@beeos-ai/device-agent 0.8.0 → 0.9.3

package/dist/plugins/message-bus/busy-reply.js.map

@@ -1 +1 @@
-{"version":3,"file":"busy-reply.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/busy-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAC/B,GAAG,CAAC,SAAS,EACb,aAAa,EACb;YACE,WAAW,EAAE,GAAG,CAAC,UAAU;YAC3B,KAAK,EAAE,YAAY;YACnB,IAAI,EAAE,8EAA8E;SACrF,EACD,EAAE,SAAS,EAAE,GAAG,CAAC,gBAAgB,EAAE,CACpC,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"busy-reply.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/busy-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAwBH,MAAM,OAAO,0BAA0B;IACR;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK,CAAC,SAAS,CAAC,GAAqB;QACnC,oEAAoE;QACpE,mEAAmE;QACnE,mEAAmE;QACnE,2DAA2D;QAC3D,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YACpD,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE;gBACP,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,KAAK,EAAE,YAAY;gBACnB,IAAI,EAAE,8EAA8E;aACrF;YACD,SAAS,EAAE,GAAG,CAAC,gBAAgB;SAChC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/plugins/message-bus/cancel.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Inbound — `chat_cancel` envelope handler.
+ *
+ * The BeeOS platform pushes a protocol-agnostic `chat_cancel` envelope
+ * onto the agent's personal Centrifugo channel when an in-flight
+ * `chat_message` turn must be aborted. Triggers include:
+ *
+ *   - A2A Service `tasks/cancel` JSON-RPC (caller-initiated)
+ *   - A2A Service `InvokeTask` ctx-cancel fallback (caller HTTP
+ *     disconnect / deadline)
+ *   - A2A Service timeout sweeper (task exceeded `timeout_ms`)
+ *
+ * The wire payload (see `backend/pkg/convmsg/extract.go`
+ * `MessageTypeChatCancel`) carries IM primitives only:
+ *
+ *   {
+ *     "target_message_id": "<message_id of the original chat_message>",
+ *     "reason": "canceled" | "caller_disconnected" | "timeout"
+ *   }
+ *
+ * Agents MUST NOT decode protocol headers (no `task_id`, no
+ * `a2a_task_cancel`) — that contract is enforced here by intentionally
+ * reading nothing besides `target_message_id` and `reason`.
+ *
+ * v0.9.0 lookup path: query the tiny `MsInflightTracker` for the
+ * matching sid, then call `sessionManager.cancel()`. The SessionManager
+ * itself owns the AbortController and only allows ONE in-flight turn
+ * globally — so resolving by inboundMessageId is unambiguous (either
+ * the current turn is THIS turn, or the cancel is for a stale /
+ * already-completed turn we should silently drop).
+ *
+ * No-ops:
+ *   - missing / non-string `target_message_id`         → drop, debug log
+ *   - tracker has no entry for that message_id         → drop, debug log
+ *     (the turn already finished, or this is a stray cancel for a
+ *     different agent on a shared principal — both safe to ignore)
+ */
+import type { MessageEnvelope } from "@beeos-ai/message-sdk";
+import type { SessionManager } from "../../app/session-manager.js";
+import type { Logger } from "../../logger/index.js";
+import type { MsInflightTracker } from "./ms-inflight-tracker.js";
+export declare const MESSAGE_TYPE_CHAT_CANCEL = "chat_cancel";
+export interface MessageBusCancelHandlerOptions {
+    sessionManager: SessionManager;
+    tracker: MsInflightTracker;
+    logger: Logger;
+}
+export declare function buildMessageBusCancelHandler(opts: MessageBusCancelHandlerOptions): (envelope: MessageEnvelope) => Promise<void>;

