@canonmsg/claude-code-plugin 0.25.5 → 0.26.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "Canon",
   "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "channels": [
     {
       "server": "canon-channel",

package/dist/host.d.ts

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
-import { type SDKControlReloadPluginsResponse } from '@anthropic-ai/claude-agent-sdk';
+import { type PermissionResult, type SDKControlReloadPluginsResponse } from '@anthropic-ai/claude-agent-sdk';
 import { type CanonRuntimeCommandDescriptor } from '@canonmsg/core';
+export declare function buildClaudePlanAllowResult(input: Record<string, unknown>): PermissionResult;
 /**
  * Claude Code's own slash commands (built-ins, plugins, project .claude/
  * commands) are executable when sent as prompt text, so the runtime's command

package/dist/host.js

@@ -31,6 +31,7 @@ import { captureTurnArtifactSnapshot, collectTurnArtifacts, } from '@canonmsg/co
 import { CLAUDE_EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, prepareConversationEnvironment, readLocalRuntimeEntry, resolveCanonAgent, initRTDBAuth, sendMessageWithRetry, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { decideAutoReply, } from './inbound-policy.js';
 import { runCli } from './cli-entry.js';
+import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer } from '@canonmsg/agent-tools';
 import { synthesizeClaudeApprovalDiff } from './approval-diff.js';
 import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
 import { applyClaudeSessionControl, buildClaudeFinalMessageId, claudeModelInfoToOption, confirmClaudeInterrupt, createClaudeInputEnvelope, formatClaudeControlError, isClaudeCustomModelOption, mergeClaudeDiscoveredModelOptions, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, } from './session-state.js';
@@ -92,6 +93,9 @@ let runtimeMetadata = {
 let runtimeMetadataRefresh = null;
 /** Bound on native slash commands exposed to the composer palette. */
 const MAX_NATIVE_SLASH_COMMANDS = 50;
+export function buildClaudePlanAllowResult(input) {
+    return { behavior: 'allow', updatedInput: input };
+}
 /**
  * Claude Code's own slash commands (built-ins, plugins, project .claude/
  * commands) are executable when sent as prompt text, so the runtime's command
@@ -864,6 +868,28 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         ...(config.effort ? { effort: config.effort } : {}),
         settings: { forceLoginMethod: 'claudeai' },
         settingSources: ['project', 'local'],
+        // Canonical Canon verbs, in-process (projection 2 of canon.verbs.v1).
+        // Fresh instance per session: the SDK connects the instance to its own
+        // in-process transport, so instances are not shared across queries.
+        // The context getter reads the session lazily (tool calls only happen
+        // once the query is running, after `session` is assigned — same pattern
+        // as canUseTool): host sessions are conversation-scoped, so the binding
+        // supplies the active conversation, turn, and turn responder that the
+        // semantic schemas leave to it.
+        mcpServers: {
+            [CANON_VERB_MCP_SERVER_NAME]: {
+                type: 'sdk',
+                name: CANON_VERB_MCP_SERVER_NAME,
+                instance: createCanonVerbMcpServer(() => client, () => {
+                    const routing = resolveClaudeTurnResponseRouting(session.activeInput, config.ownerId);
+                    return {
+                        conversationId,
+                        ...(session.currentTurnId ? { turnId: session.currentTurnId } : {}),
+                        ...(routing.responseUserId ? { responseUserId: routing.responseUserId } : {}),
+                    };
+                }),
+            },
+        },
         ...(claudeCliPath ? { pathToClaudeCodeExecutable: claudeCliPath } : {}),
         stderr: (data) => {
             const trimmed = data.toString().trim();
@@ -979,7 +1005,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                             // instead of waiting for the next 30s heartbeat (lag fix).
                             config.publishSessionSnapshots?.([conversationId]);
                         }
-                        return { behavior: 'allow' };
+                        return buildClaudePlanAllowResult(input);
                     }
                     if (reply.status === 'reject') {
                         return {

package/dist/mcp-args.d.ts

@@ -1,4 +1,3 @@
-import type { DirectSessionSelection, SendContextualMessageOptions } from '@canonmsg/core';
 export type McpParseResult<T> = {
     ok: true;
     value: T;
@@ -26,16 +25,6 @@ export interface SendMessageArgs {
     durationMs?: number;
 }
 export declare function parseSendMessageArgs(value: unknown): McpParseResult<SendMessageArgs>;
-export interface SendContextualMessageArgs {
-    sourceConversationId: string;
-    targetConversationId?: string;
-    targetUserId?: string;
-    text: string;
-    selfContext: SendContextualMessageOptions['selfContext'];
-    sessionSelection?: DirectSessionSelection;
-    messageOptions?: SendContextualMessageOptions['messageOptions'];
-}
-export declare function parseSendContextualMessageArgs(value: unknown): McpParseResult<SendContextualMessageArgs>;
 export interface SetTypingArgs {
     conversationId: string;
     typing: boolean;

