agents-can-communicate 0.8.5 → 0.9.1

package/node_modules/@agents-can-communicate/adapter-sdk/src/native-delivery.mjs

@@ -23,7 +23,7 @@ export { validateNativeActivationPlan } from "./native-activation.mjs";
 
 const orderedModes = modes => NATIVE_BINDING_MODES.filter(mode => modes.includes(mode));
 
-export function validateNativeDeliveryContract(value, { certification, client }) {
+export function validateNativeDeliveryContract(value, { certification, client, clients = [client] }) {
   // Consent to live delivery is what `acc install` recorded. Up to 0.7.x a
   // Claude shell shim could export it instead ("bootstrap-environment"); the
   // shim is gone, and the installation record is the one source left.
@@ -65,11 +65,19 @@ export function validateNativeDeliveryContract(value, { certification, client })
         + "is recorded by its evidence, and the anchor names the version alone "
         + "(docs/design/2026-09-26-native-delivery-across-platforms.md)");
     }
-    closed(anchor, ["version", "protocolContract"], "nativeDelivery anchor");
+    closed(anchor, ["version", "protocolContract"], "nativeDelivery anchor", ["client"]);
     if (parseStableVersion(anchor.version) === null) {
       usage(`nativeDelivery anchor ${index} version must be a stable version`);
     }
-    if (compareStableVersions(anchor.version, minimum) < 0) {
+    // An anchor may belong to another product the adapter serves (see
+    // client.variants). Its versions count on that product's own line, so the
+    // primary minimum says nothing about them.
+    const owner = Object.hasOwn(anchor, "client") ? anchor.client : client;
+    if (!clients.includes(owner)) {
+      usage(`nativeDelivery anchor ${anchor.version} names client ${owner}, which the adapter `
+        + "does not declare", { anchor });
+    }
+    if (owner === client && compareStableVersions(anchor.version, minimum) < 0) {
       usage(`nativeDelivery anchor ${index} version ${anchor.version} is below the minimum ${minimum}: `
         + "the minimum must be the first passing capture");
     }
@@ -79,7 +87,7 @@ export function validateNativeDeliveryContract(value, { certification, client })
     // Where the capture was taken is provenance the evidence row keeps; the
     // anchor is proven by a passing capture of this version on any platform.
     const proven = (certification?.evidence ?? []).some(item => item.result === "pass"
-      && item.capability === "delivery.livePush" && item.client === client
+      && item.capability === "delivery.livePush" && item.client === owner
       && item.version === anchor.version);
     if (!proven) {
       usage(`nativeDelivery anchor ${anchor.version} has no passing delivery.livePush certification`,
@@ -87,7 +95,18 @@ export function validateNativeDeliveryContract(value, { certification, client })
     }
     return { ...anchor };
   });
-  if (!anchors.some(anchor => compareStableVersions(anchor.version, minimum) === 0)) {
+  const owners = new Map();
+  for (const anchor of anchors) {
+    const owner = anchor.client ?? client;
+    const previous = owners.get(anchor.protocolContract);
+    if (previous !== undefined && previous !== owner) {
+      usage(`nativeDelivery protocol ${anchor.protocolContract} is anchored for both ${previous} `
+        + `and ${owner}`, { protocolContract: anchor.protocolContract });
+    }
+    owners.set(anchor.protocolContract, owner);
+  }
+  if (!anchors.some(anchor => (anchor.client ?? client) === client
+    && compareStableVersions(anchor.version, minimum) === 0)) {
     usage(`nativeDelivery minimum ${minimum} must be the first passing capture: no anchor matches it`);
   }
   if (!Array.isArray(value.knownBad)) usage("nativeDelivery.knownBad must be an array");
@@ -144,7 +163,7 @@ function knownBadHit(contract, order) {
 // validateNativeHandshake below, and the delivery router's own offer check,
 // which uses this function alone because a response already carries no probe
 // or handshake shape to check further).
-export function evaluateVersionContract(adapter, { clientVersion } = {}) {
+export function evaluateVersionContract(adapter, { clientVersion, protocolContract } = {}) {
   const contract = adapter?.nativeDelivery;
   const unsupported = { reasonCode: "native_delivery_unsupported", minimumVersion: null,
     protocolContract: null };
@@ -161,9 +180,18 @@ export function evaluateVersionContract(adapter, { clientVersion } = {}) {
   // already answers malformed input this way.
   const minimumVersion = isText(contract.minimum) ? contract.minimum : null;
   if (minimumVersion === null) return unsupported;
-  const anchor = (Array.isArray(contract.anchors) ? contract.anchors : [])
-    .find(item => item?.version === minimumVersion);
+  const anchors = Array.isArray(contract.anchors) ? contract.anchors : [];
+  const primary = adapter.client?.certificationName ?? adapter.client?.command;
+  const anchor = anchors.find(item => item?.version === minimumVersion
+    && (!isText(item?.client) || item.client === primary));
   if (anchor === undefined) return unsupported;
+  // Another product's protocol has its own floor - the first capture that
+  // anchored it - and the denylist, which names the primary product's
+  // versions, does not reach it. Asked about no protocol, or the primary one,
+  // the rule is the primary minimum as it always was.
+  if (isText(protocolContract) && protocolContract !== anchor.protocolContract) {
+    return protocolFloor(anchors, protocolContract, clientVersion);
+  }
   const facts = { minimumVersion, protocolContract: anchor.protocolContract };
   const order = versionOrder(clientVersion);
   if (order === null) return { ...facts, reasonCode: "version_unavailable" };
@@ -174,6 +202,31 @@ export function evaluateVersionContract(adapter, { clientVersion } = {}) {
   return { ...facts, reasonCode: null };
 }
 
