@canonmsg/agent-sdk 12.6.1 → 13.0.3

package/README.md

@@ -21,7 +21,7 @@ Write a module whose default export answers one turn:
 ```js
 // agent.mjs
 export default async function (turn) {
-  turn.stream('Thinking…'); // a live preview, never posted
+  turn.stream('Thinking…'); // progress: it keeps the turn alive, and is never shown or posted
   return `You said: ${turn.input.messages.at(-1).text}`; // the turn's one reply; null stays silent
 }
 ```
@@ -143,15 +143,15 @@ A handler receives a `CodeTurn`:
 | `prompt` | The same messages rendered as text for a model, history first |
 | `files` | Absolute paths of this turn's inbound attachments, already downloaded |
 | `signal` | Aborts on Stop, Stop & clear, New session, `no_reply`, membership loss, the no-progress deadline and shutdown |
-| `stream(text)` | The full visible answer so far, not a delta. A preview only |
-| `activity(event)` | A status row `{ id, kind: 'tool' \| 'status', title, state: 'running' \| 'done' \| 'failed' }`, replaced by `id` |
+| `stream(text)` | The answer so far, not a delta. It counts as progress (the no-progress deadline restarts) and is never shown or posted |
+| `activity(event)` | A status `{ id, kind: 'tool' \| 'status', title, state: 'running' \| 'done' \| 'failed' }`. It counts as progress and is never shown |
 | `ask(request)` | Approvals and questions; see below |
 | `state` | `get`, `set` and `delete` of JSON values for this conversation, at most 64 KiB. Kept across restarts; New session clears it |
 | `tools` | `call(name, args)` for `no_reply`, `communicate`, `react`, `send_file` and `ask_question`, bound to this turn |
 
 What the handler returns decides the turn's output:
 
-- A string is the turn's one final reply. Long replies are split into ordered parts for you; one that would need more than 100 parts, files included, is cut short with a note saying so.
+- A string is the turn's one final reply. Long replies are split into ordered parts for you; one that would need more than 100 parts, files included, is cut short with a note saying so. In an encrypted room a part holds up to 32 KiB, and each shows as its own message.
 - `{ reply, files }` sends the files ahead of the reply's text.
 - `null` is deliberate silence: nothing is posted and files are withheld.
 - Throwing, or returning anything else (including `undefined`), posts one short failure notice. The turn is never re-run.
@@ -198,11 +198,13 @@ Inbound attachments are downloaded before the turn starts, up to 10 MiB each, an
 - One connection and one event stream per process. Input comes only through the durable inbox.
 - One turn at a time per room, in order, and up to 8 rooms at once. There is no debounce.
 - Stop, Stop & clear and New session from the Canon app. A stopped turn's reply and files are withheld even if the handler still returns.
-- Live state: thinking, typing, previews (at most 4 per second) and activity. Turns are verbose in two-person rooms and show status only in larger rooms.
-- One final per turn, split into parts of at most 3,800 bytes and journaled before the first send, so a restart delivers it once under the same ids.
+- A content-free turn state: working, waiting on a card, stopped or done. There is no typing, live preview or activity.
+- One final per turn, encrypted, split into parts of at most 32 KiB and journaled before the first send, so a restart delivers it once under the same ids.
 - One notice when a handler throws or a turn makes no progress for 30 minutes, and one when a restart interrupted a reply.
 - Read receipts, inbound downloads, the runtime descriptor and heartbeats.
-- Group rules: Canon decides when the agent is woken, and the runner never re-evaluates it.
+- Group rules: Canon cannot read a room, so the runner applies its rules and decides when another agent wakes this one (see [Encrypted rooms](#encrypted-rooms)).
+
+Every room is encrypted, so the runner needs the agent's MLS device, which it keeps itself. It refuses a room that is not encrypted.
 
 ## Configuration
 
@@ -240,7 +242,7 @@ On Windows there is no mode to read, so the same rule reads the access list: onl
 
 ## Encrypted rooms
 
-Dev and Prod require every new room to be end-to-end encrypted (MLS). Without an MLS device an agent takes part in no encrypted room. An agent whose outbound policy is closed cannot send there. The runner holds the agent's MLS device; drivers need nothing for it.
+Dev and Prod require every new room to be end-to-end encrypted (MLS). Without an MLS device an agent takes part in no encrypted room. An agent whose outbound policy is closed can only answer there: once for each message, with no cards or files, and with its runner telling Canon which message it answers. The runner holds the agent's MLS device; drivers need nothing for it.
 
 On macOS (Apple silicon) and Linux (x64 and arm64, glibc 2.28 or later) this package ships the portable custody helper, and the runner keeps the device itself (managed custody). On the agent's first start it provisions and enrolls the device under `$CANON_HOME/mls/<environment>/`, with the environment's issuer and receipt public keys this package pins: there is nothing to configure. Later starts reuse it, and a start that finds a setup unfinished finishes it; nothing replaces a vault, so keep the home (a lost vault means a new device). The helper and the pins are trusted as this package is, as is the runner code that already handles every message. `canon-agent mls --action setup` does the same without starting a model. `createRunner` does the same when given no `mls`; `managedMlsDevice({ home, environmentId, helper, pins })` builds that device with another helper or other pins. A device set up with `--mls-dev-config` keeps its vault where that configuration says, so it keeps needing it: without it the runner refuses to start rather than fail in every room.
 
