agents-can-communicate 0.8.5 → 0.9.1

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-delivery.mjs

@@ -1,10 +1,12 @@
 import net from "node:net";
-import { compareVersionOrder, versionOrder } from "@agents-can-communicate/adapter-sdk";
+import { compareVersionOrder, isWindowsPlatform, npmShimTarget, runExecutable, versionOrder }
+  from "@agents-can-communicate/adapter-sdk";
 
 import { INBOX_MODES, MIN_VERSION, PROTOCOL_CONTRACT, TRANSPORT } from "./inbox-contract.mjs";
 import { claimWake, newEndpointId, readInboxEndpoint, releaseWake, removeInboxEndpoint,
   sweepDeadEndpoints, writeInboxEndpoint } from "./inbox-endpoint.mjs";
-import { claudeConfigDir, readSessionRecord, verifyInbox } from "./inbox-registry.mjs";
+import { claudeConfigDir, listPipesOfMachine, readPeerKey, readSessionRecord, verifyInbox }
+  from "./inbox-registry.mjs";
 import { MANAGED_SETTINGS, permissionModeFromArgs, readInboundSettings, readProcessArgs, receptionOf }
   from "./inbox-settings.mjs";
 
@@ -19,9 +21,12 @@ import { MANAGED_SETTINGS, permissionModeFromArgs, readInboundSettings, readProc
 // Claude Code frames every inbox message as a teammate's request to act on,
 // and the only thing a wake gives it to act on is ACC's own notice.
 //
-// The connection sends no auth line, and this module never reads the
-// session's messaging token or key file. A frame carrying that token would
-// pass as the session's own child and skip the inbound controls its user set.
+// On POSIX the connection sends no auth line: the socket is this user's alone.
+// Windows refuses a frame without one (measured on 2.1.286), so there the
+// offer authenticates with the peer key Claude publishes for other sessions of
+// the same user, and the wake is classified a peer's. This module never reads
+// the session's own messaging token: a frame carrying it would pass as the
+// session's child and skip the inbound controls its user set.
 
 const LEASE_MS = 120_000;
 const MESSAGE_ID = /^[A-Za-z0-9_-]{1,200}$/;
@@ -69,16 +74,11 @@ async function executableHasInbox(realExecutable) {
   }
 }
 
+// runExecutable starts an npm .cmd through cmd.exe, which execFile refuses.
 function defaultReadVersion(realExecutable, timeoutMs) {
-  return new Promise(resolve => {
-    import("node:child_process").then(({ execFile }) => {
-      execFile(realExecutable, ["--version"], { timeout: timeoutMs, windowsHide: true },
-        (error, stdout, stderr) => {
-          if (error !== null) return resolve(null);
-          resolve(/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/.exec(`${stdout}${stderr}`)?.[1] ?? null);
-        });
-    });
-  });
+  return runExecutable(realExecutable, ["--version"], { timeout: timeoutMs })
+    .then(({ stdout, stderr }) => /(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)/.exec(`${stdout}${stderr}`)?.[1] ?? null,
+      () => null);
 }
 
 function withTimeout(work, ms) {
@@ -91,22 +91,23 @@ function withTimeout(work, ms) {
 }
 
