@beeos-ai/device-agent 0.7.2 → 0.9.1

package/dist/messaging/token-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-provider.js","sourceRoot":"","sources":["../../src/messaging/token-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAEtC,OAAO,EACL,4BAA4B,GAG7B,MAAM,uBAAuB,CAAC;AAI/B,sEAAsE;AACtE,kEAAkE;AAClE,uDAAuD;AACvD,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CACtC,kCAAkC,EAClC,KAAK,CACN,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAgB;IAEhB,OAAO;QACL,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxE,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACd,MAAM,OAAO,GACX,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE;gBAC9B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;oBACZ,oBAAoB;oBACpB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;iBAChC,CAAC;gBACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;gBACrC,GAAG,EAAE,OAAO;gBACZ,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,OAAO;aACd,CAAC,CAAC;YACH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,IAAyC;IAEzC,OAAO,4BAA4B,CAAC;QAClC,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,QAAQ,EAAE,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC;QAClD,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC,CAAC;AACL,CAAC"}

package/dist/plugins/acp/index.d.ts

@@ -4,25 +4,31 @@
  * Bridges the device-agent's `AgentHost` to the BeeOS platform via the
  * Agent Control Protocol (ACP) over a WebSocket transport.
  *
- * Responsibilities:
- *   - Construct `SessionManager` (subscribes to host events) in
- *     fixed-sid single-session mode, with a JSONL-backed store
- *     persisting transcripts to
- *     `${BEEOS_HOME ?? ~/.beeos}/device-agent/sessions/<sid>.jsonl`.
- *   - Wire ACP handlers (`session/*`, `device/*`, `models/list`, `skills/list`).
- *   - Open the Bridge WebSocket, bind the router, fan `session/update`
- *     notifications back through the transport.
+ * Responsibilities (v0.9.0):
+ *   - Open the Bridge WebSocket transport.
+ *   - Build the per-transport `TransportSessionNotifier` and BIND it
+ *     to the operator's fixed sid via
+ *     `ctx.sessionManager.bindNotifier(fixedSessionId, notifier)`. The
+ *     SessionManager itself, JsonlMessageStore, JsonlSessionSweeper,
+ *     and PluginCommandRegistry are all owned by `bootstrap.ts` —
+ *     plugin pulls them via `PluginContext` so MessageBusPlugin can
+ *     share the SAME instance (the in-flight gate / Layer 3 device-
+ *     physical-serial constraint depends on a single SessionManager
+ *     per process).
+ *   - Wire ACP handlers (`session/*`, `device/*`, `models/list`,
+ *     `skills/list`) against `ctx.sessionManager`.
+ *   - Bind the router and fan `session/update` notifications back
+ *     through the transport for the fixed sid.
  *
- * Single-session sid derivation:
- *
- *   The fixed sid is `device:<first16HexOfSha256(publicKey)>` — a
- *   deterministic per-device identifier that survives reconnects and
- *   binary upgrades. Standalone mode (no keypair) falls back to
- *   `device:standalone` so local CLI testing still gets a stable sid.
+ * Single-session sid derivation lives in `bootstrap.ts`
+ * (`deriveFixedSessionId`) — the format is
+ * `device:<first16HexOfSha256(publicKey)>` (or `device:standalone`),
+ * unchanged from v0.8.0.
  *
  * Disabled when `--standalone` (no remote control plane) or `--no-acp`
  * is passed; in that mode only the http-debug plugin is useful.
  */
+import { deriveFixedSessionId } from "../../app/fixed-session-id.js";
 import type { IMcpRuntime } from "../../mcp-client/runtime.js";
 import type { IBridgeTransport } from "../../ports/transport.js";
 import type { AgentPlugin, PluginContext } from "../../ports/plugin.js";
@@ -39,33 +45,24 @@ export interface AcpPluginOptions {
         publicKey: Uint8Array;
         privateKey: Uint8Array;
     };
-    /**
-     * Agent Gateway base URL. Required for the `/screenshot` plugin
-     * command to upload frames via presign+confirm. When unset, the
-     * command is NOT registered (the device-agent gracefully degrades —
-     * `skills/list` returns an empty list and `/screenshot` falls
-     * through to the AgentRunner).
-     */
-    agentGatewayUrl?: string;
     /** Optional pre-built transport (used by tests for mock injection). */
     transportOverride?: IBridgeTransport;
-    /**
-     * Override the sessions directory. Tests pin this to a tmp dir; in
-     * production the default `${BEEOS_HOME ?? ~/.beeos}/device-agent/sessions`
-     * resolves via `getDeviceAgentSessionsDir()`.
