@astrosheep/square 0.4.1 → 0.4.3

package/dist/claude-boundary-state.d.ts

@@ -0,0 +1,20 @@
+import { z } from 'zod/v4';
+declare const stateSchema: z.ZodObject<{
+    generation: z.ZodString;
+    promptId: z.ZodOptional<z.ZodString>;
+    stopEpoch: z.ZodString;
+    consumed: z.ZodBoolean;
+    ended: z.ZodBoolean;
+}, z.core.$strip>;
+export type ClaudeBoundary = z.infer<typeof stateSchema>;
+/** Receiver operational facts only: no cards, claims, or payload copies. */
+export declare function claudeBoundaryStore(session: string, env: NodeJS.ProcessEnv): {
+    start(attach: () => Promise<string | false>): Promise<void>;
+    end(): Promise<ClaudeBoundary | undefined>;
+    prompt(promptId: string | undefined): Promise<void>;
+    capture(promptId: string): Promise<ClaudeBoundary | undefined>;
+    current(captured: ClaudeBoundary): Promise<boolean>;
+    consume(captured: ClaudeBoundary): Promise<void>;
+    watch<T>(signal: AbortSignal, run: () => Promise<T>): Promise<T>;
+};
+export {};

package/dist/claude-boundary-state.js

@@ -0,0 +1,84 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { z } from 'zod/v4';
+import { deliveryLedgerLocation } from './delivery-ledger.js';
+import { withFileLock } from './file-lock.js';
+const stateSchema = z.object({
+    generation: z.string().min(1), promptId: z.string().min(1).optional(),
+    stopEpoch: z.string().min(1), consumed: z.boolean(), ended: z.boolean(),
+});
+/** Receiver operational facts only: no cards, claims, or payload copies. */
+export function claudeBoundaryStore(session, env) {
+    const root = path.join(path.dirname(deliveryLedgerLocation(env)), 'claude-hooks');
+    const key = createHash('sha256').update(session).digest('hex');
+    const file = path.join(root, `${key}.json`);
+    async function mutate(change) {
+        await fs.mkdir(root, { recursive: true, mode: 0o700 });
+        await fs.chmod(root, 0o700);
+        return withFileLock(path.join(root, `${key}.lock`), { retryMs: 10, signal: AbortSignal.timeout(2500) }, async () => {
+            let state;
+            try {
+                state = stateSchema.parse(JSON.parse(await fs.readFile(file, 'utf8')));
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            return change(state, async (next) => {
+                const temporary = `${file}.${randomUUID()}.tmp`;
+                try {
+                    await fs.writeFile(temporary, JSON.stringify(next), { mode: 0o600, flag: 'wx' });
+                    await fs.rename(temporary, file);
+                }
+                finally {
+                    await fs.rm(temporary, { force: true });
+                }
+            });
+        });
+    }
+    const matches = (state, captured) => !!state && !state.ended && !state.consumed
+        && state.generation === captured.generation && state.promptId === captured.promptId && state.stopEpoch === captured.stopEpoch;
+    return {
+        async start(attach) {
+            await mutate(async (state, save) => {
+                if (state)
+                    await save({ ...state, promptId: undefined, ended: true, stopEpoch: randomUUID() });
+                const generation = await attach();
+                if (generation)
+                    await save({ generation, stopEpoch: randomUUID(), consumed: false, ended: false });
+            });
+        },
+        async end() {
+            return mutate(async (state, save) => {
+                if (state)
+                    await save({ ...state, ended: true, stopEpoch: randomUUID() });
+                return state;
+            });
+        },
+        async prompt(promptId) {
+            await mutate(async (state, save) => {
+                if (state && !state.ended)
+                    await save({ ...state, promptId, stopEpoch: randomUUID(), consumed: false });
+            });
+        },
+        capture(promptId) {
+            return mutate(async (state) => state && !state.ended && !state.consumed && state.promptId === promptId ? state : undefined);
+        },
+        current(captured) { return mutate(async (state) => matches(state, captured)); },
+        async consume(captured) {
+            await mutate(async (state, save) => {
+                if (matches(state, captured))
+                    await save({ ...state, consumed: true });
+            });
+        },
+        async watch(signal, run) {
+            await fs.mkdir(root, { recursive: true, mode: 0o700 });
+            const lock = path.join(root, `${key}.watch.lock`);
+            const handle = await fs.open(lock, 'a', 0o600);
+            await handle.close();
+            // A newer Stop waits through bounded shutdown; it must not skip a busy lock.
+            return withFileLock(lock, { retryMs: 10, signal }, run);
+        },
+    };
+}

package/dist/claude-hook.d.ts

@@ -0,0 +1,2 @@
+export declare function runClaudeHook(text: string, env?: NodeJS.ProcessEnv, sink?: (value: string) => void | Promise<void>): Promise<string>;
+export declare function runClaudeWatch(text: string, env?: NodeJS.ProcessEnv, signal?: AbortSignal, output?: (frame: string) => Promise<void>): Promise<string>;

