agents-can-communicate 0.8.5 → 0.9.0

package/node_modules/@agents-can-communicate/adapter-codex/src/native-endpoint.mjs

@@ -1,8 +1,9 @@
 import { randomBytes } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, mkdir, open, realpath, rename, rm } from "node:fs/promises";
+import { lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
 import path from "node:path";
 
+import { closedTo, isWindowsPlatform, openRegularNoFollow } from "@agents-can-communicate/adapter-sdk";
+
 import { PROTOCOL_CONTRACT, versionOrder } from "./app-server-client.mjs";
 
 const KEYS = ["schemaVersion", "endpointId", "socketPath", "threadId", "cwd",
@@ -28,7 +29,7 @@ function valid(record) {
     && Number.isFinite(Date.parse(record.leaseUntil));
 }
 
-async function directory(runtimeDir, create = false) {
+async function directory(runtimeDir, create = false, platform = process.platform) {
   if (!absolute(runtimeDir)) throw invalid();
   if (create) await mkdir(runtimeDir, { recursive: true, mode: 0o700 });
   const root = await realpath(runtimeDir);
@@ -37,11 +38,25 @@ async function directory(runtimeDir, create = false) {
     if (error.code !== "EEXIST") throw error;
   });
   const info = await lstat(dir);
-  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || (info.mode & 0o022) !== 0) throw invalid();
+  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || !closedTo(info, 0o022, { platform })) {
+    throw invalid();
+  }
   return dir;
 }
 
-export async function socketIsReady(socketPath) {
+/**
+ * An owned socket, never itself a link. On Windows Node's lstat refuses the
+ * daemon's AF_UNIX socket file with EACCES (measured on windows-latest, Codex
+ * 0.159.3), so there the socket counts while its directory lists it; Codex keeps
+ * that directory to its user.
+ */
+export async function socketIsReady(socketPath, { platform = process.platform } = {}) {
+  if (isWindowsPlatform(platform)) {
+    if (!absolute(socketPath)) return false;
+    const name = path.basename(socketPath).toLowerCase();
+    const names = await readdir(path.dirname(socketPath)).catch(() => []);
+    return names.some(entry => entry.toLowerCase() === name);
+  }
   if (!absolute(socketPath)) return false;
   try {
     const info = await lstat(socketPath);
@@ -53,7 +68,14 @@ export async function socketIsReady(socketPath) {
  * symlink at the path it reports and the socket itself under /private/tmp
  * (measured 2026-09-26), so the path is followed once and the socket at its
  * end is held to socketIsReady: an owned socket, never itself a link. */
-export async function readySocketPath(socketPath) {
+export async function readySocketPath(socketPath, { platform = process.platform } = {}) {
+  if (isWindowsPlatform(platform)) {
+    // The socket file itself refuses to be opened; its directory resolves.
+    if (!absolute(socketPath)) return null;
+    const directory = await realpath(path.dirname(socketPath)).catch(() => null);
+    const resolved = directory === null ? null : path.join(directory, path.basename(socketPath));
+    return resolved !== null && await socketIsReady(resolved, { platform }) ? resolved : null;
+  }
   if (!absolute(socketPath)) return null;
   const resolved = await realpath(socketPath).catch(() => null);
   return resolved !== null && await socketIsReady(resolved) ? resolved : null;
@@ -61,11 +83,11 @@ export async function readySocketPath(socketPath) {
 
 // A fresh, immutable registration for one hook binding. Refresh observes the
 // same registration again; it cannot overwrite a successor's random endpoint.
-export async function writeNativeEndpoint({ runtimeDir, record }) {
-  if (!valid(record) || !await socketIsReady(record.socketPath)) throw invalid();
+export async function writeNativeEndpoint({ runtimeDir, record, platform = process.platform }) {
+  if (!valid(record) || !await socketIsReady(record.socketPath, { platform })) throw invalid();
   const text = `${JSON.stringify(record)}\n`;
   if (Buffer.byteLength(text) > MAX_BYTES) throw invalid();
-  const dir = await directory(runtimeDir, true);
+  const dir = await directory(runtimeDir, true, platform);
   const file = path.join(dir, `${record.endpointId}.json`);
   const temporary = path.join(dir, `.${record.endpointId}.${randomBytes(8).toString("hex")}.tmp`);
   let handle;
@@ -82,25 +104,26 @@ export async function writeNativeEndpoint({ runtimeDir, record }) {
 