 /**
- * Read-only: a version at or above the capture, a platform whose inbox is a
- * Unix socket, and an executable that writes the inbox into its session
- * registry. Never launches a session. Native Windows serves a named pipe that
- * demands an auth line; nothing there is captured, so it keeps hook delivery.
+ * Read-only: a version at or above the capture and an executable that writes
+ * the inbox into its session registry. Never launches a session. On Windows an
+ * npm install puts a .cmd on PATH; the inbox is looked for in the file it runs.
  */
 export async function probeNativeDelivery({ realExecutable, timeoutMs = 750, platform = process.platform,
-  hasInbox = executableHasInbox, readVersion = defaultReadVersion } = {}) {
+  hasInbox = executableHasInbox, readVersion = defaultReadVersion, shimTarget = npmShimTarget } = {}) {
   const unsupported = (reasonCode, clientVersion = null) => ({ supported: false, clientVersion,
     protocolContract: PROTOCOL_CONTRACT, executableFingerprint: null, modes: [], reasonCode });
-  if (platform === "win32") return unsupported("native_delivery_unsupported");
   if (typeof realExecutable !== "string" || realExecutable === "") return unsupported("feature_probe_failed");
+  const scanned = isWindowsPlatform(platform) && /\.(cmd|bat)$/i.test(realExecutable)
+    ? await shimTarget(realExecutable) : realExecutable;
+  if (scanned === null) return unsupported("feature_probe_failed");
   const clientVersion = await withTimeout(Promise.resolve(readVersion(realExecutable, timeoutMs)), timeoutMs)
     .catch(() => null);
   if (versionOrder(clientVersion) === null) return unsupported("feature_probe_failed", clientVersion);
   if (belowMinimum(clientVersion)) return unsupported("below_minimum_version", clientVersion);
-  const present = await withTimeout(Promise.resolve(hasInbox(realExecutable)), timeoutMs).catch(() => false);
+  const present = await withTimeout(Promise.resolve(hasInbox(scanned)), timeoutMs).catch(() => false);
   if (!present) return unsupported("protocol_mismatch", clientVersion);
   return { supported: true, clientVersion, protocolContract: PROTOCOL_CONTRACT,
     executableFingerprint: null, modes: [...INBOX_MODES], reasonCode: null };
@@ -137,7 +138,8 @@ const handshake = (endpoint, now) => ({ supported: true, clientVersion: endpoint
  */
 export async function bindNativeSession({ event, clientPid, clientVersion, runtimeDir,
   env = process.env, now = Date.now, managedSettingsPath = MANAGED_SETTINGS[process.platform],
-  readClientArgs = readProcessArgs } = {}) {
+  readClientArgs = readProcessArgs, platform = process.platform, listPipes = listPipesOfMachine,
+  profileDir } = {}) {
   if (!Number.isInteger(clientPid) || clientPid <= 0) return closed(clientVersion, "client_process_unknown");
   if (typeof event?.sessionId !== "string" || event.sessionId === "") {
     return closed(clientVersion, "handshake_failed");
@@ -151,14 +153,14 @@ export async function bindNativeSession({ event, clientPid, clientVersion, runti
   if (typeof socketPath !== "string" || socketPath === "") {
     return closed(clientVersion, "native_endpoint_unavailable");
   }
-  await sweepDeadEndpoints({ runtimeDir });
+  await sweepDeadEndpoints({ runtimeDir, platform });
   const configDir = claudeConfigDir(env);
   const refused = await verifyInbox({ configDir, clientPid, sessionId: event.sessionId, socketPath,
-    anyConversation: true });
+    anyConversation: true, platform, listPipes, ...(profileDir === undefined ? {} : { profileDir }) });
   if (refused !== null) return closed(clientVersion, refused);
   // Project settings sit where the session was started, which the registry
   // records; the hook's cwd follows the shell.
-  const record = await readSessionRecord({ configDir, clientPid });
+  const record = await readSessionRecord({ configDir, clientPid, platform });
   const settings = await readInboundSettings({ configDir, projectDir: record?.cwd ?? event.cwd,
     managedSettingsPath });
   // The hook's mode is current. SessionStart carries none, so until the first
@@ -172,30 +174,33 @@ export async function bindNativeSession({ event, clientPid, clientVersion, runti
     sessionId: event.sessionId, clientVersion, protocolContract: PROTOCOL_CONTRACT,
     leaseUntil: new Date(now() + LEASE_MS).toISOString(), reception };
   try {
-    await writeInboxEndpoint({ runtimeDir, record: endpoint });
+    await writeInboxEndpoint({ runtimeDir, record: endpoint, platform, listPipes });
   } catch {
     return closed(clientVersion, "handshake_failed");
   }
   return handshake(endpoint, now);
 }
 
-async function verifiedEndpoint(binding, runtimeDir) {
-  const endpoint = await readInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef });
+async function verifiedEndpoint(binding, runtimeDir, system) {
+  const endpoint = await readInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef,
+    platform: system.platform });
   if (endpoint === null) return null;
   const refused = await verifyInbox({ configDir: endpoint.configDir, clientPid: endpoint.clientPid,
-    sessionId: endpoint.sessionId, socketPath: endpoint.socketPath });
+    sessionId: endpoint.sessionId, socketPath: endpoint.socketPath, ...system });
   return refused === null ? endpoint : null;
 }
 
