agents-can-communicate/adapter-codex/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-codex",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-codex/src/adapter.mjs

@@ -11,6 +11,7 @@ import { allowOutcome, denyOutcome, injectOutcome, normalizeCodexHook }
   from "./hooks.mjs";
 import { planCodexInstall, detectCodex, installCodexPlugin, preflightCodexUninstall,
   uninstallCodexPlugin } from "./install.mjs";
+import { controlSocket } from "./live-permissions.mjs";
 // Public native wiring is enabled only with installed-product capture evidence.
 
 // Re-exported so existing importers of CODEX_QUEUE_MINIMUM keep resolving; the
@@ -67,6 +68,8 @@ export function createCodexAdapter() {
     },
     probeNativeDelivery, planNativeActivation, bindNativeSession,
     refreshNativeSession, retireNativeSession, offerMessage,
+    // A Codex sender reaches another Codex session through its control socket.
+    inboundSockets: context => [controlSocket(context)],
     ...createCodexMaintenance(),
     ...createCodexServiceSetup(),
     startSession: async () => ({ ok: true, changes: [], diagnostics: [] }),

package/node_modules/@agents-can-communicate/adapter-codex/src/install.mjs

@@ -161,7 +161,7 @@ const sandboxReview = (config, file, stateRoot) =>
 
 export async function installCodexPlugin({ home, agentsHome = home,
   codexHome = path.join(home, ".codex"), dataHome, stateRoot, runner, node, cli, keepPreviousVersion = null,
-  requestedLivePolicy, livePolicy, clientVersion, platform }) {
+  requestedLivePolicy, livePolicy, clientVersion, platform, receiverSockets }) {
   // Read before writing, so a manifest that will not parse is found before a
   // plugin tree is laid down that nothing will then be able to remove.
   const existing = await readJson(marketplacePath(agentsHome), { name: MARKETPLACE,
@@ -182,7 +182,7 @@ export async function installCodexPlugin({ home, agentsHome = home,
       + "remove it and install again", { config });
   }
   const permissions = prepareLivePermissions(foreign.source, { home, codexHome, stateRoot,
-    file: config, requestedLivePolicy, livePolicy, clientVersion, platform });
+    file: config, requestedLivePolicy, livePolicy, clientVersion, platform, receiverSockets });
   const theirSandbox = permissions.skipLegacy || inspectConfig(permissions.source, config).sandbox;
   const permissionActions = permissions.status?.state === "unverified" ? [permissions.status.diagnostic] : [];
 
@@ -338,7 +338,8 @@ export async function uninstallCodexPlugin({ home, agentsHome = home,
 }
 
 export async function detectCodex({ home, agentsHome = home,
-  codexHome = path.join(home, ".codex"), stateRoot, clientVersion, platform, nativeDelivery }) {
+  codexHome = path.join(home, ".codex"), stateRoot, clientVersion, platform, nativeDelivery,
+  receiverSockets }) {
   const marketplace = await readJson(marketplacePath(agentsHome), null);
   const published = (marketplace?.plugins ?? []).some(entry => entry.name === PLUGIN_NAME);
   const config = await readFile(configPath(codexHome), "utf8").catch(() => "");
@@ -347,7 +348,7 @@ export async function detectCodex({ home, agentsHome = home,
   const cached = await stat(cachePath(codexHome))
     .then(() => true).catch(() => false);
   const outgoingDelivery = outgoingStatus(config, { home, codexHome, stateRoot,
-    file: configPath(codexHome), clientVersion, platform });
+    file: configPath(codexHome), clientVersion, platform, receiverSockets });
   // Saved trust is not readiness. Codex compares every current definition's
   // hash and can disable a trusted hook. Even a commented or stale single record
   // previously suppressed this check. Leave verification to Codex's /hooks;

package/node_modules/@agents-can-communicate/adapter-codex/src/live-permissions.mjs