@@ -257,17 +259,18 @@ canon-agent run --driver claude --mls-dev-config /abs/mls-dev.json --profile dev
 
 `canon-agent mls` runs one setup step (`status`, `setup` for whatever is left of provision then enroll, `provision` for portable custody, once, `enroll`, `renew`, `publish` a KeyPackage for a room before someone adds the agent, `refresh` a room) on the same home as `run`, so stop the agent first. Each takes `--mls-dev-config` for an operator's custody. It prints public device state and never starts a model. In library form, pass `mls: await loadMlsDevConfiguration(path, { environmentId })` to `createRunner`.
 
-In an encrypted room:
+In every room:
 
 - Turns take a person's messages, read from the device's verified history under the room's current audience, and another agent's only when it mentions this agent, a few times in a row at most (see [Team rooms](#team-rooms)). Any other agent's encrypted message is seen but starts no turn, and a message sent to an older audience is settled with no turn.
 - A change of membership stops the running turn and withholds its reply. The next turn runs in a fresh native session, and a driver without session memory sees only the history of the current audience. A member adding or removing a device (and keeping one) is not a change of membership: the turn and its session go on.
-- Canon receives encrypted text, a content-free turn state and, from `send_file` in a v3 room, the files themselves as unencrypted items; nothing else. The turn state says only when the agent is busy (`thinking`), waiting on a card (`waiting_input`), stopped (`interrupted`) or done (`idle`), with an opaque turn id and its times, so the owner's phone shows the agent working and offers Stop; Canon learns when the agent works, never what it does. There is no typing, live preview, activity, queue, read receipt or silence report. A reply longer than 32 KiB is cut short with a note, because encrypted text is not split into parts.
-- The tools are `no_reply` and a `communicate` that lists conversations or agents and sends text to the same room only, plus `ask_question` in a room created for approvals and questions (`canon.mls.dev-text.v2`, and `v3`, which Canon creates), and `send_file` in a `v3` room for a turn answering the owner. Files are sent as items, which are not end-to-end encrypted and are marked so. `react` fails closed with a tool error. In a v1 or v2 room `send_file` also fails closed, and returned files are named in the reply as not sent.
+- Canon receives encrypted text, a content-free turn state, the agent's read receipts and reactions, which a person's device sends there too, and, from `send_file` in a v3 room, the files themselves as unencrypted items; nothing else. The turn state says only when the agent is busy (`thinking`), waiting on a card (`waiting_input`), stopped (`interrupted`) or done (`idle`), with an opaque turn id and its times, so the owner's phone shows the agent working and offers Stop; Canon learns when the agent works, never what it does. There is no typing, live preview, activity, queue or silence report. A reply longer than 32 KiB goes as ordered parts, at most 100 (32 for a closed agent's reply), the last cut with a note.
+- The tools are `no_reply`, `react` and a `communicate` that lists conversations or agents and sends text to the same room only, plus `ask_question` in a room created for approvals and questions (`canon.mls.dev-text.v2`, and `v3`, which Canon creates), and `send_file` in a `v3` room for a turn answering the owner. Files are sent as items, which are not end-to-end encrypted and are marked so. In a v1 or v2 room `send_file` fails closed, and returned files are named in the reply as not sent. A relay agent has no `react`.
 - In a room created for them, approvals and questions are encrypted cards that only the room's members can read, put to the person whose message the turn answers (the owner for a secret, and when an agent's message started the turn). The answer counts only from that person's verified device, and an ask that is not answered within `askExpiryMs` expires (an approval is then a denial), whatever Canon says. The owner may allow an approval for the rest of the session, which ends with New session, any change of membership and a restart; an action the runtime marks destructive offers no such rule unless the runner runs with `--allow-session-for-destructive` (`sessionApprovalForDestructive`). If the owner adds a device while a card waits, the card is asked again so the new device can answer it. Cards still pending when the runner stops are withdrawn when it restarts. In a room created as `canon.mls.dev-text.v1`, approvals and questions fail closed (a `cancelled` ask, and `ask_question` is not offered).
+- Canon cannot read a room to apply an agent's group rules, so the runner does. A message the room's rules withhold settles with no turn: mention-required, agent-to-agent, long-running collaboration and the turn limit, which by default stops agents after 4 messages in a row until a person writes. Each turn opens with a marked block, and `input.roomFacts` for a `code` handler, that names the owner, the room, its members and its rules, so the agent can follow a participation style itself and answer with `no_reply`. Any admin of the room can set its rules, so they never change what the agent may do on your machine.
 - A reply is journaled before it is encrypted. A retry or a restart sends the same ciphertext, and only while the room's audience is unchanged.
 - The ids Canon sees for what the runner sends there (each message's id, and a card's request id) are keyed with a secret the runner creates once in `$CANON_HOME/runner/<environment>/<agent>/mls-ids/` (0600; it belongs with the rest of the home). They reveal nothing about the text or what was asked, and every message's id has the same shape, whether it is a reply, a notice or a `communicate` send.
 
-Without a device (no helper for the host and no `--mls-dev-config`, or `mls: false` for `createRunner`), the runner refuses each encrypted room, logs it once, and runs nothing for it. Where Canon encrypts every new conversation (its capabilities say `roomMode: 'default'`), such a runner does not start: it could take part in none of them.
+Without a device (no helper for the host and no `--mls-dev-config`, or `mls: false` for `createRunner`), the runner refuses each room, logs it once, and runs nothing for it. Where Canon encrypts every new conversation (its capabilities say `roomMode: 'default'`), such a runner does not start: it could take part in none of them.
 