+function protocolFloor(anchors, protocolContract, clientVersion) {
+  const own = anchors.filter(item => item?.protocolContract === protocolContract
+    && isText(item?.version));
+  if (own.length === 0) {
+    return { reasonCode: "protocol_mismatch", minimumVersion: null, protocolContract };
+  }
+  const minimumVersion = own.map(item => item.version)
+    .reduce((first, version) => (compareStableVersions(version, first) < 0 ? version : first));
+  const facts = { minimumVersion, protocolContract };
+  const order = versionOrder(clientVersion);
+  if (order === null) return { ...facts, reasonCode: "version_unavailable" };
+  if (compareVersionOrder(order, versionOrder(minimumVersion)) < 0) {
+    return { ...facts, reasonCode: "below_minimum_version" };
+  }
+  return { ...facts, reasonCode: null };
+}
+
+// The protocol a probe or handshake reports, when it is one an anchor names:
+// that protocol's own floor judges it. Any other value is left to the primary
+// rule, so it still ends as the protocol_mismatch it always was.
+function reportedProtocol(adapter, reported) {
+  return isText(reported) && (adapter?.nativeDelivery?.anchors ?? [])
+    .some(item => item?.protocolContract === reported) ? reported : undefined;
+}
+
 function validateNativeProbe(probe) {
   closed(probe, PROBE_KEYS, "native probe");
   if (typeof probe.supported !== "boolean") usage("native probe supported must be a boolean");
@@ -199,7 +252,8 @@ export function evaluateNativeEligibility(adapter, { clientVersion, probe }) {
   // Only the version is read here; the shape is validated where it always was,
   // so a malformed probe still returns a closed result rather than throwing.
   const serving = isText(probe?.clientVersion) ? probe.clientVersion : clientVersion;
-  const rule = evaluateVersionContract(adapter, { clientVersion: serving });
+  const rule = evaluateVersionContract(adapter, { clientVersion: serving,
+    protocolContract: reportedProtocol(adapter, probe?.protocolContract) });
   const base = { eligible: false, reasonCode: null, minimumVersion: rule.minimumVersion,
     protocolContract: rule.protocolContract, modes: [] };
   const closedResult = reasonCode => deepFreeze({ ...base, reasonCode });
@@ -263,7 +317,8 @@ export function validateNativeHandshake(adapter, { clientVersion, handshake }) {
   // the version is read here; the shape is validated where it always was, so
   // a malformed handshake still returns a closed result rather than throwing.
   const serving = isText(handshake?.clientVersion) ? handshake.clientVersion : clientVersion;
-  const rule = evaluateVersionContract(adapter, { clientVersion: serving });
+  const rule = evaluateVersionContract(adapter, { clientVersion: serving,
+    protocolContract: reportedProtocol(adapter, handshake?.protocolContract) });
   const base = { ok: false, reasonCode: null, clientVersion: null,
     protocolContract: rule.protocolContract, modes: [],
     opaqueEndpointRef: null, leaseUntil: null };