 // Expired records are metadata for revalidation, never proof of reachability.
 // Refuse links and oversized files before reading; no foreign error text escapes.
-export async function readNativeEndpoint({ runtimeDir, endpointId }) {
+export async function readNativeEndpoint({ runtimeDir, endpointId, platform = process.platform }) {
   if (typeof endpointId !== "string" || !ENDPOINT.test(endpointId)) return null;
   let handle;
   try {
-    const dir = await directory(runtimeDir);
-    handle = await open(path.join(dir, `${endpointId}.json`),
-      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const dir = await directory(runtimeDir, false, platform);
+    handle = await openRegularNoFollow(path.join(dir, `${endpointId}.json`), undefined, { platform });
     const info = await handle.stat();
-    if (!info.isFile() || !own(info) || info.size > MAX_BYTES || (info.mode & 0o077) !== 0) return null;
+    if (!info.isFile() || !own(info) || info.size > MAX_BYTES || !closedTo(info, 0o077, { platform })) {
+      return null;
+    }
     const record = JSON.parse(await handle.readFile("utf8"));
     return valid(record) && record.endpointId === endpointId ? record : null;
   } catch { return null; }
   finally { await handle?.close().catch(() => null); }
 }
 
-export async function removeNativeEndpoint({ runtimeDir, endpointId }) {
+export async function removeNativeEndpoint({ runtimeDir, endpointId, platform = process.platform }) {
   if (typeof endpointId !== "string" || !ENDPOINT.test(endpointId)) return;
   try {
-    const dir = await directory(runtimeDir);
+    const dir = await directory(runtimeDir, false, platform);
     await rm(path.join(dir, `${endpointId}.json`), { force: true });
   } catch { /* retirement is already recorded; cleanup is best effort */ }
 }

package/node_modules/@agents-can-communicate/adapter-codex/src/ws-json-rpc.mjs

@@ -75,8 +75,10 @@ export function refusesConnections(socketPath, { timeoutMs = 1_000 } = {}) {
   });
 }
 
+// `connect` returns the byte stream to speak over: a socket by default, or on
+// Windows the stdio of `codex app-server proxy`, which relays to the same server.
 export function openWebSocketPeer({ socketPath, timeoutMs, path = "/", host = "localhost",
-  retainNotifications = true }) {
+  retainNotifications = true, connect = () => net.createConnection(socketPath) }) {
   const notifications = [];
   const pending = new Map();
   const key = randomBytes(16).toString("base64");
@@ -90,7 +92,7 @@ export function openWebSocketPeer({ socketPath, timeoutMs, path = "/", host = "l
   const ready = new Promise((resolve, reject) => { resolveReady = resolve; rejectReady = reject; });
   ready.catch(() => {});
 
-  const socket = net.createConnection(socketPath);
+  const socket = connect();
   socket.on("connect", () => socket.write(`GET ${path} HTTP/1.1\r\nHost: ${host}\r\n`
     + `Upgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Key: ${key}\r\n`
     + "Sec-WebSocket-Version: 13\r\n\r\n"));

package/node_modules/@agents-can-communicate/adapter-gemini-cli/extension/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "agents-can-communicate",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "description": "Coordinate this Gemini CLI session with other AI agent sessions working in the same workspace.",
   "contextFileName": "skills/acc/SKILL.md"
 }

package/node_modules/@agents-can-communicate/adapter-gemini-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-gemini-cli",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-gemini-cli/src/adapter.mjs