 ### The class-C relay (Canon-operated)
 
@@ -278,7 +281,7 @@ canon-agent run --driver connector --relay-config /abs/relay.json
 canon-agent mls --action status --relay-config /abs/relay.json
 ```
 
-The relay configuration (a private JSON file) names the agent, where the channel to Canon's Functions listens, and the path of the channel secret. No API key is involved: when the owner enables the relay, Canon delivers the relay's own credential over that channel (it works only for the relay's encrypted-room work, and stops when the relay or its connection is revoked), and the relay keeps it in `$CANON_HOME/relay` and starts under the relay installation it names (`canon-relay:…`), setting up that installation's device as any runner does (or with `--mls-dev-config`). The relay serves only encrypted rooms; plaintext ones stay with the connector. In library form: `startRelayChannel({ agentId, secret, onCredential })`, then `createRunner({ apiKey: credential, driver: connectorDriver(), relay: true, installationId, mls })` and `channel.serve({ runner, inbox: driver.inbox }, grantId)`. The `connector` driver declares `remote`: a runtime off the runner's host gets no local files, and the runner takes it into encrypted rooms only in relay mode.
+The relay configuration (a private JSON file) names the agent, where the channel to Canon's Functions listens, and the path of the channel secret. No API key is involved: when the owner enables the relay, Canon delivers the relay's own credential over that channel (it works only for the relay's encrypted-room work, and stops when the relay or its connection is revoked), and the relay keeps it in `$CANON_HOME/relay` and starts under the relay installation it names (`canon-relay:…`), setting up that installation's device as any runner does (or with `--mls-dev-config`). In library form: `startRelayChannel({ agentId, secret, onCredential })`, then `createRunner({ apiKey: credential, driver: connectorDriver(), relay: true, installationId, mls })` and `channel.serve({ runner, inbox: driver.inbox }, grantId)`. The `connector` driver declares `remote`: a runtime off the runner's host gets no local files, and the runner takes it into encrypted rooms only in relay mode.
 
 ## Team rooms
 
@@ -291,8 +294,8 @@ canon-agent run --driver codex --profile qa --cwd ~/work/repo --mls-dev-config /
   --instructions ~/team/qa.md --trust-agent <engineer agent id> --mention-alias qa
 ```
 
-- **Waking each other.** In a plaintext room, Canon decides when an agent's message wakes another agent (its group rules). Canon cannot read an encrypted room, so there the runner decides: another agent's message wakes this one only when it mentions it, either in the encrypted mentions of a v3 room's message or with an @ in its text by display name, agent id or a `--mention-alias` (`mentionAliases`), in any case. To stop two agents from waking each other forever, a room wakes the agent this way at most `--agent-turn-cap` (`agentTurnCap`, default 6) times in a row; past that, agents' mentions start no turn (the runner logs it once) until a person writes in the room.
-- **Trusted teammates.** A turn holding anyone else's message gets no tools on the owner's machine (see [Claude Code](#claude-code) and [Codex](#codex)). `--trust-agent <id>` (`trustedAgents`) lists agents whose messages count as the owner's for that, in plaintext and encrypted rooms alike, but only where nobody else could have prompted them: in a room whose members are only the agent, its owner and listed agents, all of which Canon confirms at the start of each turn are active agents of the same owner; in an encrypted room with no relay device in the group; and in a plaintext room only for a teammate's final reply that its own runner marked as answering the owner or confirmed teammates alone (the runner marks its own replies that way, so list only agents that run on this runner). Anything else, including a transferred, deactivated or unlisted agent and a turn that also holds anyone else's message, is guarded as before. A trusted message carries `trustedAgent: true` and its prompt line says it comes from a trusted teammate agent. It is still not the owner: its approvals go to the owner, and the owner alone should give release go-aheads.
+- **Waking each other.** Canon cannot read a room, so the runner decides when an agent's message wakes another agent: another agent's message wakes this one only when it mentions it, either in the encrypted mentions of a v3 room's message or with an @ in its text by display name, agent id or a `--mention-alias` (`mentionAliases`), in any case. To stop two agents from waking each other forever, a room wakes the agent this way at most `--agent-turn-cap` (`agentTurnCap`, default 6) times in a row; past that, agents' mentions start no turn (the runner logs it once) until a person writes in the room.
+- **Trusted teammates.** A turn holding anyone else's message gets no tools on the owner's machine (see [Claude Code](#claude-code) and [Codex](#codex)). `--trust-agent <id>` (`trustedAgents`) lists agents whose messages count as the owner's for that, but only where nobody else could have prompted them: in a room whose members are only the agent, its owner and listed agents, all of which Canon confirms at the start of each turn are active agents of the same owner, with no relay device in the group. Anything else, including a transferred, deactivated or unlisted agent and a turn that also holds anyone else's message, is guarded as before. A trusted message carries `trustedAgent: true` and its prompt line says it comes from a trusted teammate agent. It is still not the owner: its approvals go to the owner, and the owner alone should give release go-aheads.
 - **Standing instructions.** `--instructions <file>` (the drivers' `instructions` option) appends the owner's instructions for this agent, such as its role and its handoff rules, to Claude Code's system prompt or Codex's developer instructions. The file is read once at start; it must be UTF-8 text of at most 32 KiB at its real path (no symbolic links), owned by you and not writable by others, in a directory only you (or root) can change, and it is never sent to Canon. The `code` driver's module writes its own prompts. An example brief for an engineer and a QA agent is [in the Canon repository](https://github.com/HeyBobChan/canon/blob/main/docs/agents/examples/team-room-roles.md).
 - In an encrypted room created for cards (`canon.mls.dev-text.v2` or `v3`, which is what Canon creates), approvals and questions go to the owner (or the person whose message the turn answers) as encrypted cards. In a v1 encrypted room they cannot be asked (they fail closed), so what an agent does there without asking is what its `--permission-mode` or `--sandbox` and `--approval-policy` allow.
 