package/node_modules/@agents-can-communicate/adapter-sdk/src/own-version.mjs

@@ -75,13 +75,39 @@ export async function stampPluginVersion({ file, version, io }) {
  * holds every plugin installed from that marketplace, and removing that root
  * once took a plugin the user had installed themselves - so a sibling here is
  * an older ACC, and a sibling one level up is somebody else's.
+ *
+ * A version a running session marks in use stays whatever `keep` says. Claude
+ * Code puts `.in_use/<pid>`, named after a running session, into a cached
+ * version and drops the file when that session exits (2.1.286). A reinstall
+ * after an update names only the active version, so it removed a copy the
+ * client had marked (#257). A marker whose process has exited holds nothing; a
+ * reused pid at worst keeps a copy until the next install.
  */
-export async function keepVersions({ root, keep, io }) {
+const IN_USE = ".in_use";
+const PID = /^[1-9]\d*$/;
+
+// `kill(pid, 0)` delivers nothing; EPERM means the process exists under another user.
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+async function markedInUse(directory, io, alive) {
+  const markers = await io.readdir(path.join(directory, IN_USE)).catch(() => []);
+  return markers.some(name => PID.test(name) && alive(Number(name)));
+}
+
+export async function keepVersions({ root, keep, io, alive = processAlive }) {
   const wanted = new Set(keep.filter(version => typeof version === "string" && version !== ""));
   const entries = await io.readdir(root, { withFileTypes: true }).catch(() => []);
   const removed = [];
   for (const entry of entries) {
     if (!entry.isDirectory() || wanted.has(entry.name)) continue;
+    if (await markedInUse(path.join(root, entry.name), io, alive)) continue;
     await io.rm(path.join(root, entry.name), { recursive: true, force: true });
     removed.push(entry.name);
   }

package/node_modules/@agents-can-communicate/adapter-sdk/src/private-files.mjs

@@ -0,0 +1,35 @@
+import { constants } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+
+// Private records an adapter keeps beside a live endpoint: one user's, never
+// reached through a link. POSIX keeps them to the owner with mode bits on each
+// file and directory. Windows has none - Node reports every file as 0o666 - and
+// keeps them private through the profile's ACL, checked for the data home once
+// (docs/design/2026-09-30-native-windows-support.md, section 8).
+
+export const isWindowsPlatform = platform => String(platform).startsWith("win32");
+
+/** Whether `info` grants none of `mask` to others; always so on Windows. */
+export const closedTo = (info, mask, { platform = process.platform } = {}) =>
+  isWindowsPlatform(platform) || (info.mode & mask) === 0;
+
+/**
+ * Open a regular file without following a link at its name. Windows has no
+ * O_NOFOLLOW, so the name is checked first and the handle after the open has to
+ * hold the file the name named.
+ */
+export async function openRegularNoFollow(file, flags = constants.O_RDONLY,
+  { platform = process.platform } = {}) {
+  if (!isWindowsPlatform(platform)) {
+    return open(file, flags | constants.O_NOFOLLOW | (constants.O_NONBLOCK ?? 0));
+  }
+  const named = await lstat(file, { bigint: true });
+  if (!named.isFile()) throw Object.assign(new Error(`not a regular file: ${file}`), { code: "EINVAL" });
+  const handle = await open(file, flags);
+  const opened = await handle.stat({ bigint: true }).catch(() => null);
+  if (opened?.dev !== named.dev || opened?.ino !== named.ino) {
+    await handle.close().catch(() => null);
+    throw Object.assign(new Error(`replaced while opening: ${file}`), { code: "EINVAL" });
+  }
+  return handle;
+}