-     */
-    sessionsDirOverride?: string;
 }
 export declare class AcpPlugin implements AgentPlugin {
     private readonly opts;
     readonly name = "acp";
     private ctx?;
     private transport;
-    private sessions;
-    private store;
+    private boundSid;
     private unbind;
     constructor(opts: AcpPluginOptions);
     init(ctx: PluginContext): Promise<void>;
     start(): Promise<void>;
+    /**
+     * Visible for tests — exposes the sid this plugin binds to so test
+     * harnesses can construct a SessionManager with the matching
+     * `fixedSessionId` without re-deriving the value.
+     */
+    static deriveFixedSessionId: typeof deriveFixedSessionId;
     stop(): Promise<void>;
 }

package/dist/plugins/acp/index.js

@@ -4,34 +4,32 @@
  * Bridges the device-agent's `AgentHost` to the BeeOS platform via the
  * Agent Control Protocol (ACP) over a WebSocket transport.
  *
- * Responsibilities:
- *   - Construct `SessionManager` (subscribes to host events) in
- *     fixed-sid single-session mode, with a JSONL-backed store
- *     persisting transcripts to
- *     `${BEEOS_HOME ?? ~/.beeos}/device-agent/sessions/<sid>.jsonl`.
- *   - Wire ACP handlers (`session/*`, `device/*`, `models/list`, `skills/list`).
- *   - Open the Bridge WebSocket, bind the router, fan `session/update`
- *     notifications back through the transport.
+ * Responsibilities (v0.9.0):
+ *   - Open the Bridge WebSocket transport.
+ *   - Build the per-transport `TransportSessionNotifier` and BIND it
+ *     to the operator's fixed sid via
+ *     `ctx.sessionManager.bindNotifier(fixedSessionId, notifier)`. The
+ *     SessionManager itself, JsonlMessageStore, JsonlSessionSweeper,
+ *     and PluginCommandRegistry are all owned by `bootstrap.ts` —
+ *     plugin pulls them via `PluginContext` so MessageBusPlugin can
+ *     share the SAME instance (the in-flight gate / Layer 3 device-
+ *     physical-serial constraint depends on a single SessionManager
+ *     per process).
+ *   - Wire ACP handlers (`session/*`, `device/*`, `models/list`,
+ *     `skills/list`) against `ctx.sessionManager`.
+ *   - Bind the router and fan `session/update` notifications back
+ *     through the transport for the fixed sid.
  *
- * Single-session sid derivation:
- *
- *   The fixed sid is `device:<first16HexOfSha256(publicKey)>` — a
- *   deterministic per-device identifier that survives reconnects and
- *   binary upgrades. Standalone mode (no keypair) falls back to
- *   `device:standalone` so local CLI testing still gets a stable sid.
+ * Single-session sid derivation lives in `bootstrap.ts`
+ * (`deriveFixedSessionId`) — the format is
+ * `device:<first16HexOfSha256(publicKey)>` (or `device:standalone`),
+ * unchanged from v0.8.0.
  *
  * Disabled when `--standalone` (no remote control plane) or `--no-acp`
  * is passed; in that mode only the http-debug plugin is useful.
  */
-import { fingerprint as sha256Fingerprint } from "@beeos-ai/bridge-client";
 import { BridgeWsTransport } from "../../adapters/transport-bridge-ws.js";
-import { AgentGatewayUserFileUploader } from "../../adapters/user-file-uploader.js";
-import { JsonlMessageStore } from "../../app/jsonl-store.js";
-import { PluginCommandRegistry } from "../../app/plugin-commands/registry.js";
-import { ScreenshotCommandHandler } from "../../app/plugin-commands/screenshot-command.js";
-import { ScreenshotService } from "../../app/screenshot-service.js";
-import { SessionManager } from "../../app/session-manager.js";
-import { getDeviceAgentSessionsDir } from "../../config/paths.js";
+import { deriveFixedSessionId } from "../../app/fixed-session-id.js";
 import { AcpDeviceHandlers } from "../../inbound/acp/handlers/device.js";
 import { AcpSessionHandlers } from "../../inbound/acp/handlers/session.js";
 import { AcpSkillsHandlers } from "../../inbound/acp/handlers/skills.js";
@@ -42,15 +40,14 @@ export class AcpPlugin {
     name = "acp";
     ctx;
     transport = null;
-    sessions = null;
-    store = null;
+    boundSid = null;
     unbind = null;
     constructor(opts) {
         this.opts = opts;
     }
     async init(ctx) {
         this.ctx = ctx;
-        const { config, log, host } = ctx;
+        const { config, log, sessionManager } = ctx;
         if (config.disableAcp) {
             log.info("acp: disabled by --no-acp / disableAcp config");
             return;
@@ -69,93 +66,18 @@ export class AcpPlugin {
         transport.on("connected", () => log.info("acp: bridge connected"));
         transport.on("disconnected", (reason) => log.warn({ reason }, "acp: bridge disconnected"));
         transport.on("error", (err) => log.error({ err: err.message }, "acp: bridge transport error"));
+        // Bind the operator's fixed sid to the Bridge WS transport. MS
+        // sessions get their own per-channel notifiers via
+        // `MsChannelNotifier` (bound by MessageBusPlugin), so the two
+        // surfaces never publish onto each other's channels.