@@ -306,9 +309,9 @@ canon-agent post --profile engineer --room <conversation id> --text "Release 1.4
 ```
 
 - **`tell`** leaves a private note for the agent's next turn in that room, whoever starts it. The note goes at the head of that turn's prompt (and in `turn.input.ownerNotes`), marked as the owner's private note, once; a message cannot imitate the mark. It is never posted and starts no turn, and it does not change whose turn it is: a turn answering someone else is still guarded.
-- **`post`** sends the text as the agent's own message, with no turn: split like a reply in a plaintext room, encrypted for the room's members in an encrypted one, and journaled first, so a crash or an outage sends it exactly once. Nothing marks it as written by the operator, and the agent's outbound policy, blocks and rate limits apply as to any message from it.
+- **`post`** sends the text as the agent's own message, with no turn: encrypted for the room's members, and journaled first, so a crash or an outage sends it exactly once. Nothing marks it as written by the operator, and the agent's outbound policy, blocks and rate limits apply as to any message from it.
 - The agent comes from `--agent <id>` or `--profile <name>`, the environment from `--environment` or `CANON_ENVIRONMENT_ID`; the CLI uses no network. The text is at most 32 KiB. The CLI prints the command's id and the path of its record (`runner/<env>/<agent>/errands/journal/<id>.json` in the home); `--wait` waits up to 30 s for the running runner and prints what it did (`pending` for a kept note, `sent`, or `refused`, `rejected` or `expired` with the reason), exiting 1 unless it was accepted: a note kept, a post sent. A post Canon has not accepted by then prints `sending` and exits 1; the runner keeps it and goes on delivering it. A runner that is not running takes the command when it starts; one more than a day old is refused, and a note no turn used within a day expires.
-- A room the agent is not in, or an encrypted room the runner cannot read, refuses the command. The runner refuses a command file that is a link, belongs to another user, is readable by others, has a second name, is malformed or is too large, and logs why, never the text.
+- A room the agent is not in, or one the runner cannot read, refuses the command. The runner refuses a command file that is a link, belongs to another user, is readable by others, has a second name, is malformed or is too large, and logs why, never the text.
 - Errands are off for Canon's class-C relay, whose home is Canon's. In library form, `queueErrand(errandsDirectory(home, environmentId, agentId), { kind, conversationId, text })` writes one.
 
 `canon-agent errand` sends the agent on an errand: one turn, run as if the owner had asked in person (the owner's tool policy, approvals to the owner), whose job is to carry the instruction to someone else:
@@ -320,10 +323,9 @@ canon-agent errands --profile engineer --follow
 canon-agent errands --profile engineer --cancel <errand id>
 ```
 
-- **The recipient.** `--to` names a conversation the agent is in (plaintext or encrypted), or else a person or agent, with whom the errand always starts a new conversation. On the errand, `communicate` reaches only the recipient and the origin; Canon's policies, blocks and rate limits apply as to any message from the agent, and nothing marks the message as the owner's (the agent may say who asked).
+- **The recipient.** `--to` names a conversation the agent is in, or else a person or agent, with whom the errand always starts a new encrypted conversation. On the errand, `communicate` reaches only the recipient and the origin; Canon's policies, blocks and rate limits apply as to any message from the agent, and nothing marks the message as the owner's (the agent may say who asked).
 - **The report.** The turn's final answer is its report, posted in `--origin` like any reply. While it runs, the origin shows the agent working (and nothing more), approvals and questions go to the owner there, and Stop there stops it. Without `--origin` the report stays on this machine. `--wait` waits up to 30 s for the turn to end and its report to be answered, and exits 1 unless it ended answered with its report (if one went) accepted. New session in the origin also starts the origin's own conversation afresh.
 - **Replies.** Once the agent reached the recipient, every later turn in that conversation (for a week after the last reply) gets the errand's context at the head of its prompt and in `turn.input.errands`, so the agent knows why it is there. Those turns answer the recipient as usual, under the recipient's (guarded) tool policy.
-- **Encrypted rooms.** What concerns an encrypted room is reported only into an encrypted origin. An errand to an encrypted room from a plaintext origin still runs, but its report stays on this machine and its turn sends nothing to any plaintext room; a reply turn in an encrypted room may report to an encrypted origin, and the runner refuses to send what it received to a plaintext one. Canon never receives that content in plaintext.
 - **Status.** `canon-agent errands` prints each errand's local record (one JSON line): `pending`, `running`, `waiting` (the recipient was reached), `replied`, `done`, `failed`, `cancelled`, `interrupted` (the runner stopped during its turn, which never runs again) or `expired`, with the report when it stayed local. `--follow` keeps printing changes; `--cancel <id>` stops a running errand turn (its report is withheld) and closes the errand.
 
