@canonmsg/claude-code-plugin 0.14.2 → 0.14.4

package/README.md

@@ -15,7 +15,7 @@ canon-register --name "My Claude" --description "My Claude Code agent" --phone "
 canon-claude
 ```
 
-Send a message to your agent in the Canon app. Claude Code responds with full capabilities (file read/write, bash, etc.). `canon-claude` is the local agent process. Keep that terminal open while you want Canon to reach the agent. Closing it, logging out, rebooting, or sleeping long enough to stop the process takes this local agent offline until you revive it.
+Send a message to your agent in the Canon app. Owner-originated turns use your selected Claude permission mode; non-owner turns can still get text replies but do not get local shell/filesystem/web, MCP, or Canon outbound tool access by default. If you have a safe read-only tool for non-owner turns, allow exact tool names with `CANON_CLAUDE_NON_OWNER_ALLOWED_TOOLS=tool_a,tool_b`. `canon-claude` is the local agent process. Keep that terminal open while you want Canon to reach the agent. Closing it, logging out, rebooting, or sleeping long enough to stop the process takes this local agent offline until you revive it.
 
 After a restart or closed terminal, use the shared local manager to list and revive all recorded local agents:
 
@@ -48,7 +48,7 @@ Advertise multiple project choices to the Canon app:
 canon-claude --cwd ~/dev --workspace-root ~/dev
 ```
 
-`--cwd` is the default workspace. Each `--workspace-root` value is an approved local root; the host discovers immediate child projects with common markers such as `.git`, `package.json`, `pyproject.toml`, `Cargo.toml`, or `go.mod` and publishes them as selectable projects during session creation. Use repeated `--workspace /path/to/project` entries to advertise specific projects outside those roots. Worktree mode creates a per-conversation git worktree under `~/.canon/conversation-worktrees`; shared-project mode runs directly in the selected directory.
+`--cwd` is the default workspace. Each `--workspace-root` value is an approved local root; the host discovers immediate child projects with common markers such as `.git`, `package.json`, `pyproject.toml`, `Cargo.toml`, or `go.mod` and publishes them as selectable projects during session creation. Use repeated `--workspace /path/to/project` entries to advertise specific projects outside those roots. Worktree mode creates a best-effort per-conversation git worktree under `~/.canon/conversation-worktrees`; shared-project mode runs directly in the selected directory.
 
 Current Canon truth for Claude host mode:
 
@@ -56,7 +56,8 @@ Current Canon truth for Claude host mode:
 - thinking level / effort is live-editable when the host reports it
 - workspace selection is setup-only
 - execution mode selection is setup-only
-- permission modes are rendered exactly as the Claude runtime reports them; Canon does not flatten them to a smaller hardcoded set
+- permission modes are the known Claude Code modes supported by this host; Claude Code applies and enforces the selected mode for owner-originated turns
+- non-owner turns deny local filesystem, shell, web/network, task, MCP, and Canon outbound tools by default in first-party host mode; pure text replies still work, and owners can allow exact safe tool names with `CANON_CLAUDE_NON_OWNER_ALLOWED_TOOLS`
 - if worktree creation is unavailable for the selected project, Canon may fall back to shared-project execution and surface the fallback reason in session details
 
 ## Multiple agents

package/dist/approval-server.d.ts

@@ -10,13 +10,23 @@ export declare class ApprovalHttpServer {
     private manager;
     private port;
     private getConversationId;
+    private getIsOwnerTurn;
+    private token;
+    private maxBodyBytes;
+    private requestTimeoutMs;
     constructor(manager: ApprovalManager, getConversationId: () => string | null, opts?: {
         port?: number;
+        token?: string;
+        maxBodyBytes?: number;
+        requestTimeoutMs?: number;
+        getIsOwnerTurn?: () => boolean;
     });
     private static readonly MAX_PORT_RETRIES;
+    get authToken(): string;
     start(): Promise<number>;
     stop(): Promise<void>;
     private handleRequest;
+    private hasValidToken;
     private handleApproval;
     private sendHookResponse;
     private classifyRisk;