package/node_modules/@agents-can-communicate/adapter-sdk/src/process-table.mjs

@@ -0,0 +1,232 @@
+import { execFile } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+
+// A hook runs in front of someone's turn. Reading the table is worth a few
+// hundred milliseconds once per session and nothing at all if it is slow.
+const DEFAULT_TIMEOUT_MS = 1_000;
+
+const LINE = /^\s*(\d+)\s+(\d+)\s+(.+?)\s*$/;
+// A pid, then the whole rest of the line: a command line has spaces anywhere.
+const ARGS_LINE = /^\s*(\d+)\s+(.+?)\s*$/;
+// Command lines are long; measured at 231 KB for 1,137 processes on a desktop
+// Mac, a quarter of execFile's default buffer.
+const ARGS_BUFFER = 16 * 1024 * 1024;
+
+// Deep enough for a client that wraps its hook in a shell and a launcher.
+const WINDOWS_HOPS = 8;
+
+async function posixTable({ run, timeoutMs }) {
+  const options = { timeout: timeoutMs, killSignal: "SIGKILL", windowsHide: true };
+  const [tree, commandLines] = await Promise.all([
+    run("ps", ["-o", "pid=,ppid=,comm=", "-A"], options).then(({ stdout }) => stdout, () => null),
+    run("ps", ["-A", "-o", "pid=,args="], { ...options, maxBuffer: ARGS_BUFFER })
+      .then(({ stdout }) => stdout, () => ""),
+  ]);
+  if (typeof tree !== "string") return new Map();
+  const args = new Map();
+  for (const line of String(commandLines).split("\n")) {
+    const match = ARGS_LINE.exec(line);
+    if (match !== null) args.set(Number(match[1]), match[2]);
+  }
+  const table = new Map();
+  for (const line of tree.split("\n")) {
+    const match = LINE.exec(line);
+    if (match === null) continue;
+    const pid = Number(match[1]);
+    table.set(pid, { ppid: Number(match[2]), comm: match[3],
+      ...(args.has(pid) ? { args: args.get(pid) } : {}) });
+  }
+  return table;
+}
+
+// Windows has no `ps` and no longer ships `wmic`. Win32_Process through CIM
+// answers pid, parent, creation time and command line. A full scan took 1.07 s
+// in Windows PowerShell 5.1 on a windows-latest runner, so the script asks only
+// for the chain it needs, one filtered query per hop. The creation time goes
+// out as a string: a FILETIME is larger than a double holds exactly.
+const chainScript = (from, hops) => `$ErrorActionPreference = 'Stop'
+$next = ${Number(from)}
+$chain = New-Object System.Collections.ArrayList
+for ($hop = 0; $hop -lt ${Number(hops)}; $hop++) {
+  $p = Get-CimInstance Win32_Process -Filter "ProcessId=$next" -Property ProcessId,ParentProcessId,CreationDate,Name,CommandLine
+  if ($null -eq $p) { break }
+  [void]$chain.Add([pscustomobject]@{ pid = [int]$p.ProcessId; ppid = [int]$p.ParentProcessId; name = [string]$p.Name; start = $p.CreationDate.ToFileTimeUtc().ToString(); cmd = [string]$p.CommandLine })
+  if ($p.ParentProcessId -eq 0 -or $p.ParentProcessId -eq $next) { break }
+  $next = [int]$p.ParentProcessId
+}
+ConvertTo-Json -Compress -InputObject @($chain)`;
+
+// PowerShell by absolute path only, so a PATH entry cannot stand in for it.
+// PowerShell 7 is not part of Windows; where it is installed it answers faster
+// (0.37 s against 1.07 s for a full scan, measured), and a missing one fails to
+// spawn at once.
+function powershellCandidates(env) {
+  const root = env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows";
+  const programs = env.ProgramFiles ?? env.PROGRAMFILES ?? "C:\\Program Files";
+  return [path.win32.join(programs, "PowerShell", "7", "pwsh.exe"),
+    path.win32.join(root, "System32", "WindowsPowerShell", "v1.0", "powershell.exe")];
+}
+
+// Windows Script Host reads the same chain through WMI in a quarter of the
+// time: 145 ms against PowerShell's 580, and 258 against 1,080 with four hooks
+// at once (windows-latest, measured), because it starts no .NET runtime. A
+// machine can switch it off by policy; PowerShell then reads the chain.
+const WMI_CHAIN = fileURLToPath(new URL("./windows-process-chain.wsf", import.meta.url));
+
+// WMI's `yyyymmddHHMMSS.ffffff+UUU` - offset in minutes - as a FILETIME string,
+// the form the PowerShell script prints.
+function wmiFileTime(value) {
+  const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})\.(\d{6})([+-])(\d{3})$/.exec(value ?? "");
+  if (match === null) return undefined;
+  const [, year, month, day, hour, minute, second, micros, sign, offset] = match;
+  const local = Date.UTC(Number(year), Number(month) - 1, Number(day), Number(hour),
+    Number(minute), Number(second));
+  const utc = local - (sign === "+" ? 1 : -1) * Number(offset) * 60_000;
+  return String((BigInt(utc) + 11_644_473_600_000n) * 10_000n + BigInt(micros) * 10n);
+}
+
+const chainOf = stdout => {
+  const parsed = JSON.parse(stdout);
+  return (Array.isArray(parsed) ? parsed : [parsed]).map(hop => (typeof hop?.created === "string"
+    ? { ...hop, start: wmiFileTime(hop.created) } : hop));
+};
+
+async function windowsChain({ from, hops, run, timeoutMs, env }) {
+  const deadline = Date.now() + timeoutMs;
+  const options = () => ({ timeout: Math.max(1, deadline - Date.now()), killSignal: "SIGKILL",
+    windowsHide: true, maxBuffer: ARGS_BUFFER });
+  const root = env.SystemRoot ?? env.SYSTEMROOT ?? "C:\\Windows";