 ## Registration
@@ -353,14 +355,14 @@ Canon messages carry media only in `attachments[]`. GIFs are image attachments w
 | `new CanonAgent(opts)`, `agent.on('message', h)`, `agent.start()` | `createRunner({ apiKey, environmentId, home, driver: codeDriver(h) })` and `runner.start()`, or the CLI |
 | `ctx.messages`, `history`, `conversation`, `groupContext`, `turnContext`, `provenance` | `turn.input` and `turn.prompt` |
 | `ctx.replyFinal(text)`, callable many times | The return value: exactly one final per turn |
-| `ctx.replyProgress(text, { durable })` | `turn.stream(text)`, a preview only. There are no progress messages |
+| `ctx.replyProgress(text, { durable })` | `turn.stream(text)`, progress only. There are no progress messages |
 | `ctx.turn.setThinking`, `setStreaming`, `setTool`, deltas and blocks | `turn.stream(snapshot)` and `turn.activity(event)` |
 | `ctx.turn.noReply()`, which did not stop `replyFinal` | `return null` or the `no_reply` tool. Silence is strict: reply and files are withheld |
 | `ctx.requestApproval`, `ctx.requestRuntimeInput` | `turn.ask({ kind: 'approve' \| 'choose' \| 'text' })`, expiring after 1 hour |
 | `ctx.media.materialize`; `media.replyWithFile`, `uploadFile` | `turn.files`; `return { reply, files }` or `send_file` |
 | `ctx.communicate`, `react`, `addMember`, `removeMember`, `leave`; `agent.communicate` | `turn.tools.call('communicate' \| 'react', args)`; `runner.communicate(input)` outside a turn |
 | `ctx.abortSignal`, `runtimeControls`, `on('interrupt' \| 'stopAndDrop' \| 'newSession')` | `turn.signal`. The runner handles Stop, Stop & clear and New session |
-| `sessions`, `debounceMs`, `historyLimit`, `turnVerbosity` | Turns always queue per room, there is no debounce, history is up to 20 messages, and verbosity follows room size |
+| `sessions`, `debounceMs`, `historyLimit`, `turnVerbosity` | Turns always queue per room, there is no debounce, history is up to 20 messages, and a turn shows only its content-free state |
 | `runtimeDescriptor`, `runtimePrimitives`, `clientType` | The runner generates the descriptor |
 | `autoMarkRead`, `ctx.markAsRead()` | The runner marks read |
 | `CanonAgent.register`, `checkStatus`, `ackStatus` | `ensureAgentProfile` or `resumeRegistration` |

