agents-can-communicate 0.8.4 → 0.9.0

package/node_modules/@agents-can-communicate/adapter-sdk/src/native-vocabulary.mjs

@@ -50,6 +50,13 @@ export const PROBE_KEYS = ["supported", "clientVersion", "protocolContract", "ex
   "modes", "reasonCode"];
 export const HANDSHAKE_KEYS = ["supported", "clientVersion", "protocolContract", "modes",
   "opaqueEndpointRef", "leaseUntil", "reasonCode"];
+// A refused handshake may name the client launch option that caused it, such
+// as Codex's `--search`. A bare option token, never its value: a value can be
+// anything a user typed.
+export const HANDSHAKE_OPTIONAL_KEYS = ["launchOption"];
+export const LAUNCH_OPTION = /^-(?:[a-z]|-[a-z][a-z0-9]*(?:-[a-z0-9]+)*)$/;
+export const isLaunchOption = value => typeof value === "string" && value.length <= 40
+  && LAUNCH_OPTION.test(value);
 
 export function usage(message, details = {}) {
   throw new AccError(EXIT.USAGE, message, details);
@@ -58,10 +65,10 @@ export function usage(message, details = {}) {
 export const isPlainObject = value => value !== null && typeof value === "object" && !Array.isArray(value);
 export const isText = value => typeof value === "string" && value !== "";
 
-export function closed(value, keys, label) {
+export function closed(value, keys, label, optional = []) {
   if (!isPlainObject(value)) usage(`${label} must be an object`);
   for (const key of Object.keys(value)) {
-    if (!keys.includes(key)) usage(`unknown ${label} field ${key}`, { key });
+    if (!keys.includes(key) && !optional.includes(key)) usage(`unknown ${label} field ${key}`, { key });
   }
   for (const key of keys) {
     if (!Object.hasOwn(value, key)) usage(`${label} requires ${key}`, { key });

package/node_modules/@agents-can-communicate/adapter-sdk/src/private-files.mjs

@@ -0,0 +1,35 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+
+// Private records an adapter keeps beside a live endpoint: one user's, never
+// reached through a link. POSIX keeps them to the owner with mode bits on each
+// file and directory. Windows has none - Node reports every file as 0o666 - and
+// keeps them private through the profile's ACL, checked for the data home once
+// (docs/design/2026-09-30-native-windows-support.md, section 8).
+
+export const isWindowsPlatform = platform => String(platform).startsWith("win32");
+
+/** Whether `info` grants none of `mask` to others; always so on Windows. */
+export const closedTo = (info, mask, { platform = process.platform } = {}) =>
+  isWindowsPlatform(platform) || (info.mode & mask) === 0;
+
+/**
+ * Open a regular file without following a link at its name. Windows has no
+ * O_NOFOLLOW, so the name is checked first and the handle after the open has to
+ * hold the file the name named.
+ */
+export async function openRegularNoFollow(file, flags = constants.O_RDONLY,
+  { platform = process.platform } = {}) {
+  if (!isWindowsPlatform(platform)) {
+    return open(file, flags | constants.O_NOFOLLOW | (constants.O_NONBLOCK ?? 0));
+  }
+  const named = await lstat(file, { bigint: true });
+  if (!named.isFile()) throw Object.assign(new Error(`not a regular file: ${file}`), { code: "EINVAL" });
+  const handle = await open(file, flags);
+  const opened = await handle.stat({ bigint: true }).catch(() => null);
+  if (opened?.dev !== named.dev || opened?.ino !== named.ino) {
+    await handle.close().catch(() => null);
+    throw Object.assign(new Error(`replaced while opening: ${file}`), { code: "EINVAL" });
+  }
+  return handle;
+}