package/dist/approval-server.js

@@ -1,4 +1,6 @@
 import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { buildClaudeApprovalDetails, classifyClaudeApprovalCategory, classifyClaudeApprovalRisk, } from './tool-policy.js';
 /**
  * HTTP server that bridges Claude Code's PermissionRequest hook
  * to Canon's ApprovalManager.
@@ -10,12 +12,23 @@ export class ApprovalHttpServer {
     manager;
     port;
     getConversationId;
+    getIsOwnerTurn;
+    token;
+    maxBodyBytes;
+    requestTimeoutMs;
     constructor(manager, getConversationId, opts) {
         this.manager = manager;
         this.getConversationId = getConversationId;
+        this.getIsOwnerTurn = opts?.getIsOwnerTurn ?? (() => true);
         this.port = opts?.port ?? 19420;
+        this.token = opts?.token ?? randomBytes(32).toString('base64url');
+        this.maxBodyBytes = opts?.maxBodyBytes ?? 64 * 1024;
+        this.requestTimeoutMs = opts?.requestTimeoutMs ?? 10_000;
     }
     static MAX_PORT_RETRIES = 10;
+    get authToken() {
+        return this.token;
+    }
     async start() {
         const startPort = this.port;
         return new Promise((resolve, reject) => {
@@ -34,6 +47,10 @@ export class ApprovalHttpServer {
                 }
             });
             this.server.listen(this.port, '127.0.0.1', () => {
+                const address = this.server?.address();
+                if (address && typeof address === 'object') {
+                    this.port = address.port;
+                }
                 console.error(`[canon] Approval server listening on 127.0.0.1:${this.port}`);
                 resolve(this.port);
             });
@@ -55,18 +72,53 @@ export class ApprovalHttpServer {
             res.end(JSON.stringify({ error: 'Not found' }));
             return;
         }
+        req.setTimeout(this.requestTimeoutMs, () => {
+            res.writeHead(408, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Request timeout' }));
+            req.destroy();
+        });
+        if (!this.hasValidToken(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unauthorized' }));
+            return;
+        }
         let body = '';
         req.on('data', (chunk) => {
+            if (res.writableEnded)
+                return;
+            if (body.length + chunk.length > this.maxBodyBytes) {
+                res.writeHead(413, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Request body too large' }));
+                req.destroy();
+                return;
+            }
             body += chunk.toString();
         });
         req.on('end', () => {
+            if (res.writableEnded)
+                return;
             this.handleApproval(body, res).catch((err) => {
                 console.error('[canon] Approval handler error:', err);
+                if (res.writableEnded)
+                    return;
                 res.writeHead(500, { 'Content-Type': 'application/json' });
                 res.end(JSON.stringify({ error: 'Internal error' }));
             });
         });
     }
+    hasValidToken(req) {
+        const authHeader = req.headers.authorization;
+        const bearer = typeof authHeader === 'string' && authHeader.toLowerCase().startsWith('bearer ')
+            ? authHeader.slice('bearer '.length).trim()
+            : null;
+        const headerToken = req.headers['x-canon-approval-token'];
+        const supplied = bearer || (typeof headerToken === 'string' ? headerToken : null);
+        if (!supplied)
+            return false;
+        const expected = Buffer.from(this.token);
+        const received = Buffer.from(supplied);
+        return expected.length === received.length && timingSafeEqual(expected, received);
+    }
     async handleApproval(body, res) {
         let payload;
         try {
@@ -81,23 +133,38 @@ export class ApprovalHttpServer {
         const toolInput = payload.tool_input ?? {};
         // Determine risk level
         const riskLevel = this.classifyRisk(toolName, toolInput);
-        // Check session rules first (may resolve immediately)
-        const existingRule = this.manager.checkSessionRules(toolName);
-        if (existingRule) {
-            const decision = existingRule.type === 'deny-tool' ? 'deny' : 'allow';
-            this.sendHookResponse(res, decision);
-            return;
-        }
-        // Find the conversation to send the approval to
+        const isOwnerTurn = this.getIsOwnerTurn();
+        // Find the conversation to send the approval to.
         const conversationId = this.getConversationId();
         if (!conversationId) {
-            console.error('[canon] No active conversation for approval — falling back to allow');
-            // Can't send approval message, fall through to terminal prompt
+            console.error('[canon] No active conversation for approval — falling back to ask');
+            // Can't send approval message, fall through to terminal prompt.
             this.sendHookResponse(res, 'ask');
             return;
         }
+        // Check session rules first for owner-triggered turns. Non-owner-triggered
+        // tools require a fresh owner decision so an old "approve all" does not
+        // turn into remote control of the owner's local runtime.
+        const existingRule = isOwnerTurn ? this.manager.checkSessionRules(toolName, conversationId) : null;
+        if (existingRule) {
+            const decision = existingRule.type === 'deny-tool' ? 'deny' : 'allow';
+            this.sendHookResponse(res, decision);
+            return;
+        }
         try {
-            const result = await this.manager.requestApproval(conversationId, toolName, toolInput, { riskLevel });
+            const result = await this.manager.requestApproval(conversationId, toolName, toolInput, {
+                riskLevel,
+                risk: classifyClaudeApprovalRisk(toolName, toolInput),
+                category: classifyClaudeApprovalCategory(toolName),
+                native: {
+                    runtime: 'claude-code',
+                    method: 'PermissionRequest',
+                    ...(payload.session_id ? { requestId: payload.session_id } : {}),
+                },
+                details: buildClaudeApprovalDetails(toolName, toolInput),
+                ignoreSessionRules: !isOwnerTurn,
+                allowSessionRule: isOwnerTurn,
+            });
             this.sendHookResponse(res, result.decision);
         }
         catch (err) {

package/dist/host.js

@@ -25,11 +25,12 @@ import { randomUUID } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { query, } from '@anthropic-ai/claude-agent-sdk';
-import { isAnthropicImageAttachment, materializeMessageMedia, toAnthropicImageBlock, } from '@canonmsg/agent-sdk';
-import { CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonHostPrompt, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPlanApprovalRequest, buildQuestionRequest, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, createConversationMetadataLoader, createRuntimeStatePublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, prepareConversationEnvironment, resolveCanonAgent, initRTDBAuth, rtdbRead, rtdbWrite, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, resolveHostWorkspaceCwd, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { isAnthropicImageAttachment, materializeMessageMedia, materializeReplyContextMedia, toAnthropicImageBlock, } from '@canonmsg/agent-sdk';
+import { CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonHostPrompt, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPlanApprovalRequest, buildQuestionRequest, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, createConversationMetadataLoader, createRuntimeStatePublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, prepareConversationEnvironment, resolveCanonAgent, initRTDBAuth, rtdbRead, rtdbWrite, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, resolveHostWorkspaceCwd, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { buildInboundContextLines, decideAutoReply, } from './inbound-policy.js';
 import { createStreamingBuffer } from './streaming-buffer.js';
 import { runCli } from './cli-entry.js';
+import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
 import { buildClaudeFinalMessageId, createClaudeInputEnvelope, formatClaudeControlError, mergeClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, } from './session-state.js';
 const HELP = `canon-claude — run a local Claude Code agent host for Canon
 