package/dist/chunks/{chunk-S7BV74DN.js → chunk-5WPAB5MB.js}

@@ -1228,6 +1228,14 @@ function parseMlsDevGroupRoster(value) {
   });
 }
 __name(parseMlsDevGroupRoster, "parseMlsDevGroupRoster");
+var MLS_MEMBER_JOIN_WAIT_MS = 6e4;
+function mlsAdmissionWait(input) {
+  const { senderId, memberIds, admitted } = input;
+  const expected = [.../* @__PURE__ */ new Set([...memberIds, ...input.unacceptedIds])];
+  if (!expected.some((id7) => id7 !== senderId && admitted.has(id7))) return expected.filter((id7) => !admitted.has(id7));
+  return input.nowMs < input.joinedAtMs + MLS_MEMBER_JOIN_WAIT_MS ? memberIds.filter((id7) => !admitted.has(id7)) : [];
+}
+__name(mlsAdmissionWait, "mlsAdmissionWait");
 var MLS_DEV_ROOM_REMOVAL_DEADLINE_MS = 72 * 60 * 60 * 1e3;
 function parseMlsDevRoomRemoval(value) {
   return boundary6(() => {
@@ -2470,6 +2478,10 @@ function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 __name(isRecord, "isRecord");
+function isMembershipChangeMessage(message) {
+  return isRecord(message.metadata) && message.metadata.type === "membership_change";
+}
+__name(isMembershipChangeMessage, "isMembershipChangeMessage");
 function isNameOrId(value) {
   return value === null || typeof value === "string" && value.trim().length > 0;
 }
@@ -2506,6 +2518,253 @@ __name(formatMembershipChangeNotice, "formatMembershipChangeNotice");
 // ../backend-contracts/src/turnProtocol.ts
 var ACTIVE_TURN_STALE_THRESHOLD_MS = 30 * 60 * 1e3;
 var WAITING_INPUT_STALE_THRESHOLD_MS = 12 * 60 * 60 * 1e3;
+var TURN_SEMANTICS = [
+  "progress",
+  "turn_complete",
+  "control"
+];
+var DELIVERY_INTENTS = [
+  "queue",
+  "interrupt",
+  "interleave",
+  "stop"
+];
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+__name(isRecord2, "isRecord");
+function normalizeTurnMetadata(metadata) {
+  if (!isRecord2(metadata)) return null;
+  const turnId = typeof metadata.turnId === "string" && metadata.turnId.trim() ? metadata.turnId.trim() : null;
+  const turnSemantics = TURN_SEMANTICS.includes(metadata.turnSemantics) ? metadata.turnSemantics : void 0;
+  const deliveryIntent = DELIVERY_INTENTS.includes(metadata.deliveryIntent) ? metadata.deliveryIntent : void 0;
+  const replyBehavior = metadata.replyBehavior === "allow_auto_reply" || metadata.replyBehavior === "suppress_auto_reply" ? metadata.replyBehavior : void 0;
+  const inboundDisposition = metadata.inboundDisposition === "queued" || metadata.inboundDisposition === "accepted_now" || metadata.inboundDisposition === "interleaved" || metadata.inboundDisposition === "trigger_suppressed" || metadata.inboundDisposition === "rejected" || metadata.inboundDisposition === "cancelled" ? metadata.inboundDisposition : void 0;
+  const requestedTurnMode = typeof metadata.requestedTurnMode === "string" && /^[A-Za-z0-9_.:-]{1,80}$/.test(metadata.requestedTurnMode.trim()) ? metadata.requestedTurnMode.trim() : void 0;
+  if (!turnId && !turnSemantics && !deliveryIntent && !replyBehavior && !inboundDisposition && !requestedTurnMode) {
+    return null;
+  }
+  return {
+    ...turnId ? { turnId } : {},
+    ...turnSemantics ? { turnSemantics } : {},
+    ...deliveryIntent ? { deliveryIntent } : {},
+    ...replyBehavior ? { replyBehavior } : {},
+    ...inboundDisposition ? { inboundDisposition } : {},
+    ...requestedTurnMode ? { requestedTurnMode } : {}
+  };
+}
+__name(normalizeTurnMetadata, "normalizeTurnMetadata");
+function resolveTurnMessageSemantics(input) {
+  if (isMembershipChangeMessage(input)) return "control";
+  const turnMetadata = normalizeTurnMetadata(input.metadata);
+  if (turnMetadata?.turnSemantics) return turnMetadata.turnSemantics;
+  if (input.senderType === "human") return "turn_complete";
+  return "progress";
+}
+__name(resolveTurnMessageSemantics, "resolveTurnMessageSemantics");
+function shouldTriggerAgentTurn(input) {
+  if (isMembershipChangeMessage(input)) {
+    return { allow: false, semantics: "control", reason: "membership notices do not trigger agent replies" };
+  }
+  const semantics = resolveTurnMessageSemantics(input);
+  const turnMetadata = normalizeTurnMetadata(input.metadata);
+  if (turnMetadata?.replyBehavior === "suppress_auto_reply") {
+    return {
+      allow: false,
+      semantics,
+      reason: "metadata explicitly suppresses auto-reply"
+    };
+  }
+  if (input.senderType === "human") {
+    return {
+      allow: true,
+      semantics,
+      reason: "human messages always remain triggerable"
+    };
+  }
+  if (semantics === "progress") {
+    return {
+      allow: false,
+      semantics,
+      reason: turnMetadata?.turnSemantics === "progress" ? "non-final agent progress does not trigger other agents" : "agent messages require explicit turn_complete semantics"
+    };
+  }
+  return {
+    allow: true,
+    semantics,
+    reason: "agent message is treated as turn-complete"
+  };
+}
+__name(shouldTriggerAgentTurn, "shouldTriggerAgentTurn");
+
+// ../backend-contracts/src/agentBehaviorPolicy.ts
+var PARTICIPATION_HISTORY_FETCH_LIMIT = 50;
+var DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS = 4;
+var DEFAULT_DIRECT_MAX_CONSECUTIVE_AGENT_TURNS = 4;
+function defaultMaxConsecutiveAgentTurns(conversationType) {
+  if (conversationType === "group") {
+    return DEFAULT_GROUP_MAX_CONSECUTIVE_AGENT_TURNS;
+  }
+  if (conversationType === "direct") {
+    return DEFAULT_DIRECT_MAX_CONSECUTIVE_AGENT_TURNS;
+  }
+  return null;
+}
+__name(defaultMaxConsecutiveAgentTurns, "defaultMaxConsecutiveAgentTurns");
+var DEFAULT_POLICY = {
+  participation: {
+    style: "natural",
+    allowAgentToAgent: true,
+    allowHumanToAgent: true,
+    allowLongRunningCollaboration: true,
+    requireMentionForGroupReplies: false,
+    maxConsecutiveAgentTurns: null
+  },
+  instructions: [],
+  source: {
+    hasAgentDefault: false,
+    hasConversationOverride: false
+  }
+};
+function coalesceBoolean(overrideValue, fallbackValue, defaultValue) {
+  if (typeof overrideValue === "boolean") return overrideValue;
+  if (typeof fallbackValue === "boolean") return fallbackValue;
+  return defaultValue;
+}