package/dist/plugins/message-bus/cancel.js

@@ -0,0 +1,66 @@
+/**
+ * Inbound — `chat_cancel` envelope handler.
+ *
+ * The BeeOS platform pushes a protocol-agnostic `chat_cancel` envelope
+ * onto the agent's personal Centrifugo channel when an in-flight
+ * `chat_message` turn must be aborted. Triggers include:
+ *
+ *   - A2A Service `tasks/cancel` JSON-RPC (caller-initiated)
+ *   - A2A Service `InvokeTask` ctx-cancel fallback (caller HTTP
+ *     disconnect / deadline)
+ *   - A2A Service timeout sweeper (task exceeded `timeout_ms`)
+ *
+ * The wire payload (see `backend/pkg/convmsg/extract.go`
+ * `MessageTypeChatCancel`) carries IM primitives only:
+ *
+ *   {
+ *     "target_message_id": "<message_id of the original chat_message>",
+ *     "reason": "canceled" | "caller_disconnected" | "timeout"
+ *   }
+ *
+ * Agents MUST NOT decode protocol headers (no `task_id`, no
+ * `a2a_task_cancel`) — that contract is enforced here by intentionally
+ * reading nothing besides `target_message_id` and `reason`.
+ *
+ * v0.9.0 lookup path: query the tiny `MsInflightTracker` for the
+ * matching sid, then call `sessionManager.cancel()`. The SessionManager
+ * itself owns the AbortController and only allows ONE in-flight turn
+ * globally — so resolving by inboundMessageId is unambiguous (either
+ * the current turn is THIS turn, or the cancel is for a stale /
+ * already-completed turn we should silently drop).
+ *
+ * No-ops:
+ *   - missing / non-string `target_message_id`         → drop, debug log
+ *   - tracker has no entry for that message_id         → drop, debug log
+ *     (the turn already finished, or this is a stray cancel for a
+ *     different agent on a shared principal — both safe to ignore)
+ */
+export const MESSAGE_TYPE_CHAT_CANCEL = "chat_cancel";
+export function buildMessageBusCancelHandler(opts) {
+    return async (envelope) => {
+        const payload = (envelope.payload ?? {});
+        const targetMessageId = pickString(payload.target_message_id);
+        if (!targetMessageId) {
+            opts.logger.debug({ type: envelope.type, message_id: envelope.message_id }, "message-bus: chat_cancel dropped (no target_message_id)");
+            return;
+        }
+        const reason = pickString(payload.reason) || "unknown";
+        const entry = opts.tracker.findByInboundMessageId(targetMessageId);
+        if (!entry) {
+            opts.logger.debug({ targetMessageId, reason }, "message-bus: chat_cancel for unknown / already-finished turn — no-op");
+            return;
+        }
+        const cancelled = await opts.sessionManager.cancel();
+        opts.logger.info({
+            sid: entry.sid,
+            channelId: entry.channelId,
+            targetMessageId,
+            reason,
+            cancelled,
+        }, "message-bus: chat_cancel received — aborting in-flight turn");
+    };
+}
+function pickString(v) {
+    return typeof v === "string" && v.length > 0 ? v : "";
+}
+//# sourceMappingURL=cancel.js.map

package/dist/plugins/message-bus/cancel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cancel.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/cancel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AASH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC;AAQtD,MAAM,UAAU,4BAA4B,CAC1C,IAAoC;IAEpC,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;QACpE,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC9D,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EACxD,yDAAyD,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAEvD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,eAAe,EAAE,MAAM,EAAE,EAC3B,sEAAsE,CACvE,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe;YACf,MAAM;YACN,SAAS;SACV,EACD,6DAA6D,CAC9D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/plugins/message-bus/inbound.d.ts