 // The router calls this when a lease ran out, so a session that sits idle
 // between turns stays reachable. The id never changes on a refresh.
-export async function refreshNativeSession({ binding, runtimeDir, now = Date.now } = {}) {
-  const endpoint = await verifiedEndpoint(binding, runtimeDir);
+export async function refreshNativeSession({ binding, runtimeDir, now = Date.now,
+  platform = process.platform, listPipes = listPipesOfMachine, profileDir } = {}) {
+  const endpoint = await verifiedEndpoint(binding, runtimeDir, { platform, listPipes,
+    ...(profileDir === undefined ? {} : { profileDir }) });
   return endpoint === null ? closed(binding?.clientVersion, "handshake_failed") : handshake(endpoint, now);
 }
 
-export const retireNativeSession = ({ binding, runtimeDir }) =>
-  removeInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef });
+export const retireNativeSession = ({ binding, runtimeDir, platform = process.platform }) =>
+  removeInboxEndpoint({ runtimeDir, endpointId: binding?.opaqueEndpointRef, platform });
 
 /**
  * Sender side: re-verify the receiver, then write one wake line. The socket
@@ -204,20 +209,27 @@ export const retireNativeSession = ({ binding, runtimeDir }) =>
  * receiver's own hook.
  */
 export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 2_000,
-  connect = net.createConnection } = {}) {
+  connect = net.createConnection, platform = process.platform, listPipes = listPipesOfMachine,
+  profileDir } = {}) {
   const rejected = safeErrorCode => ({ accepted: false, transport: TRANSPORT,
     clientVersion: binding?.clientVersion ?? null, safeErrorCode });
   if (typeof message?.messageId !== "string" || !MESSAGE_ID.test(message.messageId)) {
     return rejected("transport_rejected");
   }
-  const endpoint = await verifiedEndpoint(binding, runtimeDir);
+  const endpoint = await verifiedEndpoint(binding, runtimeDir, { platform, listPipes,
+    ...(profileDir === undefined ? {} : { profileDir }) });
   if (endpoint === null) return rejected("recipient_unavailable");
+  // Read per offer and kept nowhere: the key of the process the record names now.
+  const peerToken = isWindowsPlatform(platform) ? await readPeerKey({ configDir: endpoint.configDir,
+    record: await readSessionRecord({ configDir: endpoint.configDir, clientPid: endpoint.clientPid, platform }) })
+    : null;
+  if (isWindowsPlatform(platform) && peerToken === null) return rejected("recipient_unavailable");
   // The receiver's own crossSessionInbound refuses unattested wakes; one would
   // be dropped, so none is sent and the message waits for its next turn.
   if (endpoint.reception === "refused") return rejected("delivery_disabled");
   const accepted = { accepted: true, transport: TRANSPORT, clientVersion: endpoint.clientVersion,
     ...(endpoint.reception === "held" ? { pendingApproval: true } : {}) };
-  const wake = { runtimeDir, endpointId: endpoint.endpointId, messageId: message.messageId };
+  const wake = { runtimeDir, endpointId: endpoint.endpointId, messageId: message.messageId, platform };
   // Claude Code delivers a repeated msg_id again, so the dedupe is ours.
   let first;
   try {
@@ -226,7 +238,8 @@ export async function offerMessage({ binding, message, runtimeDir, timeoutMs = 2
     return rejected("transport_error");
   }
   if (!first) return accepted;
-  const frame = `${JSON.stringify({ type: "user",
+  const auth = peerToken === null ? "" : `${JSON.stringify({ type: "auth", token: peerToken })}\n`;
+  const frame = `${auth}${JSON.stringify({ type: "user",
     message: { role: "user", content: wakeText(message.messageId) },
     msg_id: `acc-wake-${message.messageId}` })}\n`;
   const result = await new Promise(resolve => {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-endpoint.mjs

@@ -1,16 +1,17 @@
 import { randomBytes } from "node:crypto";
-import { constants } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rename, rm } from "node:fs/promises";
 import path from "node:path";
-import { versionOrder } from "@agents-can-communicate/adapter-sdk";
+import { closedTo, isWindowsPlatform, openRegularNoFollow, versionOrder } from "@agents-can-communicate/adapter-sdk";
 
 import { PROTOCOL_CONTRACT } from "./inbox-contract.mjs";
-import { inboxSocketIsSafe } from "./inbox-registry.mjs";
+import { inboxSocketIsSafe, isInboxPipe, listPipesOfMachine } from "./inbox-registry.mjs";
 import { isReception } from "./inbox-settings.mjs";
 