@@ -61,6 +62,7 @@ let workspaceRoots = [];
 let workspaceRootMetadata = [];
 let runtimeModels = [];
 const CLAUDE_METADATA_TTL_MS = 5 * 60 * 1000;
+const allowedNonOwnerClaudeTools = parseAllowedNonOwnerClaudeTools(process.env.CANON_CLAUDE_NON_OWNER_ALLOWED_TOOLS);
 let runtimeMetadata = {
     account: null,
     mcpServers: [],
@@ -261,6 +263,17 @@ function buildClaudeRuntimeDescriptor(input) {
         ],
     });
 }
+function parseClaudePermissionMode(value) {
+    if (value === 'acceptEdits'
+        || value === 'auto'
+        || value === 'bypassPermissions'
+        || value === 'default'
+        || value === 'dontAsk'
+        || value === 'plan') {
+        return value;
+    }
+    return null;
+}
 function normalizeClaudeEffortLevel(value) {
     return value === 'low' || value === 'medium' || value === 'high'
         ? value
@@ -319,7 +332,9 @@ async function loadSessionConfig(conversationId, agentId) {
     });
     return {
         ...config,
-        permissionMode: config?.permissionMode,
+        permissionMode: config?.permissionMode
+            ? parseClaudePermissionMode(config.permissionMode) ?? undefined
+            : undefined,
         effort: normalizeClaudeEffortLevel(config?.effort),
     };
 }
@@ -618,6 +633,21 @@ function buildClaudeSessionContextLines(session) {
 function renderInboundContent(message, materialized) {
     return renderCanonHostInboundContent(message, materialized);
 }
+async function materializePromptReplyContext(input) {
+    if (!input.replyContext?.found || !input.replyContext.attachments?.length) {
+        return { replyContext: input.replyContext, materialized: [] };
+    }
+    try {
+        return await materializeReplyContextMedia(input.replyContext, {
+            agentId: input.agentId,
+            conversationId: input.conversationId,
+        });
+    }
+    catch (error) {
+        console.error(`${input.logPrefix} Failed to materialize replied-to media:`, error instanceof Error ? error.message : error);
+        return { replyContext: input.replyContext, materialized: [] };
+    }
+}
 /**
  * Build the multimodal `content` payload handed to the Claude Code SDK.
  *
@@ -656,13 +686,14 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
             messageQueue.push(input);
         }
     };
-    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false) => {
+    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false) => {
         sendInput(createClaudeInputEnvelope({
             kind: 'canon',
             msg,
             intent,
             sourceMessageId,
             markAccepted,
+            isOwnerTurn,
         }));
     };
     const inputStream = {
@@ -717,7 +748,7 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
     const queryOptions = {
         systemPrompt: { type: 'preset', preset: 'claude_code' },
         tools: { type: 'preset', preset: 'claude_code' },
-        permissionMode: config.permissionMode,
+        permissionMode: parseClaudePermissionMode(config.permissionMode) ?? 'default',
         allowDangerouslySkipPermissions: true,
         cwd,
         includePartialMessages: true,
@@ -809,8 +840,20 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
                     return { behavior: 'deny', message: 'No reply received (timed out)' };
                 }
             }
-            // Default: allow (permission mode handles restrictions)
-            return { behavior: 'allow' };
+            return decideClaudeToolPermissionForMode({
+                permissionMode: session.state.permissionMode ?? config.permissionMode,
+                toolName,
+                toolInput: input,
+                conversationId,
+                runtimeId: config.runtimeId,
+                turnId: session.currentTurnId,
+                isOwnerTurn: session.activeInput?.kind === 'canon'
+                    ? session.activeInput.isOwnerTurn === true
+                    : true,
+                approvalManager: config.approvalManager,
+                canRequestApproval: config.canRequestApproval,
+                allowedNonOwnerTools: allowedNonOwnerClaudeTools,
+            });
         },
     };
     if (resumeSessionId) {
@@ -826,7 +869,7 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
         environment,
         query: q,
         sendInput,
-        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted),
+        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted, isOwnerTurn),
         state: {
             model: undefined,
             permissionMode: config.permissionMode,
@@ -1119,7 +1162,7 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
         void markQueuedMessageAccepted(next.sourceMessageId, next.markAccepted)
             .finally(() => sendInput(next));
     }
-    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false) => {
+    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false, isOwnerTurn = false) => {
         session.lastActivity = Date.now();
         const input = createClaudeInputEnvelope({
             kind: 'canon',
@@ -1127,6 +1170,7 @@ function createSession(conversationId, environment, agentId, client, runtimeStat
             intent,
             sourceMessageId,
             markAccepted,
+            isOwnerTurn,
         });
         if (session.pendingFinalDelivery) {
             session.pendingInputs.push(input);
@@ -1622,6 +1666,7 @@ export async function main() {
     }
     // ── Session manager ──
     const sessions = new Map();
+    const approvalManager = ownerId ? new ApprovalManager(client, agentId, ownerId) : null;
     const pendingSessionCreations = new Map();
     let controlStopped = false;
     const lastSeenControl = new Map();
@@ -1647,6 +1692,13 @@ export async function main() {
         }
         lastKnownConversationRefreshAt = Date.now();
     }
+    async function canRequestCanonApproval(conversationId) {
+        if (!ownerId)
+            return false;
+        const conversation = await getConversationMeta(conversationId)
+            .catch(() => conversationCache.get(conversationId) ?? null);
+        return Array.isArray(conversation?.memberIds) && conversation.memberIds.includes(ownerId);
+    }
     function handleConversationUpdated(payload) {
         const rawMemberIds = payload.changes.memberIds;
         if (!Array.isArray(rawMemberIds))
@@ -1695,10 +1747,12 @@ export async function main() {
         ]);
         return buildHydratedInboundContext({
             agentId,
+            conversationId: input.conversationId,
             conversation,
             page,
             activeSelfContextId: input.activeSelfContextId,
             selfContexts: input.selfContexts,
+            provenance: input.provenance,
             message: input.message,
             senderName: input.senderName,
             isOwner: input.isOwner,
@@ -1873,6 +1927,9 @@ export async function main() {
                     effort: config?.effort,
                     availableModels: runtimeModels,
                     availableExecutionModes: hostAvailableExecutionModes,
+                    approvalManager,
+                    canRequestApproval: () => canRequestCanonApproval(conversationId),
+                    runtimeId,
                 }, resumeId);
                 sessions.set(conversationId, session);
                 await Promise.all([
@@ -1945,6 +2002,13 @@ export async function main() {
         const behavior = input.hydratedPage?.behavior ?? hydrated.behavior;
         const activeSelfContextId = hydrated.activeSelfContextId;
         const selfContexts = hydrated.selfContexts;
+        const replyMedia = await materializePromptReplyContext({
+            replyContext: hydrated.replyContext,
+            agentId,
+            conversationId: input.conversationId,
+            logPrefix: `[canon-host] [${input.conversationId.slice(0, 8)}]`,
+        });
+        const replyContext = replyMedia.replyContext;
         const participantContext = hydrated.participantContext;
         const autoReply = decideAutoReply(participantContext, behavior);
         if (!autoReply.allow) {
@@ -1980,9 +2044,13 @@ export async function main() {
             participantContext,
             behavior,
             selfContexts,
+            replyContext,
             session,
         });
-        const messageContent = await buildCanonUserContent({ promptText, materialized });
+        const messageContent = await buildCanonUserContent({
+            promptText,
+            materialized: [...replyMedia.materialized, ...materialized],
+        });
         session.enqueueInbound({
             type: 'user',
             message: {
@@ -1990,7 +2058,7 @@ export async function main() {
                 content: messageContent,
             },
             parent_tool_use_id: null,
-        }, deliveryIntent, m.id ?? null, shouldMarkAccepted);
+        }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner);
         if (m.id) {
             saveRuntimeSessionState(runtimeId, {
                 conversationId: input.conversationId,
@@ -2039,6 +2107,21 @@ export async function main() {
                     return;
                 const convoId = payload.conversationId;
                 knownConversationIds.add(convoId);
+                if (m.metadata?.type === 'approval_reply' || (approvalManager?.pendingCount ?? 0) > 0) {
+                    const consumed = approvalManager?.handleMessage(convoId, {
+                        senderId: m.senderId,
+                        text: m.text ?? undefined,
+                        metadata: m.metadata,
+                    }) ?? false;
+                    if (m.metadata?.type === 'approval_reply') {
+                        console.error(`[canon-host] [${convoId.slice(0, 8)}] ${consumed ? 'Approval reply consumed' : 'Ignoring stale approval reply'} from ${m.senderName || m.senderId}`);
+                        return;
+                    }
+                    if (consumed) {
+                        console.error(`[canon-host] [${convoId.slice(0, 8)}] Approval text reply consumed from ${m.senderName || m.senderId}`);
+                        return;
+                    }
+                }
                 // Check for metadata replies (question answers, plan approvals)
                 if (m.metadata?.type === 'question_reply' || m.metadata?.type === 'plan_approval_reply') {
                     const existingSession = sessions.get(convoId);
@@ -2091,10 +2174,18 @@ export async function main() {
                         isOwner,
                         activeSelfContextId: payload.activeSelfContextId,
                         selfContexts: payload.selfContexts,
+                        provenance: payload.provenance,
                     });
                     const behavior = payload.behavior ?? hydrated.behavior;
                     const activeSelfContextId = hydrated.activeSelfContextId;
                     const selfContexts = hydrated.selfContexts;
+                    const replyMedia = await materializePromptReplyContext({
+                        replyContext: hydrated.replyContext,
+                        agentId,
+                        conversationId: convoId,
+                        logPrefix: `[canon-host] [${convoId.slice(0, 8)}]`,
+                    });
+                    const replyContext = replyMedia.replyContext;
                     const participantContext = hydrated.participantContext;
                     const autoReply = decideAutoReply(participantContext, behavior);
                     if (!autoReply.allow) {
@@ -2131,9 +2222,13 @@ export async function main() {
                         participantContext,
                         behavior,
                         selfContexts,
+                        replyContext,
                         session,
                     });
-                    const messageContent = await buildCanonUserContent({ promptText, materialized });
+                    const messageContent = await buildCanonUserContent({
+                        promptText,
+                        materialized: [...replyMedia.materialized, ...materialized],
+                    });
                     session.enqueueInbound({
                         type: 'user',
                         message: {
@@ -2141,7 +2236,7 @@ export async function main() {
                             content: messageContent,
                         },
                         parent_tool_use_id: null,
-                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted);
+                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner);
                     if (m.id) {
                         saveRuntimeSessionState(runtimeId, {
                             conversationId: convoId,
@@ -2197,15 +2292,20 @@ export async function main() {
                                         console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to set model:`, err);
                                     }
                                 }
-                                if (ctrl.permissionMode && ctrl.permissionMode !== session.state.permissionMode) {
+                                const nextPermissionMode = parseClaudePermissionMode(ctrl.permissionMode);
+                                if (ctrl.permissionMode && !nextPermissionMode) {
+                                    session.setRuntimeControlError('permissionMode', ctrl.permissionMode, new Error(`Unsupported Claude permission mode: ${ctrl.permissionMode}`));
+                                    console.error(`[canon-host] [${convoId.slice(0, 8)}] Unsupported mode: ${ctrl.permissionMode}`);
+                                }
+                                else if (nextPermissionMode && nextPermissionMode !== session.state.permissionMode) {
                                     try {
-                                        await session.query.setPermissionMode(ctrl.permissionMode);
-                                        session.state.permissionMode = ctrl.permissionMode;
+                                        await session.query.setPermissionMode(nextPermissionMode);
+                                        session.state.permissionMode = nextPermissionMode;
                                         session.clearRuntimeControlError('permissionMode');
-                                        console.error(`[canon-host] [${convoId.slice(0, 8)}] Mode → ${ctrl.permissionMode}`);
+                                        console.error(`[canon-host] [${convoId.slice(0, 8)}] Mode → ${nextPermissionMode}`);
                                     }
                                     catch (err) {
-                                        session.setRuntimeControlError('permissionMode', ctrl.permissionMode, err);
+                                        session.setRuntimeControlError('permissionMode', nextPermissionMode, err);
                                         console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to set mode:`, err);
                                     }
                                 }
@@ -2327,6 +2427,7 @@ export async function main() {
         clearInterval(heartbeat);
         clearInterval(idleCheck);
         stream.stop();
+        approvalManager?.dispose();
         await runtimeState.clearAgentRuntime().catch(() => { });
         for (const convoId of [...sessions.keys()]) {
             closeSession(convoId);