         const fixedSessionId = deriveFixedSessionId(this.opts.keypair.publicKey);
-        const sessionsDir = this.opts.sessionsDirOverride ?? getDeviceAgentSessionsDir();
-        const messageStore = await JsonlMessageStore.open({
-            sessionsDir,
-            preloadSids: [fixedSessionId],
-            logger: { warn: (...args) => log.warn(...args) },
-        });
-        log.info({ fixedSessionId, sessionsDir }, "acp: jsonl store ready");
         const notifier = new TransportSessionNotifier(transport);
-        // Build the plugin-command registry. Only commands whose dependencies
-        // are satisfied get registered — this keeps `skills/list` honest in
-        // degraded modes (e.g. local dev without an agent gateway URL still
-        // boots, just without `/screenshot`).
-        const pluginCommands = new PluginCommandRegistry();
-        if (this.opts.agentGatewayUrl) {
-            const uploader = new AgentGatewayUserFileUploader({
-                agentGatewayUrl: this.opts.agentGatewayUrl,
-                identity: {
-                    publicKey: this.opts.keypair.publicKey,
-                    privateKey: this.opts.keypair.privateKey,
-                },
-            });
-            // ScreenshotService takes the live MCP runtime — bind to a single
-            // resolved instance per plugin lifetime; on autospawn restart the
-            // outer mcpProvider issues a fresh runtime and the next call will
-            // observe it transparently (the service captures the runtime at
-            // each `captureAndUpload` call, NOT at construction).
-            const lazyMcp = {
-                screenshot: () => this.opts.mcpProvider().screenshot(),
-                uiDump: (o) => this.opts.mcpProvider().uiDump(o),
-                act: (a) => this.opts.mcpProvider().act(a),
-            };
-            const screenshotService = new ScreenshotService(lazyMcp, uploader);
-            pluginCommands.register(new ScreenshotCommandHandler(screenshotService));
-            log.info({ commands: pluginCommands.list().map((c) => c.name) }, "acp: plugin commands registered");
-        }
-        else {
-            log.info("acp: agentGatewayUrl unset — skipping `/screenshot` and other upload-dependent plugin commands");
-        }
-        const sessions = new SessionManager({
-            host,
-            messageStore,
-            notifier,
-            fixedSessionId,
-            pluginCommands,
-            // `Config.sessionTimeoutMs` is the single source of truth for idle GC.
-            // 0 disables the threshold check (effectively keeps sessions forever
-            // until `maxSessions` LRU eviction kicks in) — it's surfaced in the
-            // schema so kiosk deployments can pin a deterministic value.
-            sessionTtlMs: config.sessionTimeoutMs > 0 ? config.sessionTimeoutMs : undefined,
-            onSetModel: async (provider, model) => {
-                try {
-                    await host.agent.setModel(provider, model);
-                    log.info({ provider, model }, "acp: agent model switched");
-                }
-                catch (e) {
-                    log.warn({ err: e.message, provider, model }, "acp: setModel failed");
-                }
-            },
-            // Surface plugin command lifecycle into the agent's pino log so
-            // failures are auditable. Without this hook the only signal a failed
-            // `/screenshot` produces is a `system_message_chunk` notice, which
-            // some clients render and some swallow — leaving operators staring
-            // at silent JSONL.