 // One private record per hook binding, the way the Codex adapter keeps its
 // daemon endpoints: core holds only the random id, and the socket path, pid and
-// session id stay in a 0600 file under the workspace runtime directory.
+// session id stay in a 0600 file under the workspace runtime directory. On
+// Windows the file and its directory carry no mode bits; the profile's ACL keeps
+// them to this user, and the inbox is a named pipe rather than a socket path.
 
 const KEYS = ["schemaVersion", "endpointId", "socketPath", "configDir", "clientPid", "sessionId",
   "clientVersion", "protocolContract", "leaseUntil", "reception"];
@@ -24,11 +25,12 @@ export const newEndpointId = () => `claude_inbox_${randomBytes(16).toString("hex
 // Where, under a workspace runtime directory, the records live.
 export const ENDPOINTS_DIRECTORY = "claude-inbox-endpoints";
 
-function valid(record) {
+function valid(record, platform) {
   return record !== null && typeof record === "object" && !Array.isArray(record)
     && Object.keys(record).length === KEYS.length && KEYS.every(key => Object.hasOwn(record, key))
     && record.schemaVersion === 1 && ENDPOINT.test(record.endpointId)
-    && absolute(record.socketPath) && absolute(record.configDir)
+    && (isWindowsPlatform(platform) ? isInboxPipe(record.socketPath) : absolute(record.socketPath))
+    && absolute(record.configDir)
     && Number.isInteger(record.clientPid) && record.clientPid > 0
     && typeof record.sessionId === "string" && record.sessionId !== "" && record.sessionId.length <= 200
     && typeof record.clientVersion === "string" && versionOrder(record.clientVersion) !== null
@@ -39,7 +41,7 @@ function valid(record) {
     && isReception(record.reception);
 }
 
-async function directory(runtimeDir, create = false) {
+async function directory(runtimeDir, create = false, platform = process.platform) {
   if (!absolute(runtimeDir)) throw invalid();
   if (create) await mkdir(runtimeDir, { recursive: true, mode: 0o700 });
   const root = await realpath(runtimeDir);
@@ -48,15 +50,20 @@ async function directory(runtimeDir, create = false) {
     if (error.code !== "EEXIST") throw error;
   });
   const info = await lstat(dir);
-  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || (info.mode & 0o022) !== 0) throw invalid();
+  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || !closedTo(info, 0o022, { platform })) {
+    throw invalid();
+  }
   return dir;
 }
 
-export async function writeInboxEndpoint({ runtimeDir, record }) {
-  if (!valid(record) || !await inboxSocketIsSafe(record.socketPath)) throw invalid();
+export async function writeInboxEndpoint({ runtimeDir, record, platform = process.platform,
+  listPipes = listPipesOfMachine }) {
+  if (!valid(record, platform) || !await inboxSocketIsSafe(record.socketPath, { platform, listPipes })) {
+    throw invalid();
+  }
   const text = `${JSON.stringify(record)}\n`;
   if (Buffer.byteLength(text) > MAX_BYTES) throw invalid();
-  const dir = await directory(runtimeDir, true);
+  const dir = await directory(runtimeDir, true, platform);
   const file = path.join(dir, `${record.endpointId}.json`);
   const temporary = path.join(dir, `.${record.endpointId}.${randomBytes(8).toString("hex")}.tmp`);
   let handle;
@@ -72,17 +79,18 @@ export async function writeInboxEndpoint({ runtimeDir, record }) {
 }
 