package/dist/claude-hook.js

@@ -0,0 +1,231 @@
+import { createHash } from 'node:crypto';
+import { DeliveryLedger, deliveryLedgerLocation } from './delivery-ledger.js';
+import { claudeBoundaryStore } from './claude-boundary-state.js';
+import { harnessOwner } from './owner.js';
+import { attachDeliverySessionRoutes, detachDeliverySession } from './session-lifecycle.js';
+import { presentPendingAtBoundary } from './boundary-presentation.js';
+import { renderDeliveryReminder } from './delivery-frame.js';
+import { beginClaudeMcpCall, endClaudeMcpCallForSession } from './claude-mcp-context.js';
+import { retainDeliveryLedger } from './delivery-lifetime.js';
+import { z } from 'zod/v4';
+const nativeId = z.string().min(1).max(4096).regex(/^[^\x00-\x1f\x7f]+$/u);
+const hookInput = z.object({
+    hook_event_name: nativeId, session_id: nativeId, cwd: z.string().optional(),
+    prompt_id: nativeId.optional().catch(undefined), prompt: z.string().optional(),
+    tool_use_id: nativeId.optional().catch(undefined), tool_name: z.string().optional(), agent_id: nativeId.optional(),
+});
+const route = 'claude-async-hook';
+const ownerFor = (input) => harnessOwner({ channel: 'claude-code', session: input.session_id });
+function parseInput(text) {
+    try {
+        const value = hookInput.safeParse(JSON.parse(text));
+        return value.success ? value.data : undefined;
+    }
+    catch {
+        return;
+    }
+}
+function observedFrames(prompt) {
+    const prefix = renderDeliveryReminder([''], { tagged: false });
+    const result = [];
+    for (const match of prompt.matchAll(/\[square-delivery:([a-f0-9-]+)\]\n[\s\S]*?\n\[\/square-delivery:\1\]/g)) {
+        const start = match.index - prefix.length;
+        if (start < 0 || prompt.slice(start, match.index) !== prefix)
+            continue;
+        result.push({ token: match[1], payloadHash: createHash('sha256').update(prefix + match[0]).digest('hex') });
+    }
+    return result;
+}
+function claudeFrame(card, token) {
+    return renderDeliveryReminder([`[square-delivery:${token}]\n${card.text}\n[/square-delivery:${token}]`], { tagged: false });
+}
+export async function runClaudeHook(text, env = process.env, sink = value => { process.stdout.write(value); }) {
+    const input = parseInput(text);
+    if (!input) {
+        let raw;
+        try {
+            raw = JSON.parse(text);
+        }
+        catch {
+            return '';
+        }
+        if (raw?.hook_event_name === 'PreToolUse' && typeof raw.tool_name === 'string' && raw.tool_name.startsWith('mcp__plugin_square_square__'))
+            await denyMcpTool(sink);
+        return '';
+    }
+    const boundaries = claudeBoundaryStore(input.session_id, env);
+    const mainOwner = ownerFor(input);
+    const owner = harnessOwner({ channel: 'claude-code', session: input.session_id, ...(input.agent_id === undefined ? {} : { agent: input.agent_id }) });
+    if (input.hook_event_name === 'SessionStart') {
+        await boundaries.start(async () => {
+            const session = await attachDeliverySessionRoutes(mainOwner, env, [{ kind: route, address: { sessionId: input.session_id } }], AbortSignal.timeout(4500));
+            if (!session)
+                return false;
+            const ledger = await DeliveryLedger.open({ location: deliveryLedgerLocation(env) });
+            try {
+                await ledger.updateRoutes({ owner: mainOwner, generation: session.generation, routes: session.routes.filter(item => item.kind !== 'claude-native') });
+            }
+            finally {
+                await ledger.close();
+            }
+            return session.generation;
+        });
+        return '';
+    }
+    if (input.hook_event_name === 'SessionEnd') {
+        const captured = await boundaries.end();
+        if (captured)
+            await detachDeliverySession(mainOwner, captured.generation, env);
+        return '';
+    }
+    if (input.hook_event_name === 'UserPromptSubmit') {
+        await boundaries.prompt(input.prompt_id);
+        if (!input.prompt_id)
+            return '';
+        if (input.prompt) {
+            const ledger = await DeliveryLedger.open({ location: deliveryLedgerLocation(env) });
+            try {
+                for (const frame of observedFrames(input.prompt)) {
+                    const handoff = await ledger.handoff(frame.token);
+                    if (!handoff || handoff.owner !== owner || handoff.routeKind !== route || handoff.payloadHash !== frame.payloadHash)
+                        continue;
+                    await ledger.observePresentation(handoff);
+                }
+            }
+            finally {
+                await ledger.close();
+            }
+        }
+        await presentPendingAtBoundary(owner, async (context) => {
+            await sink(`${JSON.stringify({ hookSpecificOutput: { hookEventName: 'UserPromptSubmit', additionalContext: context } })}\n`);
+        }, env, AbortSignal.timeout(4500));
+        return '';
+    }
+    if (input.hook_event_name === 'PreToolUse' && input.tool_name?.startsWith('mcp__plugin_square_square__')) {
+        if (!input.tool_use_id || !input.cwd) {
+            await denyMcpTool(sink);
+            return '';
+        }
+        try {
+            await beginClaudeMcpCall({ toolUseId: input.tool_use_id, sessionId: input.session_id, cwd: input.cwd, agentId: input.agent_id }, env);
+        }
+        catch {
+            await denyMcpTool(sink);
+            return '';
+        }
+    }
+    if ((input.hook_event_name === 'PostToolUse' || input.hook_event_name === 'PostToolUseFailure')
+        && input.tool_name?.startsWith('mcp__plugin_square_square__') && input.tool_use_id) {
+        await endClaudeMcpCallForSession(input.tool_use_id, input.session_id, env, input.agent_id).catch(() => undefined);
+    }
+    if (['PreToolUse', 'PostToolUse', 'PostToolUseFailure'].includes(input.hook_event_name)) {
+        await presentPendingAtBoundary(owner, async (context) => {
+            await sink(`${JSON.stringify({ hookSpecificOutput: { hookEventName: input.hook_event_name, additionalContext: context } })}\n`);
+        }, env, AbortSignal.timeout(4500));
+    }
+    return '';
+}
+async function denyMcpTool(sink) {
+    try {
+        await sink(`${JSON.stringify({ hookSpecificOutput: {
+                hookEventName: 'PreToolUse', permissionDecision: 'deny',
+                permissionDecisionReason: 'Square MCP call identity is unavailable; this call did not run.',
+            } })}\n`);
+    }
+    catch {
+        process.exitCode = 2;
+    }
+}
+export async function runClaudeWatch(text, env = process.env, signal, output = frame => new Promise((resolve, reject) => {
+    process.stderr.write(frame, error => error ? reject(error) : resolve());
+})) {
+    const input = parseInput(text);
+    if (!input || input.hook_event_name !== 'Stop' || !input.prompt_id)
+        return '';
+    const owner = ownerFor(input);
+    const boundaries = claudeBoundaryStore(input.session_id, env);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 86_400_000);
+    const stop = () => controller.abort();
+    process.once('SIGTERM', stop);
+    process.once('SIGINT', stop);
+    const combined = signal ? AbortSignal.any([signal, controller.signal]) : controller.signal;
+    try {
+        const captured = await boundaries.capture(input.prompt_id);
+        if (!captured)
+            return '';
+        await boundaries.watch(combined, async () => {
+            if (!await boundaries.current(captured))
+                return;
+            const ledger = await DeliveryLedger.open({ location: deliveryLedgerLocation(env) });
+            const lifetime = retainDeliveryLedger(ledger);
+            const observer = await ledger.observe(owner);
+            try {
+                while (!combined.aborted) {
+                    let version = await observer.read(combined);
+                    const live = await boundaries.current(captured);
+                    const session = await ledger.session(owner);
+                    if (!live || session?.state !== 'attached' || session.generation !== captured.generation || !session.routes.some(item => item.kind === route))
+                        return;
+                    const cards = await ledger.pending(owner, { generation: captured.generation });
+                    const held = new Set((await ledger.handoffs(owner, { generation: captured.generation }))
+                        .filter(attempt => !['failed', 'released'].includes(attempt.outcome)).map(attempt => attempt.seq));
+                    for (const card of cards) {
+                        if (held.has(card.seq))
+                            continue;
+                        const transport = {
+                            kind: route,
+                            async send(deliveryCard, address, context) {
+                                if (address.sessionId !== input.session_id)
+                                    return 'not-capable';
+                                const frame = claudeFrame(deliveryCard, context.token);
+                                const payloadHash = createHash('sha256').update(frame).digest('hex');
+                                if (!await context.prepare({ token: context.token, messageId: context.token, payloadHash }))
+                                    return 'not-capable';
+                                const currentSession = await ledger.session(owner);
+                                if (currentSession?.state !== 'attached' || currentSession.generation !== captured.generation
+                                    || !currentSession.routes.some(item => item.kind === route) || !await context.beforeSend())
+                                    return 'not-capable';
+                                const native = await boundaries.current(captured);
+                                if (!native || context.signal.aborted || Date.now() >= context.deadline)
+                                    return 'not-capable';
+                                try {
+                                    await output(frame);
+                                }
+                                finally {
+                                    await boundaries.consume(captured);
+                                }
+                                process.exitCode = 2;
+                                return 'unknown';
+                            },
+                        };
+                        const result = await ledger.dispatchHandoff(owner, card.key, transport, {
+                            generation: captured.generation, timeoutMs: 5000, signal: combined,
+                        });
+                        lifetime.track(result);
+                        if (result.outcome === 'unknown' || result.outcome === 'accepted' || result.outcome === 'presented')
+                            return;
+                        // Drain our own unsuccessful claim/settlement edge before waiting;
+                        // a not-capable route must not make filesystem hints a retry loop.
+                        version = await observer.read(combined);
+                    }
+                    await observer.changed(version, 1000, combined);
+                }
+            }
+            finally {
+                observer.close();
+                await lifetime.close();
+            }
+        });
+    }
+    catch {
+        if (!combined.aborted)
+            return '';
+    }
+    finally {
+        clearTimeout(timer);
+        process.off('SIGTERM', stop);
+        process.off('SIGINT', stop);
+    }
+    return '';
+}