package/node_modules/@agents-can-communicate/adapter-sdk/src/process-table.mjs

@@ -0,0 +1,232 @@
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+// A hook runs in front of someone's turn. Reading the table is worth a few
+// hundred milliseconds once per session and nothing at all if it is slow.
+const DEFAULT_TIMEOUT_MS = 1_000;
+
+const LINE = /^\s*(\d+)\s+(\d+)\s+(.+?)\s*$/;
+// A pid, then the whole rest of the line: a command line has spaces anywhere.
+const ARGS_LINE = /^\s*(\d+)\s+(.+?)\s*$/;
+// Command lines are long; measured at 231 KB for 1,137 processes on a desktop
+// Mac, a quarter of execFile's default buffer.
+const ARGS_BUFFER = 16 * 1024 * 1024;
+
+// Deep enough for a client that wraps its hook in a shell and a launcher.
+const WINDOWS_HOPS = 8;
+
+async function posixTable({ run, timeoutMs }) {
+  const options = { timeout: timeoutMs, killSignal: "SIGKILL", windowsHide: true };
+  const [tree, commandLines] = await Promise.all([
+    run("ps", ["-o", "pid=,ppid=,comm=", "-A"], options).then(({ stdout }) => stdout, () => null),
+    run("ps", ["-A", "-o", "pid=,args="], { ...options, maxBuffer: ARGS_BUFFER })
+      .then(({ stdout }) => stdout, () => ""),
+  ]);
+  if (typeof tree !== "string") return new Map();
+  const args = new Map();
+  for (const line of String(commandLines).split("\n")) {
+    const match = ARGS_LINE.exec(line);
+    if (match !== null) args.set(Number(match[1]), match[2]);
+  }
+  const table = new Map();
+  for (const line of tree.split("\n")) {
+    const match = LINE.exec(line);
+    if (match === null) continue;
+    const pid = Number(match[1]);
+    table.set(pid, { ppid: Number(match[2]), comm: match[3],
+      ...(args.has(pid) ? { args: args.get(pid) } : {}) });
+  }
+  return table;
+}
+
+// Windows has no `ps` and no longer ships `wmic`. Win32_Process through CIM
+// answers pid, parent, creation time and command line. A full scan took 1.07 s
+// in Windows PowerShell 5.1 on a windows-latest runner, so the script asks only
+// for the chain it needs, one filtered query per hop. The creation time goes
+// out as a string: a FILETIME is larger than a double holds exactly.
+const chainScript = (from, hops) => `$ErrorActionPreference = 'Stop'
+$next = ${Number(from)}
+$chain = New-Object System.Collections.ArrayList
+for ($hop = 0; $hop -lt ${Number(hops)}; $hop++) {
+  $p = Get-CimInstance Win32_Process -Filter "ProcessId=$next" -Property ProcessId,ParentProcessId,CreationDate,Name,CommandLine
+  if ($null -eq $p) { break }
+  [void]$chain.Add([pscustomobject]@{ pid = [int]$p.ProcessId; ppid = [int]$p.ParentProcessId; name = [string]$p.Name; start = $p.CreationDate.ToFileTimeUtc().ToString(); cmd = [string]$p.CommandLine })
+  if ($p.ParentProcessId -eq 0 -or $p.ParentProcessId -eq $next) { break }
+  $next = [int]$p.ParentProcessId
+}
+ConvertTo-Json -Compress -InputObject @($chain)`;
+
+// PowerShell by absolute path only, so a PATH entry cannot stand in for it.
+// PowerShell 7 is not part of Windows; where it is installed it answers faster
+// (0.37 s against 1.07 s for a full scan, measured), and a missing one fails to
+// spawn at once.
+function powershellCandidates(env) {
+  const root = env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows";
+  const programs = env.ProgramFiles ?? env.PROGRAMFILES ?? "C:\\Program Files";
+  return [path.win32.join(programs, "PowerShell", "7", "pwsh.exe"),
+    path.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")];
+}
+
+// Windows Script Host reads the same chain through WMI in a quarter of the
+// time: 145 ms against PowerShell's 580, and 258 against 1,080 with four hooks
+// at once (windows-latest, measured), because it starts no .NET runtime. A
+// machine can switch it off by policy; PowerShell then reads the chain.
+const WMI_CHAIN = fileURLToPath(new URL("./windows-process-chain.wsf", import.meta.url));
+
+// WMI's `yyyymmddHHMMSS.ffffff+UUU` - offset in minutes - as a FILETIME string,
+// the form the PowerShell script prints.
+function wmiFileTime(value) {
+  const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d{6})([+-])(\d{3})$/.exec(value ?? "");
+  if (match === null) return undefined;
+  const [, year, month, day, hour, minute, second, micros, sign, offset] = match;
+  const local = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour),
+    Number(minute), Number(second));
+  const utc = local - (sign === "+" ? 1 : -1) * Number(offset) * 60_000;
+  return String((BigInt(utc) + 11_644_473_600_000n) * 10_000n + BigInt(micros) * 10n);
+}
+
+const chainOf = stdout => {
+  const parsed = JSON.parse(stdout);
+  return (Array.isArray(parsed) ? parsed : [parsed]).map(hop => (typeof hop?.created === "string"
+    ? { ...hop, start: wmiFileTime(hop.created) } : hop));
+};
+
+async function windowsChain({ from, hops, run, timeoutMs, env }) {
+  const deadline = Date.now() + timeoutMs;
+  const options = () => ({ timeout: Math.max(1, deadline - Date.now()), killSignal: "SIGKILL",
+    windowsHide: true, maxBuffer: ARGS_BUFFER });
+  const root = env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows";
+  try {