 // An expired record is metadata for re-verification, never proof of reach.
-export async function readInboxEndpoint({ runtimeDir, endpointId }) {
+export async function readInboxEndpoint({ runtimeDir, endpointId, platform = process.platform }) {
   if (typeof endpointId !== "string" || !ENDPOINT.test(endpointId)) return null;
   let handle;
   try {
-    const dir = await directory(runtimeDir);
-    handle = await open(path.join(dir, `${endpointId}.json`),
-      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const dir = await directory(runtimeDir, false, platform);
+    handle = await openRegularNoFollow(path.join(dir, `${endpointId}.json`), undefined, { platform });
     const info = await handle.stat();
-    if (!info.isFile() || !own(info) || info.size > MAX_BYTES || (info.mode & 0o077) !== 0) return null;
+    if (!info.isFile() || !own(info) || info.size > MAX_BYTES || !closedTo(info, 0o077, { platform })) {
+      return null;
+    }
     const record = JSON.parse(await handle.readFile("utf8"));
-    return valid(record) && record.endpointId === endpointId ? record : null;
+    return valid(record, platform) && record.endpointId === endpointId ? record : null;
   } catch {
     return null;
   } finally {
@@ -90,14 +98,15 @@ export async function readInboxEndpoint({ runtimeDir, endpointId }) {
   }
 }
 
-export async function removeInboxEndpoint({ runtimeDir, endpointId }) {
+export async function removeInboxEndpoint({ runtimeDir, endpointId, platform = process.platform }) {
   if (typeof endpointId !== "string" || !ENDPOINT.test(endpointId)) return;
   try {
-    const dir = await directory(runtimeDir);
+    const dir = await directory(runtimeDir, false, platform);
     await rm(path.join(dir, `${endpointId}.json`), { force: true });
   } catch { /* retirement is already recorded; cleanup is best effort */ }
   try {
-    await rm(path.join(await wakesDirectory(runtimeDir), endpointId), { recursive: true, force: true });
+    await rm(path.join(await wakesDirectory(runtimeDir, false, platform), endpointId),
+      { recursive: true, force: true });
   } catch { /* the same */ }
 }
 
@@ -115,17 +124,18 @@ const processExists = pid => {
  * retired. Only a record whose process is gone is removed: a live session whose
  * registry briefly names another conversation (right after /resume) keeps its own.
  */
-export async function sweepDeadEndpoints({ runtimeDir, exists = processExists, limit = 64 }) {
+export async function sweepDeadEndpoints({ runtimeDir, exists = processExists, limit = 64,
+  platform = process.platform }) {
   let names;
   try {
-    names = await readdir(await directory(runtimeDir));
+    names = await readdir(await directory(runtimeDir, false, platform));
   } catch {
     return;
   }
   for (const name of names.filter(item => /^claude_inbox_[a-f0-9]{32}\.json$/.test(item)).slice(0, limit)) {
     const endpointId = name.slice(0, -".json".length);
-    const record = await readInboxEndpoint({ runtimeDir, endpointId });
-    if (record !== null && !exists(record.clientPid)) await removeInboxEndpoint({ runtimeDir, endpointId });
+    const record = await readInboxEndpoint({ runtimeDir, endpointId, platform });
+    if (record !== null && !exists(record.clientPid)) await removeInboxEndpoint({ runtimeDir, endpointId, platform });
   }
 }
 
@@ -134,20 +144,22 @@ export async function sweepDeadEndpoints({ runtimeDir, exists = processExists, l
 // transport again; the marker keeps it to one wake per message and binding.
 const WAKE_MESSAGE = /^[A-Za-z0-9_-]{1,200}$/;
 
-async function wakesDirectory(runtimeDir, create = false) {
-  const dir = path.join(path.dirname(await directory(runtimeDir, create)), "claude-inbox-wakes");
+async function wakesDirectory(runtimeDir, create = false, platform = process.platform) {
+  const dir = path.join(path.dirname(await directory(runtimeDir, create, platform)), "claude-inbox-wakes");
   if (create) await mkdir(dir, { mode: 0o700 }).catch(error => {
     if (error.code !== "EEXIST") throw error;
   });
   const info = await lstat(dir);
-  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || (info.mode & 0o022) !== 0) throw invalid();
+  if (!info.isDirectory() || info.isSymbolicLink() || !own(info) || !closedTo(info, 0o022, { platform })) {
+    throw invalid();
+  }
   return dir;
 }
 