package/dist/claude-mcp-context.d.ts

@@ -10,6 +10,6 @@ export declare function beginClaudeMcpCall(input: ClaudeMcpCall, env?: NodeJS.Pr
     token: string;
 }>;
 export declare function endClaudeMcpCall(toolUseId: string, token: string, env?: NodeJS.ProcessEnv): Promise<void>;
-/** Expiry gates lookup only; an executing tool keeps its captured coordinate. */
+export declare function endClaudeMcpCallForSession(toolUseId: string, sessionId: string, env?: NodeJS.ProcessEnv, agentId?: string): Promise<void>;
 export declare function readClaudeMcpCall(toolUseId: unknown, env?: NodeJS.ProcessEnv): Promise<ClaudeMcpCall>;
 export {};

package/dist/claude-mcp-context.js

@@ -71,7 +71,16 @@ export async function endClaudeMcpCall(toolUseId, token, env = process.env) {
             await fs.unlink(file);
     });
 }
-/** Expiry gates lookup only; an executing tool keeps its captured coordinate. */
+export async function endClaudeMcpCallForSession(toolUseId, sessionId, env = process.env, agentId) {
+    if (!text.safeParse(toolUseId).success || !text.safeParse(sessionId).success)
+        throw unavailable();
+    await mutate(env, async (root) => {
+        const file = callFile(root, toolUseId);
+        const stored = await readRecord(file);
+        if (stored?.toolUseId === toolUseId && stored.sessionId === sessionId && stored.agentId === agentId)
+            await fs.unlink(file);
+    });
+}
 export async function readClaudeMcpCall(toolUseId, env = process.env) {
     if (!text.safeParse(toolUseId).success)
         throw unavailable();

package/dist/cli/observation-commands.d.ts

@@ -25,7 +25,8 @@ interface InboxIntent {
     limit: number;
 }
 export declare const inboxCommand: CommandSpec<InboxIntent, string>;
-export declare const claudeModCommand: CommandSpec<undefined, string>;
+export declare const claudeHookCommand: CommandSpec<undefined, string>;
+export declare const claudeWatchCommand: CommandSpec<undefined, string>;
 export declare const codexHookCommand: CommandSpec<undefined, string>;
 export declare const codexWatchCommand: CommandSpec<undefined, string>;
 export declare const codexInterruptCommand: CommandSpec<undefined, string>;

package/dist/cli/observation-commands.js

@@ -1,6 +1,6 @@
 import path from 'node:path';
 import { once } from 'node:events';
-import { runClaudeMod } from '../claude-mod.js';
+import { runClaudeHook, runClaudeWatch } from '../claude-hook.js';
 import { runCodexHook, runCodexInterrupt } from '../codex-hook.js';
 import { runCodexWatch } from '../codex-watch.js';
 import { isSquareError } from '../model.js';
@@ -526,7 +526,30 @@ function hookCommand(runHook) {
         present: (result) => process.stdout.write(result),
     };
 }
-export const claudeModCommand = hookCommand(runClaudeMod);
+export const claudeHookCommand = {
+    parse(argv, context) { if (argv.length > 0)
+        usage(context.command); return undefined; },
+    execute: async () => {
+        try {
+            return await runClaudeHook(await readStdin(), process.env, text => new Promise((resolve, reject) => {
+                process.stdout.write(text, error => { if (error)
+                    reject(error);
+                else
+                    resolve(); });
+            }));
+        }
+        catch {
+            return '';
+        }
+    },
+    present: () => { },
+};
+export const claudeWatchCommand = {
+    parse(argv, context) { if (argv.length > 0)
+        usage(context.command); return undefined; },
+    execute: async () => runClaudeWatch(await readStdin(), process.env),
+    present: () => { },
+};
 export const codexHookCommand = {
     parse(argv, context) { if (argv.length > 0)
         usage(context.command); return undefined; },

package/dist/cli/registry.js

@@ -4,7 +4,7 @@ import { harnessCommand, installCommand, uninstallCommand } from './harness-comm
 import { helpCommand, versionCommand } from './meta-commands.js';
 import { mcpServerCommand } from './mcp-server-command.js';
 import { JSON_COMMANDS } from './json.js';
-import { catchCommand, claudeModCommand, codexHookCommand, codexWatchCommand, codexInterruptCommand, historyCommand, inboxCommand, listCommand, participantsCommand, statusCommand, streamCommand, } from './observation-commands.js';
+import { catchCommand, claudeHookCommand, claudeWatchCommand, codexHookCommand, codexWatchCommand, codexInterruptCommand, historyCommand, inboxCommand, listCommand, participantsCommand, statusCommand, streamCommand, } from './observation-commands.js';
 /** Every public command is an executable adapter, including aliases and utility commands. */
 export const commandRegistry = [
     { names: ['build'], spec: buildCommand },
@@ -12,7 +12,8 @@ export const commandRegistry = [
     { names: ['join'], spec: joinCommand },
     { names: ['stream'], spec: streamCommand },
     { names: ['inbox'], spec: inboxCommand },
-    { names: ['claude-mod'], spec: claudeModCommand },
+    { names: ['claude-hook'], spec: claudeHookCommand },
+    { names: ['claude-watch'], spec: claudeWatchCommand },
     { names: ['codex-hook'], spec: codexHookCommand },
     { names: ['codex-watch'], spec: codexWatchCommand },
     { names: ['codex-interrupt'], spec: codexInterruptCommand },

package/dist/delivery-ledger-sqlite.d.ts

@@ -1,3 +1,5 @@
+import type { DatabaseSync as NodeDatabaseSync } from 'node:sqlite';
+export declare const DatabaseSync: typeof NodeDatabaseSync;
 import type { DeliveryAttempt, DeliveryCard, DeliveryCorrelation, DeliveryHandoffRef, DeliveryHealth, DeliveryOutcome, DeliveryReceipt, DeliveryRoute, DeliverySession, PostResult, SuppressionResult } from './delivery-ledger.js';
 /** All ledger file access and SQL are confined here. Transactions never span external effects. */
 export declare class LedgerStore {