+  try {
+    const { stdout } = await run(path.win32.join(root, "System32", "cscript.exe"),
+      ["//Nologo", WMI_CHAIN, String(Number(from)), String(Number(hops))], options());
+    return chainOf(stdout);
+  } catch {
+    // Script Host is off or failed; PowerShell below.
+  }
+  const encoded = Buffer.from(chainScript(from, hops), "utf16le").toString("base64");
+  for (const shell of powershellCandidates(env)) {
+    if (Date.now() >= deadline) break;
+    try {
+      const { stdout } = await run(shell, ["-NoLogo", "-NoProfile", "-NonInteractive",
+        "-ExecutionPolicy", "Bypass", "-EncodedCommand", encoded], options());
+      return chainOf(stdout);
+    } catch {
+      // Try the next shell; none left is the empty answer below.
+    }
+  }
+  return [];
+}
+
+/**
+ * Windows: one process - pid, parent, image name, creation time as a FILETIME
+ * string (to the microsecond, as WMI keeps it) and command line - or null when
+ * it cannot be read.
+ */
+export async function readWindowsProcess(pid, { run = execFileAsync, timeoutMs = DEFAULT_TIMEOUT_MS,
+  env = process.env } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  const [found] = await windowsChain({ from: pid, hops: 1, run, timeoutMs, env });
+  return found?.pid === pid ? found : null;
+}
+
+async function windowsTable({ from, run, timeoutMs, env }) {
+  const table = new Map();
+  let child = null;
+  for (const hop of await windowsChain({ from, hops: WINDOWS_HOPS, run, timeoutMs, env })) {
+    if (!Number.isSafeInteger(hop?.pid) || typeof hop.name !== "string") break;
+    // Windows never re-parents an orphan: its ppid can name a process that
+    // died and whose number was reused. A parent created after its child is
+    // exactly that, and nothing above it belongs to this chain.
+    if (child !== null && !(BigInt(hop.start ?? "0") <= BigInt(child.start ?? "0"))) break;
+    table.set(hop.pid, { ppid: hop.ppid, comm: hop.name,
+      ...(typeof hop.cmd === "string" && hop.cmd !== "" ? { args: hop.cmd } : {}),
+      ...(typeof hop.start === "string" ? { start: hop.start } : {}) });
+    child = hop;
+  }
+  return table;
+}
+
+/**
+ * Processes on this machine, as pid -> parent, executable and, when it could be
+ * read, command line.
+ *
+ * POSIX reads the whole table with `ps`. Windows reads the chain from `from`
+ * upward - the only part a hook asks about - with a creation time for each hop.
+ * A failed read is an empty map, never an error: an empty table resolves no
+ * client, which is the "nobody knows" answer every caller already handles.
+ */
+export async function readProcessTable({ platform = process.platform, from = process.pid,
+  run = execFileAsync, timeoutMs = DEFAULT_TIMEOUT_MS, env = process.env } = {}) {
+  if (platform === "win32") return windowsTable({ from, run, timeoutMs, env });
+  return posixTable({ run, timeoutMs });
+}
+
+/**
+ * The words one process was started with, or null when they cannot be read.
+ *
+ * POSIX splits `ps -o args=` on whitespace, as every caller did before. Windows
+ * keeps one command-line string per process, split here the way the C runtime
+ * splits it.
+ */
+export async function readProcessArgs(pid, { platform = process.platform, run = execFileAsync,
+  timeoutMs = DEFAULT_TIMEOUT_MS, env = process.env, ps = "ps" } = {}) {
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (platform === "win32") {
+    const [own] = await windowsChain({ from: pid, hops: 1, run, timeoutMs, env });
+    return own?.pid === pid && typeof own.cmd === "string" && own.cmd !== ""
+      ? splitWindowsCommandLine(own.cmd) : null;
+  }
+  try {
+    const { stdout } = await run(ps, ["-o", "args=", "-p", String(pid)],
+      { timeout: timeoutMs, killSignal: "SIGKILL", windowsHide: true });
+    const words = stdout.trim().split(/\s+/).filter(Boolean);
+    return words.length > 0 ? words : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Split a Windows command line into argv the way CommandLineToArgvW does:
+ * whitespace separates words outside quotes; 2n backslashes before a quote are
+ * n backslashes and the quote toggles quoting; 2n+1 are n backslashes and a
+ * literal quote; backslashes elsewhere are literal.
+ */
+export function splitWindowsCommandLine(line) {
+  const words = [];
+  let word = "";
+  let started = false;
+  let quoted = false;
+  for (let index = 0; index < line.length; index += 1) {
+    const char = line[index];
+    if (char === "\\") {
+      let count = 0;
+      while (line[index] === "\\") { count += 1; index += 1; }
+      if (line[index] === "\"") {
+        word += "\\".repeat(Math.floor(count / 2));
+        if (count % 2 === 1) word += "\"";
+        else quoted = !quoted;
+      } else {
+        word += "\\".repeat(count);
+        index -= 1;
+      }
+      started = true;
+    } else if (char === "\"") {
+      quoted = !quoted;
+      started = true;
+    } else if ((char === " " || char === "\t") && !quoted) {
+      if (started) words.push(word);
+      word = "";
+      started = false;
+    } else {
+      word += char;
+      started = true;
+    }
+  }
+  if (started) words.push(word);
+  return words;
+}

