@canonmsg/claude-code-plugin 0.22.0 → 0.23.0

package/.claude-plugin/plugin.json

@@ -0,0 +1,25 @@
+{
+  "name": "Canon",
+  "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
+  "version": "0.1.0",
+  "channels": [
+    {
+      "server": "canon-channel",
+      "userConfig": {
+        "api_key": {
+          "description": "Canon agent API key (agk_live_...)",
+          "sensitive": true
+        }
+      }
+    }
+  ],
+  "mcpServers": {
+    "canon-channel": {
+      "command": "node",
+      "args": ["${CLAUDE_PLUGIN_ROOT}/dist/server.js"],
+      "env": {
+        "CANON_PLUGIN_API_KEY": "${user_config.api_key}"
+      }
+    }
+  }
+}

package/README.md

@@ -1,4 +1,4 @@
-# Canon Host for Claude Code
+# Canon Plugin for Claude Code
 
 Connect Claude Code to [Canon](https://github.com/HeyBobChan/canon) — a messaging app where AI agents are first-class citizens. Control Claude Code from your phone.
 
@@ -67,10 +67,26 @@ canon-register --name "Frontend" --description "React work" --phone "+1..." --pr
 CANON_AGENT=frontend canon-claude --cwd ~/projects/frontend
 ```
 
+## Channel mode (alternative)
+
+For a lighter integration without session controls, run Canon as a channel plugin inside your own Claude Code session. The `canon-channel-server` binary (installed by this package) is an MCP stdio server that Claude Code launches.
+
+Register the channel server with Claude Code's MCP config and provide your Canon API key via the `CANON_API_KEY` environment variable:
+
+```bash
+# Register once per Claude Code project
+claude mcp add canon-channel canon-channel-server
+
+# Then start Claude Code with your Canon key in the environment
+CANON_API_KEY=agk_live_... claude
+```
+
+Channel mode forwards messages between Canon conversations and the embedded Claude Code session without managing session lifecycle. It is shown as non-revivable by `canon-necromance`. Use `canon-claude` host mode when you want phone-controlled runtime sessions with setup and live controls.
+
 ## Development
 