 /** True when this call is the first to wake the binding for the message. */
-export async function claimWake({ runtimeDir, endpointId, messageId }) {
+export async function claimWake({ runtimeDir, endpointId, messageId, platform = process.platform }) {
   if (!ENDPOINT.test(endpointId) || !WAKE_MESSAGE.test(messageId)) throw invalid();
-  const dir = path.join(await wakesDirectory(runtimeDir, true), endpointId);
+  const dir = path.join(await wakesDirectory(runtimeDir, true, platform), endpointId);
   await mkdir(dir, { mode: 0o700 }).catch(error => {
     if (error.code !== "EEXIST") throw error;
   });
@@ -160,9 +172,10 @@ export async function claimWake({ runtimeDir, endpointId, messageId }) {
   }
 }
 
-export async function releaseWake({ runtimeDir, endpointId, messageId }) {
+export async function releaseWake({ runtimeDir, endpointId, messageId, platform = process.platform }) {
   if (!ENDPOINT.test(endpointId) || !WAKE_MESSAGE.test(messageId)) return;
   try {
-    await rm(path.join(await wakesDirectory(runtimeDir), endpointId, messageId), { force: true });
+    await rm(path.join(await wakesDirectory(runtimeDir, false, platform), endpointId, messageId),
+      { force: true });
   } catch { /* a marker left behind only suppresses a repeat wake */ }
 }

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-registry.mjs

@@ -1,33 +1,65 @@
-import { constants } from "node:fs";
-import { lstat, open, realpath } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { lstat, readdir, realpath } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { isWindowsPlatform as isWindows, openRegularNoFollow } from "@agents-can-communicate/adapter-sdk";
 
 // Claude Code's own record of a live session: `<config>/sessions/<pid>.json`
-// names the session id and the inbox socket it listens on. ACC reads that file
-// and nothing beside it - never the `<pid>.<hash>.key` next to it.
+// names the session id and the inbox it listens on. On POSIX the inbox is a
+// socket only this user can open, and ACC reads that file and nothing beside it.
+// On Windows the inbox is a named pipe that refuses a frame without an auth
+// line, and Claude publishes a key for other sessions of the same user beside
+// the record: `<pid>.<sha256 of the lowercased pipe path>.key` (measured on
+// 2.1.286). ACC reads that peer key there, so a wake is classified a peer's and
+// the recipient's inbound settings apply; it never reads the session's own
+// messaging token, which would pass as the session's child.
 
 const MAX_BYTES = 16_384;
+const KEY_MAX_BYTES = 4_096;
+const INBOX_PIPE = /^\\\\\.\\pipe\\((?:LOCAL\\)?cc-msg-[0-9a-f]{32})$/i;
+const PEER_TOKEN = /^[0-9a-f]{32}$/;
+const VERSION = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
 const own = info => typeof process.getuid !== "function" || info.uid === process.getuid();
+const text = value => (typeof value === "string" && value !== "" ? value : null);
 
 export const claudeConfigDir = env => typeof env?.CLAUDE_CONFIG_DIR === "string"
   && path.isAbsolute(env.CLAUDE_CONFIG_DIR)
   ? env.CLAUDE_CONFIG_DIR : path.join(os.homedir(), ".claude");
 
+/** Whether a directory lies inside the user's profile, compared as Windows compares paths. */
+export function insideProfile(directory, profileDir) {
+  if (typeof directory !== "string" || typeof profileDir !== "string") return false;
+  const relative = path.win32.relative(profileDir.toLowerCase(), directory.toLowerCase());
+  return relative !== "" && !relative.startsWith("..") && !path.win32.isAbsolute(relative);
+}
+
+/** Whether a value names a Claude Code inbox pipe. */
+export const isInboxPipe = value => typeof value === "string" && INBOX_PIPE.test(value);
+
+export const listPipesOfMachine = () => readdir("\\\\.\\pipe\\");
+
 /** The registry entry for one pid, or null. Bounded, owner-checked, never through a link. */
-export async function readSessionRecord({ configDir, clientPid }) {
+export async function readSessionRecord({ configDir, clientPid, platform = process.platform }) {
   if (!Number.isInteger(clientPid) || clientPid <= 0 || typeof configDir !== "string") return null;
+  const windows = isWindows(platform);
+  const paths = windows ? path.win32 : path;
   let handle;
   try {
-    handle = await open(path.join(configDir, "sessions", `${clientPid}.json`),
-      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    handle = await openRegularNoFollow(path.join(configDir, "sessions", `${clientPid}.json`),
+      undefined, { platform });
     const info = await handle.stat();
     if (!info.isFile() || !own(info) || info.size > MAX_BYTES) return null;
     const record = JSON.parse(await handle.readFile("utf8"));
+    const inbox = typeof record?.messagingSocketPath === "string" && (windows
+      ? INBOX_PIPE.test(record.messagingSocketPath) : paths.isAbsolute(record.messagingSocketPath));
     return record?.pid === clientPid && typeof record.sessionId === "string" && record.sessionId !== ""
-      && typeof record.messagingSocketPath === "string" && path.isAbsolute(record.messagingSocketPath)
+      && inbox
       ? { pid: record.pid, sessionId: record.sessionId, messagingSocketPath: record.messagingSocketPath,
-        cwd: typeof record.cwd === "string" && path.isAbsolute(record.cwd) ? record.cwd : null }
+        cwd: typeof record.cwd === "string" && paths.isAbsolute(record.cwd) ? record.cwd : null,
+        // The build this process runs, as Claude Code itself recorded it.
+        version: typeof record.version === "string" && VERSION.test(record.version)
+          ? record.version : null,
+        ...(windows ? { procStart: text(record.procStart), pidDomain: text(record.pidDomain) } : {}) }
       : null;
   } catch {
     return null;
@@ -36,8 +68,19 @@ export async function readSessionRecord({ configDir, clientPid }) {
   }
 }
 