+    const { stdout } = await run(path.win32.join(root, "System32", "cscript.exe"),
+      ["//Nologo", WMI_CHAIN, String(Number(from)), String(Number(hops))], options());
+    return chainOf(stdout);
+  } catch {
+    // Script Host is off or failed; PowerShell below.
+  }
+  const encoded = Buffer.from(chainScript(from, hops), "utf16le").toString("base64");
+  for (const shell of powershellCandidates(env)) {
+    if (Date.now() >= deadline) break;
+    try {
+      const { stdout } = await run(shell, ["-NoLogo", "-NoProfile", "-NonInteractive",
+        "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], options());
+      return chainOf(stdout);
+    } catch {
+      // Try the next shell; none left is the empty answer below.
+    }
+  }
+  return [];
+}
+
+/**
+ * Windows: one process - pid, parent, image name, creation time as a FILETIME
+ * string (to the microsecond, as WMI keeps it) and command line - or null when
+ * it cannot be read.
+ */
+export async function readWindowsProcess(pid, { run = execFileAsync, timeoutMs = DEFAULT_TIMEOUT_MS,
+  env = process.env } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  const [found] = await windowsChain({ from: pid, hops: 1, run, timeoutMs, env });
+  return found?.pid === pid ? found : null;
+}
+
+async function windowsTable({ from, run, timeoutMs, env }) {
+  const table = new Map();
+  let child = null;
+  for (const hop of await windowsChain({ from, hops: WINDOWS_HOPS, run, timeoutMs, env })) {
+    if (!Number.isSafeInteger(hop?.pid) || typeof hop.name !== "string") break;
+    // Windows never re-parents an orphan: its ppid can name a process that
+    // died and whose number was reused. A parent created after its child is
+    // exactly that, and nothing above it belongs to this chain.
+    if (child !== null && !(BigInt(hop.start ?? "0") <= BigInt(child.start ?? "0"))) break;
+    table.set(hop.pid, { ppid: hop.ppid, comm: hop.name,
+      ...(typeof hop.cmd === "string" && hop.cmd !== "" ? { args: hop.cmd } : {}),
+      ...(typeof hop.start === "string" ? { start: hop.start } : {}) });
+    child = hop;
+  }
+  return table;
+}
+
+/**
+ * Processes on this machine, as pid -> parent, executable and, when it could be
+ * read, command line.
+ *
+ * POSIX reads the whole table with `ps`. Windows reads the chain from `from`
+ * upward - the only part a hook asks about - with a creation time for each hop.
+ * A failed read is an empty map, never an error: an empty table resolves no
+ * client, which is the "nobody knows" answer every caller already handles.
+ */
+export async function readProcessTable({ platform = process.platform, from = process.pid,
+  run = execFileAsync, timeoutMs = DEFAULT_TIMEOUT_MS, env = process.env } = {}) {
+  if (platform === "win32") return windowsTable({ from, run, timeoutMs, env });
+  return posixTable({ run, timeoutMs });
+}
+
+/**
+ * The words one process was started with, or null when they cannot be read.
+ *
+ * POSIX splits `ps -o args=` on whitespace, as every caller did before. Windows
+ * keeps one command-line string per process, split here the way the C runtime
+ * splits it.
+ */
+export async function readProcessArgs(pid, { platform = process.platform, run = execFileAsync,
+  timeoutMs = DEFAULT_TIMEOUT_MS, env = process.env, ps = "ps" } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (platform === "win32") {
+    const [own] = await windowsChain({ from: pid, hops: 1, run, timeoutMs, env });
+    return own?.pid === pid && typeof own.cmd === "string" && own.cmd !== ""
+      ? splitWindowsCommandLine(own.cmd) : null;
+  }
+  try {
+    const { stdout } = await run(ps, ["-o", "args=", "-p", String(pid)],
+      { timeout: timeoutMs, killSignal: "SIGKILL", windowsHide: true });
+    const words = stdout.trim().split(/\s+/).filter(Boolean);
+    return words.length > 0 ? words : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Split a Windows command line into argv the way CommandLineToArgvW does:
+ * whitespace separates words outside quotes; 2n backslashes before a quote are
+ * n backslashes and the quote toggles quoting; 2n+1 are n backslashes and a
+ * literal quote; backslashes elsewhere are literal.
+ */
+export function splitWindowsCommandLine(line) {
+  const words = [];
+  let word = "";
+  let started = false;
+  let quoted = false;
+  for (let index = 0; index < line.length; index += 1) {
+    const char = line[index];
+    if (char === "\\") {
+      let count = 0;
+      while (line[index] === "\\") { count += 1; index += 1; }
+      if (line[index] === "\"") {
+        word += "\\".repeat(Math.floor(count / 2));
+        if (count % 2 === 1) word += "\"";
+        else quoted = !quoted;
+      } else {
+        word += "\\".repeat(count);
+        index -= 1;
+      }
+      started = true;
+    } else if (char === "\"") {
+      quoted = !quoted;
+      started = true;
+    } else if ((char === " " || char === "\t") && !quoted) {
+      if (started) words.push(word);
+      word = "";
+      started = false;
+    } else {
+      word += char;
+      started = true;
+    }
+  }
+  if (started) words.push(word);
+  return words;
+}