package/node_modules/@agents-can-communicate/adapter-sdk/src/session-binding.mjs

@@ -43,13 +43,17 @@ function assertBindingDeadline(deadlineAt) {
 }
 
 export async function storeSessionBinding({ runtimeDir, harnessSessionId, accSessionId,
-  generation, clientVersion, platform, clientPid, deadlineAt, storeVersion, runtimeRoot }) {
+  generation, clientVersion, clientName, platform, clientPid, deadlineAt, storeVersion, runtimeRoot }) {
   assertBindingDeadline(deadlineAt);
   const file = fileFor(runtimeDir, harnessSessionId);
   const record = { schemaVersion: SCHEMA_VERSION, harnessSessionId, accSessionId, generation };
   assertIdentity(record);
   await mkdir(path.dirname(file), { recursive: true });
   if (typeof clientVersion === "string" && clientVersion !== "") record.clientVersion = clientVersion;
+  // The product the session runs in, when it is one of the adapter's variants
+  // rather than its own client: its evidence and its version line are its own.
+  // A reader that predates the field ignores it.
+  if (typeof clientName === "string" && clientName !== "") record.clientName = clientName;
   if (typeof platform === "string" && platform !== "") record.platform = platform;
   // The vendor process this session runs in, resolved once at SessionStart.
   // A native endpoint is matched against it, so a binding without one can
@@ -106,6 +110,7 @@ export async function loadSessionBinding({ runtimeDir, harnessSessionId }) {
   assertIdentity(record, harnessSessionId);
   const binding = { accSessionId: record.accSessionId, generation: record.generation };
   if (typeof record.clientVersion === "string") binding.clientVersion = record.clientVersion;
+  if (typeof record.clientName === "string" && record.clientName !== "") binding.clientName = record.clientName;
   if (typeof record.platform === "string") binding.platform = record.platform;
   if (isPid(record.clientPid)) binding.clientPid = record.clientPid;
   return binding;
@@ -147,6 +152,8 @@ export async function listSessionBindings({ runtimeDir }) {
       accSessionId: record.accSessionId, generation: record.generation,
       ...(typeof record.clientVersion === "string"
         ? { clientVersion: record.clientVersion } : {}),
+      ...(typeof record.clientName === "string" && record.clientName !== ""
+        ? { clientName: record.clientName } : {}),
       ...(typeof record.platform === "string" ? { platform: record.platform } : {}),
       ...(isPid(record.clientPid) ? { clientPid: record.clientPid } : {}) });
   }