-            onPluginCommandEvent: (ev) => {
-                if (ev.kind === "begin") {
-                    log.info({ command: ev.name, sessionId: ev.sessionId, turnId: ev.turnId, args: ev.args }, "acp: plugin command begin");
-                }
-                else if (ev.kind === "end") {
-                    log.info({ command: ev.name, sessionId: ev.sessionId, turnId: ev.turnId, durationMs: ev.durationMs }, "acp: plugin command end");
-                }
-                else {
-                    log.warn({
-                        command: ev.name,
-                        sessionId: ev.sessionId,
-                        turnId: ev.turnId,
-                        durationMs: ev.durationMs,
-                        err: ev.error.message,
-                        stack: ev.error.stack,
-                    }, "acp: plugin command failed");
-                }
-            },
-        });
+        sessionManager.bindNotifier(fixedSessionId, notifier);
+        this.boundSid = fixedSessionId;
         const router = new AcpRouter({
             device: new AcpDeviceHandlers(this.opts.mcpProvider),
-            session: new AcpSessionHandlers(sessions),
-            skills: new AcpSkillsHandlers(pluginCommands),
+            session: new AcpSessionHandlers(sessionManager),
+            skills: new AcpSkillsHandlers(sessionManager.pluginCommandRegistry),
             log: ({ method, error }) => {
                 if (error)
                     log.warn({ method, err: error.message }, "acp handler error");
@@ -164,8 +86,6 @@ export class AcpPlugin {
             },
         });
         this.transport = transport;
-        this.sessions = sessions;
-        this.store = messageStore;
         this.unbind = bindRouterToTransport(router, transport);
     }
     async start() {
@@ -173,45 +93,32 @@ export class AcpPlugin {
             return;
         await this.transport.connect();
     }
+    /**
+     * Visible for tests — exposes the sid this plugin binds to so test
+     * harnesses can construct a SessionManager with the matching
+     * `fixedSessionId` without re-deriving the value.
+     */
+    static deriveFixedSessionId = deriveFixedSessionId;
     async stop() {
-        if (this.sessions) {
-            this.sessions.detach();
-            this.sessions = null;
-        }
-        if (this.unbind) {
+        if (this.boundSid && this.ctx) {
             try {
-                await this.unbind();
+                this.ctx.sessionManager.unbindNotifier(this.boundSid);
             }
             catch {
                 /* ignore */
             }
-            this.unbind = null;
+            this.boundSid = null;
         }
-        if (this.store) {
+        if (this.unbind) {
             try {
-                await this.store.close();
+                await this.unbind();
             }
-            catch (e) {
-                // Best-effort flush — log but don't block shutdown on a stale stream.
-                this.ctx?.log.warn({ err: e.message }, "acp: jsonl store close failed");
+            catch {
+                /* ignore */
             }
-            this.store = null;
+            this.unbind = null;
         }
         this.transport = null;
     }
 }
-/**
- * Compute the per-device fixed sid.
- *
- * Format: `device:<first16HexOfSha256(publicKey)>`. 16 hex chars give
- * 64 bits of entropy — far more than enough to avoid collisions
- * across the BeeOS device fleet, while keeping the sid short enough
- * to use as a filename / log correlation tag without truncation.