@@ -43,7 +43,8 @@ export function createGeminiCliAdapter() {
     // The binary this client actually installs. Probed for a version to
     // decide whether the client is on this machine, so it has to be the
     // real command rather than the adapter id: `0.57.0`.
-    client: { command: "gemini", certificationName: "gemini-cli", versionArgs: ["--version"] },
+    client: { command: "gemini", package: "@google/gemini-cli", certificationName: "gemini-cli",
+      versionArgs: ["--version"] },
     certification,
     capabilities: {
       lifecycle: { sessionStart: true, sessionEnd: true },

package/node_modules/@agents-can-communicate/adapter-gemini-cli/src/install.mjs

@@ -6,7 +6,7 @@ import { fileURLToPath } from "node:url";
 
 import { acccreatedFile, bakeSkillCommand, blankJson, ownVersion, removeIfEmpty,
   removeInstalledTree,
-  stampPluginVersion, writeCliShim, writeForeignJson, writeHookShim }
+  shellQuote, stampPluginVersion, windowsHookCommand, writeCliShim, writeForeignJson, writeHookShim }
   from "@agents-can-communicate/adapter-sdk";
 
 const bundle = fileURLToPath(new URL("../extension", import.meta.url));
@@ -46,11 +46,16 @@ const writeJson = (file, value) => writeForeignJson(file, value,
 const isOurs = hook => typeof hook?.name === "string" && hook.name.startsWith(OWNER_PREFIX);
 
 // Replace the bundle's placeholder command with the shim that was just written.
-const withShim = (wiring, shim) => ({ hooks: Object.fromEntries(
+// On Windows this client runs hooks through PowerShell, which has no `sh`: the
+// pinned node runs the Node shim there.
+const withShim = (wiring, shim, windowsNode = null) => ({ hooks: Object.fromEntries(
   Object.entries(wiring.hooks).map(([event, entries]) => [event, entries.map(entry => ({
     ...entry,
-    hooks: entry.hooks.map(hook => ({ ...hook,
-      command: `sh "${shim}" ${hook.command.split(" ").pop()}` })),
+    hooks: entry.hooks.map(hook => {
+      const kind = hook.command.split(" ").pop();
+      return { ...hook, command: windowsNode === null ? `sh ${shellQuote(shim)} ${kind}`
+        : windowsHookCommand("powershell", { node: windowsNode, shim, args: [kind] }) };
+    }),
   }))])) });
 
 /**
@@ -62,7 +67,8 @@ const withShim = (wiring, shim) => ({ hooks: Object.fromEntries(
  * No environment variable is copied or persisted. The extension declares what
  * it needs; secrets stay where the user put them.
  */
-export async function installGeminiExtension({ home, runner, cli, node }) {
+export async function installGeminiExtension({ home, runner, cli, node,
+  hostPlatform = process.platform }) {
   // Read before writing: a settings file that will not parse must not be found
   // out after the extension tree is already on disk.
   const found = await readJson(settingsPath(home), null);
@@ -82,15 +88,15 @@ export async function installGeminiExtension({ home, runner, cli, node }) {
   await rm(path.join(target, "hooks", "hooks.json"), { force: true });
   // The skill ships with a placeholder where the command belongs: `acc` is
   // not on PATH everywhere, and an agent that cannot run it improvises.
-  const cliShim = await writeCliShim({ dir: target, cli, node });
-  await bakeSkillCommand({ root: target, cliShim });
+  const cliShim = await writeCliShim({ dir: target, cli, node, platform: hostPlatform });
+  await bakeSkillCommand({ root: target, cliShim, platform: hostPlatform });
   // This client offers no plugin-root variable in a hook command, so the shim's
   // absolute path is written in at install time.
   const shim = await writeHookShim({ dir: path.join(target, "hooks"),
-    adapterId: "gemini_cli", runner, node });
+    adapterId: "gemini_cli", runner, node, platform: hostPlatform });
 
   const ours = withShim(await readJson(path.join(bundle, "hooks", "hooks.json"),
-    { hooks: {} }), shim);
+    { hooks: {} }), shim, hostPlatform === "win32" ? node ?? process.execPath : null);
   const file = settingsPath(home);
   const merged = { ...existing, hooks: { ...(existing.hooks ?? {}) } };
   // Recorded now: afterwards a settings file holding `{}` looks the same

package/node_modules/@agents-can-communicate/adapter-grok/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-grok",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-grok/src/install.mjs