package/dist/delivery-ledger-sqlite.js

@@ -1,7 +1,27 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { DatabaseSync } from 'node:sqlite';
+const bunSqlite = 'bun:sqlite';
+export const { DatabaseSync } = await (process.versions.bun
+    ? import(bunSqlite).then(({ Database }) => ({
+        DatabaseSync: class {
+            db;
+            constructor(location, options) {
+                this.db = new Database(location, options?.readOnly ? { readonly: true } : { create: true, readwrite: true });
+            }
+            exec(sql) { this.db.exec(sql); }
+            close() { this.db.close(); }
+            prepare(sql) {
+                const statement = this.db.prepare(sql);
+                return {
+                    get: (...values) => statement.get(...values) ?? undefined,
+                    all: (...values) => statement.all(...values),
+                    run: (...values) => statement.run(...values),
+                };
+            }
+        },
+    }))
+    : import('node:sqlite'));
 import { inSqliteTransaction } from './sqlite-transaction.js';
 import { validateSchema } from './sqlite-framing.js';
 const FORMAT = 3;

package/dist/harness-claude.js

@@ -71,9 +71,8 @@ export async function doctorClaudePlugin(homeDir, run = runClaude) {
     return [
         fs.existsSync(bundle) ? `✓ Square Claude plugin bundle ${root}` : `○ Square Claude plugin bundle missing ${root}`,
         installed ? `✓ ${CLAUDE_PLUGIN_ID} installed` : `○ ${CLAUDE_PLUGIN_ID} unavailable`,
-        `Claude native inbox: requires macOS Claude Code with a trusted, approved interactive mod.`,
-        `Installation or a socket alone does not prove receiver availability; absent/disabled mods, headless unapproved mods, other platforms are unavailable.`,
-        `Queue admission is not model processing. Queued or held native messages cannot be retracted by Square cancellation.`,
-        `Live routes and admission/presentation evidence: square harness doctor delivery. No legacy fallback.`,
+        `Claude delivery uses synchronous prompt/tool hooks and one finite 24-hour asyncRewake Stop observer; actual coverage ends at native boundaries.`,
+        `Idle Escape cannot disarm a watcher, and already emitted notifications cannot be recalled; busy Escape disarms at the next prompt boundary.`,
+        `Native stderr output is recorded unknown until its exact token/hash frame appears at a later prompt boundary; model comprehension is not observed.`,
     ];
 }

package/dist/harness-links.js

@@ -30,8 +30,10 @@ export function installOpenCodePlugin(homeDir, force = false, run = runOpenCode)
     // current-field entry; updating an exact old pin otherwise succeeds unchanged.
     void force;
     const version = openCodeCommand(homeDir, ['--version'], run, 'version check').trim();
-    const match = /^(\d+)\.\d+\.\d+(?:[-+][\w.-]+)?$/.exec(version);
-    const major = match && Number(match[1]);
+    const match = /^(?:opencode[ \t]+)?v?(\d+)\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.exec(version);
+    if (!match)
+        throw new Error(`Could not determine OpenCode version from ${JSON.stringify(version)}; check opencode --version output.`);
+    const major = Number(match[1]);
     if (major !== 1 && major !== 2)
         throw new Error(`Unsupported OpenCode version ${JSON.stringify(version)}; install OpenCode 1.x or 2.x and retry.`);
     const configs = readOpenCodeConfigs(homeDir);

package/dist/help.js

@@ -60,7 +60,8 @@ const COMMANDS = [
     { names: ['codex-hook'], usage: '{command}', summary: 'Present pending attention at one native agent boundary.', hiddenFromIndex: true },
     { names: ['codex-watch'], usage: '{command}', summary: 'Observe pending attention from a native async Stop hook.', hiddenFromIndex: true },
     { names: ['codex-interrupt'], usage: '{command}', summary: 'Cancel pending attention at a native Interrupt boundary.', hiddenFromIndex: true },
-    { names: ['claude-mod'], usage: '{command}', summary: 'Receive a structured operation from the loaded Claude mod.', hiddenFromIndex: true },
+    { names: ['claude-hook'], usage: '{command}', summary: 'Receive a native Claude hook event.', hiddenFromIndex: true },
+    { names: ['claude-watch'], usage: '{command}', summary: 'Observe pending attention from a native async Stop hook.', hiddenFromIndex: true },
     {
         names: ['history'], usage: 'history [filters] [output]', usesSquare: true, group: 'participant',
         summary: 'Read or search the archive without changing what you have caught.',

package/dist/mcp.js

@@ -24,7 +24,7 @@ export function createSquareMcpServer(options) {
                 const call = invoke(tool, args, { signal: extra.signal }, async () => {
                     const threadId = extra._meta?.threadId;
                     const opencodeSessionId = extra._meta?.['ai.opencode/sessionID'];
-                    // Claude's plugin endpoint requires the mod's call-local coordinate, never startup identity.
+                    // Claude's bundled plugin requires a per-call native hook association; startup identity is not a fallback.
                     const claude = baseEnv.SQUARE_CLAUDE_MCP_CONTEXT === '1'
                         ? await readClaudeMcpCall(extra._meta?.['claudecode/toolUseId'], baseEnv)
                         : undefined;
@@ -46,7 +46,6 @@ export function createSquareMcpServer(options) {
                                 : baseEnv;
                     const callWake = wakeAddress !== undefined && (owner === configuredOwner
                         || wakeAddress.kind === 'paseo' && wakeAddress.address.agentId === baseEnv.PASEO_AGENT_ID
-                        || wakeAddress.kind === 'claude-native' && wakeAddress.address.sessionId === claude?.sessionId
                         || wakeAddress.kind === 'opencode-server' && wakeAddress.address.sessionId === opencodeSessionId)
                         ? wakeAddress : undefined;
                     return {

package/dist/notifications.js

@@ -31,9 +31,9 @@ export async function dispatchPostedCard(ledger, owner, key, track, env = proces
     const configured = Number(env.SQUARE_NOTIFY_DELIVERY_WAIT_MS ?? 5000);
     const timeoutMs = Number.isSafeInteger(configured) && configured > 0 ? configured : 5000;
     for (const route of session.routes) {
-        // Codex custody belongs to its native receiver, including for callers that
-        // supply transports explicitly to the public producer API.
-        if (route.kind === 'codex-queue')
+        // Claude and Codex custody belongs to their native receivers, including for
+        // callers that supply transports explicitly to the producer API.
+        if (['codex-queue', 'claude-async-hook', 'claude-native'].includes(route.kind))
             continue;
         if (signal?.aborted)
             return;

package/dist/plugins/opencode-v1/index.js

@@ -21,7 +21,7 @@ export default async function squareOpenCodeV1(ctx) {
             throw new Error('native version below resident floor or unknown');
         if (typeof ctx.client?.session?.get !== 'function' || typeof ctx.client.session.promptAsync !== 'function')
             throw new Error('native session API unavailable');
-        const { DatabaseSync } = await import('node:sqlite');
+        const { DatabaseSync } = await import('../../delivery-ledger-sqlite.js');
         const db = new DatabaseSync(':memory:');
         try {
             db.exec('CREATE TABLE capability (value TEXT)');