package/dist/mcp-args.d.ts

@@ -0,0 +1,43 @@
+import type { SendContextualMessageOptions } from '@canonmsg/core';
+export type McpParseResult<T> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: string;
+};
+type ContentType = 'text' | 'image' | 'audio' | 'file';
+export interface ReplyArgs {
+    conversationId: string;
+    text: string;
+}
+export declare function parseReplyArgs(value: unknown): McpParseResult<ReplyArgs>;
+export interface SendMessageArgs {
+    conversationId: string;
+    text: string;
+    contentType: ContentType;
+    imageUrl?: string;
+    audioUrl?: string;
+    fileUrl?: string;
+    mediaPath?: string;
+    fileName?: string;
+    mimeType?: string;
+    durationMs?: number;
+}
+export declare function parseSendMessageArgs(value: unknown): McpParseResult<SendMessageArgs>;
+export interface SendContextualMessageArgs {
+    sourceConversationId: string;
+    targetConversationId?: string;
+    targetUserId?: string;
+    text: string;
+    selfContext: SendContextualMessageOptions['selfContext'];
+    messageOptions?: SendContextualMessageOptions['messageOptions'];
+}
+export declare function parseSendContextualMessageArgs(value: unknown): McpParseResult<SendContextualMessageArgs>;
+export interface SetTypingArgs {
+    conversationId: string;
+    typing: boolean;
+    status?: 'typing' | 'thinking';
+}
+export declare function parseSetTypingArgs(value: unknown): McpParseResult<SetTypingArgs>;
+export {};