@@ -3,7 +3,8 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
-import { bakeSkillCommand, removeInstalledTree, writeCliShim, writeHookShim }
+import { bakeSkillCommand, removeInstalledTree, shellQuote, windowsHookCommand, writeCliShim,
+  writeHookShim }
   from "@agents-can-communicate/adapter-sdk";
 
 const bundle = fileURLToPath(new URL("../plugin", import.meta.url));
@@ -15,7 +16,9 @@ export const grokHomeOf = context =>
   context.grokHome ?? path.join(context.home, ".grok");
 
 export const hooksFile = home => path.join(home, "hooks", HOOKS_NAME);
-export const shimPath = home => path.join(home, "hooks", SHIM_NAME);
+// Windows gets the Node shim: no Windows client can be relied on to have `sh`.
+export const shimPath = (home, platform = process.platform) => path.join(home, "hooks",
+  platform === "win32" ? SHIM_NAME.replace(/\.sh$/, ".mjs") : SHIM_NAME);
 export const skillPath = home => path.join(home, "skills", "acc");
 
 async function readJson(file, fallback) {
@@ -46,37 +49,44 @@ const writeJson = async (file, value) => {
 // for plugins; we install into ~/.grok/hooks, which is always trusted and does
 // not need [plugins].enabled. The shim's absolute path is written in at install
 // time, the same lesson Codex taught: a relative hook command fails silently.
-const withShim = (wiring, shim) => ({
+// On Windows this client runs hooks through the shell it detects - pwsh, Git
+// Bash or cmd - so the command is written in the one form all three read.
+const withShim = (wiring, shim, windowsNode = null) => ({
   description: wiring.description,
   hooks: Object.fromEntries(Object.entries(wiring.hooks).map(([event, entries]) =>
     [event, entries.map(entry => ({
       ...entry,
-      hooks: entry.hooks.map(hook => ({ ...hook,
-        command: `sh "${shim}" ${hook.command.split(" ").pop()}` })),
+      hooks: entry.hooks.map(hook => {
+        const kind = hook.command.split(" ").pop();
+        return { ...hook, command: windowsNode === null ? `sh ${shellQuote(shim)} ${kind}`
+          : windowsHookCommand("portable", { node: windowsNode, shim, args: [kind] }) };
+      }),
     }))])),
 });
 
-export async function installGrokHooks({ grokHome, home, runner, cli, node }) {
+export async function installGrokHooks({ grokHome, home, runner, cli, node,
+  hostPlatform = process.platform }) {
   const root = grokHome ?? grokHomeOf({ home, grokHome });
   const template = await readJson(path.join(bundle, "hooks", "hooks.json"), { hooks: {} });
   const shim = await writeHookShim({ dir: path.join(root, "hooks"), adapterId: "grok",
-    runner, node, name: SHIM_NAME });
+    runner, node, name: SHIM_NAME, platform: hostPlatform });
 
   const skills = skillPath(root);
   await rm(skills, { recursive: true, force: true });
   await mkdir(path.dirname(skills), { recursive: true });
   await cp(path.join(bundle, "skills", "acc"), skills, { recursive: true });
-  const cliShim = await writeCliShim({ dir: skills, cli, node });
-  await bakeSkillCommand({ root: skills, cliShim });
+  const cliShim = await writeCliShim({ dir: skills, cli, node, platform: hostPlatform });
+  await bakeSkillCommand({ root: skills, cliShim, platform: hostPlatform });
 
-  await writeJson(hooksFile(root), withShim(template, shim));
+  await writeJson(hooksFile(root), withShim(template, shim,
+    hostPlatform === "win32" ? node ?? process.execPath : null));
   return { ok: true, changes: [hooksFile(root), shim, skills], diagnostics: [] };
 }
 