package/node_modules/@agents-can-communicate/adapter-sdk/src/windows-command.mjs

@@ -0,0 +1,69 @@
+// A hook command in the form each client's Windows hook runner reads. Measured
+// from the clients' sources and binaries (docs/design/2026-09-30-native-windows-
+// support.md): Codex and Gemini CLI run PowerShell, Grok detects PowerShell,
+// Git Bash or cmd, Kimi Code runs cmd.exe, and Antigravity runs `cmd /c` through
+// Go, which escapes inner quotes as `\"` - a form cmd does not read.
+
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const defaultRun = promisify(execFile);
+
+// Characters one of those shells expands or ends a quoted word on. A path that
+// carries one is refused: writing it would run something other than the shim.
+const EXPANDED = /[$`"%]/;
+// What cmd acts on in a word outside quotes, whitespace included.
+const UNQUOTED_UNSAFE = /[\s&|<>^(),;=!]/;
+
+const powershellLiteral = value => `'${String(value).replaceAll("'", "''")}'`;
+const forward = value => String(value).replaceAll("\\", "/");
+
+/**
+ * @param {"powershell"|"portable"|"cmd"|"unquoted"} shell
+ * @param {{ node: string, shim: string, args: string[] }} parts
+ */
+export function windowsHookCommand(shell, { node, shim, args }) {
+  for (const word of [node, shim]) {
+    if (EXPANDED.test(word)) {
+      throw new Error(`a hook command cannot name ${word}: a Windows shell would expand it`);
+    }
+  }
+  const tail = args.join(" ");
+  switch (shell) {
+    // `&` runs a quoted program; single quotes take nothing literally but `''`.
+    // pwsh -Command reports exit 2 as 1 unless the command exits itself.
+    case "powershell":
+      return `& ${powershellLiteral(node)} ${powershellLiteral(shim)} ${tail}; exit $LASTEXITCODE`;
+    // Node from PATH, which every one of the three shells finds; the shim then
+    // prefers the pinned runner. Forward slashes survive bash unquoting.
+    case "portable":
+      return `node "${forward(shim)}" ${tail}`;
+    case "cmd":
+      return `"${node}" "${shim}" ${tail}`;
+    // The path reaches cmd bare: & | < > ^ ( ) run as cmd's own operators and
+    // , ; = split the word the way a space does, so none may be in it.
+    case "unquoted":
+      if (UNQUOTED_UNSAFE.test(shim)) {
+        throw new Error(`a hook command cannot name ${shim} unquoted: it has a space or a character cmd acts on`);
+      }
+      return `node ${forward(shim)} ${tail}`;
+    default:
+      throw new Error(`unknown Windows hook shell: ${shell}`);
+  }
+}
+
+/**
+ * The 8.3 form of a path with a space in it, for a hook runner that cannot pass
+ * a quoted path (Antigravity CLI). cmd prints it through `%~s`. A volume with 8.3
+ * names turned off answers with the long path, which the caller then refuses.
+ */
+export async function shortPath(file, { run = defaultRun, env = process.env } = {}) {
+  if (!/\s/.test(file)) return file;
+  if (/["%^&|<>!]/.test(file)) return file;
+  const comspec = env.ComSpec ?? env.COMSPEC ?? "cmd.exe";
+  const { stdout } = await run(comspec, ["/d", "/c", `for %I in ("${file}") do @echo %~sI`],
+    { windowsHide: true, windowsVerbatimArguments: true, timeout: 5_000 });
+  const answer = String(stdout).trim().split(/\r?\n/).at(-1) ?? "";
+  return answer === "" ? file : answer;
+}
+