@@ -1,5 +1,6 @@
+import { realpathSync } from "node:fs";
 import path from "node:path";
-import { channelSocketDirectory, tomlString } from "@agents-can-communicate/adapter-sdk";
+import { tomlString } from "@agents-can-communicate/adapter-sdk";
 import { compareVersions } from "./app-server-client.mjs";
 import { addPermissions, inspectPermissions } from "./permission-ownership.mjs";
 import { scanConfig } from "./toml-scan.mjs";
@@ -23,8 +24,12 @@ const configured = (source, context) => {
     && value(["features", "network_proxy"]) === "true"
     && value(["permissions", profile, "network", "enabled"]) === "true"
     && literal(value(["permissions", profile, "filesystem", context.stateRoot])) === "write"
-    && sockets(context).every(socket => literal(value(["permissions", profile, "network", "unix_sockets", socket])) === "allow");
+    && missingSockets(entries, profile, context).length === 0;
 };
+// The grants a profile lacks for the sockets ACC delivers to.
+const missingSockets = (entries, profile, context) => sockets(context).filter(socket =>
+  literal(entries.find(entry => !entry.header
+    && equal(entry.keys, ["permissions", profile, "network", "unix_sockets", socket]))?.value) !== "allow");
 
 const hasCustomPolicy = (source, context) => {
   const ownership = inspectPermissions(source);
@@ -48,10 +53,37 @@ const hasCustomPolicy = (source, context) => {
     || proxies.length > 1 || proxies.some(entry => entry.header || !["true", "false"].includes(entry.value));
 };
 
-// Match the channel's per-user temporary directory and Codex's actual home.
-// Grants cover only ACC's local channel namespace, never arbitrary Unix sockets.
-const sockets = context => [channelSocketDirectory(),
-  path.join(context.codexHome ?? path.join(context.home, ".codex"), "app-server-control", "app-server-control.sock")];
+// Where this adapter's own sessions receive: the app-server control socket in
+// Codex's actual home.
+export const controlSocket = context => path.join(context.codexHome ?? path.join(context.home, ".codex"),
+  "app-server-control", "app-server-control.sock");
+
+// Codex 0.157.1 on macOS, measured with `codex sandbox -P` (2026-09-27): a
+// granted path that exists when Codex builds the sandbox policy is compared in
+// its resolved form, and one that does not is kept as written, while Seatbelt
+// checks the path the kernel resolved. A `/tmp/cc-socks-501` grant made before
+// that directory existed never matched `/private/tmp/cc-socks-501/<pid>.sock`;
+// `/private/tmp/cc-socks-501` did, both before and after. So the existing
+// parent is resolved the way the kernel will, and the last component is kept as
+// spelled: a socket that is a link - Codex's own control socket - must keep
+// naming the link, because its target changes with every daemon.
+export function grantPath(target, realpath = realpathSync.native) {
+  const tail = [path.basename(target)];
+  for (let parent = path.dirname(target); ; parent = path.dirname(parent)) {
+    try {
+      return path.join(realpath(parent), ...tail);
+    } catch {
+      if (parent === path.dirname(parent)) return target;
+      tail.unshift(path.basename(parent));
+    }
+  }
+}
+
+// Every socket ACC delivers to - Codex's own and each receiving adapter's
+// declaration, composed by the installer as `receiverSockets` - and nothing
+// else: grants cover ACC's local receivers, never arbitrary Unix sockets.
+const sockets = context => [...new Set([controlSocket(context), ...(context.receiverSockets ?? [])]
+  .map(socket => grantPath(socket, context.realpath)))].sort();
 
 export function outgoingStatus(source, context) {
   const state = inspectPermissions(source).state;
@@ -62,8 +94,10 @@ export function outgoingStatus(source, context) {
       : ready ? null : "sender_permissions_unverified";
   return { state: reasonCode === null ? "configured" : "unverified", reasonCode,
     setup: supported(context)
-      ? "Codex outgoing setup: default workspace settings gain ACC state write access and an ACC local socket allowlist "
-        + "through the network proxy (external network stays denied); custom policies are preserved. Start a new session after installation."
+      ? "Codex outgoing setup: default workspace settings gain ACC state write access and an allowlist of the "
+        + "local sockets ACC delivers to - ACC's own channel, the Codex control socket and other clients' session "
+        + "inboxes - through the network proxy (external network stays denied); custom policies are preserved. "
+        + "Start a new session after installation."
       : null,
     diagnostic: reasonCode === null
       ? "outgoing live delivery: local socket permissions configured for new sessions; active session overrides remain unverified"
@@ -73,8 +107,21 @@ export function outgoingStatus(source, context) {
           : custom
             ? "custom permission policy was preserved; manually allow ACC state and local sockets "
               + "through the network proxy in the effective workspace profile"
-            : "ACC outgoing grants are absent; run acc install --adapter codex --delivery actionable, "
-              + "then start a new session") };
+            : state === "owned"
+              ? `${incomplete(source, context)}; run acc install --adapter codex, then start a new session`
+              : "ACC outgoing grants are absent; run acc install --adapter codex --delivery actionable, "
+                + "then start a new session") };
+}
+
+// An owned profile ACC wrote for fewer receivers - 0.8.1 predates the Claude
+// Code inbox grant - or for another state root. Reinstalling rewrites it.
+function incomplete(source, context) {
+  const entries = scanConfig(source);
+  const profile = literal(entries.find(entry => !entry.header && equal(entry.keys, ["default_permissions"]))?.value);
+  const missing = typeof profile === "string" ? missingSockets(entries, profile, context) : [];
+  return missing.length > 0
+    ? `ACC outgoing grants do not cover every socket ACC delivers to; missing ${missing.join(", ")}`
+    : "ACC outgoing grants are out of date";
 }
 