+__name(coalesceBoolean, "coalesceBoolean");
+function normalizeAgentBehaviorInstructions(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+__name(normalizeAgentBehaviorInstructions, "normalizeAgentBehaviorInstructions");
+function resolveAgentBehaviorPolicy(params) {
+  const agentDefault = params?.agentDefault ?? null;
+  const conversationOverride = params?.conversationOverride ?? null;
+  const defaultInstructions = normalizeAgentBehaviorInstructions(agentDefault?.instructions);
+  const overrideInstructions = normalizeAgentBehaviorInstructions(conversationOverride?.instructions);
+  return {
+    participation: {
+      style: conversationOverride?.participationStyle ?? agentDefault?.participationStyle ?? DEFAULT_POLICY.participation.style,
+      allowAgentToAgent: coalesceBoolean(
+        conversationOverride?.allowAgentToAgent,
+        agentDefault?.allowAgentToAgent,
+        DEFAULT_POLICY.participation.allowAgentToAgent
+      ),
+      allowHumanToAgent: DEFAULT_POLICY.participation.allowHumanToAgent,
+      allowLongRunningCollaboration: coalesceBoolean(
+        conversationOverride?.allowLongRunningCollaboration,
+        agentDefault?.allowLongRunningCollaboration,
+        DEFAULT_POLICY.participation.allowLongRunningCollaboration
+      ),
+      requireMentionForGroupReplies: coalesceBoolean(
+        conversationOverride?.requireMentionForGroupReplies,
+        agentDefault?.requireMentionForGroupReplies,
+        DEFAULT_POLICY.participation.requireMentionForGroupReplies
+      ),
+      maxConsecutiveAgentTurns: conversationOverride?.maxConsecutiveAgentTurns !== void 0 ? conversationOverride.maxConsecutiveAgentTurns ?? null : agentDefault?.maxConsecutiveAgentTurns !== void 0 ? agentDefault.maxConsecutiveAgentTurns ?? null : defaultMaxConsecutiveAgentTurns(params?.conversationType)
+    },
+    instructions: [
+      ...defaultInstructions ? [defaultInstructions] : [],
+      ...overrideInstructions ? [overrideInstructions] : []
+    ],
+    source: {
+      hasAgentDefault: agentDefault != null,
+      hasConversationOverride: conversationOverride != null
+    }
+  };
+}
+__name(resolveAgentBehaviorPolicy, "resolveAgentBehaviorPolicy");
+function toHistorySenderType(message) {
+  if (isMembershipChangeMessage(message)) return null;
+  if (message.senderType !== "ai_agent") {
+    return "human";
+  }
+  return shouldTriggerAgentTurn({
+    senderType: "ai_agent",
+    metadata: message.metadata
+  }).allow ? "ai_agent" : null;
+}
+__name(toHistorySenderType, "toHistorySenderType");
+function buildParticipationHistorySnapshotFromSenderTypes(recentSenderTypes) {
+  let consecutiveAgentTurns = 0;
+  for (const senderType of recentSenderTypes) {
+    if (senderType !== "ai_agent") break;
+    consecutiveAgentTurns += 1;
+  }
+  return {
+    recentSenderTypes,
+    recentHumanCount: recentSenderTypes.filter((senderType) => senderType === "human").length,
+    recentAgentCount: recentSenderTypes.filter((senderType) => senderType === "ai_agent").length,
+    consecutiveAgentTurns,
+    currentAgentStreakStartedByHuman: consecutiveAgentTurns > 0 && recentSenderTypes[consecutiveAgentTurns] === "human"
+  };
+}
+__name(buildParticipationHistorySnapshotFromSenderTypes, "buildParticipationHistorySnapshotFromSenderTypes");
+function buildParticipationHistorySnapshot(messages, agentId) {
+  void agentId;
+  const recentSenderTypes = messages.flatMap((message) => {
+    const senderType = toHistorySenderType(message);
+    return senderType ? [senderType] : [];
+  });
+  return buildParticipationHistorySnapshotFromSenderTypes(recentSenderTypes);
+}
+__name(buildParticipationHistorySnapshot, "buildParticipationHistorySnapshot");
+function evaluateParticipationPolicy(policy, input) {
+  const resolved = policy ?? resolveAgentBehaviorPolicy({ conversationType: input.conversationType });
+  const participation = resolved.participation;
+  const priorAgentTurns = Math.max(input.consecutiveAgentTurns ?? 0, 0);
+  const agentTurnsWithCurrent = priorAgentTurns + (input.senderType === "ai_agent" ? 1 : 0);
+  const consecutiveAgentTurns = Math.max(
+    priorAgentTurns,
+    input.senderType === "ai_agent" ? 1 : 0
+  );
+  const currentAgentStreakStartedByHuman = input.currentAgentStreakStartedByHuman === true;
+  if (input.conversationType === "group" && participation.requireMentionForGroupReplies && !input.mentionedAgent) {
+    return {
+      allow: false,
+      reasonCode: "group_mention_required",
+      reason: "group replies require a direct mention"
+    };
+  }
+  if (input.isOwner) {
+    return {
+      allow: true,
+      reasonCode: "owner_sender",
+      reason: "owner messages pass through outside mention-required group turns"
+    };
+  }
+  if (input.senderType !== "ai_agent") {
+    return { allow: true, reasonCode: "human_sender", reason: "latest sender is human" };
+  }
+  if (!participation.allowAgentToAgent) {
+    return {
+      allow: false,
+      reasonCode: "agent_to_agent_disabled",
+      reason: "agent-to-agent participation is disabled by policy"
+    };
+  }
+  if (!participation.allowLongRunningCollaboration && (consecutiveAgentTurns > 1 || !currentAgentStreakStartedByHuman)) {
+    return {
+      allow: false,
+      reasonCode: "human_reset_required",
+      reason: "a fresh human steer is required before continuing agent collaboration"
+    };
+  }
+  if (typeof participation.maxConsecutiveAgentTurns === "number" && participation.maxConsecutiveAgentTurns >= 0 && agentTurnsWithCurrent >= participation.maxConsecutiveAgentTurns) {
+    return {
+      allow: false,
+      reasonCode: "agent_turn_limit_reached",
+      reason: "maximum consecutive agent turns reached"
+    };
+  }
+  return {
+    allow: true,
+    reasonCode: input.conversationType === "group" ? "group_agent_allowed" : "direct_agent_allowed",
+    reason: participation.requireMentionForGroupReplies ? "policy allows this directly mentioned group reply" : "agent-to-agent participation allowed by policy"
+  };
+}
+__name(evaluateParticipationPolicy, "evaluateParticipationPolicy");
 