 ```bash
-cd adapters/claude-code-plugin
+cd packages/claude-code-plugin
 npm install
 npm run build
 ```

package/dist/approval-diff.d.ts

@@ -1,4 +1,4 @@
-import { type CanonUnifiedDiff } from '@canonmsg/core/contract';
+import { type CanonUnifiedDiff } from '@canonmsg/core';
 /** Read a file's text, or null when the file does not exist. */
 export type ApprovalDiffReadFile = (filePath: string) => Promise<string | null>;
 export interface SynthesizeApprovalDiffOptions {

package/dist/approval-diff.js

@@ -1,5 +1,5 @@
 import { isAbsolute, join, relative } from 'node:path';
-import { sanitizeUnifiedDiffForSharing, truncateUnifiedDiff, } from '@canonmsg/core/contract';
+import { sanitizeUnifiedDiffForSharing, truncateUnifiedDiff, } from '@canonmsg/core';
 /** Unified-hunk context lines on either side of a change (git default). */
 const HUNK_CONTEXT_LINES = 3;
 /**

package/dist/approval-server.d.ts

@@ -0,0 +1,33 @@
+import type { ApprovalManager } from '@canonmsg/core';
+/**
+ * HTTP server that bridges Claude Code's PermissionRequest hook
+ * to Canon's ApprovalManager.
+ *
+ * Listens on localhost for POST /approve from Claude Code hooks.
+ */
+export declare class ApprovalHttpServer {
+    private server;
+    private manager;
+    private port;
+    private getConversationId;
+    private getIsOwnerTurn;
+    private token;
+    private maxBodyBytes;
+    private requestTimeoutMs;
+    constructor(manager: ApprovalManager, getConversationId: () => string | null, opts?: {
+        port?: number;
+        token?: string;
+        maxBodyBytes?: number;
+        requestTimeoutMs?: number;
+        getIsOwnerTurn?: () => boolean;
+    });
+    private static readonly MAX_PORT_RETRIES;
+    get authToken(): string;
+    start(): Promise<number>;
+    stop(): Promise<void>;
+    private handleRequest;
+    private hasValidToken;
+    private handleApproval;
+    private sendHookResponse;
+    private classifyRisk;
+}

package/dist/approval-server.js

@@ -0,0 +1,200 @@
+import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { buildClaudeApprovalDetails, classifyClaudeApprovalCategory, classifyClaudeApprovalRisk, } from './tool-policy.js';
+/**
+ * HTTP server that bridges Claude Code's PermissionRequest hook
+ * to Canon's ApprovalManager.
+ *
+ * Listens on localhost for POST /approve from Claude Code hooks.
+ */
+export class ApprovalHttpServer {
+    server = null;
+    manager;
+    port;
+    getConversationId;
+    getIsOwnerTurn;
+    token;
+    maxBodyBytes;
+    requestTimeoutMs;
+    constructor(manager, getConversationId, opts) {
+        this.manager = manager;
+        this.getConversationId = getConversationId;
+        this.getIsOwnerTurn = opts?.getIsOwnerTurn ?? (() => true);
+        this.port = opts?.port ?? 19420;
+        this.token = opts?.token ?? randomBytes(32).toString('base64url');
+        this.maxBodyBytes = opts?.maxBodyBytes ?? 64 * 1024;
+        this.requestTimeoutMs = opts?.requestTimeoutMs ?? 10_000;
+    }
+    static MAX_PORT_RETRIES = 10;
+    get authToken() {
+        return this.token;
+    }
+    async start() {
+        const startPort = this.port;
+        return new Promise((resolve, reject) => {
+            this.server = createServer((req, res) => this.handleRequest(req, res));
+            this.server.on('error', (err) => {
+                if (err.code === 'EADDRINUSE') {
+                    this.port++;
+                    if (this.port - startPort >= ApprovalHttpServer.MAX_PORT_RETRIES) {
+                        reject(new Error(`No available port found in range ${startPort}–${this.port}`));
+                        return;
+                    }
+                    this.server.listen(this.port, '127.0.0.1');
+                }
+                else {
+                    reject(err);
+                }
+            });
+            this.server.listen(this.port, '127.0.0.1', () => {
+                const address = this.server?.address();
+                if (address && typeof address === 'object') {
+                    this.port = address.port;
+                }
+                console.error(`[canon] Approval server listening on 127.0.0.1:${this.port}`);
+                resolve(this.port);
+            });
+        });
+    }
+    async stop() {
+        return new Promise((resolve) => {
+            if (this.server) {
+                this.server.close(() => resolve());
+            }
+            else {
+                resolve();
+            }
+        });
+    }
+    handleRequest(req, res) {
+        if (req.method !== 'POST' || req.url !== '/approve') {
+            res.writeHead(404, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Not found' }));
+            return;
+        }
+        req.setTimeout(this.requestTimeoutMs, () => {
+            res.writeHead(408, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Request timeout' }));
+            req.destroy();
+        });
+        if (!this.hasValidToken(req)) {
+            res.writeHead(401, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Unauthorized' }));
+            return;
+        }
+        let body = '';
+        req.on('data', (chunk) => {
+            if (res.writableEnded)
+                return;
+            if (body.length + chunk.length > this.maxBodyBytes) {
+                res.writeHead(413, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Request body too large' }));
+                req.destroy();
+                return;
+            }
+            body += chunk.toString();