 export function prepareLivePermissions(source, context) {
@@ -85,10 +132,15 @@ export function prepareLivePermissions(source, context) {
   // Once ACC owns a valid outgoing profile, turning incoming requests off must
   // not revoke the already approved ability to use ACC from the sandbox. A
   // fresh off install still creates no grants because it has no owned unit.
-  if (!requested && owned.state === "owned") {
+  // An owned unit written for fewer receivers is brought up to date even so:
+  // the approval was for ACC's local sockets, and without this `acc install`
+  // under a recorded off could never repair a profile an older ACC wrote.
+  const stale = owned.state === "owned" && supported(context) && Boolean(context.stateRoot)
+    && !configured(source, context) && !hasCustomPolicy(owned.source, context);
+  if (!requested && owned.state === "owned" && !stale) {
     return { source, skipLegacy: true, status: outgoingStatus(source, context) };
   }
-  if (!requested) return { source: owned.source, skipLegacy: hasPermissions(scanConfig(owned.source)) };
+  if (!requested && !stale) return { source: owned.source, skipLegacy: hasPermissions(scanConfig(owned.source)) };
   if (!supported(context) || !context.stateRoot) {
     return { source, skipLegacy: hasPermissions(scanConfig(source)), status: outgoingStatus(source, context) };
   }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/src/capabilities.mjs

@@ -129,6 +129,13 @@ export function defineAdapter(manifest) {
       usage(`optional native method ${method} must be a function`, { id: manifest.id, method });
     }
   }
+  // `inboundSockets(context)` names the Unix socket paths - directories or
+  // sockets - a sender connects to when this adapter's sessions receive live
+  // delivery. A sandboxed sender's installer allows exactly these, so a value
+  // that is not a function would silently read as "nothing to allow".
+  if (manifest.inboundSockets !== undefined && typeof manifest.inboundSockets !== "function") {
+    usage("optional inboundSockets must be a function", { id: manifest.id });
+  }
   if (manifest.nativeDelivery !== undefined) {
     const client = manifest.client.certificationName ?? manifest.client.command;
     native.nativeDelivery = validateNativeDeliveryContract(manifest.nativeDelivery,

package/node_modules/@agents-can-communicate/adapter-sdk/src/hook-shim.mjs

@@ -84,6 +84,15 @@ const PLACEHOLDER = "{{ACC}}";
 // shell's to interpret.
 const quote = value => `"${String(value).replace(/(["\\$`])/g, "\\$1")}"`;
 
+/**
+ * Whether a path is one shell word exactly as written: absolute, and made only
+ * of the POSIX portable filename characters and slashes. Nothing in it is
+ * expanded, split or quoted by a shell, so the unquoted text and the word a
+ * shell runs are the same string.
+ */
+export const isShellWord = value => typeof value === "string"
+  && /^\/[A-Za-z0-9._/-]*$/.test(value);
+
 /**
  * Write the small shim a client's hook command points at.
  *
@@ -231,13 +240,18 @@ export const defaultCli = () => ownBinary("acc.mjs");
  * JSON, worked out the schema, and wrote records and events by hand - inventing
  * an event type, a harness name, and its own generation tokens. So the command
  * is pinned here for the same reason it is pinned in the shim.
+ *
+ * `bareWhenSafe` names the shim without quotes when it is one shell word. A
+ * client that matches allow rules against the command's first word needs it:
+ * Antigravity CLI 1.2.12 never matched a command whose program word was quoted,
+ * whatever rule was loaded (issue #214). A path that needs quotes keeps them.
  */
-export async function bakeSkillCommand({ root, cliShim }) {
+export async function bakeSkillCommand({ root, cliShim, bareWhenSafe = false }) {
   if (typeof cliShim !== "string" || cliShim === "") {
     throw new AccError(EXIT.DATA, "refusing to bake an empty skill command", { cliShim });
   }
   // A managed data home is "Application Support"; an unquoted path splits.
-  const command = quote(cliShim);
+  const command = bareWhenSafe && isShellWord(cliShim) ? cliShim : quote(cliShim);
   const baked = [];
   const walk = async directory => {
     for (const entry of await readdir(directory, { withFileTypes: true })) {