package/node_modules/@agents-can-communicate/adapter-sdk/src/session-binding.mjs

@@ -43,13 +43,17 @@ function assertBindingDeadline(deadlineAt) {
 }
 
 export async function storeSessionBinding({ runtimeDir, harnessSessionId, accSessionId,
-  generation, clientVersion, platform, clientPid, deadlineAt, storeVersion, runtimeRoot }) {
+  generation, clientVersion, clientName, platform, clientPid, deadlineAt, storeVersion, runtimeRoot }) {
   assertBindingDeadline(deadlineAt);
   const file = fileFor(runtimeDir, harnessSessionId);
   const record = { schemaVersion: SCHEMA_VERSION, harnessSessionId, accSessionId, generation };
   assertIdentity(record);
   await mkdir(path.dirname(file), { recursive: true });
   if (typeof clientVersion === "string" && clientVersion !== "") record.clientVersion = clientVersion;
+  // The product the session runs in, when it is one of the adapter's variants
+  // rather than its own client: its evidence and its version line are its own.
+  // A reader that predates the field ignores it.
+  if (typeof clientName === "string" && clientName !== "") record.clientName = clientName;
   if (typeof platform === "string" && platform !== "") record.platform = platform;
   // The vendor process this session runs in, resolved once at SessionStart.
   // A native endpoint is matched against it, so a binding without one can
@@ -106,6 +110,7 @@ export async function loadSessionBinding({ runtimeDir, harnessSessionId }) {
   assertIdentity(record, harnessSessionId);
   const binding = { accSessionId: record.accSessionId, generation: record.generation };
   if (typeof record.clientVersion === "string") binding.clientVersion = record.clientVersion;
+  if (typeof record.clientName === "string" && record.clientName !== "") binding.clientName = record.clientName;
   if (typeof record.platform === "string") binding.platform = record.platform;
   if (isPid(record.clientPid)) binding.clientPid = record.clientPid;
   return binding;
@@ -147,6 +152,8 @@ export async function listSessionBindings({ runtimeDir }) {
       accSessionId: record.accSessionId, generation: record.generation,
       ...(typeof record.clientVersion === "string"
         ? { clientVersion: record.clientVersion } : {}),
+      ...(typeof record.clientName === "string" && record.clientName !== ""
+        ? { clientName: record.clientName } : {}),
       ...(typeof record.platform === "string" ? { platform: record.platform } : {}),
       ...(isPid(record.clientPid) ? { clientPid: record.clientPid } : {}) });
   }