package/dist/mcp-args.js

@@ -0,0 +1,151 @@
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function requiredString(record, key, maxLength = 4096) {
+    const value = record[key];
+    if (typeof value !== 'string') {
+        return { ok: false, error: `Missing ${key}` };
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return { ok: false, error: `Missing ${key}` };
+    }
+    if (trimmed.length > maxLength) {
+        return { ok: false, error: `${key} is too long` };
+    }
+    return { ok: true, value: trimmed };
+}
+function optionalString(record, key, maxLength = 4096) {
+    const value = record[key];
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed && trimmed.length <= maxLength ? trimmed : undefined;
+}
+function optionalNumber(record, key) {
+    const value = record[key];
+    return typeof value === 'number' && Number.isFinite(value) && value >= 0
+        ? value
+        : undefined;
+}
+function parseContentType(value) {
+    if (value == null)
+        return { ok: true, value: 'text' };
+    if (value === 'text' || value === 'image' || value === 'audio' || value === 'file') {
+        return { ok: true, value };
+    }
+    return { ok: false, error: 'Invalid content_type' };
+}
+export function parseReplyArgs(value) {
+    if (!isRecord(value))
+        return { ok: false, error: 'Arguments must be an object' };
+    const conversationId = requiredString(value, 'conversation_id', 256);
+    if (!conversationId.ok)
+        return conversationId;
+    const text = requiredString(value, 'text');
+    if (!text.ok)
+        return text;
+    return {
+        ok: true,
+        value: {
+            conversationId: conversationId.value,
+            text: text.value,
+        },
+    };
+}
+export function parseSendMessageArgs(value) {
+    if (!isRecord(value))
+        return { ok: false, error: 'Arguments must be an object' };
+    const conversationId = requiredString(value, 'conversation_id', 256);
+    if (!conversationId.ok)
+        return conversationId;
+    const contentType = parseContentType(value.content_type);
+    if (!contentType.ok)
+        return contentType;
+    const imageUrl = optionalString(value, 'image_url', 4096);
+    const audioUrl = optionalString(value, 'audio_url', 4096);
+    const fileUrl = optionalString(value, 'file_url', 4096);
+    const mediaPath = optionalString(value, 'media_path', 4096);
+    const fileName = optionalString(value, 'file_name', 512);
+    const mimeType = optionalString(value, 'mime_type', 256);
+    const durationMs = optionalNumber(value, 'duration_ms');
+    return {
+        ok: true,
+        value: {
+            conversationId: conversationId.value,
+            text: optionalString(value, 'text') ?? '',
+            contentType: contentType.value,
+            ...(imageUrl ? { imageUrl } : {}),
+            ...(audioUrl ? { audioUrl } : {}),
+            ...(fileUrl ? { fileUrl } : {}),
+            ...(mediaPath ? { mediaPath } : {}),
+            ...(fileName ? { fileName } : {}),
+            ...(mimeType ? { mimeType } : {}),
+            ...(durationMs != null ? { durationMs } : {}),
+        },
+    };
+}
+export function parseSendContextualMessageArgs(value) {
+    if (!isRecord(value))
+        return { ok: false, error: 'Arguments must be an object' };
+    const sourceConversationId = requiredString(value, 'source_conversation_id', 256);
+    if (!sourceConversationId.ok)
+        return sourceConversationId;
+    const text = requiredString(value, 'text');
+    if (!text.ok)
+        return text;
+    const targetConversationId = optionalString(value, 'target_conversation_id', 256);
+    const targetUserId = optionalString(value, 'target_user_id', 256);
+    if (Boolean(targetConversationId) === Boolean(targetUserId)) {
+        return { ok: false, error: 'Provide exactly one target_conversation_id or target_user_id' };
+    }
+    if (!isRecord(value.self_context)) {
+        return { ok: false, error: 'Missing self_context' };
+    }
+    const type = value.self_context.type;
+    const context = requiredString(value.self_context, 'context');
+    if (!context.ok)
+        return context;
+    if (type !== 'cross_session') {
+        return { ok: false, error: 'self_context.type must be cross_session' };
+    }
+    const messageOptions = isRecord(value.message_options)
+        ? value.message_options
+        : undefined;
+    return {
+        ok: true,
+        value: {
+            sourceConversationId: sourceConversationId.value,
+            ...(targetConversationId ? { targetConversationId } : {}),
+            ...(targetUserId ? { targetUserId } : {}),
+            text: text.value,
+            selfContext: {
+                type: 'cross_session',
+                context: context.value,
+            },
+            ...(messageOptions ? { messageOptions } : {}),
+        },
+    };
+}
+export function parseSetTypingArgs(value) {
+    if (!isRecord(value))
+        return { ok: false, error: 'Arguments must be an object' };
+    const conversationId = requiredString(value, 'conversation_id', 256);
+    if (!conversationId.ok)
+        return conversationId;
+    if (typeof value.typing !== 'boolean') {
+        return { ok: false, error: 'typing must be a boolean' };
+    }
+    const status = value.status;
+    if (status !== undefined && status !== 'typing' && status !== 'thinking') {
+        return { ok: false, error: 'Invalid status' };
+    }
+    return {
+        ok: true,
+        value: {
+            conversationId: conversationId.value,
+            typing: value.typing,
+            ...(status ? { status } : {}),
+        },
+    };
+}

package/dist/server.js

@@ -14,6 +14,7 @@ import { CanonClient, CanonStream, ApprovalManager, buildLocalRuntimeId, getActi
 import { materializeMessageMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { ApprovalHttpServer } from './approval-server.js';
 import { runCli } from './cli-entry.js';
+import { parseReplyArgs, parseSendContextualMessageArgs, parseSendMessageArgs, parseSetTypingArgs, } from './mcp-args.js';
 const HELP = `canon-channel-server — Claude Code MCP channel server for Canon
 