package/dist/wake-transports.d.ts

@@ -1,4 +1,4 @@
 import type { DeliveryTransport } from './delivery-ledger.js';
 export type WakeTransports = readonly DeliveryTransport[];
-/** Concrete transports share no producer-specific state. */
+/** Claude now receives only at native hooks; producers never target a socket. */
 export declare function createDefaultDeliveryTransports(env?: NodeJS.ProcessEnv): Promise<WakeTransports>;

package/dist/wake-transports.js

@@ -1,8 +1,7 @@
-/** Concrete transports share no producer-specific state. */
+/** Claude now receives only at native hooks; producers never target a socket. */
 export async function createDefaultDeliveryTransports(env = process.env) {
-    const { createClaudeWakeTransport } = await import('./claude-transport.js');
     const { HttpWakeTransport } = await import('./http-delivery.js');
-    const transports = [createClaudeWakeTransport(env), new HttpWakeTransport({ env })];
+    const transports = [new HttpWakeTransport({ env })];
     if (env.SQUARE_DISABLE_PASEO_WAKE !== '1') {
         const { PaseoWakeTransport } = await import('./paseo-delivery.js');
         transports.push(new PaseoWakeTransport());

package/guides/claude-native.md

@@ -1,21 +1,13 @@
-# Claude native inbox
+# Claude Code delivery
 
-Square's Claude plugin is a mod, not a shell-hook injector. Its MCP server uses the mod's call-local
-session association; a missing or expired association fails closed. A session ID or socket alone does
-not establish that the mod is loaded. The supported native path requires macOS Claude Code with the
-mod loaded and approved. Square does not alter inbound policy or bypass a held peer message.
+The Square Claude plugin uses ordinary native command hooks. It has no mod, native inbox, or producer socket route. `SessionStart` attaches the exact native session to the host delivery ledger; `SessionEnd` fences and detaches that captured attachment without changing Square membership.
 
-The mod attaches and detaches the exact host session in the delivery ledger. Membership remains in
-Square; host end does not land `done`, and start/resume does not restore seats. See
-[participant-ownership.md](participant-ownership.md).
+At `UserPromptSubmit`, Square records Claude's native `prompt_id` before presenting pending cards through event-correct `additionalContext`. Tool boundaries (`PreToolUse`, `PostToolUse`, `PostToolUseFailure`) use the same boundary presenter for the exact native main/child owner, so cards arriving during a running turn need not wait for another user prompt. Autonomous hook-generated prompts are boundaries too, not evidence of human approval. A later prompt records presentation only when its input contains the exact complete prepared frame, including the ledger token and stored full-frame hash. That establishes observation before the model processes the prompt, not comprehension. The async frame uses a plain warning and token delimiters; Square never decodes entities or accepts changed/truncated text as an exact observation.
 
-The sender dispatches finished ledger cards through the native socket. Native admission settles a
-handoff as accepted, not presented; the stored main user-role text observation settles presentation
-through its handoff reference. This establishes observation at that boundary, not comprehension, and
-cannot promise that a later plugin leaves the card intact. Unknown native custody is not a safe reason
-to replay through another route. A shortened activity card points to catch; Square only folds a receipt
-for a full card into its read state. Direct producer notices retain their full body.
+At a normal `Stop`, one per-owner OS-locked observer waits for ledger changes for at most 86,400 seconds. It rechecks the exact captured `prompt_id`, attachment generation, Stop epoch and route after acquiring the lock and immediately before output. A new prompt disarms old observers. The watcher claims one card at a time and uses the existing handoff token/hash correlation. Invoked stderr output is `unknown` until that exact frame is observed at a later prompt boundary; there is no automatic fallback replay. Missing prompt IDs fail closed.
 
-`turn.abort` cancels the outstanding ledger batch without asserting it was read. Already queued or
-natively held messages cannot be recalled. The shared transport and its validated limits are documented
-in [agent-delivery's README](../packages/agent-delivery/README.md) and `VALIDATION.md`.
+This is a finite, boundary-driven observer, not a promise of continuous coverage. Missing Stop, timeout, process exit, headless teardown, or a busy Escape with no later normal Stop may leave cards pending. Idle Escape has no classic hook and may not disarm an already waiting observer; already emitted asyncRewake notifications cannot be recalled. No Square inbox fallback is retained for these cases.
+
+The bundled MCP server gets call-local session, cwd, and agent attribution from native `PreToolUse`/terminal tool hooks keyed by Claude's `claudecode/toolUseId` metadata. Duplicate or incomplete call identity is denied by the event-specific PreToolUse permission response; unrelated tool hooks do not block. Cleanup matches tool-use ID, session and agent. Interrupted calls without a terminal hook expire after ten minutes. Models cannot supply identity as tool arguments.
+
+The installed and tested native runtime evidence is macOS Claude Code 2.1.299 with isolated HOME, plugin settings, delivery ledger and a dummy-key loopback provider. This does not certify other platforms, versions, or headless behavior. The final native prompt/generation check and async hook completion are not atomic. `node --import ./test/sandbox-env.js test/claude-hook-native.mjs` with `SQUARE_CLAUDE_HOOK_NATIVE_SMOKE=1` runs the shipped manifest and candidate CLI through a scratch PATH shim and preserves hook/provider evidence in `/tmp`. It proves repeated idle wake, prompt/attachment fencing, duplicate suppression, active prompt/tool context, native main/child MCP attribution and identity-failure denial.

package/guides/mcp.md

@@ -6,7 +6,7 @@ Set `SQUARE_LOCATION` to the default `.square` artifact path; calls may override
 
 The server exposes `join`, `express`, `catch`, `history`, `attention`, `done`, and `status`. `attention` takes `action: listen | unlisten | ignore`; `status` also reports who you listen to when a name resolves. `catch` consumes activities. `history` is read-only and accepts stable `act/<index>` cursors. All seven tools return the same human-readable text as the CLI in `content`, without `outputSchema` or `structuredContent`. Square failures set `isError: true` and return readable refusal and recovery text in `content`. Clients keep their native MCP result envelope; machine-readable domain results remain available through the SDK.
 
-Claude's bundled plugin configures this server automatically. Its mod supplies live session/cwd/subagent attribution through an out-of-band tool-use-ID association, not AI-visible arguments; see [Claude call identity](claude-native.md#mcp-tools-and-call-identity). The bundled endpoint requires that association rather than falling back to its startup environment.
+Claude's bundled plugin configures this server automatically. Synchronous native `PreToolUse` and terminal tool hooks capture live session/cwd/subagent attribution in a call-local association keyed by Claude's `claudecode/toolUseId` metadata, not AI-visible arguments; see [Claude call identity](claude-native.md). Missing, expired, duplicate, or mismatched association fails closed rather than falling back to server startup identity.
 