package/node_modules/@agents-can-communicate/adapter-sdk/src/windows-command.mjs

@@ -0,0 +1,69 @@
+// A hook command in the form each client's Windows hook runner reads. Measured
+// from the clients' sources and binaries (docs/design/2026-09-30-native-windows-
+// support.md): Codex and Gemini CLI run PowerShell, Grok detects PowerShell,
+// Git Bash or cmd, Kimi Code runs cmd.exe, and Antigravity runs `cmd /c` through
+// Go, which escapes inner quotes as `\"` - a form cmd does not read.
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const defaultRun = promisify(execFile);
+
+// Characters one of those shells expands or ends a quoted word on. A path that
+// carries one is refused: writing it would run something other than the shim.
+const EXPANDED = /[$`"%]/;
+// What cmd acts on in a word outside quotes, whitespace included.
+const UNQUOTED_UNSAFE = /[\s&|<>^(),;=!]/;
+
+const powershellLiteral = value => `'${String(value).replaceAll("'", "''")}'`;
+const forward = value => String(value).replaceAll("\\", "/");
+
+/**
+ * @param {"powershell"|"portable"|"cmd"|"unquoted"} shell
+ * @param {{ node: string, shim: string, args: string[] }} parts
+ */
+export function windowsHookCommand(shell, { node, shim, args }) {
+  for (const word of [node, shim]) {
+    if (EXPANDED.test(word)) {
+      throw new Error(`a hook command cannot name ${word}: a Windows shell would expand it`);
+    }
+  }
+  const tail = args.join(" ");
+  switch (shell) {
+    // `&` runs a quoted program; single quotes take nothing literally but `''`.
+    // pwsh -Command reports exit 2 as 1 unless the command exits itself.
+    case "powershell":
+      return `& ${powershellLiteral(node)} ${powershellLiteral(shim)} ${tail}; exit $LASTEXITCODE`;
+    // Node from PATH, which every one of the three shells finds; the shim then
+    // prefers the pinned runner. Forward slashes survive bash unquoting.
+    case "portable":
+      return `node "${forward(shim)}" ${tail}`;
+    case "cmd":
+      return `"${node}" "${shim}" ${tail}`;
+    // The path reaches cmd bare: & | < > ^ ( ) run as cmd's own operators and
+    // , ; = split the word the way a space does, so none may be in it.
+    case "unquoted":
+      if (UNQUOTED_UNSAFE.test(shim)) {
+        throw new Error(`a hook command cannot name ${shim} unquoted: it has a space or a character cmd acts on`);
+      }
+      return `node ${forward(shim)} ${tail}`;
+    default:
+      throw new Error(`unknown Windows hook shell: ${shell}`);
+  }
+}
+
+/**
+ * The 8.3 form of a path with a space in it, for a hook runner that cannot pass
+ * a quoted path (Antigravity CLI). cmd prints it through `%~s`. A volume with 8.3
+ * names turned off answers with the long path, which the caller then refuses.
+ */
+export async function shortPath(file, { run = defaultRun, env = process.env } = {}) {
+  if (!/\s/.test(file)) return file;
+  if (/["%^&|<>!]/.test(file)) return file;
+  const comspec = env.ComSpec ?? env.COMSPEC ?? "cmd.exe";
+  const { stdout } = await run(comspec, ["/d", "/c", `for %I in ("${file}") do @echo %~sI`],
+    { windowsHide: true, windowsVerbatimArguments: true, timeout: 5_000 });
+  const answer = String(stdout).trim().split(/\r?\n/).at(-1) ?? "";
+  return answer === "" ? file : answer;
+}
+

package/node_modules/@agents-can-communicate/adapter-sdk/src/windows-process-chain.wsf