-/** A socket this user owns, reached without a link, closed to group and others. */
-export async function inboxSocketIsSafe(socketPath) {
+/**
+ * A socket this user owns, reached without a link, closed to group and others.
+ * On Windows a Claude inbox pipe the machine lists: its name is 128 random bits
+ * that only this user's profile records.
+ */
+export async function inboxSocketIsSafe(socketPath, { platform = process.platform,
+  listPipes = listPipesOfMachine } = {}) {
+  if (isWindows(platform)) {
+    const name = INBOX_PIPE.exec(typeof socketPath === "string" ? socketPath : "")?.[1]?.toLowerCase();
+    if (name === undefined) return false;
+    const pipes = await Promise.resolve().then(listPipes).catch(() => []);
+    return pipes.some(pipe => String(pipe).toLowerCase() === name);
+  }
   if (typeof socketPath !== "string" || !path.isAbsolute(socketPath)) return false;
   try {
     const info = await lstat(socketPath);
@@ -59,13 +102,55 @@ export async function inboxSocketIsSafe(socketPath) {
  * /resume before it rewrites the entry, so there the hook's own process and
  * socket are the proof; every offer and refresh still requires the session id.
  */
-export async function verifyInbox({ configDir, clientPid, sessionId, socketPath, anyConversation = false }) {
-  if (!await inboxSocketIsSafe(socketPath)) return "native_endpoint_unavailable";
-  const record = await readSessionRecord({ configDir, clientPid });
+export async function verifyInbox({ configDir, clientPid, sessionId, socketPath, anyConversation = false,
+  platform = process.platform, listPipes = listPipesOfMachine, profileDir = os.homedir() }) {
+  // The profile's ACL is what keeps the session files on Windows to their user,
+  // so a configuration directory outside it is not trusted for a peer key. Both
+  // are resolved first: TEMP and a hand-set CLAUDE_CONFIG_DIR may use 8.3 names.
+  if (isWindows(platform)) {
+    const [config, profile] = await Promise.all([configDir, profileDir]
+      .map(directory => realpath(directory).catch(() => null)));
+    if (!insideProfile(config, profile)) return "native_endpoint_unavailable";
+  }
+  if (!await inboxSocketIsSafe(socketPath, { platform, listPipes })) return "native_endpoint_unavailable";
+  const record = await readSessionRecord({ configDir, clientPid, platform });
   if (record === null || (!anyConversation && record.sessionId !== sessionId)) {
     return "native_session_unavailable";
   }
+  // A pipe has no path to resolve; Windows compares its name without case.
+  if (isWindows(platform)) {
+    return record.messagingSocketPath.toLowerCase() === socketPath.toLowerCase()
+      ? null : "native_session_unavailable";
+  }
   const [registered, expected] = await Promise.all([
     realpath(record.messagingSocketPath).catch(() => null), realpath(socketPath).catch(() => null)]);
   return registered !== null && registered === expected ? null : "native_session_unavailable";
 }
+
+/**
+ * Windows: the token Claude published for peers of this session, or null. The
+ * key's name binds it to this pid and this pipe, and its process start has to
+ * be the one the session record gives, so a key left by an earlier process
+ * that held the pid is never used. Read per offer, never stored by ACC.
+ */
+export async function readPeerKey({ configDir, record }) {
+  if (typeof configDir !== "string" || typeof record?.messagingSocketPath !== "string"
+    || !Number.isInteger(record.pid) || text(record.procStart) === null) return null;
+  const digest = createHash("sha256").update(record.messagingSocketPath.toLowerCase()).digest("hex");
+  let handle;
+  try {
+    handle = await openRegularNoFollow(path.join(configDir, "sessions", `${record.pid}.${digest}.key`),
+      undefined, { platform: "win32" });
+    const info = await handle.stat();
+    if (!info.isFile() || info.size > KEY_MAX_BYTES) return null;
+    const key = JSON.parse(await handle.readFile("utf8"));
+    const started = text(key?.procStartFt) ?? text(key?.procStart);
+    const domain = record.pidDomain === null || key?.pidDomain === record.pidDomain;
+    return PEER_TOKEN.test(key?.peerToken ?? "") && started === record.procStart && domain
+      ? key.peerToken : null;
+  } catch {
+    return null;
+  } finally {
+    await handle?.close().catch(() => null);
+  }
+}