-export async function uninstallGrokHooks({ grokHome, home, keep = [] }) {
+export async function uninstallGrokHooks({ grokHome, home, keep = [], hostPlatform }) {
   const root = grokHome ?? grokHomeOf({ home, grokHome });
   const changes = [];
-  for (const target of [hooksFile(root), shimPath(root), skillPath(root)]) {
+  for (const target of [hooksFile(root), shimPath(root, hostPlatform), skillPath(root)]) {
     if (await removeInstalledTree(target, keep)) changes.push(target);
   }
   return { ok: true, changes, diagnostics: [] };
@@ -87,7 +97,8 @@ export async function detectGrok({ grokHome, home }) {
   const wired = await readJson(hooksFile(root), null);
   const installed = typeof wired?.hooks?.SessionStart?.[0]?.hooks?.[0]?.command
     === "string"
-    && wired.hooks.SessionStart[0].hooks[0].command.includes(SHIM_NAME);
+    // The shell shim on POSIX, the Node shim on Windows.
+    && /acc-hook\.(?:sh|mjs)\b/.test(wired.hooks.SessionStart[0].hooks[0].command);
   return { ok: true, changes: [],
     diagnostics: [installed ? "acc hooks registered" : "acc hooks not registered"] };
 }
@@ -96,7 +107,7 @@ export function planGrokInstall(context) {
   const root = grokHomeOf(context);
   return [
     { path: hooksFile(root), kind: "tree" },
-    { path: shimPath(root), kind: "tree" },
+    { path: shimPath(root, context.hostPlatform), kind: "tree" },
     { path: skillPath(root), kind: "tree" },
   ];
 }

package/node_modules/@agents-can-communicate/adapter-kimi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-kimi",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-kimi/src/adapter.mjs

@@ -32,7 +32,8 @@ export function createKimiAdapter() {
     // The binary this client actually installs. Probed for a version to
     // decide whether the client is on this machine, so it has to be the
     // real command rather than the adapter id: `0.36.1`.
-    client: { command: "kimi", certificationName: "kimi", versionArgs: ["--version"] },
+    client: { command: "kimi", package: "@moonshot-ai/kimi-code", certificationName: "kimi",
+      versionArgs: ["--version"] },
     certification,
     capabilities: {
       lifecycle: { sessionStart: true, heartbeat: true },

package/node_modules/@agents-can-communicate/adapter-kimi/src/install.mjs

@@ -4,9 +4,9 @@ import path from "node:path";
 import { AccError, EXIT } from "@agents-can-communicate/protocol";
 import { fileURLToPath } from "node:url";
 
-import { assertRunner, bakeSkillCommand, blankText, defaultRunner, removeIfEmpty,
-  ownVersion, stampPluginVersion,
-  removeInstalledTree, runnerExists, writeCliShim, writeForeignJson }
+import { assertRunner, bakeSkillCommand, blankText, defaultRunner, ownVersion, removeIfEmpty,
+  removeInstalledTree, runnerExists, shellQuote, stampPluginVersion, windowsHookCommand,
+  writeCliShim, writeForeignJson }
   from "@agents-can-communicate/adapter-sdk";
 
 const bundle = fileURLToPath(new URL("../plugin", import.meta.url));
@@ -99,13 +99,17 @@ export function stripBlock(source) {
   return kept.join("\n");
 }
 
-export function renderBlock(runner, node = process.execPath) {
+export function renderBlock(runner, node = process.execPath, platform = process.platform) {
   const entries = WIRING.map(({ event, kind, matcher }) => {
     // Both paths are shell-quoted inside the TOML string: a hook runs through a
     // shell, and a space in either path would otherwise split the command.
     // The interpreter is named outright rather than left to PATH, which a hook's
-    // environment does not reliably carry.
-    const command = `${tomlString(node)} ${tomlString(runner)} kimi ${kind}`;
+    // environment does not reliably carry. On Windows that shell is cmd.exe, and
+    // a TOML-escaped path inside the command would reach it with every
+    // backslash doubled.
+    const command = platform === "win32"
+      ? windowsHookCommand("cmd", { node, shim: runner, args: ["kimi", kind] })
+      : `${shellQuote(node)} ${shellQuote(runner)} kimi ${kind}`;
     const lines = ["[[hooks]]", `event = ${tomlString(event)}`,
       `command = ${tomlString(command)}`];
     if (matcher !== undefined) lines.push(`matcher = ${tomlString(matcher)}`);
@@ -121,7 +125,8 @@ const registerPlugin = (registry, root) => {
     plugins: [...plugins, { id: PLUGIN_NAME, root, source: "local", enabled: true }] };
 };
 