@@ -1,37 +1,53 @@
 /**
  * Inbound — `chat_message` / `agent_request` envelope handler.
  *
- * Wires `MessageSDK.onMessage(...)` to `AgentHost.submitTask(...)`,
- * extracting the prompt + IM correlators via the shared
- * `extractChatPrompt` helper from `@beeos-ai/message-sdk`.
+ * v0.9.0 — wires `MessageSDK.onMessage(...)` directly to
+ * `SessionManager.promptForSession(sid, prompt)`. Per-channel session
+ * isolation:
  *
- * Flow per inbound envelope:
- *
- *   1. Extract `{ message, channelId, messageId, contextId }` from the
- *      payload (returns null on malformed envelopes — silently dropped).
+ *   1. Extract `{ message, channelId, messageId, contextId, sessionKey,
+ *      files }` from the payload via `extractChatPrompt` (returns null
+ *      on malformed envelopes — silently dropped).
  *   2. Reject if no `channelId` or no `messageId` — replies must round
  *      trip through `ch:{channelId}` with `in_reply_to=messageId`, so
- *      neither is optional for our outbound bridge.
- *   3. Try to claim the in-flight turn register. If busy → busy-reply
- *      path (handled by the caller); otherwise submit to the host.
- *   4. The submitted `taskId` gets stored in the register so the
- *      outbound listener can correlate AgentEvents back to the right
- *      MS channel.
+ *      neither is optional.
+ *   3. Layer 3 in-flight gate: if `sessionManager.isTurnInFlight()`
+ *      returns true, send a busy-reply on the inbound channel and
+ *      return. The agent serialises every prompt through a single
+ *      physical device, so concurrent requests are rejected (not
+ *      queued) — matches v0.8.0 contract.
+ *   4. Resolve the per-channel sid from `sessionKey` (the SDK already
+ *      computed `agent:{id}:invoke:ctx-{contextId}` /
+ *      `:ch-{channelId}`). Bind a fresh `MsChannelNotifier` to that
+ *      sid for the duration of the turn.
+ *   5. Build the prompt (text + a minimal `[attachments]` block when
+ *      `files.length > 0`) and call
+ *      `sessionManager.promptForSession(sid, promptText)`.
+ *   6. The notifier translates streaming session/update envelopes into
+ *      MS wire envelopes (`agent_reply_delta`, terminal `agent_reply`)
+ *      automatically — no separate outbound listener needed.
+ *   7. ALWAYS unbind the notifier on completion (success / error /
+ *      cancellation) so the next turn on the same channel gets a fresh
+ *      notifier with `accumulatedText = ""`.
  *
- * The inbound handler intentionally does NOT subscribe to the host
- * event stream — that's `outbound.ts`'s job, registered ONCE at plugin
- * start. Keeping the two sides decoupled means we never accidentally
- * double-publish for the same turn.
+ * Defensive paths:
+ *   - If `promptForSession` rejects with `"agent_busy"` (extremely
+ *     rare race after the explicit `isTurnInFlight` check), fall
+ *     through to the busy-reply path so the caller's `/wait` doesn't
+ *     hang.
+ *   - For any other thrown error, publish a terminal `agent_reply`
+ *     with `error` set so callers see a definite outcome.
  */
-import { type MessageEnvelope } from "@beeos-ai/message-sdk";
-import type { AgentHost } from "../../ports/agent-host.js";
+import { type MessageEnvelope, type MessageSDK } from "@beeos-ai/message-sdk";
+import type { SessionManager } from "../../app/session-manager.js";
 import type { Logger } from "../../logger/index.js";
-import type { TurnContextRegister } from "./turn-context.js";
 import type { BusyReplyHandler } from "./busy-reply.js";
+import type { MsInflightTracker } from "./ms-inflight-tracker.js";
 export interface MessageBusInboundOptions {
-    host: AgentHost;
-    register: TurnContextRegister;
+    sessionManager: SessionManager;
+    sdk: MessageSDK;
     busyReply: BusyReplyHandler;
+    tracker: MsInflightTracker;
     logger: Logger;
     /**
      * Local agent identity surfaced to `extractChatPrompt`. Used only for