- */
-function deriveFixedSessionId(publicKey) {
-    if (!publicKey || publicKey.length === 0)
-        return "device:standalone";
-    const hex = sha256Fingerprint(publicKey);
-    return `device:${hex.slice(0, 16)}`;
-}
 //# sourceMappingURL=index.js.map

package/dist/plugins/acp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/acp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAiCzE,MAAM,OAAO,SAAS;IAQS;IAPpB,IAAI,GAAG,KAAK,CAAC;IACd,GAAG,CAAiB;IACpB,SAAS,GAA4B,IAAI,CAAC;IAC1C,QAAQ,GAA0B,IAAI,CAAC;IACvC,KAAK,GAA6B,IAAI,CAAC;IACvC,MAAM,GAAiC,IAAI,CAAC;IAEpD,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,KAAK,CAAC,IAAI,CAAC,GAAkB;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QAElC,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAC3B,IAAI,iBAAiB,CAAC;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,aAAa;gBAC7B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;gBACxC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;aACvC,CAAC,CAAC;QACL,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnE,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC3F,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAE/F,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,yBAAyB,EAAE,CAAC;QACjF,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC;YAChD,WAAW;YACX,WAAW,EAAE,CAAC,cAAc,CAAC;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAI,IAAyB,CAAC,EAAE;SAClF,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,WAAW,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAEzD,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,sCAAsC;QACtC,MAAM,cAAc,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,4BAA4B,CAAC;gBAChD,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe;gBAC1C,QAAQ,EAAE;oBACR,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBACtC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;iBACzC;aACF,CAAC,CAAC;YACH,kEAAkE;YAClE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,sDAAsD;YACtD,MAAM,OAAO,GAAgB;gBAC3B,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE;gBACtD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChD,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3C,CAAC;YACF,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,cAAc,CAAC,QAAQ,CACrB,IAAI,wBAAwB,CAAC,iBAAiB,CAAC,CAChD,CAAC;YACF,GAAG,CAAC,IAAI,CACN,EAAE,QAAQ,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EACtD,iCAAiC,CAClC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CACN,gGAAgG,CACjG,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC;YAClC,IAAI;YACJ,YAAY;YACZ,QAAQ;YACR,cAAc;YACd,cAAc;YACd,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,6DAA6D;YAC7D,YAAY,EAAE,MAAM,CAAC,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC/E,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;gBACpC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;gBACnF,CAAC;YACH,CAAC;YACD,gEAAgE;YAChE,qEAAqE;YACrE,mEAAmE;YACnE,mEAAmE;YACnE,mBAAmB;YACnB,oBAAoB,EAAE,CAAC,EAAE,EAAE,EAAE;gBAC3B,IAAI,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBACxB,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAC/E,2BAA2B,CAC5B,CAAC;gBACJ,CAAC;qBAAM,IAAI,EAAE,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;oBAC7B,GAAG,CAAC,IAAI,CACN,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,EAC3F,yBAAyB,CAC1B,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CACN;wBACE,OAAO,EAAE,EAAE,CAAC,IAAI;wBAChB,SAAS,EAAE,EAAE,CAAC,SAAS;wBACvB,MAAM,EAAE,EAAE,CAAC,MAAM;wBACjB,UAAU,EAAE,EAAE,CAAC,UAAU;wBACzB,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO;wBACrB,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK;qBACtB,EACD,4BAA4B,CAC7B,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,MAAM,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACpD,OAAO,EAAE,IAAI,kBAAkB,CAAC,QAAQ,CAAC;YACzC,MAAM,EAAE,IAAI,iBAAiB,CAAC,cAAc,CAAC;YAC7C,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;gBACzB,IAAI,KAAK;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;;oBAC/E,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,sEAAsE;gBACtE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAG,CAAW,CAAC,OAAO,EAAE,EAAE,+BAA+B,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;CACF;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,SAAqB;IACjD,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrE,MAAM,GAAG,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/plugins/acp/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAmBzE,MAAM,OAAO,SAAS;IAOS;IANpB,IAAI,GAAG,KAAK,CAAC;IACd,GAAG,CAAiB;IACpB,SAAS,GAA4B,IAAI,CAAC;IAC1C,QAAQ,GAAkB,IAAI,CAAC;IAC/B,MAAM,GAAiC,IAAI,CAAC;IAEpD,YAA6B,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAAG,CAAC;IAEvD,KAAK,CAAC,IAAI,CAAC,GAAkB;QAC3B,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;QACf,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;QAE5C,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAC3B,IAAI,iBAAiB,CAAC;gBACpB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,OAAO,EAAE,MAAM,CAAC,aAAa;gBAC7B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU;gBACxC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;aACvC,CAAC,CAAC;QACL,SAAS,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnE,SAAS,CAAC,EAAE,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QAC3F,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAE/F,+DAA+D;QAC/D,mDAAmD;QACnD,8DAA8D;QAC9D,qDAAqD;QACrD,MAAM,cAAc,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,wBAAwB,CAAC,SAAS,CAAC,CAAC;QACzD,cAAc,CAAC,YAAY,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC;QAE/B,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC;YAC3B,MAAM,EAAE,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;YACpD,OAAO,EAAE,IAAI,kBAAkB,CAAC,cAAc,CAAC;YAC7C,MAAM,EAAE,IAAI,iBAAiB,CAAC,cAAc,CAAC,qBAAqB,CAAC;YACrE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;gBACzB,IAAI,KAAK;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAG,KAAe,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;;oBAC/E,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC;YAC5C,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,oBAAoB,GAAG,oBAAoB,CAAC;IAEnD,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC"}

package/dist/plugins/message-bus/busy-reply.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Busy-reply path — emits a terminal `agent_reply` with `error: agent_busy`
+ * back to the caller's IM channel when a second `chat_message` arrives
+ * while a turn is already in flight.