-export async function installKimiPlugin({ home, runner = defaultRunner(), node, cli }) {
+export async function installKimiPlugin({ home, runner = defaultRunner(), node, cli,
+  hostPlatform = process.platform }) {
   // A hook whose command does not exist fails silently, on every event, for as
   // long as it stays installed: the client reports nothing and ACC simply never
   // sees a session. Writing that entry and hoping is worse than refusing.
@@ -139,8 +144,8 @@ export async function installKimiPlugin({ home, runner = defaultRunner(), node,
     version: await ownVersion(import.meta.url), io: { readFile, writeFile } });
   // The skill ships with a placeholder where the command belongs: `acc` is
   // not on PATH everywhere, and an agent that cannot run it improvises.
-  const cliShim = await writeCliShim({ dir: target, cli, node });
-  await bakeSkillCommand({ root: target, cliShim });
+  const cliShim = await writeCliShim({ dir: target, cli, node, platform: hostPlatform });
+  await bakeSkillCommand({ root: target, cliShim, platform: hostPlatform });
 
   const file = configPath(home);
   const existing = await readText(file, "");
@@ -149,7 +154,7 @@ export async function installKimiPlugin({ home, runner = defaultRunner(), node,
   // user's last section cannot swallow our entries.
   const separator = withoutOurs === "" || withoutOurs.endsWith("\n") ? "" : "\n";
   await mkdir(path.dirname(file), { recursive: true });
-  await writeFile(file, `${withoutOurs}${separator}${renderBlock(runner, node)}\n`);
+  await writeFile(file, `${withoutOurs}${separator}${renderBlock(runner, node, hostPlatform)}\n`);
 
   const registry = registryPath(home);
   await mkdir(path.dirname(registry), { recursive: true });

package/node_modules/@agents-can-communicate/adapter-sdk/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agents-can-communicate/adapter-sdk",
-  "version": "0.8.5",
+  "version": "0.9.0",
   "private": true,
   "type": "module",
   "exports": {

package/node_modules/@agents-can-communicate/adapter-sdk/src/capabilities.mjs

@@ -81,6 +81,41 @@ export function assertCapabilities(declared = {}, implementation = {}, certifica
   return freezeCapabilities(resolved);
 }
 