package/dist/plugins/message-bus/inbound.js

@@ -1,29 +1,45 @@
 /**
  * Inbound — `chat_message` / `agent_request` envelope handler.
  *
- * Wires `MessageSDK.onMessage(...)` to `AgentHost.submitTask(...)`,
- * extracting the prompt + IM correlators via the shared
- * `extractChatPrompt` helper from `@beeos-ai/message-sdk`.
+ * v0.9.0 — wires `MessageSDK.onMessage(...)` directly to
+ * `SessionManager.promptForSession(sid, prompt)`. Per-channel session
+ * isolation:
  *
- * Flow per inbound envelope:
- *
- *   1. Extract `{ message, channelId, messageId, contextId }` from the
- *      payload (returns null on malformed envelopes — silently dropped).
+ *   1. Extract `{ message, channelId, messageId, contextId, sessionKey,
+ *      files }` from the payload via `extractChatPrompt` (returns null
+ *      on malformed envelopes — silently dropped).
  *   2. Reject if no `channelId` or no `messageId` — replies must round
  *      trip through `ch:{channelId}` with `in_reply_to=messageId`, so
- *      neither is optional for our outbound bridge.
- *   3. Try to claim the in-flight turn register. If busy → busy-reply
- *      path (handled by the caller); otherwise submit to the host.
- *   4. The submitted `taskId` gets stored in the register so the
- *      outbound listener can correlate AgentEvents back to the right
- *      MS channel.
+ *      neither is optional.
+ *   3. Layer 3 in-flight gate: if `sessionManager.isTurnInFlight()`
+ *      returns true, send a busy-reply on the inbound channel and
+ *      return. The agent serialises every prompt through a single
+ *      physical device, so concurrent requests are rejected (not
+ *      queued) — matches v0.8.0 contract.
+ *   4. Resolve the per-channel sid from `sessionKey` (the SDK already
+ *      computed `agent:{id}:invoke:ctx-{contextId}` /
+ *      `:ch-{channelId}`). Bind a fresh `MsChannelNotifier` to that
+ *      sid for the duration of the turn.
+ *   5. Build the prompt (text + a minimal `[attachments]` block when
+ *      `files.length > 0`) and call
+ *      `sessionManager.promptForSession(sid, promptText)`.
+ *   6. The notifier translates streaming session/update envelopes into
+ *      MS wire envelopes (`agent_reply_delta`, terminal `agent_reply`)
+ *      automatically — no separate outbound listener needed.
+ *   7. ALWAYS unbind the notifier on completion (success / error /
+ *      cancellation) so the next turn on the same channel gets a fresh
+ *      notifier with `accumulatedText = ""`.
  *
- * The inbound handler intentionally does NOT subscribe to the host
- * event stream — that's `outbound.ts`'s job, registered ONCE at plugin
- * start. Keeping the two sides decoupled means we never accidentally
- * double-publish for the same turn.
+ * Defensive paths:
+ *   - If `promptForSession` rejects with `"agent_busy"` (extremely
+ *     rare race after the explicit `isTurnInFlight` check), fall
+ *     through to the busy-reply path so the caller's `/wait` doesn't
+ *     hang.
+ *   - For any other thrown error, publish a terminal `agent_reply`
+ *     with `error` set so callers see a definite outcome.
  */
 import { extractChatPrompt, } from "@beeos-ai/message-sdk";
+import { MsChannelNotifier } from "./ms-channel-notifier.js";
 /**
  * Build the per-envelope handler. The returned function is what gets
  * registered with `sdk.onMessage(type, handler)` — keeping the factory
@@ -48,11 +64,14 @@ export function buildMessageBusInboundHandler(opts) {
             }, "message-bus: dropped envelope (missing channelId or messageId — cannot correlate reply)");
             return;
         }
-        if (opts.register.isBusy()) {
+        // Layer 3 — physical-device-serial gate. The agent has ONE device
+        // and ONE in-flight task slot. Concurrent invocations get an
+        // `agent_busy` reply so callers can retry instead of hanging on
+        // /wait.
+        if (opts.sessionManager.isTurnInFlight()) {
             opts.logger.warn({
                 incomingMessageId: prompt.messageId,
                 incomingChannelId: prompt.channelId,
-                activeTurn: opts.register.current_()?.taskId,
             }, "message-bus: agent busy — sending agent_busy reply");
             await opts.busyReply.replyBusy({
                 channelId: prompt.channelId,
@@ -61,47 +80,91 @@ export function buildMessageBusInboundHandler(opts) {
             });
             return;
         }
-        // Gap E: forward `prompt.files` URLs into the prompt text so the
-        // agent at least sees them. beeos-claw's localServer.agentSend takes
-        // files as a separate argument; device-agent's host.submitTask only
-        // accepts a single string today. Append a minimal `[attachments]`
-        // block — deeper resource-resolver integration is out of scope here.
-        const promptText = appendAttachments(prompt.message, prompt.files);
-        const submitted = opts.host.submitTask(promptText, {