 USAGE
@@ -42,8 +43,10 @@ const TURN_COMPLETE_METADATA = {
     turnSemantics: 'turn_complete',
     turnComplete: true,
 };
-/** The conversation that most recently triggered work (for approval routing) */
-let triggerConversationId = null;
+/** Last owner-visible conversation to route approval cards into. */
+let approvalConversationId = null;
+/** Whether the message that most recently triggered work came from the owner. */
+let triggerIsOwner = true;
 function getPrimaryAttachment(message) {
     const attachment = message.attachments?.[0];
     if (attachment?.url)
@@ -53,6 +56,12 @@ function getPrimaryAttachment(message) {
 function renderInboundContent(message, materialized) {
     return renderCanonHostInboundContent(message, materialized);
 }
+function toolArgumentError(error) {
+    return {
+        content: [{ type: 'text', text: `Invalid arguments: ${error}` }],
+        isError: true,
+    };
+}
 // ── Tool definitions ───────────────────────────────────────────────────
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: [
@@ -216,8 +225,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
     const args = request.params.arguments;
     switch (request.params.name) {
         case 'reply': {
-            const conversationId = args.conversation_id;
-            const text = args.text;
+            const parsed = parseReplyArgs(args);
+            if (!parsed.ok)
+                return toolArgumentError(parsed.error);
+            const { conversationId, text } = parsed.value;
             const result = await client.sendMessage(conversationId, text, {
                 metadata: TURN_COMPLETE_METADATA,
             });
@@ -231,17 +242,11 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             };
         }
         case 'send_message': {
-            const conversationId = args.conversation_id;
-            const text = typeof args.text === 'string' ? args.text : '';
-            const contentType = args.content_type || 'text';
+            const parsed = parseSendMessageArgs(args);
+            if (!parsed.ok)
+                return toolArgumentError(parsed.error);
+            const { conversationId, text, contentType, imageUrl, audioUrl, fileUrl, mediaPath, fileName, mimeType, durationMs, } = parsed.value;
             const opts = {};
-            const imageUrl = typeof args.image_url === 'string' ? args.image_url : null;
-            const audioUrl = typeof args.audio_url === 'string' ? args.audio_url : null;
-            const fileUrl = typeof args.file_url === 'string' ? args.file_url : null;
-            const mediaPath = typeof args.media_path === 'string' ? args.media_path : null;
-            const fileName = typeof args.file_name === 'string' ? args.file_name : null;
-            const mimeType = typeof args.mime_type === 'string' ? args.mime_type : null;
-            const durationMs = typeof args.duration_ms === 'number' ? args.duration_ms : null;
             const metadata = TURN_COMPLETE_METADATA;
             if (mediaPath) {
                 const result = await sendMediaFileMessage(client, conversationId, mediaPath, text, {
@@ -301,25 +306,17 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             };
         }
         case 'send_contextual_message': {
-            const sourceConversationId = args.source_conversation_id;
-            const targetConversationId = typeof args.target_conversation_id === 'string'
-                ? args.target_conversation_id
-                : undefined;
-            const targetUserId = typeof args.target_user_id === 'string' ? args.target_user_id : undefined;
-            const text = args.text;
-            const selfContext = typeof args.self_context === 'object' && args.self_context != null
-                ? args.self_context
-                : undefined;
-            const messageOptions = typeof args.message_options === 'object' && args.message_options != null
-                ? args.message_options
-                : undefined;
+            const parsed = parseSendContextualMessageArgs(args);
+            if (!parsed.ok)
+                return toolArgumentError(parsed.error);
+            const { sourceConversationId, targetConversationId, targetUserId, text, selfContext, messageOptions, } = parsed.value;
             const contextualMessageOptions = messageOptions;
             const result = await client.sendContextualMessage({
                 sourceConversationId,
                 ...(targetConversationId ? { targetConversationId } : {}),
                 ...(targetUserId ? { targetUserId } : {}),
                 text,
-                selfContext: selfContext,
+                selfContext,
                 ...(contextualMessageOptions
                     ? {
                         messageOptions: {
@@ -344,7 +341,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             };
         }
         case 'list_conversations': {
-            const limit = args.limit || 20;
+            const rawArgs = args && typeof args === 'object' ? args : {};
+            const limit = typeof rawArgs.limit === 'number' && Number.isFinite(rawArgs.limit)
+                ? Math.max(1, Math.min(100, Math.floor(rawArgs.limit)))
+                : 20;
             const convos = await client.getConversations();
             const slice = convos.slice(0, limit);
             const summary = slice.map((c) => ({
@@ -381,9 +381,10 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
             };
         }
         case 'set_typing': {
-            const conversationId = args.conversation_id;
-            const typing = args.typing;
-            const status = args.status;
+            const parsed = parseSetTypingArgs(args);
+            if (!parsed.ok)
+                return toolArgumentError(parsed.error);
+            const { conversationId, typing, status } = parsed.value;
             await client.setTyping(conversationId, typing, status);
             return {
                 content: [
@@ -407,9 +408,12 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
 async function handleInboundMessage(payload) {
     const m = payload.message;
     const convo = conversationCache.get(payload.conversationId);
-    // Track trigger conversation — updated when the owner sends a message
-    if (m.isOwner) {
-        triggerConversationId = payload.conversationId;
+    // Track turn provenance separately from the owner-visible approval route.
+    // Non-owner direct chats do not include the owner, so approval cards still go
+    // to the last owner conversation while the hook bypasses cached session rules.
+    triggerIsOwner = m.isOwner === true;
+    if (triggerIsOwner) {
+        approvalConversationId = payload.conversationId;
     }
     // Route to approval manager first — if consumed, don't forward to Claude
     if (approvalManager) {
@@ -476,6 +480,9 @@ async function handleInboundMessage(payload) {
         }
     }
     const primaryAttachment = getPrimaryAttachment(m);
+    if (m.attachments?.length) {
+        meta.attachments_json = JSON.stringify(m.attachments);
+    }
     if (primaryAttachment?.url) {
         meta.attachment_kind = primaryAttachment.kind;
         meta.attachment_url = primaryAttachment.url;
@@ -489,6 +496,11 @@ async function handleInboundMessage(payload) {
     const primaryMaterialized = materialized.find((attachment) => attachment.index === 0);
     if (primaryMaterialized?.path)
         meta.attachment_path = primaryMaterialized.path;
+    if (materialized.length > 0) {
+        meta.attachment_paths = materialized
+            .map((attachment) => attachment.path)
+            .join('\n');
+    }
     const renderedContent = renderInboundContent(m, materialized);
     console.error(`[canon] Inbound message from ${meta.sender_name}: "${renderedContent}"`);
     try {
@@ -612,11 +624,18 @@ async function startChannel() {
     // Start approval system
     if (agentContext?.ownerId) {
         approvalManager = new ApprovalManager(client, agentId, agentContext.ownerId);
-        approvalServer = new ApprovalHttpServer(approvalManager, () => triggerConversationId);
+        approvalServer = new ApprovalHttpServer(approvalManager, () => approvalConversationId, {
+            token: process.env.CANON_CLAUDE_APPROVAL_TOKEN,
+            getIsOwnerTurn: () => triggerIsOwner,
+        });
         approvalServer.start().catch((err) => {
             const msg = err instanceof Error ? err.message : String(err);
             console.error(`[canon] Approval server error: ${msg}`);
         });
+        console.error('[canon] Approval hooks must send Authorization: Bearer <token> or x-canon-approval-token.');
+        if (!process.env.CANON_CLAUDE_APPROVAL_TOKEN) {
+            console.error(`[canon] Generated local approval token: ${approvalServer.authToken}`);
+        }
     }
 }
 // ── Main ───────────────────────────────────────────────────────────────