+/**
+ * The other products whose hooks one adapter serves. Antigravity 2.0 runs the
+ * same `~/.gemini/config/hooks.json` as Antigravity CLI, on its own version
+ * line, so its evidence is recorded under its own certification name. A
+ * variant names a product, not a launch mode: one adapter's hooks, one more
+ * version line.
+ */
+function validateClientVariants(variants, primary) {
+  if (variants === undefined) return [];
+  if (!Array.isArray(variants)) usage("client.variants must be an array", { variants });
+  const seen = new Set([primary]);
+  return variants.map((variant, index) => {
+    if (variant === null || typeof variant !== "object" || Array.isArray(variant)) {
+      usage(`client.variants entry ${index} must be an object`);
+    }
+    for (const key of Object.keys(variant)) {
+      if (!["certificationName", "displayName"].includes(key)) {
+        usage(`client.variants entry ${index} has unknown field ${key}`, { key });
+      }
+    }
+    const { certificationName, displayName } = variant;
+    if (typeof certificationName !== "string" || certificationName.trim() === "") {
+      usage(`client.variants entry ${index} certificationName must be a non-empty string`);
+    }
+    if (typeof displayName !== "string" || displayName.trim() === "") {
+      usage(`client.variants entry ${index} displayName must be a non-empty string`);
+    }
+    if (seen.has(certificationName)) {
+      usage(`client.variants entry ${index} repeats ${certificationName}`, { certificationName });
+    }
+    seen.add(certificationName);
+    return { certificationName, displayName };
+  });
+}
+
 export function defineAdapter(manifest) {
   if (typeof manifest?.id !== "string") usage("an adapter must declare an id");
   assertPortableId(manifest.id, "adapter id");
@@ -104,15 +139,25 @@ export function defineAdapter(manifest) {
   const certification = validateCertification(manifest.certification);
   const known = new Set(Object.entries(CAPABILITY_SHAPE)
     .flatMap(([group, names]) => names.map(name => `${group}.${name}`)));
+  const primary = manifest.client.certificationName ?? manifest.client.command;
+  const clients = new Set([primary, ...validateClientVariants(manifest.client.variants, primary)
+    .map(variant => variant.certificationName)]);
   for (const item of certification.evidence) {
     if (!known.has(item.capability)) {
       usage(`unknown certified capability: ${item.capability}`,
         { capability: item.capability });
     }
-    const client = manifest.client.certificationName ?? manifest.client.command;
-    if (item.client !== client) {
-      usage(`certification evidence client ${item.client} does not match ${client}`,
-        { evidenceClient: item.client, client });
+    if (!clients.has(item.client)) {
+      usage(`certification evidence client ${item.client} does not match ${primary}`,
+        { evidenceClient: item.client, client: primary });
+    }
+  }
+  // How the hook runner learns which product and which version a session runs
+  // in, from the process that runs it rather than the binary on PATH. Both are
+  // optional; an adapter without them is matched by client.command.
+  for (const method of ["identifyClientProcess", "clientVersionOf"]) {
+    if (manifest[method] !== undefined && typeof manifest[method] !== "function") {
+      usage(`optional client method ${method} must be a function`, { id: manifest.id, method });
     }
   }
   // A floor said "judge later versions by this capture". Evidence now does that
@@ -139,7 +184,7 @@ export function defineAdapter(manifest) {
   if (manifest.nativeDelivery !== undefined) {
     const client = manifest.client.certificationName ?? manifest.client.command;
     native.nativeDelivery = validateNativeDeliveryContract(manifest.nativeDelivery,
-      { certification, client });
+      { certification, client, clients: [...clients] });
     for (const method of NATIVE_METHODS) {
       if (typeof manifest[method] !== "function") {
         usage(`a native delivery contract requires ${method}()`, { id: manifest.id, method });

package/node_modules/@agents-can-communicate/adapter-sdk/src/certification.mjs

@@ -178,12 +178,21 @@ function falseCapabilities() {
  * first capture, whose version is returned) or `recorded-failure` (a capture at
  * the returned version recorded the loss).
  */
-export function capabilityEvidence(adapter, { clientVersion, platform } = {}, capability) {
+export function capabilityEvidence(adapter, { clientVersion, platform, clientName } = {},
+  capability) {
   const [group, name] = capability.split(".");
   if (adapter.capabilities?.[group]?.[name] !== true) {
     return { granted: false, reason: "undeclared", version: null };
   }
-  const client = adapter.client?.certificationName ?? adapter.client?.command;
+  // `clientName` names the product the session runs in when it is one of the
+  // adapter's variants. Another product's evidence never stands in for it: its
+  // versions count on a different line. A name the adapter does not declare
+  // has no evidence at all.
+  const primary = adapter.client?.certificationName ?? adapter.client?.command;
+  const declared = [primary, ...(adapter.client?.variants ?? [])
+    .map(variant => variant?.certificationName)];
+  const client = typeof clientName === "string" ? clientName : primary;
+  if (!declared.includes(client)) return { granted: false, reason: "unobserved", version: null };
   const named = (adapter.certification?.evidence ?? [])
     .filter(item => item.client === client && item.capability === capability);
   if (named.length === 0) return { granted: false, reason: "unobserved", version: null };