-            correlationTag: `ms:${prompt.channelId}`,
-        });
-        const claimed = opts.register.claim({
-            taskId: submitted.taskId,
+        // Per-channel session anchor. `sessionKey` is the canonical id —
+        // multiple chat_message envelopes carrying the same `context_id`
+        // (or `channel_id` fallback) flow into the same sid, so the
+        // history-injection preamble in `_executePrompt` can stitch them
+        // into a continuous conversation.
+        const sid = prompt.sessionKey;
+        const notifier = new MsChannelNotifier({
+            sdk: opts.sdk,
             channelId: prompt.channelId,
             inboundMessageId: prompt.messageId,
             sessionKey: prompt.sessionKey,
-            contextId: prompt.contextId,
+            logger: opts.logger,
         });
-        if (!claimed) {
-            // Race between two near-simultaneous publications — undo the
-            // submit and treat the second one as busy. host.cancel returns
-            // `false` if the task already finished, which is fine.
-            opts.host.cancel(submitted.taskId);
-            opts.logger.warn({ messageId: prompt.messageId }, "message-bus: turn-context race — cancelling and replying busy");
-            await opts.busyReply.replyBusy({
-                channelId: prompt.channelId,
-                inboundMessageId: prompt.messageId,
-                sessionKey: prompt.sessionKey,
-            });
-            return;
-        }
+        opts.sessionManager.bindNotifier(sid, notifier);
+        opts.tracker.set({
+            messageId: prompt.messageId,
+            channelId: prompt.channelId,
+            sid,
+        });
+        const promptText = appendAttachments(prompt.message, prompt.files);
         opts.logger.info({
-            taskId: submitted.taskId,
+            sid,
             channelId: prompt.channelId,
             inboundMessageId: prompt.messageId,
             contextId: prompt.contextId,
             sessionKey: prompt.sessionKey,
+            files: prompt.files.length,
         }, "message-bus: turn started");
-        // Surface late submission failures into the outbound stream so the
-        // caller's /wait does not hang. The outbound listener already
-        // emits an agent_reply on `task:end (error)`; we do NOT await
-        // `submitted.done` here because the listener handles all terminal
-        // events.
+        try {
+            const result = await opts.sessionManager.promptForSession(sid, promptText);
+            opts.logger.info({
+                sid,
+                channelId: prompt.channelId,
+                inboundMessageId: prompt.messageId,
+                stopReason: result.stopReason,
+            }, "message-bus: turn finished");
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            opts.logger.warn({
+                sid,
+                channelId: prompt.channelId,
+                inboundMessageId: prompt.messageId,
+                err: message,
+            }, "message-bus: promptForSession rejected — emitting fallback reply");
+            // If the notifier already published the terminal `agent_reply`
+            // (normal stream_complete path) the second publish is harmless
+            // because the notifier guards on `finalized`.
+            if (message === "agent_busy") {
+                await opts.busyReply.replyBusy({
+                    channelId: prompt.channelId,
+                    inboundMessageId: prompt.messageId,
+                    sessionKey: prompt.sessionKey,
+                });
+            }
+            else if (!notifier.isFinalized) {
+                // Surface the error as a terminal agent_reply so callers see
+                // a definite outcome instead of a /wait timeout. Use durable
+                // sendChannelMessage (same path as MsChannelNotifier.publishFinal)
+                // so caller's /wait can match via DB even if it's mid-reconnect.
+                try {
+                    await opts.sdk.sendChannelMessage(prompt.channelId, {
+                        type: "agent_reply",
+                        payload: {
+                            session_key: prompt.sessionKey,
+                            error: message,
+                            text: notifier.currentText,
+                        },
+                        inReplyTo: prompt.messageId,
+                    });
+                }
+                catch (publishErr) {
+                    opts.logger.error({
+                        err: publishErr instanceof Error
+                            ? publishErr.message
+                            : String(publishErr),
+                        channelId: prompt.channelId,
+                    }, "message-bus: failed to publish fallback agent_reply");
+                }
+            }
+        }
+        finally {
+            opts.sessionManager.unbindNotifier(sid);
+            opts.tracker.clear(prompt.messageId);
+        }
     };
 }
 /**