+ *
+ * Mirrors the SessionManager's "one turn per session" contract that the
+ * ACP handlers enforce — concurrent prompts on the same session are
+ * rejected, not queued. The MS path keeps the same semantics so callers
+ * (L0 / A2A / MCP / OpenAPI) get a deterministic refusal instead of a
+ * `/wait` timeout.
+ *
+ * Type/payload alignment: uses the same `agent_reply` type that the
+ * outbound listener emits, with a `{ error }` body that matches
+ * `backend/pkg/chatinvoke/invoker.go::extractReplyFinal` (which reads
+ * `payload.error` first, falling back to `payload.text`).
+ */
+import type { MessageSDK } from "@beeos-ai/message-sdk";
+export interface BusyReplyRequest {
+    channelId: string;
+    inboundMessageId: string;
+    /**
+     * Session key derived from the rejected envelope (via
+     * `extractChatPrompt(envelope).sessionKey`). Always set so the busy
+     * reply payload has the same `{ session_key, error }` shape as a
+     * regular `agent_reply`.
+     */
+    sessionKey: string;
+}
+export interface BusyReplyHandler {
+    replyBusy(req: BusyReplyRequest): Promise<void>;
+}
+export interface BusyReplyHandlerOptions {
+    sdk: MessageSDK;
+}
+export declare class MessageSdkBusyReplyHandler implements BusyReplyHandler {
+    private readonly opts;
+    constructor(opts: BusyReplyHandlerOptions);
+    replyBusy(req: BusyReplyRequest): Promise<void>;
+}

package/dist/plugins/message-bus/busy-reply.js

@@ -0,0 +1,30 @@
+/**
+ * Busy-reply path — emits a terminal `agent_reply` with `error: agent_busy`
+ * back to the caller's IM channel when a second `chat_message` arrives
+ * while a turn is already in flight.
+ *
+ * Mirrors the SessionManager's "one turn per session" contract that the
+ * ACP handlers enforce — concurrent prompts on the same session are
+ * rejected, not queued. The MS path keeps the same semantics so callers
+ * (L0 / A2A / MCP / OpenAPI) get a deterministic refusal instead of a
+ * `/wait` timeout.
+ *
+ * Type/payload alignment: uses the same `agent_reply` type that the
+ * outbound listener emits, with a `{ error }` body that matches
+ * `backend/pkg/chatinvoke/invoker.go::extractReplyFinal` (which reads
+ * `payload.error` first, falling back to `payload.text`).
+ */
+export class MessageSdkBusyReplyHandler {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async replyBusy(req) {
+        await this.opts.sdk.sendToChannel(req.channelId, "agent_reply", {
+            session_key: req.sessionKey,
+            error: "agent_busy",
+            text: "device-agent is processing another request — please retry once it completes.",
+        }, { inReplyTo: req.inboundMessageId });
+    }
+}
+//# sourceMappingURL=busy-reply.js.map

package/dist/plugins/message-bus/busy-reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"busy-reply.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/busy-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAC/B,GAAG,CAAC,SAAS,EACb,aAAa,EACb;YACE,WAAW,EAAE,GAAG,CAAC,UAAU;YAC3B,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,8EAA8E;SACrF,EACD,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,CACpC,CAAC;IACJ,CAAC;CACF"}

package/dist/plugins/message-bus/cancel.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Inbound — `chat_cancel` envelope handler.
+ *
+ * The BeeOS platform pushes a protocol-agnostic `chat_cancel` envelope
+ * onto the agent's personal Centrifugo channel when an in-flight
+ * `chat_message` turn must be aborted. Triggers include:
+ *
+ *   - A2A Service `tasks/cancel` JSON-RPC (caller-initiated)
+ *   - A2A Service `InvokeTask` ctx-cancel fallback (caller HTTP
+ *     disconnect / deadline)
+ *   - A2A Service timeout sweeper (task exceeded `timeout_ms`)
+ *
+ * The wire payload (see `backend/pkg/convmsg/extract.go`
+ * `MessageTypeChatCancel`) carries IM primitives only:
+ *
+ *   {
+ *     "target_message_id": "<message_id of the original chat_message>",
+ *     "reason": "canceled" | "caller_disconnected" | "timeout"
+ *   }
+ *
+ * Agents MUST NOT decode protocol headers (no `task_id`, no
+ * `a2a_task_cancel`) — that contract is enforced here by intentionally
+ * reading nothing besides `target_message_id` and `reason`.