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-settings.mjs

@@ -1,6 +1,6 @@
-import { execFile } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import path from "node:path";
+import { readProcessArgs as readArgs } from "@agents-can-communicate/adapter-sdk";
 
 // What Claude Code does with a wake from a sender that attests no permission
 // mode - ACC never attests one. A session that bypasses permission prompts
@@ -67,13 +67,9 @@ export function permissionModeFromArgs(args) {
   return null;
 }
 
-/** A process's arguments as `ps` prints them, split on spaces, or null. */
+/** A process's arguments, or null when they cannot be read. */
 export function readProcessArgs(pid, { timeoutMs = 500 } = {}) {
-  if (!Number.isInteger(pid) || pid <= 0 || process.platform === "win32") return Promise.resolve(null);
-  return new Promise(resolve => {
-    execFile("ps", ["-o", "args=", "-p", String(pid)], { timeout: timeoutMs, maxBuffer: 64 * 1024 },
-      (error, stdout) => resolve(error ? null : String(stdout).trim().split(/\s+/).filter(Boolean)));
-  });
+  return readArgs(pid, { timeoutMs });
 }
 
 export function receptionOf({ permissionMode, crossSessionInbound }) {

package/node_modules/@agents-can-communicate/adapter-claude-code/src/inbox-socket-directories.mjs

@@ -21,6 +21,8 @@ import path from "node:path";
 // serves the inbox on a named pipe, which no Unix socket grant covers.
 
 const hostOf = platform => String(platform ?? process.platform).split("-")[0];
+// Every branch below is a POSIX client's layout, built the same on any host.
+const posix = path.posix;
 const set = value => typeof value === "string" && value !== "";
 
 export function inboxSocketDirectories({ env = {}, platform, uid } = {}) {
@@ -30,12 +32,12 @@ export function inboxSocketDirectories({ env = {}, platform, uid } = {}) {
   // Claude Code's `||`: an empty value falls through to the next one.
   const root = [env.XDG_RUNTIME_DIR, env.CLAUDE_CODE_TMPDIR].find(set) ?? "/tmp";
   const fallbackRoot = set(env.TERMUX_VERSION) && set(env.PREFIX)
-    ? path.join(env.PREFIX, "tmp") : "/tmp";
+    ? posix.join(env.PREFIX, "tmp") : "/tmp";
   const directories = [
-    path.join(root, "cc-socks"),
+    posix.join(root, "cc-socks"),
     "/tmp/cc-socks",
     ...(host === "linux" ? [`/run/user/${user}/cc-socks`] : []),
-    path.join(fallbackRoot, `cc-socks-${user}`),
+    posix.join(fallbackRoot, `cc-socks-${user}`),
   ];
-  return [...new Set(directories.filter(directory => path.isAbsolute(directory)))];
+  return [...new Set(directories.filter(directory => posix.isAbsolute(directory)))];
 }