package/dist/plugins/message-bus/inbound.js.map

@@ -1 +1 @@
-{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,iBAAiB,GAElB,MAAM,uBAAuB,CAAC;AA2B/B;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAA8B;IAE9B,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EACxD,8DAA8D,CAC/D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;gBAChC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;aACjC,EACD,yFAAyF,CAC1F,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,MAAM;aAC7C,EACD,oDAAoD,CACrD,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;gBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,iEAAiE;QACjE,qEAAqE;QACrE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;YACjD,cAAc,EAAE,MAAM,MAAM,CAAC,SAAS,EAAE;SACzC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;YAClC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,6DAA6D;YAC7D,+DAA+D;YAC/D,uDAAuD;YACvD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAC/B,+DAA+D,CAChE,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;gBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;YAClC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,EACD,2BAA2B,CAC5B,CAAC;QAEF,mEAAmE;QACnE,8DAA8D;QAC9D,8DAA8D;QAC9D,kEAAkE;QAClE,UAAU;IACZ,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAwB;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,GAAG,OAAO,sBAAsB,IAAI,EAAE,CAAC;AAChD,CAAC"}
+{"version":3,"file":"inbound.js","sourceRoot":"","sources":["../../../src/plugins/message-bus/inbound.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EACL,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAwB7D;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,IAA8B;IAE9B,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;SACtC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,EACxD,8DAA8D,CAC/D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;gBAChC,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS;aACjC,EACD,yFAAyF,CAC1F,CAAC;YACF,OAAO;QACT,CAAC;QAED,kEAAkE;QAClE,6DAA6D;QAC7D,gEAAgE;QAChE,SAAS;QACT,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,iBAAiB,EAAE,MAAM,CAAC,SAAS;aACpC,EACD,oDAAoD,CACrD,CAAC;YACF,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;gBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;gBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,iEAAiE;QACjE,kCAAkC;QAClC,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;QAC9B,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC;YACrC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;YAClC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,iBAAiB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAEnE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;YACE,GAAG;YACH,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;YAClC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;SAC3B,EACD,2BAA2B,CAC5B,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;YAC3E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;gBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,EACD,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd;gBACE,GAAG;gBACH,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;gBAClC,GAAG,EAAE,OAAO;aACb,EACD,kEAAkE,CACnE,CAAC;YACF,+DAA+D;YAC/D,+DAA+D;YAC/D,8CAA8C;YAC9C,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;gBAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;oBAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,gBAAgB,EAAE,MAAM,CAAC,SAAS;oBAClC,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACjC,6DAA6D;gBAC7D,6DAA6D;gBAC7D,mEAAmE;gBACnE,iEAAiE;gBACjE,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE;wBAClD,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE;4BACP,WAAW,EAAE,MAAM,CAAC,UAAU;4BAC9B,KAAK,EAAE,OAAO;4BACd,IAAI,EAAE,QAAQ,CAAC,WAAW;yBAC3B;wBACD,SAAS,EAAE,MAAM,CAAC,SAAS;qBAC5B,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CACf;wBACE,GAAG,EACD,UAAU,YAAY,KAAK;4BACzB,CAAC,CAAC,UAAU,CAAC,OAAO;4BACpB,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;wBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;qBAC5B,EACD,qDAAqD,CACtD,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,OAAe,EAAE,KAAwB;IAClE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,OAAO,GAAG,OAAO,sBAAsB,IAAI,EAAE,CAAC;AAChD,CAAC"}

package/dist/plugins/message-bus/index.d.ts

@@ -94,8 +94,7 @@ export declare class MessageBusPlugin implements AgentPlugin {
     readonly name = "message-bus";
     private ctx?;
     private sdk;
-    private register;
-    private unsubscribeOutbound;
+    private tracker;
     private resolvedPrincipalId;
     private stopped;
     private retryHandle;