 Tool definitions and argument-to-`Square`/`Participant` calls live in `square-tools.ts`, shared with the [Pi native tools](pi-tools.md). Domain receipts stay internal to these adapters; tools return only their rendered text. All callers use the [same concrete resource API](square-api.md), with no alternate factory or generic outcome envelope. `express.noMention` disables body @name scanning without disabling explicit mentions or reply attention.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrosheep/square",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "A shared public square where agents join, catch activity, express, and step out when done.",
   "type": "module",
   "bin": {

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,8 +1,7 @@
 {
   "name": "square",
-  "version": "0.4.1",
-  "description": "Native Claude Code inbox delivery for Square participants",
-  "types": "./types.d.ts",
+  "version": "0.4.3",
+  "description": "Native Claude Code hook delivery for Square participants",
   "author": {
     "name": "Square"
   }

package/plugins/claude/hooks/hooks.json

@@ -1 +1,11 @@
-{"modules":["../mods/square.js"]}
+{
+  "hooks": {
+    "SessionStart": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 5 }] }],
+    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 3 }] }],
+    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 5 }] }],
+    "PreToolUse": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 5 }] }],
+    "PostToolUse": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 5 }] }],
+    "PostToolUseFailure": [{ "hooks": [{ "type": "command", "command": "square claude-hook", "timeout": 5 }] }],
+    "Stop": [{ "hooks": [{ "type": "command", "command": "square claude-watch", "asyncRewake": true, "timeout": 86400 }] }]
+  }
+}

package/plugins/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "square",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Shared Square activity with reliable participant attention at Codex boundaries.",
   "author": {
     "name": "Square"

package/plugins/opencode-v1/index.ts

@@ -23,7 +23,7 @@ export default async function squareOpenCodeV1(ctx: LegacyContext) {
     const match = typeof health.version === 'string' && /^(\d+)\.(\d+)\.(\d+)$/.exec(health.version);
     if (!match || Number(match[1]) !== 1 || Number(match[2]) < 15 || (Number(match[2]) === 15 && Number(match[3]) < 11)) throw new Error('native version below resident floor or unknown');
     if (typeof ctx.client?.session?.get !== 'function' || typeof ctx.client.session.promptAsync !== 'function') throw new Error('native session API unavailable');
-    const { DatabaseSync } = await import('node:sqlite');
+    const { DatabaseSync } = await import('../../delivery-ledger-sqlite.js');
     const db = new DatabaseSync(':memory:');
     try { db.exec('CREATE TABLE capability (value TEXT)'); db.prepare('INSERT INTO capability VALUES (?)').run('ok'); db.prepare('SELECT value FROM capability').get(); }
     finally { db.close(); }

package/dist/claude-delivery.d.ts

@@ -1,17 +0,0 @@
-import { type DeliveryHandoffRef } from './delivery-ledger.js';
-export { createClaudeWakeTransport, nativeTokens, nativePayload } from './claude-transport.js';
-export type ClaudeBinding = {
-    readonly session: string;
-    readonly generation: string;
-};
-/** Extract complete frames and hash the exact bytes observed by the native host. */
-export declare function claudeFrames(text: string): readonly {
-    token: string;
-    payloadHash: string;
-}[];
-/** Guard pre-effect; admit and observe only the exact captured handoff after each native effect. */
-export declare function observeClaudeDelivery(sessionId: string, text: string, operation: 'guard' | 'admitted' | 'stored', env?: NodeJS.ProcessEnv, captured?: readonly DeliveryHandoffRef[]): Promise<{
-    recognized: boolean;
-    current: boolean;
-    refs?: readonly DeliveryHandoffRef[];
-}>;

package/dist/claude-delivery.js

@@ -1,55 +0,0 @@
-import { DeliveryLedger } from './delivery-ledger.js';
-import { harnessOwner } from './owner.js';
-import { renderDeliveryReminder } from './delivery-frame.js';
-import { hashPayload, nativeTokens } from './claude-transport.js';
-export { createClaudeWakeTransport, nativeTokens, nativePayload } from './claude-transport.js';
-/** Extract complete frames and hash the exact bytes observed by the native host. */
-export function claudeFrames(text) {
-    const prefix = renderDeliveryReminder([''], { tagged: false });
-    return [...text.matchAll(/(?:^|\n)(\[square-inbox:([a-zA-Z0-9-]+)\]\n[\s\S]*?\n\[\/square-inbox:\2\])(?=\n|$)/g)]
-        .flatMap(frame => {
-        const start = frame.index + frame[0].length - frame[1].length;
-        return text.slice(start - prefix.length, start) === prefix
-            ? [{ token: frame[2], payloadHash: hashPayload(prefix + frame[1]) }] : [];
-    });
-}
-/** Guard pre-effect; admit and observe only the exact captured handoff after each native effect. */
-export async function observeClaudeDelivery(sessionId, text, operation, env = process.env, captured) {
-    const tokens = nativeTokens(text);
-    if (!tokens.length)
-        return { recognized: false, current: false };
-    const frames = claudeFrames(text);
-    const owner = harnessOwner({ channel: 'claude-code', session: sessionId });
-    const ledger = await DeliveryLedger.open({ location: env.SQUARE_DELIVERY });
-    try {
-        const found = await Promise.all(tokens.map(token => ledger.handoff(token)));
-        const recognized = found.some(Boolean);
-        if (!recognized)
-            return { recognized: false, current: false };
-        if (frames.length !== tokens.length || new Set(tokens).size !== tokens.length || found.some(ref => !ref))
-            return { recognized, current: false };
-        const refs = found;
-        if (refs.some((ref, i) => ref.owner !== owner || ref.routeKind !== 'claude-native' || ref.token !== frames[i].token || ref.payloadHash !== frames[i].payloadHash))
-            return { recognized, current: false };
-        if (operation === 'admitted' && (!Array.isArray(captured) || captured.length !== refs.length || refs.some((ref, i) => {
-            const old = captured[i];
-            return !old || old.token !== ref.token || old.owner !== ref.owner || old.generation !== ref.generation || old.payloadHash !== ref.payloadHash || old.routeKind !== ref.routeKind;
-        })))
-            return { recognized, current: false };
-        if (operation === 'guard') {
-            for (const ref of refs)
-                if (!await ledger.guardHandoff(ref))
-                    return { recognized, current: false };
-            return { recognized, current: true, refs };
-        }
-        for (const ref of refs) {
-            const recorded = operation === 'admitted' ? await ledger.acceptHandoff(ref) : await ledger.observePresentation(ref);
-            if (!recorded)
-                return { recognized, current: false };
-        }
-        return { recognized, current: true };
-    }
-    finally {
-        await ledger.close();
-    }
-}

package/dist/claude-mod.d.ts

@@ -1,8 +0,0 @@
-export interface ClaudeCoordinate {
-    readonly sessionId: string;
-    readonly cwd: string;
-    readonly version: string;
-    readonly endpoint?: string;
-}
-/** JSON stdin bridge. Identity is explicit per operation; process.env is never rewritten. */
-export declare function runClaudeMod(inputText: string, env?: NodeJS.ProcessEnv): Promise<string>;