package/node_modules/@agents-can-communicate/adapter-sdk/src/index.mjs

@@ -9,7 +9,7 @@ export { NATIVE_ACTIVATION_KINDS, NATIVE_BINDING_MODES, NATIVE_REASON_CODES,
   validateNativeActivationPlan, validateNativeDeliveryContract, validateNativeHandshake }
   from "./native-delivery.mjs";
 export { EVENT_KINDS, NORMALIZED_EVENT_KEYS, normalizedEvent } from "./events.mjs";
-export { assertRunner, bakeSkillCommand, defaultAntigravityRelay, defaultCli,
+export { assertRunner, bakeSkillCommand, defaultAntigravityRelay, defaultCli, isShellWord,
   defaultRunner, removeInstalledTree, runnerExists, writeCliShim, writeHookShim }
   from "./hook-shim.mjs";
 export { BEGIN, END, removeTomlBlock, renderBlock, stripBlock, tomlString, writeTomlBlock }

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/cli/src/doctor-command.mjs

@@ -12,7 +12,7 @@ export { describeNative } from "./native-delivery-status.mjs";
 import { nativeSessionLines, updateNativeSessions } from "./native-session-diagnostics.mjs";
 import { ALL_ADAPTERS, clientContext, probeTimeout } from "./install-command.mjs";
 import { decisionOf } from "./install-delivery-consent.mjs";
-import { describePresence } from "./main.mjs";
+import { describePresence, presenceBreakdown } from "./main.mjs";
 import { platformPaths } from "./platform-paths.mjs";
 import { noticeUpdate } from "./update-check.mjs";
 import { managedUpdateDiagnostic } from "./managed-runtime/diagnostics.mjs";
@@ -116,7 +116,7 @@ export async function diagnoseAdapters({ options, runtime, detect = detectInstal
     env: runtime?.env ?? {} });
   // The same environment install reads, so detection probes the same client.
   const clients = clientContext(home, path.join(dataHome, "acc"),
-    { env: runtime?.env ?? {} });
+    { env: runtime?.env ?? {}, platform: runtime?.platform });
   const adapters = ALL_ADAPTERS();
   const detected = await detect({ adapters, context: clients,
     probeTimeoutMs: probeTimeout(runtime?.env) });
@@ -192,8 +192,12 @@ export async function runDoctor({ options, context, runtime }) {
   // "unreadable protocol.json" and a person's first `acc doctor` in a new
   // project would answer that their store is broken.
   const started = await stat(path.join(root, "protocol.json")).then(() => true, () => false);
+  // Shaped like the storage report, so a reader of one finds every field of
+  // the other: without `trimmedThrough` the summary said "history from
+  // undefined" on every first doctor in a new project.
   const report = !started
-    ? { healthy: true, blocked: [], corrupt: [], repaired: [] }
+    ? { healthy: true, blocked: [], corrupt: [], repaired: [], swept: 0, staged: 0, partials: 0,
+      retired: 0, trimmedThrough: null }
     : options.repair === true
       ? await repairFilesystemStore({ root, clock })
       : await diagnoseFilesystemStore({ root });
@@ -276,7 +280,8 @@ export async function runDoctor({ options, context, runtime }) {
     report.trimmedThrough === null ? null : `history from ${report.trimmedThrough}`,
   ].filter(Boolean);
   const staging = held.length === 0 ? "" : ` (${held.join(", ")})`;
-  const text = [`store healthy${staging}; ${describePresence(status.counts)}; `
+  const text = [`store healthy${staging}; `
+    + `${describePresence(status.counts, presenceBreakdown(status.participants, ALL_ADAPTERS()))}; `
     + `protection ${status.protection}; ${installed} of ${adapters.length} adapter(s) installed`,
   ...adapters.filter(adapter => (adapter.present || adapter.installed)
     && adapter.nativeDelivery.reasonCode === "native_delivery_unsupported"