package/node_modules/@agents-can-communicate/adapter-sdk/src/windows-process-chain.wsf

@@ -0,0 +1,45 @@
+<?xml version="1.0" ?>
+<!--
+  The chain of processes from one pid upward, read through WMI by Windows Script
+  Host: cscript //Nologo windows-process-chain.wsf <pid> <hops>. Prints a JSON
+  array of { pid, ppid, name, created, cmd }, created in WMI's own date form.
+  JScript here predates JSON, so strings are escaped by hand, and everything
+  outside printable ASCII as \uXXXX: the output never depends on a code page.
+-->
+<job>
+<script language="JScript"><![CDATA[
+var next = parseInt(WScript.Arguments(0), 10);
+var hops = parseInt(WScript.Arguments(1), 10);
+var wmi = GetObject("winmgmts:{impersonationLevel=impersonate}!\\\\.\\root\\cimv2");
+
+function text(value) {
+  if (value === null || typeof value === "undefined") return "null";
+  var source = String(value);
+  var out = "\"";
+  for (var index = 0; index < source.length; index++) {
+    var code = source.charCodeAt(index);
+    if (code === 34) out += "\\\"";
+    else if (code === 92) out += "\\\\";
+    else if (code < 32 || code > 126) {
+      var hex = code.toString(16);
+      out += "\\u" + "0000".substr(hex.length) + hex;
+    } else out += source.charAt(index);
+  }
+  return out + "\"";
+}
+
+var chain = [];
+for (var hop = 0; hop < hops && next > 0; hop++) {
+  var found = new Enumerator(wmi.ExecQuery("SELECT ProcessId,ParentProcessId,Name,CommandLine,"
+    + "CreationDate FROM Win32_Process WHERE ProcessId=" + next));
+  if (found.atEnd()) break;
+  var process = found.item();
+  chain.push("{\"pid\":" + process.ProcessId + ",\"ppid\":" + process.ParentProcessId
+    + ",\"name\":" + text(process.Name) + ",\"created\":" + text(process.CreationDate)
+    + ",\"cmd\":" + text(process.CommandLine) + "}");
+  if (process.ParentProcessId === 0 || process.ParentProcessId === next) break;
+  next = process.ParentProcessId;
+}
+WScript.StdOut.Write("[" + chain.join(",") + "]");
+]]></script>
+</job>

package/node_modules/@agents-can-communicate/cli/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@agents-can-communicate/cli",
-  "version": "0.8.5",
+  "version": "0.9.1",
   "private": true,
   "type": "module",
   "exports": {
     ".": "./src/index.mjs",
+    "./hook-support": "./src/hook-support.mjs",
     "./managed-entry": "./src/managed-runtime/entry.mjs",
     "./managed-worker": "./src/managed-runtime/worker.mjs"
   },

package/node_modules/@agents-can-communicate/cli/src/config-command.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 
 import { AccError, CONFIG_FILENAME, EXIT, createId, defaultProjectConfig,
   validateProjectConfig } from "@agents-can-communicate/protocol";
+import { openNoFollow } from "@agents-can-communicate/storage-filesystem";
 
 const configPathIn = cwd => path.join(cwd, CONFIG_FILENAME);
 
@@ -32,7 +33,7 @@ async function readConfig(cwd) {
   try {
     // Same rule as discovery: a config reached through a symlink may point
     // anywhere, so it is refused rather than followed.
-    handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW);
+    handle = await openNoFollow(file, constants.O_RDONLY);
   } catch (error) {
     if (error.code === "ENOENT") return null;
     throw new AccError(EXIT.DATA, "cannot safely read the workspace config",