+ *
+ * v0.9.0 lookup path: query the tiny `MsInflightTracker` for the
+ * matching sid, then call `sessionManager.cancel()`. The SessionManager
+ * itself owns the AbortController and only allows ONE in-flight turn
+ * globally — so resolving by inboundMessageId is unambiguous (either
+ * the current turn is THIS turn, or the cancel is for a stale /
+ * already-completed turn we should silently drop).
+ *
+ * No-ops:
+ *   - missing / non-string `target_message_id`         → drop, debug log
+ *   - tracker has no entry for that message_id         → drop, debug log
+ *     (the turn already finished, or this is a stray cancel for a
+ *     different agent on a shared principal — both safe to ignore)
+ */
+import type { MessageEnvelope } from "@beeos-ai/message-sdk";
+import type { SessionManager } from "../../app/session-manager.js";
+import type { Logger } from "../../logger/index.js";
+import type { MsInflightTracker } from "./ms-inflight-tracker.js";
+export declare const MESSAGE_TYPE_CHAT_CANCEL = "chat_cancel";
+export interface MessageBusCancelHandlerOptions {
+    sessionManager: SessionManager;
+    tracker: MsInflightTracker;
+    logger: Logger;
+}
+export declare function buildMessageBusCancelHandler(opts: MessageBusCancelHandlerOptions): (envelope: MessageEnvelope) => Promise<void>;

package/dist/plugins/message-bus/cancel.js

@@ -0,0 +1,66 @@
+/**
+ * Inbound — `chat_cancel` envelope handler.
+ *
+ * The BeeOS platform pushes a protocol-agnostic `chat_cancel` envelope
+ * onto the agent's personal Centrifugo channel when an in-flight
+ * `chat_message` turn must be aborted. Triggers include:
+ *
+ *   - A2A Service `tasks/cancel` JSON-RPC (caller-initiated)
+ *   - A2A Service `InvokeTask` ctx-cancel fallback (caller HTTP
+ *     disconnect / deadline)
+ *   - A2A Service timeout sweeper (task exceeded `timeout_ms`)
+ *
+ * The wire payload (see `backend/pkg/convmsg/extract.go`
+ * `MessageTypeChatCancel`) carries IM primitives only:
+ *
+ *   {
+ *     "target_message_id": "<message_id of the original chat_message>",
+ *     "reason": "canceled" | "caller_disconnected" | "timeout"
+ *   }
+ *
+ * Agents MUST NOT decode protocol headers (no `task_id`, no
+ * `a2a_task_cancel`) — that contract is enforced here by intentionally
+ * reading nothing besides `target_message_id` and `reason`.
+ *
+ * v0.9.0 lookup path: query the tiny `MsInflightTracker` for the
+ * matching sid, then call `sessionManager.cancel()`. The SessionManager
+ * itself owns the AbortController and only allows ONE in-flight turn
+ * globally — so resolving by inboundMessageId is unambiguous (either
+ * the current turn is THIS turn, or the cancel is for a stale /
+ * already-completed turn we should silently drop).
+ *
+ * No-ops:
+ *   - missing / non-string `target_message_id`         → drop, debug log
+ *   - tracker has no entry for that message_id         → drop, debug log
+ *     (the turn already finished, or this is a stray cancel for a
+ *     different agent on a shared principal — both safe to ignore)
+ */
+export const MESSAGE_TYPE_CHAT_CANCEL = "chat_cancel";
+export function buildMessageBusCancelHandler(opts) {
+    return async (envelope) => {
+        const payload = (envelope.payload ?? {});
+        const targetMessageId = pickString(payload.target_message_id);
+        if (!targetMessageId) {
+            opts.logger.debug({ type: envelope.type, message_id: envelope.message_id }, "message-bus: chat_cancel dropped (no target_message_id)");
+            return;
+        }
+        const reason = pickString(payload.reason) || "unknown";
+        const entry = opts.tracker.findByInboundMessageId(targetMessageId);
+        if (!entry) {
+            opts.logger.debug({ targetMessageId, reason }, "message-bus: chat_cancel for unknown / already-finished turn — no-op");
+            return;
+        }
+        const cancelled = await opts.sessionManager.cancel();
+        opts.logger.info({
+            sid: entry.sid,
+            channelId: entry.channelId,
+            targetMessageId,
+            reason,
+            cancelled,
+        }, "message-bus: chat_cancel received — aborting in-flight turn");
+    };
+}
+function pickString(v) {
+    return typeof v === "string" && v.length > 0 ? v : "";
+}
+//# sourceMappingURL=cancel.js.map

package/dist/plugins/message-bus/cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/cancel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AASH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAQtD,MAAM,UAAU,4BAA4B,CAC1C,IAAoC;IAEpC,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QACpE,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EACxD,yDAAyD,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,eAAe,EAAE,MAAM,EAAE,EAC3B,sEAAsE,CACvE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe;YACf,MAAM;YACN,SAAS;SACV,EACD,6DAA6D,CAC9D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/plugins/message-bus/inbound.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Inbound — `chat_message` / `agent_request` envelope handler.