@@ -0,0 +1,45 @@
+<?xml version="1.0" ?>
+<!--
+  The chain of processes from one pid upward, read through WMI by Windows Script
+  Host: cscript //Nologo windows-process-chain.wsf <pid> <hops>. Prints a JSON
+  array of { pid, ppid, name, created, cmd }, created in WMI's own date form.
+  JScript here predates JSON, so strings are escaped by hand, and everything
+  outside printable ASCII as \uXXXX: the output never depends on a code page.
+-->
+<job>
+<script language="JScript"><![CDATA[
+var next = parseInt(WScript.Arguments(0), 10);
+var hops = parseInt(WScript.Arguments(1), 10);
+var wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
+
+function text(value) {
+  if (value === null || typeof value === "undefined") return "null";
+  var source = String(value);
+  var out = "\"";
+  for (var index = 0; index < source.length; index++) {
+    var code = source.charCodeAt(index);
+    if (code === 34) out += "\\\"";
+    else if (code === 92) out += "\\\\";
+    else if (code < 32 || code > 126) {
+      var hex = code.toString(16);
+      out += "\\u" + "0000".substr(hex.length) + hex;
+    } else out += source.charAt(index);
+  }
+  return out + "\"";
+}
+
+var chain = [];
+for (var hop = 0; hop < hops && next > 0; hop++) {
+  var found = new Enumerator(wmi.ExecQuery("SELECT ProcessId,ParentProcessId,Name,CommandLine,"
+    + "CreationDate FROM Win32_Process WHERE ProcessId=" + next));
+  if (found.atEnd()) break;
+  var process = found.item();
+  chain.push("{\"pid\":" + process.ProcessId + ",\"ppid\":" + process.ParentProcessId
+    + ",\"name\":" + text(process.Name) + ",\"created\":" + text(process.CreationDate)
+    + ",\"cmd\":" + text(process.CommandLine) + "}");
+  if (process.ParentProcessId === 0 || process.ParentProcessId === next) break;
+  next = process.ParentProcessId;
+}
+WScript.StdOut.Write("[" + chain.join(",") + "]");
+]]></script>
+</job>

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.8.4",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {
     ".": "./src/index.mjs",
+    "./hook-support": "./src/hook-support.mjs",
     "./managed-entry": "./src/managed-runtime/entry.mjs",
     "./managed-worker": "./src/managed-runtime/worker.mjs"
   },

package/node_modules/@agents-can-communicate/cli/src/config-command.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 
 import { AccError, CONFIG_FILENAME, EXIT, createId, defaultProjectConfig,
   validateProjectConfig } from "@agents-can-communicate/protocol";
+import { openNoFollow } from "@agents-can-communicate/storage-filesystem";
 
 const configPathIn = cwd => path.join(cwd, CONFIG_FILENAME);
 
@@ -32,7 +33,7 @@ async function readConfig(cwd) {
   try {
     // Same rule as discovery: a config reached through a symlink may point
     // anywhere, so it is refused rather than followed.
-    handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    handle = await openNoFollow(file, constants.O_RDONLY);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw new AccError(EXIT.DATA, "cannot safely read the workspace config",