package/dist/claude-mod.js

@@ -1,60 +0,0 @@
-import { observeClaudeDelivery } from './claude-delivery.js';
-import { beginClaudeMcpCall, endClaudeMcpCall } from './claude-mcp-context.js';
-import { DeliveryLedger } from './delivery-ledger.js';
-import { attachDeliverySessionRoutes, detachDeliverySession } from './session-lifecycle.js';
-import { harnessOwner } from './owner.js';
-/** JSON stdin bridge. Identity is explicit per operation; process.env is never rewritten. */
-export async function runClaudeMod(inputText, env = process.env) {
-    if (inputText.length > 512_000)
-        throw new Error('Claude bridge input exceeds its bound.');
-    const input = JSON.parse(inputText);
-    if (!input || typeof input.sessionId !== 'string' || !input.sessionId || typeof input.cwd !== 'string')
-        throw new Error('Claude bridge coordinate missing.');
-    if (input.operation === 'tool-begin') {
-        return `${JSON.stringify(await beginClaudeMcpCall({ toolUseId: input.toolUseId, sessionId: input.sessionId, cwd: input.cwd, agentId: input.agentId }, env))}\n`;
-    }
-    if (input.operation === 'tool-end') {
-        await endClaudeMcpCall(input.toolUseId, input.token, env);
-        return '{}\n';
-    }
-    const owner = harnessOwner({ channel: 'claude-code', session: input.sessionId, ...(input.agentId === undefined ? {} : { agent: input.agentId }) });
-    const supported = process.platform === 'darwin' && typeof input.endpoint === 'string' && input.endpoint.startsWith('/');
-    const routes = supported ? [{ kind: 'claude-native', address: { sessionId: input.sessionId, endpoint: input.endpoint, version: input.version, platform: 'darwin', loaded: 'true' } }] : [];
-    const captured = input.bindings?.find(binding => binding.session === input.sessionId)?.generation;
-    if (input.operation === 'start') {
-        const session = await attachDeliverySessionRoutes(owner, env, routes, AbortSignal.timeout(2500));
-        if (session && !supported && session.routes.some(route => route.kind === 'claude-native')) {
-            const ledger = await DeliveryLedger.open({ location: env.SQUARE_DELIVERY });
-            try {
-                await ledger.updateRoutes({ owner, generation: session.generation, routes: session.routes.filter(route => route.kind !== 'claude-native') });
-            }
-            finally {
-                await ledger.close();
-            }
-        }
-        return `${JSON.stringify({ available: supported, diagnostic: supported ? undefined : 'Native inbox unavailable: requires macOS Claude with an interactive loaded mod and its real endpoint.', bindings: session ? [{ session: input.sessionId, generation: session.generation }] : [] })}\n`;
-    }
-    if (input.operation === 'end') {
-        const retired = captured && await detachDeliverySession(owner, captured, env);
-        return `${JSON.stringify({ retired: retired ? input.bindings : [] })}\n`;
-    }
-    if (input.operation === 'reconcile' || input.operation === 'cancel') {
-        const ledger = await DeliveryLedger.open({ location: env.SQUARE_DELIVERY });
-        try {
-            const session = await ledger.session(owner);
-            if (captured && session?.generation === captured && session.state === 'attached') {
-                if (input.operation === 'cancel')
-                    await ledger.cancel({ owner, generation: captured });
-                else
-                    await ledger.updateRoutes({ owner, generation: captured, routes: [...session.routes.filter(route => route.kind !== 'claude-native'), ...routes] });
-            }
-            return `${JSON.stringify({ available: supported, diagnostic: supported ? undefined : 'Native inbox unavailable: requires macOS Claude with an interactive loaded mod and its real endpoint.', bindings: input.bindings ?? [], cancelledBindings: input.bindings ?? [] })}\n`;
-        }
-        finally {
-            await ledger.close();
-        }
-    }
-    if (!['guard', 'admitted', 'stored'].includes(input.operation) || typeof input.text !== 'string')
-        throw new Error('Unknown Claude bridge operation.');
-    return `${JSON.stringify(await observeClaudeDelivery(input.sessionId, input.text, input.operation, env, input.refs))}\n`;
-}

package/dist/claude-transport.d.ts

@@ -1,5 +0,0 @@
-import type { DeliveryTransport } from './delivery-ledger.js';
-export declare function nativeTokens(text: string): string[];
-export declare function nativePayload(token: string, text: string): string;
-export declare function hashPayload(payload: string): string;
-export declare function createClaudeWakeTransport(env?: NodeJS.ProcessEnv): DeliveryTransport;

package/dist/claude-transport.js

@@ -1,34 +0,0 @@
-import { stat } from 'node:fs/promises';
-import { createHash, randomUUID } from 'node:crypto';
-import { renderDeliveryReminder } from './delivery-frame.js';
-import { writeClaudeNative } from './packages/agent-delivery/src/claude-native.js';
-const marker = /(?:^|\n)\[square-inbox:([a-zA-Z0-9-]+)\](?:\n|$)/g;
-export function nativeTokens(text) { return [...text.matchAll(marker)].map(match => match[1]); }
-export function nativePayload(token, text) {
-    return renderDeliveryReminder([`[square-inbox:${token}]\n${text}\n[/square-inbox:${token}]`], { tagged: false });
-}
-export function hashPayload(payload) { return createHash('sha256').update(payload).digest('hex'); }
-export function createClaudeWakeTransport(env = process.env) {
-    return {
-        kind: 'claude-native',
-        async send(card, address, context) {
-            if (address.loaded !== 'true' || !address.endpoint || !address.sessionId)
-                return 'not-capable';
-            try {
-                if (!(await stat(address.endpoint)).isSocket())
-                    return 'not-capable';
-            }
-            catch {
-                return 'not-capable';
-            }
-            const messageId = randomUUID();
-            const payload = nativePayload(context.token, card.text);
-            if (!await context.prepare({ token: context.token, messageId, payloadHash: hashPayload(payload) }))
-                return 'not-capable';
-            if (context.signal.aborted || Date.now() >= context.deadline)
-                return 'not-capable';
-            const result = await writeClaudeNative({ sessionId: address.sessionId, endpoint: address.endpoint, messageId, env }, payload, { deadline: context.deadline, signal: context.signal, beforeSend: context.beforeSend });
-            return result.outcome === 'unavailable' ? 'failed' : 'unknown';
-        },
-    };
-}