package/dist/session-state.d.ts

@@ -8,6 +8,7 @@ export interface ClaudeInputEnvelope {
     sourceMessageId: string | null;
     markAccepted: boolean;
     turnKey: string;
+    isOwnerTurn: boolean;
 }
 export interface ClaudeRuntimeControlError {
     value: string;
@@ -38,6 +39,7 @@ export declare function createClaudeInputEnvelope(input: {
     intent?: DeliveryIntent;
     sourceMessageId?: string | null;
     markAccepted?: boolean;
+    isOwnerTurn?: boolean;
 }): ClaudeInputEnvelope;
 export declare function buildClaudeFinalMessageId(input: {
     agentId: string;

package/dist/session-state.js

@@ -8,6 +8,9 @@ export function createClaudeInputEnvelope(input) {
         intent: input.intent ?? 'queue',
         sourceMessageId,
         markAccepted: Boolean(input.markAccepted),
+        isOwnerTurn: input.kind === 'canon'
+            ? input.isOwnerTurn === true
+            : input.isOwnerTurn !== false,
         turnKey: input.kind === 'canon' && sourceMessageId
             ? `canon:${sourceMessageId}`
             : `${input.kind}:${fallbackId}`,

package/dist/tool-policy.d.ts

@@ -0,0 +1,30 @@
+import type { ApprovalManager, ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRisk } from '@canonmsg/core';
+export type ClaudeToolPolicyDecision = {
+    behavior: 'allow';
+} | {
+    behavior: 'deny';
+    message: string;
+};
+export declare const CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE = "default";
+export declare function parseAllowedNonOwnerClaudeTools(value: string | null | undefined): string[];
+export declare function isSensitiveNonOwnerClaudeTool(toolName: string, allowedNonOwnerTools?: Iterable<string>): boolean;
+export declare function decideClaudeToolPermission(input: {
+    toolName: string;
+    isOwnerTurn: boolean;
+    allowedNonOwnerTools?: Iterable<string>;
+}): ClaudeToolPolicyDecision;
+export declare function classifyClaudeApprovalCategory(toolName: string): ApprovalRequestCategory;
+export declare function classifyClaudeApprovalRisk(toolName: string, toolInput: Record<string, unknown>): ApprovalRisk;
+export declare function buildClaudeApprovalDetails(toolName: string, toolInput: Record<string, unknown>): ApprovalRequestDetail[];
+export declare function decideClaudeToolPermissionForMode(input: {
+    permissionMode: string;
+    toolName: string;
+    toolInput: Record<string, unknown>;
+    conversationId: string;
+    runtimeId?: string;
+    turnId?: string | null;
+    isOwnerTurn: boolean;
+    approvalManager?: ApprovalManager | null;
+    canRequestApproval?: () => Promise<boolean>;
+    allowedNonOwnerTools?: Iterable<string>;
+}): Promise<ClaudeToolPolicyDecision>;