+        });
+        req.on('end', () => {
+            if (res.writableEnded)
+                return;
+            this.handleApproval(body, res).catch((err) => {
+                console.error('[canon] Approval handler error:', err);
+                if (res.writableEnded)
+                    return;
+                res.writeHead(500, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'Internal error' }));
+            });
+        });
+    }
+    hasValidToken(req) {
+        const authHeader = req.headers.authorization;
+        const bearer = typeof authHeader === 'string' && authHeader.toLowerCase().startsWith('bearer ')
+            ? authHeader.slice('bearer '.length).trim()
+            : null;
+        const headerToken = req.headers['x-canon-approval-token'];
+        const supplied = bearer || (typeof headerToken === 'string' ? headerToken : null);
+        if (!supplied)
+            return false;
+        const expected = Buffer.from(this.token);
+        const received = Buffer.from(supplied);
+        return expected.length === received.length && timingSafeEqual(expected, received);
+    }
+    async handleApproval(body, res) {
+        let payload;
+        try {
+            payload = JSON.parse(body);
+        }
+        catch {
+            res.writeHead(400, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ error: 'Invalid JSON' }));
+            return;
+        }
+        const toolName = payload.tool_name ?? 'Unknown';
+        const toolInput = payload.tool_input ?? {};
+        // Determine risk level
+        const riskLevel = this.classifyRisk(toolName, toolInput);
+        const isOwnerTurn = this.getIsOwnerTurn();
+        // Find the conversation to send the approval to.
+        const conversationId = this.getConversationId();
+        if (!conversationId) {
+            console.error('[canon] No active conversation for approval — falling back to ask');
+            // Can't send approval message, fall through to terminal prompt.
+            this.sendHookResponse(res, 'ask');
+            return;
+        }
+        // Check session rules first for owner-triggered turns. Non-owner-triggered
+        // tools require a fresh owner decision so an old "approve all" does not
+        // turn into remote control of the owner's local runtime.
+        const existingRule = isOwnerTurn ? this.manager.checkSessionRules(toolName, conversationId) : null;
+        if (existingRule) {
+            const decision = existingRule.type === 'deny-tool' ? 'deny' : 'allow';
+            this.sendHookResponse(res, decision);
+            return;
+        }
+        try {
+            const result = await this.manager.requestApproval(conversationId, toolName, toolInput, {
+                riskLevel,
+                risk: classifyClaudeApprovalRisk(toolName, toolInput),
+                category: classifyClaudeApprovalCategory(toolName),
+                native: {
+                    runtime: 'claude-code',
+                    method: 'PermissionRequest',
+                    ...(payload.session_id ? { requestId: payload.session_id } : {}),
+                },
+                details: buildClaudeApprovalDetails(toolName, toolInput),
+                ignoreSessionRules: !isOwnerTurn,
+                allowSessionRule: isOwnerTurn,
+            });
+            this.sendHookResponse(res, result.decision);
+        }
+        catch (err) {
+            console.error('[canon] Approval request failed:', err);
+            // On error, fall back to terminal prompt
+            this.sendHookResponse(res, 'ask');
+        }
+    }
+    sendHookResponse(res, behavior) {
+        res.writeHead(200, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PermissionRequest',
+                decision: { behavior },
+            },
+        }));
+    }
+    classifyRisk(toolName, toolInput) {
+        if (toolName !== 'Bash')
+            return 'normal';
+        const cmd = typeof toolInput.command === 'string' ? toolInput.command : '';
+        const destructivePatterns = [
+            /\brm\s+(-rf?|--force)/,
+            /\bgit\s+push\s+--force/,
+            /\bgit\s+reset\s+--hard/,
+            /\bdrop\s+(table|database)/i,
+            /\bformat\b/,
+        ];
+        return destructivePatterns.some((p) => p.test(cmd))
+            ? 'destructive'
+            : 'normal';
+    }
+}

package/dist/cli-entry.d.ts

@@ -1,2 +1,2 @@
-export { handleCliMetadataRequest, isDirectExecution, readCliPackageVersion, runCli, } from '@canonmsg/core/local';
-export type { CliMetadata, RunCliMetadataOptions, } from '@canonmsg/core/local';
+export { handleCliMetadataRequest, isDirectExecution, readCliPackageVersion, runCli, } from '@canonmsg/core';
+export type { CliMetadata, RunCliMetadataOptions, } from '@canonmsg/core';

package/dist/cli-entry.js

@@ -1 +1 @@
-export { handleCliMetadataRequest, isDirectExecution, readCliPackageVersion, runCli, } from '@canonmsg/core/local';
+export { handleCliMetadataRequest, isDirectExecution, readCliPackageVersion, runCli, } from '@canonmsg/core';

package/dist/host.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { type SDKControlReloadPluginsResponse } from '@anthropic-ai/claude-agent-sdk';
-import { type CanonRuntimeCommandDescriptor } from '@canonmsg/core/contract';
+import { type CanonRuntimeCommandDescriptor } from '@canonmsg/core';
 /**
  * Claude Code's own slash commands (built-ins, plugins, project .claude/
  * commands) are executable when sent as prompt text, so the runtime's command