package/node_modules/@agents-can-communicate/cli/src/doctor-command.mjs

@@ -50,13 +50,66 @@ import { diagnoseFilesystemStore, repairFilesystemStore }
  *
  * Null for anything unreadable. "Might be old" on every run is not a diagnosis.
  */
+/**
+ * The package directory of the runner a shim or config names, or null.
+ *
+ * ACC writes the runner in double quotes in every form: a shell shim
+ * (`ACC_RUNNER="..."`), the Node shim Windows gets (a JSON string) and Kimi's
+ * config (a TOML string holding a command, whose own quotes are cmd's on
+ * Windows and TOML's elsewhere). Each quoted string is read the way a shell
+ * reads one: a backslash escapes only a quote, a backslash, $ or a backtick,
+ * which is all the shim escapes and all a path needs undone in JSON or TOML,
+ * so an unescaped C:\Users\... in a shell script stays that path. A string
+ * holding quotes is a command. A Windows path in it is cmd's, which has no
+ * escape character, so it is read as it stands and a UNC path keeps its leading
+ * \\; other words are read the shell's way, since Kimi's POSIX command escapes a
+ * quote in a path; then, when no word names the runner, the string is read
+ * whole, since a POSIX path may hold a quote.
+ * An apostrophe, as in C:\Users\O'Neil, is part of a path. An unquoted path is
+ * read to the whitespace before it.
+ */
+const RUNNER = /[\\/]agents-can-communicate(?=[\\/]bin[\\/]acc-hook\.mjs)/;
+const absoluteRoot = value => {
+  const match = RUNNER.exec(value);
+  if (match === null) return null;
+  const root = value.slice(0, match.index + match[0].length);
+  return /^(?:[A-Za-z]:)?[\\/]/.test(root) ? root : null;
+};
+
+const quotedStrings = text => [...text.matchAll(/"((?:[^"\\]|\\[\s\S])*)"/g)]
+  .map(([, quoted]) => quoted.replace(/\\(["\\$`])/g, "$1"));
+
+const commandRoot = command => {
+  for (const [, word] of command.matchAll(/"([^"]*)"/g)) {
+    const root = /^(?:[A-Za-z]:\\|\\\\)/.test(word) ? absoluteRoot(word) : null;
+    if (root !== null) return root;
+  }
+  for (const word of quotedStrings(command)) {
+    const root = absoluteRoot(word);
+    if (root !== null) return root;
+  }
+  return absoluteRoot(command);
+};
+
+export function runnerRoot(text) {
+  for (const value of quotedStrings(String(text))) {
+    const root = value.includes("\"") ? commandRoot(value) : absoluteRoot(value);
+    if (root !== null) return root;
+  }
+  const flat = String(text);
+  const match = RUNNER.exec(flat);
+  if (match === null) return null;
+  const start = flat.slice(0, match.index).search(/\S+$/);
+  return start < 0 ? null : absoluteRoot(flat.slice(start));
+}
+
 export async function wiredVersion(shimPath) {
   if (typeof shimPath !== "string" || shimPath === "") return null;
   const text = await readFile(shimPath, "utf8").catch(() => null);
   if (text === null) return null;
-  const runner = /["']?(\/[^"'\s]*\/agents-can-communicate)\/bin\/acc-hook\.mjs["']?/.exec(text);
-  if (runner === null) return null;
-  const manifest = await readFile(path.join(runner[1], "package.json"), "utf8")
+  const root = runnerRoot(text);
+  if (root === null) return null;
+  const manifest = await readFile(path.join(root, "package.json"), "utf8")
     .catch(() => null);
   if (manifest === null) return null;
   try {
@@ -103,7 +156,10 @@ async function findShims(root, depth) {
   for (const entry of entries) {
     const target = path.join(root, entry.name);
     if (entry.isDirectory()) found.push(...await findShims(target, depth - 1));
-    else if (entry.name.endsWith(".sh")) found.push(target);
+    // The shell shim on POSIX, the Node shim on Windows.
+    else if (/^acc-(?:hook|cli)\.(?:sh|mjs)$/.test(entry.name) || entry.name.endsWith(".sh")) {
+      found.push(target);
+    }
   }
   return found;
 }

package/node_modules/@agents-can-communicate/cli/src/hook-support.mjs

@@ -0,0 +1,9 @@
+// What a hook needs from this package, without the rest of it. A hook starts a
+// process on every turn, and the package index loads the whole command line and
+// the installer with it: modules a hook never runs, about a millisecond each on
+// windows-latest.
+export { resolveHookWorkspace } from "./hook-workspace.mjs";
+export { createGitProbe } from "./git-probe.mjs";
+export { platformDataHome, runtimePaths } from "./runtime-paths.mjs";
+export { clearPin, hookEntrypointFor, resolvePinnedGeneration, writePin }
+  from "./managed-runtime/pins.mjs";