package/dist/plugins/message-bus/index.js

@@ -31,9 +31,9 @@
 import { MessageSDK } from "@beeos-ai/message-sdk";
 import { createDeviceMessagingTokenProvider } from "../../messaging/token-provider.js";
 import { MessageSdkBusyReplyHandler } from "./busy-reply.js";
+import { buildMessageBusCancelHandler, MESSAGE_TYPE_CHAT_CANCEL, } from "./cancel.js";
 import { buildMessageBusInboundHandler } from "./inbound.js";
-import { installMessageBusOutbound } from "./outbound.js";
-import { TurnContextRegister } from "./turn-context.js";
+import { MsInflightTracker } from "./ms-inflight-tracker.js";
 /**
  * Backoff schedule for token / connect failures (milliseconds). Each
  * entry is the delay BEFORE the next retry. The last entry caps the
@@ -57,8 +57,7 @@ export class MessageBusPlugin {
     name = "message-bus";
     ctx;
     sdk = null;
-    register = null;
-    unsubscribeOutbound = null;
+    tracker = null;
     resolvedPrincipalId = "";
     // Connect-loop state.
     stopped = false;
@@ -117,15 +116,6 @@ export class MessageBusPlugin {
         // Resolve any outstanding waiter so test code that awaits
         // `whenSettled()` does not hang past stop().
         this.resolveConnectSettled();
-        if (this.unsubscribeOutbound) {
-            try {
-                this.unsubscribeOutbound();
-            }
-            catch {
-                /* ignore */
-            }
-            this.unsubscribeOutbound = null;
-        }
         if (this.sdk) {
             try {
                 await this.sdk.disconnect();
@@ -135,9 +125,9 @@ export class MessageBusPlugin {
             }
             this.sdk = null;
         }
-        if (this.register) {
-            this.register.reset();
-            this.register = null;
+        if (this.tracker) {
+            this.tracker.reset();
+            this.tracker = null;
         }
     }
     // Test seam — exposes the resolved principal so integration tests can
@@ -199,8 +189,12 @@ export class MessageBusPlugin {
             createDeviceMessagingTokenProvider({ agentGatewayUrl, keypair });
         const sdk = this.opts.sdkFactory?.(log) ??
             new MessageSDK({
-                // No serviceUrl — agents talk to MS only via Agent Gateway
-                // proxy + Centrifugo (P6 boundary).
+                // serviceUrl is discovered post-token (tok.service_url) and
+                // late-bound via setServiceUrl below. Once bound, the SDK
+                // forwards the Centrifugo token as Authorization: Bearer
+                // for principal-level REST auth — agent never sees the MS
+                // X-API-Key. This is the durable publish path used by
+                // sendChannelMessage for terminal agent_reply.
                 centrifugoUrl: ctx.config.messageBus.centrifugoUrl || undefined,
             }, wrapLoggerForSdk(log));
         let tok;
@@ -216,20 +210,31 @@ export class MessageBusPlugin {
             this.logAttemptFailure(attempt, "gateway returned empty principal_id", null, log);
             return false;
         }
-        const register = new TurnContextRegister();
+        // Late-bind MS REST URL discovered from the token response so
+        // sdk.sendChannelMessage (used by MsChannelNotifier.publishFinal
+        // for durable terminal replies) has somewhere to POST. When
+        // service_url is empty (legacy gateway not exposing it yet), the
+        // SDK keeps `serviceUrl: undefined` and any sendChannelMessage call
+        // throws — that's the explicit failure mode preferred over silently
+        // falling back to lossy Centrifugo direct publish.
+        sdk.setServiceUrl(tok.service_url);
+        const tracker = new MsInflightTracker();
         const busyReply = new MessageSdkBusyReplyHandler({ sdk });
+        const sessionManager = ctx.sessionManager;
         const chatHandler = buildMessageBusInboundHandler({
-            host: ctx.host,
-            register,
+            sessionManager,
+            sdk,
             busyReply,
+            tracker,
             logger: log,
             localAgentId: this.opts.localAgentId,
             source: "chat_message",
         });
         const legacyHandler = buildMessageBusInboundHandler({
-            host: ctx.host,
-            register,
+            sessionManager,
+            sdk,
             busyReply,
+            tracker,
             logger: log,
             localAgentId: this.opts.localAgentId,
             source: "agent_request",
@@ -245,12 +250,17 @@ export class MessageBusPlugin {
             }
             await legacyHandler(env);
         });
-        const unsubscribe = installMessageBusOutbound({
-            host: ctx.host,
-            sdk,
-            register,
+        // Cooperative cancel: the platform pushes `chat_cancel` envelopes
+        // when the caller hangs up / explicitly cancels / times out. We
+        // address the in-flight turn IM-natively by `target_message_id`
+        // (== inbound chat_message.message_id) so the agent stays free of
+        // A2A / MCP / OpenAPI protocol knowledge.
+        const cancelHandler = buildMessageBusCancelHandler({
+            sessionManager,
+            tracker,
             logger: log,
         });
+        sdk.onMessage(MESSAGE_TYPE_CHAT_CANCEL, async (env) => cancelHandler(env));
         sdk.onceConnected(() => {
             log.info({
                 principalId,
@@ -266,14 +276,7 @@ export class MessageBusPlugin {
             });
         }
         catch (err) {
-            // Roll back the listener so we don't double-subscribe on the
-            // next retry, and disconnect the half-opened SDK.
-            try {
-                unsubscribe();
-            }
-            catch {
-                /* ignore */
-            }
+            // Disconnect the half-opened SDK so the next retry starts clean.
             try {
                 await sdk.disconnect();
             }
@@ -284,8 +287,7 @@ export class MessageBusPlugin {
             return false;
         }
         this.sdk = sdk;
-        this.register = register;
-        this.unsubscribeOutbound = unsubscribe;
+        this.tracker = tracker;
         this.resolvedPrincipalId = principalId;
         return true;
     }