 // ../backend-contracts/src/agentDirectory.ts
 var MAX_DISCOVER_AGENTS_QUERY_LENGTH = 64;
@@ -4287,6 +4546,14 @@ function normalizePublicRuntimeFacts(value) {
 }
 __name(normalizePublicRuntimeFacts, "normalizePublicRuntimeFacts");
 
+// ../backend-contracts/src/conversationMembership.ts
+function resolveConversationPolicyScope(memberIdsOrCount) {
+  const count = Array.isArray(memberIdsOrCount) ? new Set(memberIdsOrCount.filter((id7) => typeof id7 === "string" && id7.length > 0)).size : memberIdsOrCount;
+  if (typeof count !== "number" || !Number.isSafeInteger(count)) return "unknown";
+  return count === 2 ? "direct" : count > 2 ? "group" : "unknown";
+}
+__name(resolveConversationPolicyScope, "resolveConversationPolicyScope");
+
 // ../backend-contracts/src/endpointContentPolicy.ts
 var MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS = ["forward_message"];
 var MLS_DEV_DISCLOSED_PROCESSING_FIELDS = {
@@ -4508,15 +4775,19 @@ var actionRouting = {
   create_conversation: ["memberIds.*"],
   add_member: ["conversationId", "userId", "agentId"],
   remove_member: ["conversationId", "userId", "agentId", "targetUserId"],
+  // A member's role is membership, which Canon sees and enforces in any room (ruling 3).
   leave_conversation: ["conversationId"],
-  update_member_role: ["conversationId", "userId", "targetUserId"],
-  update_conversation: ["conversationId"],
-  rename_conversation: ["conversationId"],
-  update_topic: ["conversationId"],
-  update_group_avatar: ["conversationId"],
+  update_member_role: ["conversationId", "userId", "targetUserId", "role"],
+  // A room's name, topic and picture are its public details, as in any room: Canon stores and serves them. The picture
+  // names no file: Canon takes its type from `mimeType`.
+  update_conversation: ["conversationId", "name", "topic"],
+  rename_conversation: ["conversationId", "name"],
+  update_topic: ["conversationId", "topic"],
+  update_group_avatar: ["conversationId", "data", "mimeType"],
   mark_read: ["conversationId"],
   cancel_queued_message: ["conversationId", "messageId"],
-  set_conversation_preferences: ["conversationId"],
+  // A person's own settings for a room, muting it or hiding it from their list: Canon applies them, as it decides who gets a push.
+  set_conversation_preferences: ["conversationId", "mutedUntil", "deleted"],
   set_block: ["targetUserId"],
   save_contact: ["contactUserId"],
   remove_contact: ["contactId", "contactUserId"],
@@ -4548,7 +4819,17 @@ var actionRouting = {
   consume_runtime_primitive: ["conversationId", "requestId", "expectedRevision"],
   generate_image: ["conversationId", "requestId"],
   update_agent_behavior_policy: ["agentId"],
-  update_conversation_agent_behavior_policy: ["conversationId", "agentId"]
+  // A room's rules are settings Canon stores and an encrypted room's runner reads back, so they are metadata; its free-text
+  // `instructions` stay private, which keeps them out of an encrypted room (plaintext-retirement.md §5.5).
+  update_conversation_agent_behavior_policy: [
+    "conversationId",
+    "agentId",
+    "policy.participationStyle",
+    "policy.allowAgentToAgent",
+    "policy.allowLongRunningCollaboration",
+    "policy.requireMentionForGroupReplies",
+    "policy.maxConsecutiveAgentTurns"
+  ]
 };
 var queryRouting = {
   mls_interactions: ["version", "conversationId"],
@@ -5275,6 +5556,7 @@ export {
   parseMlsDevGroupHead,
   parseMlsDevGroupMarker,
   parseMlsDevGroupRoster,
+  mlsAdmissionWait,
   parseMlsDevRoomRemoval,
   parseMlsDevGroupControl,
   parseMlsDevGroupAcceptedControl,
@@ -5297,8 +5579,10 @@ export {
   RUNTIME_CARD_LINE_ITEM_COLUMN_TYPES,
   readMembershipChangeMetadata,
   formatMembershipChangeNotice,
+  PARTICIPATION_HISTORY_FETCH_LIMIT,
+  buildParticipationHistorySnapshot,
+  evaluateParticipationPolicy,
   MAX_DISCOVER_AGENTS_QUERY_LENGTH,
-  VERB_LIMITS,
   NO_REPLY_ACK_NOTE,
   CANON_VERB_WIRE_SCHEMA_VERSION,
   projectVerbIntentToWire,
@@ -5308,6 +5592,7 @@ export {
   MAX_PUBLIC_RUNTIME_COMMANDS,
   normalizePublicRuntimeDescriptor,
   normalizePublicRuntimeFacts,
+  resolveConversationPolicyScope,
   MLS_DEV_UNSUPPORTED_CONTENT_ACTIONS,
   MLS_DEV_DISCLOSED_PROCESSING_FIELDS,
   endpointOperationRequestRetention,

package/dist/chunks/{chunk-HH7KR22P.js → chunk-DTAWEQCM.js}

@@ -6,11 +6,11 @@ import {
   frame,
   requireValue,
   typedNodeMlsDevCustody
-} from "./chunk-FVYKLH6I.js";
+} from "./chunk-YJUPKU47.js";
 import {
   __name,
   parseMlsDevDeviceContext
-} from "./chunk-S7BV74DN.js";
+} from "./chunk-5WPAB5MB.js";
 
 // src/runner/home.ts
 import { randomBytes } from "node:crypto";