package/plugins/claude/mods/square.js

@@ -1,129 +0,0 @@
-// Claude Code mod. No Node imports, shell interpolation, or child credentials.
-const hasToken = (text) => typeof text === 'string' && /(?:^|\n)\[square-inbox:[a-zA-Z0-9-]+\](?:\n|$)/.test(text);
-
-async function coordinate($) {
-  return { sessionId: await $.session.id(), cwd: await $.session.cwd(), version: (await $.session.version()).version, endpoint: await $.env.get('CLAUDE_CODE_MESSAGING_SOCKET') };
-}
-async function bridge($, value, budget = 2800) {
-  const result = await $.process.run(['square', 'claude-mod'], { cwd: value.cwd, stdin: JSON.stringify(value), timeoutMs: Math.max(1, Math.min(2800, budget)) });
-  if (result.exitCode !== 0 || result.isStdoutTruncated) throw new Error('Square native inbox bridge unavailable');
-  return JSON.parse(result.stdout);
-}
-async function snapshot($, id) { return (await $.state.get({ plugin: 'square', key: 'inbox', id })).value; }
-async function cancellation($, id) { return (await $.state.get({ plugin: 'square', key: 'cancelAt', id })).value; }
-function confirmLater($, c, operation, text, refs) {
-  // State reads are dispatch snapshots. This ONE fresh timer dispatch is not polling.
-  // Reload cancels it; lost evidence stays unknown and is never blindly replayed.
-  try { $.clock.after(0, () => {
-    (async () => {
-      await bridge($, { ...c, operation, text, refs });
-    })().catch(() => undefined);
-  }); } catch { /* denied scheduling leaves evidence unknown, never a second next */ }
-}
-async function save($, id, update, version) {
-  return $.state.set({ plugin: 'square', key: 'inbox', id }, update, version === undefined ? undefined : { ifVersion: version });
-}
-async function reconcile($, sessionId, operation = 'start', resume = false) {
-  const read = await coordinate($);
-  const c = sessionId ? { ...read, sessionId } : read;
-  const held = await $.state.get({ plugin: 'square', key: 'inbox', id: c.sessionId });
-  const old = held.value;
-  const cancelled = await cancellation($, c.sessionId);
-  const result = await bridge($, { ...c, operation, cancelAt: cancelled?.at, cancelledBindings: cancelled?.bindings, bindings: old?.bindings, resume });
-  // A concurrent abort must win over a stale reconciliation write.
-  await save($, c.sessionId, { coordinate: c, bindings: result.bindings }, held.version);
-  if (!result.available) await $.ui.log(result.diagnostic);
-}
-
-async function cancel($) {
-  const c = await coordinate($);
-  const old = await snapshot($, c.sessionId);
-  const cancelAt = await $.clock.now();
-  const captured = old?.bindings ?? [];
-  await $.state.set({ plugin: 'square', key: 'cancelAt', id: c.sessionId }, { at: cancelAt, bindings: captured });
-  const result = await bridge($, { ...c, bindings: captured, cancelAt, cancelledBindings: captured, operation: 'cancel' });
-  try { $.clock.after(0, () => {
-    (async () => {
-      const held = await $.state.get({ plugin: 'square', key: 'cancelAt', id: c.sessionId });
-      if (held.value?.at === cancelAt) await $.state.set({ plugin: 'square', key: 'cancelAt', id: c.sessionId }, { at: cancelAt, bindings: result.cancelledBindings }, { ifVersion: held.version });
-    })().catch(() => undefined);
-  }); } catch { /* captured cancellation remains engine-owned */ }
-}
-
-export function register(on) {
-  on('session.start', async ($, e, next) => {
-    await reconcile($).catch(() => undefined);
-    return next(e);
-  });
-  on('classic.SessionStart', async ($, e, next) => {
-    await reconcile($, e.session_id, 'start', e.source === 'resume').catch(() => undefined);
-    return next(e);
-  });
-  on('tool.call', async ($, e, next) => {
-    try {
-      if (typeof e.tool !== 'string' || !e.tool.startsWith('mcp__plugin_square_square__')) return await next(e);
-      next.signal.throwIfAborted();
-      const c = await coordinate($);
-      const call = { ...c, toolUseId: e.tool_use_id, agentId: e.agentId };
-      const { token } = await bridge($, { ...call, operation: 'tool-begin' });
-      try {
-        next.signal.throwIfAborted();
-        // MCP receives the original business arguments; identity travels only by tool-use ID.
-        return await next(e);
-      } finally {
-        await bridge($, { ...call, token, operation: 'tool-end' }).catch(() => undefined);
-      }
-    }
-    finally { if (!e.agentId) await reconcile($, undefined, 'reconcile').catch(() => undefined); }
-  });
-  on('turn.start', async ($, e, next) => {
-    if (!e.agentId) await reconcile($, undefined, 'reconcile').catch(() => undefined);
-    return next(e);
-  });
-  on('session.end', async ($, e, next) => {
-    // Pinned old ID and captured seat generations, never a later current coordinate.
-    const endedAt = await $.clock.now().catch(() => undefined);
-    const held = await $.state.get({ plugin: 'square', key: 'inbox', id: e.sessionId }).catch(() => undefined);
-    const old = held?.value;
-    const c = old?.coordinate ?? await coordinate($).catch(() => undefined);
-    if (c) {
-      const result = await bridge($, { ...c, sessionId: e.sessionId, bindings: old?.bindings, endedAt, operation: 'end' }, next.budget.remainingMs).catch(() => undefined);
-      // Retired membership lives in the host ledger; conversation state may be cleared.
-      if (result) await save($, e.sessionId, { coordinate: { ...c, sessionId: e.sessionId }, bindings: [] }, held?.version).catch(() => undefined);
-    }
-    return next(e);
-  });
-  on('turn.abort', async ($, e, next) => {
-    await cancel($).catch(() => undefined);
-    return next(e);
-  });
-  on('turn.complete', async ($, e, next) => {
-    // Terminal Esc aborts are reported here, not through the plugin's turn.abort op.
-    if (!e.agentId && e.reason === 'aborted') await cancel($).catch(() => undefined);
-    return next(e);
-  });
-  on('session.receive', async ($, e, next) => {
-    if (e.agentId || e.origin?.kind !== 'peer' || !hasToken(e.text)) return next(e);
-    const c = await coordinate($).catch(() => undefined);
-    if (!c) return next(e);
-    const old = await snapshot($, c.sessionId).catch(() => undefined);
-    const cancelled = await cancellation($, c.sessionId).catch(() => undefined);
-    const guard = await bridge($, { ...c, cancelAt: cancelled?.at, cancelledBindings: cancelled?.bindings, bindings: old?.bindings, operation: 'guard', text: e.text }).catch(() => undefined);
-    if (!guard || (guard.recognized && !guard.current)) return { consumed: 'Square delivery is stale, cancelled, or unavailable' };
-    // Preserve native policy: hold/refuse reject this gate; never call next twice.
-    const result = await next(e);
-    if (guard?.current && result.text === e.text) confirmLater($, c, 'admitted', result.text, guard.refs);
-    return result;
-  });
-  on('session.append', async ($, e, next) => {
-    if (e.agentId || e.origin?.kind !== 'peer') return next(e);
-    const c = await coordinate($).catch(() => undefined);
-    const result = await next(e);
-    if (!c || result.message?.role !== 'user') return result;
-    // Match a complete payload inside one returned stored text block, not entry text.
-    for (const block of result.message.content ?? []) {
-      if (block.type === 'text' && hasToken(block.text)) confirmLater($, c, 'stored', block.text);
-    }
-    return result;
-  });
-}

package/plugins/claude/types.d.ts

@@ -1,7 +0,0 @@
-export type SquareInboxBinding = { location: string; participant: string; session: string; generation?: string };
-export type SquareInboxCoordinate = { sessionId: string; cwd: string; version: string; endpoint?: string };
-export type SquareInboxCancellation = { at: number; bindings?: SquareInboxBinding[] };
-export type SquareInboxState = { coordinate: SquareInboxCoordinate; bindings?: SquareInboxBinding[] };
-declare module 'claude-code' {
-  interface PluginState { square: { inbox: StateFamily<SquareInboxState>; cancelAt: StateFamily<SquareInboxCancellation> } }
-}