package/node_modules/@agents-can-communicate/cli/src/hook-workspace.mjs

@@ -12,7 +12,7 @@ import { runtimePaths } from "./runtime-paths.mjs";
 // this survives client exit: resuming the same native conversation keeps its
 // room. Adapter + native id distinguish independent conversations.
 export async function resolveHookWorkspace({ adapterId, event, room, cwd, dataHome, env = {},
-  gitProbe, clock, deadlineAt }) {
+  gitProbe, clock, deadlineAt, platform = process.platform }) {
   const identityKey = (adapter, native) => createHash("sha256")
     .update(JSON.stringify([adapter, native])).digest("hex");
   if (room !== undefined && !/^[a-f0-9]{64}$/.test(room)) {
@@ -72,7 +72,13 @@ export async function resolveHookWorkspace({ adapterId, event, room, cwd, dataHo
     let current = descriptor;
     if (descriptor.source === "git" && path.resolve(event.cwd) !== workspaceCwd) {
       const git = await gitProbe({ cwd: event.cwd }).catch(() => null);
-      if (git !== null && await realpath(git.commonDir) === descriptor.git.commonDir) {
+      // Both sides canonical: Git spells the directory the way the cwd did
+      // (through a symlink, or `C:/…` on Windows), and the room kept that
+      // spelling.
+      const same = git !== null && await Promise.all([git.commonDir, descriptor.git.commonDir]
+        .map(directory => realpath(directory).catch(() => null)))
+        .then(([here, room]) => here !== null && here === room);
+      if (same) {
         current = { ...descriptor, git };
       }
     }
@@ -97,13 +103,16 @@ export async function resolveHookWorkspace({ adapterId, event, room, cwd, dataHo
       const raced = await read();
       if (raced !== null) return discover(raced);
       deadline();
+      // On Windows the session this hook opens next flushes, and that commits
+      // this name with NTFS's journal; a crash before it leaves the room to be
+      // chosen again by the session's next hook.
       await writeManagedJson(file, { schemaVersion: 1, adapterId,
         nativeSessionId: event.sessionId, cwd: context.workspaceCwd,
         workspaceId: context.descriptor.id, source: context.descriptor.source,
         ...(context.descriptor.source === "git" ? { git: {
           commonDir: await realpath(context.descriptor.git.commonDir),
           worktreeRoot: await realpath(context.descriptor.git.worktreeRoot),
-        } } : {}) });
+        } } : {}) }, { flushName: platform !== "win32" });
       return { ...context, workspaceRef: `acc://${key}` };
     });
 }

package/node_modules/@agents-can-communicate/cli/src/main.mjs

@@ -164,7 +164,8 @@ export function recordedText(message, delivery) {
         ? "live offer blocked by sender permissions; message remains queued; run acc doctor in the sending session"
         : item.errorCode === "no_live_transport"
           ? `${item.recipientParticipantId} has no live transport`
-            + `${item.nativeReasonCode ? ` (${describeNativeReason(item.nativeReasonCode)})` : ""}`
+            + `${item.nativeReasonCode ? ` (${describeNativeReason(item.nativeReasonCode,
+              { launchOption: item.nativeLaunchOption })})` : ""}`
             + "; the message waits in its inbox"
         : item.errorCode === "recipient_offline" && item.endReason === "clear"
           ? `${item.recipientParticipantId}'s conversation was cleared (/clear); the message waits `

package/node_modules/@agents-can-communicate/cli/src/managed-runtime/activation.mjs

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-import { readdir, rm } from "node:fs/promises";
+import { readdir } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { assertPortableId } from "@agents-can-communicate/protocol";
@@ -8,6 +8,7 @@ import { listRuntimeHolds } from "./leases.mjs";
 import { confirmedDead, defaultPidIsAlive, withManagerLock } from "./mutex.mjs";
 import { reapPins } from "./pins.mjs";
 import { reapStagingHolds } from "./staging.mjs";
+import { removeTree } from "./portable-fs.mjs";
 import { canonicalManagerRoot, managedDirectory, readControl, readManagedJson, syncDirectory, writeControl } from "./state.mjs";
 
 /** The staged generation states its own contract in its manifest, so the
@@ -250,7 +251,7 @@ export async function reclaimGenerations({ root, active = null, pidIsAlive = def
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
       const directory = path.join(generations, entry.name);
       if (referenced.has(directory)) continue;
-      await rm(directory, { recursive: true, force: true });
+      await removeTree(directory);
       removed.push(entry.name);
     }
     if (removed.length) await syncDirectory(generations);