+ *
+ * v0.9.0 — wires `MessageSDK.onMessage(...)` directly to
+ * `SessionManager.promptForSession(sid, prompt)`. Per-channel session
+ * isolation:
+ *
+ *   1. Extract `{ message, channelId, messageId, contextId, sessionKey,
+ *      files }` from the payload via `extractChatPrompt` (returns null
+ *      on malformed envelopes — silently dropped).
+ *   2. Reject if no `channelId` or no `messageId` — replies must round
+ *      trip through `ch:{channelId}` with `in_reply_to=messageId`, so
+ *      neither is optional.
+ *   3. Layer 3 in-flight gate: if `sessionManager.isTurnInFlight()`
+ *      returns true, send a busy-reply on the inbound channel and
+ *      return. The agent serialises every prompt through a single
+ *      physical device, so concurrent requests are rejected (not
+ *      queued) — matches v0.8.0 contract.
+ *   4. Resolve the per-channel sid from `sessionKey` (the SDK already
+ *      computed `agent:{id}:invoke:ctx-{contextId}` /
+ *      `:ch-{channelId}`). Bind a fresh `MsChannelNotifier` to that
+ *      sid for the duration of the turn.
+ *   5. Build the prompt (text + a minimal `[attachments]` block when
+ *      `files.length > 0`) and call
+ *      `sessionManager.promptForSession(sid, promptText)`.
+ *   6. The notifier translates streaming session/update envelopes into
+ *      MS wire envelopes (`agent_reply_delta`, terminal `agent_reply`)
+ *      automatically — no separate outbound listener needed.
+ *   7. ALWAYS unbind the notifier on completion (success / error /
+ *      cancellation) so the next turn on the same channel gets a fresh
+ *      notifier with `accumulatedText = ""`.
+ *
+ * Defensive paths:
+ *   - If `promptForSession` rejects with `"agent_busy"` (extremely
+ *     rare race after the explicit `isTurnInFlight` check), fall
+ *     through to the busy-reply path so the caller's `/wait` doesn't
+ *     hang.
+ *   - For any other thrown error, publish a terminal `agent_reply`
+ *     with `error` set so callers see a definite outcome.
+ */
+import { type MessageEnvelope, type MessageSDK } from "@beeos-ai/message-sdk";
+import type { SessionManager } from "../../app/session-manager.js";
+import type { Logger } from "../../logger/index.js";
+import type { BusyReplyHandler } from "./busy-reply.js";
+import type { MsInflightTracker } from "./ms-inflight-tracker.js";
+export interface MessageBusInboundOptions {
+    sessionManager: SessionManager;
+    sdk: MessageSDK;
+    busyReply: BusyReplyHandler;
+    tracker: MsInflightTracker;
+    logger: Logger;
+    /**
+     * Local agent identity surfaced to `extractChatPrompt`. Used only for
+     * sessionKey prefixing; safe to leave empty in standalone-style
+     * tests.
+     */
+    localAgentId?: string;
+    /**
+     * Source tag passed to `extractChatPrompt`. Identifies which Centrifugo
+     * envelope type triggered the call — `chat_message` is the primary L0
+     * path, `agent_request` is the legacy A2A SendTask shim.
+     */
+    source: "chat_message" | "agent_request";
+}
+/**
+ * Build the per-envelope handler. The returned function is what gets
+ * registered with `sdk.onMessage(type, handler)` — keeping the factory
+ * shape lets unit tests instantiate the closure with mock collaborators
+ * and feed envelopes synchronously.
+ */
+export declare function buildMessageBusInboundHandler(opts: MessageBusInboundOptions): (envelope: MessageEnvelope) => Promise<void>;