package/dist/tool-policy.js

@@ -0,0 +1,208 @@
+const NON_OWNER_DENY_MESSAGE = 'Only the agent owner can authorize Claude Code to use runtime tools from Canon chat.';
+const NATIVE_APPROVAL_UNAVAILABLE_MESSAGE = 'Runtime action approval is not available for this conversation.';
+const NATIVE_APPROVAL_DENIED_MESSAGE = 'The agent owner denied this action in Canon.';
+export const CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE = 'default';
+const SENSITIVE_CLAUDE_TOOLS = new Set([
+    'agent',
+    'bash',
+    'bashoutput',
+    'config',
+    'edit',
+    'enterworktree',
+    'exitworktree',
+    'glob',
+    'grep',
+    'killbash',
+    'listmcpresources',
+    'ls',
+    'multiedit',
+    'notebookedit',
+    'notebookread',
+    'powershell',
+    'read',
+    'readmcpresource',
+    'task',
+    'taskoutput',
+    'taskstop',
+    'todowrite',
+    'webfetch',
+    'websearch',
+    'write',
+]);
+function normalizeToolName(toolName) {
+    return toolName.trim().toLowerCase();
+}
+function isCanonOutboundTool(normalizedToolName) {
+    return normalizedToolName.endsWith('__reply')
+        || normalizedToolName.endsWith('__send_message')
+        || normalizedToolName.endsWith('__send_contextual_message')
+        || normalizedToolName === 'reply'
+        || normalizedToolName === 'send_message'
+        || normalizedToolName === 'send_contextual_message';
+}
+function isMcpTool(normalizedToolName) {
+    return normalizedToolName.startsWith('mcp__');
+}
+function normalizeAllowedToolNames(values) {
+    const normalized = new Set();
+    for (const value of values ?? []) {
+        const toolName = normalizeToolName(value);
+        if (toolName)
+            normalized.add(toolName);
+    }
+    return normalized;
+}
+export function parseAllowedNonOwnerClaudeTools(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+}
+export function isSensitiveNonOwnerClaudeTool(toolName, allowedNonOwnerTools) {
+    const normalized = normalizeToolName(toolName);
+    if (normalizeAllowedToolNames(allowedNonOwnerTools).has(normalized))
+        return false;
+    if (SENSITIVE_CLAUDE_TOOLS.has(normalized))
+        return true;
+    if (isMcpTool(normalized))
+        return true;
+    return isCanonOutboundTool(normalized);
+}
+export function decideClaudeToolPermission(input) {
+    if (input.isOwnerTurn)
+        return { behavior: 'allow' };
+    if (!isSensitiveNonOwnerClaudeTool(input.toolName, input.allowedNonOwnerTools)) {
+        return { behavior: 'allow' };
+    }
+    return {
+        behavior: 'deny',
+        message: NON_OWNER_DENY_MESSAGE,
+    };
+}
+export function classifyClaudeApprovalCategory(toolName) {
+    const normalized = normalizeToolName(toolName);
+    if (normalized === 'bash' || normalized === 'bashoutput' || normalized === 'powershell' || normalized === 'killbash') {
+        return 'command';
+    }
+    if (normalized === 'edit'
+        || normalized === 'multiedit'
+        || normalized === 'write'
+        || normalized === 'notebookedit'
+        || normalized === 'read'
+        || normalized === 'notebookread'
+        || normalized === 'ls'
+        || normalized === 'glob'
+        || normalized === 'grep') {
+        return 'file';
+    }
+    if (normalized === 'webfetch' || normalized === 'websearch') {
+        return 'network';
+    }
+    if (isMcpTool(normalized) || normalized === 'listmcpresources' || normalized === 'readmcpresource') {
+        return 'mcp';
+    }
+    if (isCanonOutboundTool(normalized)) {
+        return 'canon';
+    }
+    return 'tool';
+}
+export function classifyClaudeApprovalRisk(toolName, toolInput) {
+    const normalized = normalizeToolName(toolName);
+    if (normalized === 'bash' || normalized === 'powershell') {
+        const command = typeof toolInput.command === 'string' ? toolInput.command : '';
+        const destructivePatterns = [
+            /\brm\s+(-rf?|--force)/,
+            /\bgit\s+push\s+--force/,
+            /\bgit\s+reset\s+--hard/,
+            /\bdrop\s+(table|database)/i,
+            /\bformat\b/i,
+        ];
+        if (destructivePatterns.some((pattern) => pattern.test(command))) {
+            return 'destructive';
+        }
+        return 'high';
+    }
+    if (normalized === 'write' || normalized === 'edit' || normalized === 'multiedit' || normalized === 'notebookedit') {
+        return 'high';
+    }
+    if (normalized === 'webfetch' || normalized === 'websearch' || isMcpTool(normalized)) {
+        return 'high';
+    }
+    return 'normal';
+}
+export function buildClaudeApprovalDetails(toolName, toolInput) {
+    const details = [];
+    const normalized = normalizeToolName(toolName);
+    const command = typeof toolInput.command === 'string' ? toolInput.command : null;
+    const filePath = typeof toolInput.file_path === 'string'
+        ? toolInput.file_path
+        : typeof toolInput.path === 'string'
+            ? toolInput.path
+            : null;
+    if (command) {
+        details.push({ label: 'Command', value: command, monospace: true });
+    }
+    if (filePath) {
+        details.push({ label: 'Path', value: filePath, monospace: true });
+    }
+    if (normalized.startsWith('mcp__')) {
+        details.push({ label: 'MCP tool', value: toolName, monospace: true });
+    }
+    const json = JSON.stringify(toolInput);
+    if (json && json !== '{}' && details.length === 0) {
+        details.push({
+            label: 'Input',
+            value: json.length > 500 ? `${json.slice(0, 497)}...` : json,
+            monospace: true,
+        });
+    }
+    return details;
+}
+export async function decideClaudeToolPermissionForMode(input) {
+    if (input.permissionMode !== CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE) {
+        return decideClaudeToolPermission({
+            toolName: input.toolName,
+            isOwnerTurn: input.isOwnerTurn,
+            allowedNonOwnerTools: input.allowedNonOwnerTools,
+        });
+    }
+    if (!input.approvalManager || !(await input.canRequestApproval?.())) {
+        return {
+            behavior: 'deny',
+            message: NATIVE_APPROVAL_UNAVAILABLE_MESSAGE,
+        };
+    }
+    let result;
+    try {
+        const risk = classifyClaudeApprovalRisk(input.toolName, input.toolInput);
+        result = await input.approvalManager.requestApproval(input.conversationId, input.toolName, input.toolInput, {
+            category: classifyClaudeApprovalCategory(input.toolName),
+            risk,
+            riskLevel: risk === 'destructive' ? 'destructive' : 'normal',
+            runtimeId: input.runtimeId,
+            turnId: input.turnId ?? undefined,
+            native: {
+                runtime: 'claude-code',
+                method: 'canUseTool',
+            },
+            details: buildClaudeApprovalDetails(input.toolName, input.toolInput),
+            ignoreSessionRules: !input.isOwnerTurn,
+            allowSessionRule: input.isOwnerTurn,
+        });
+    }
+    catch {
+        return {
+            behavior: 'deny',
+            message: NATIVE_APPROVAL_UNAVAILABLE_MESSAGE,
+        };
+    }
+    if (result.decision === 'allow') {
+        return { behavior: 'allow' };
+    }
+    return {
+        behavior: 'deny',
+        message: NATIVE_APPROVAL_DENIED_MESSAGE,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",
@@ -31,8 +31,8 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.101",
-    "@canonmsg/agent-sdk": "^1.4.0",
-    "@canonmsg/core": "^0.18.0",
+    "@canonmsg/agent-sdk": "^1.5.0",
+    "@canonmsg/core": "^0.19.0",
     "@modelcontextprotocol/sdk": "^1.12.0"
   },
   "engines": {