package/dist/mcp-args.js

@@ -87,74 +87,6 @@ export function parseSendMessageArgs(value) {
         },
     };
 }
-function parseSessionSelection(value) {
-    if (value == null)
-        return { ok: true, value: undefined };
-    const raw = typeof value === 'string'
-        ? value
-        : isRecord(value) && typeof value.mode === 'string'
-            ? value.mode
-            : null;
-    const mode = raw?.trim().toLowerCase().replace(/-/g, '_');
-    if (!mode)
-        return { ok: false, error: 'Invalid session_selection' };
-    if (mode === 'new' || mode === 'fresh' || mode === 'start_new') {
-        return { ok: true, value: { mode: 'new' } };
-    }
-    if (mode === 'continue_latest' || mode === 'latest' || mode === 'continue') {
-        return { ok: true, value: { mode: 'continue_latest' } };
-    }
-    if (mode === 'continue_or_create' || mode === 'auto' || mode === 'reuse_or_create') {
-        return { ok: true, value: { mode: 'continue_or_create' } };
-    }
-    return { ok: false, error: 'session_selection must be new, continue_latest, or continue_or_create' };
-}
-export function parseSendContextualMessageArgs(value) {
-    if (!isRecord(value))
-        return { ok: false, error: 'Arguments must be an object' };
-    const sourceConversationId = requiredString(value, 'source_conversation_id', 256);
-    if (!sourceConversationId.ok)
-        return sourceConversationId;
-    const text = requiredString(value, 'text');
-    if (!text.ok)
-        return text;
-    const targetConversationId = optionalString(value, 'target_conversation_id', 256);
-    const targetUserId = optionalString(value, 'target_user_id', 256);
-    if (Boolean(targetConversationId) === Boolean(targetUserId)) {
-        return { ok: false, error: 'Provide exactly one target_conversation_id or target_user_id' };
-    }
-    if (!isRecord(value.self_context)) {
-        return { ok: false, error: 'Missing self_context' };
-    }
-    const type = value.self_context.type;
-    const context = requiredString(value.self_context, 'context');
-    if (!context.ok)
-        return context;
-    if (type !== 'cross_session') {
-        return { ok: false, error: 'self_context.type must be cross_session' };
-    }
-    const sessionSelection = parseSessionSelection(value.session_selection);
-    if (!sessionSelection.ok)
-        return sessionSelection;
-    const messageOptions = isRecord(value.message_options)
-        ? value.message_options
-        : undefined;
-    return {
-        ok: true,
-        value: {
-            sourceConversationId: sourceConversationId.value,
-            ...(targetConversationId ? { targetConversationId } : {}),
-            ...(targetUserId ? { targetUserId } : {}),
-            text: text.value,
-            selfContext: {
-                type: 'cross_session',
-                context: context.value,
-            },
-            ...(sessionSelection.value ? { sessionSelection: sessionSelection.value } : {}),
-            ...(messageOptions ? { messageOptions } : {}),
-        },
-    };
-}
 export function parseSetTypingArgs(value) {
     if (!isRecord(value))
         return { ok: false, error: 'Arguments must be an object' };

package/dist/server.js

@@ -14,7 +14,8 @@ import { CanonClient, CanonStream, ApprovalManager, buildLocalRuntimeId, getActi
 import { materializeMessageMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { ApprovalHttpServer } from './approval-server.js';
 import { runCli } from './cli-entry.js';
-import { parseReplyArgs, parseSendContextualMessageArgs, parseSendMessageArgs, parseSetTypingArgs, } from './mcp-args.js';
+import { parseReplyArgs, parseSendMessageArgs, parseSetTypingArgs, } from './mcp-args.js';
+import { canonVerbToolDefinitions, executeCanonVerbTool, isCanonToolVerb, stampSendToTurnComplete, } from '@canonmsg/agent-tools';
 const HELP = `canon-channel-server — Claude Code MCP channel server for Canon
 
 USAGE
@@ -137,58 +138,6 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ['conversation_id'],
             },
         },
-        {
-            name: 'send_contextual_message',
-            description: 'Send a message into another Canon conversation or contact with private cross-session self-context',
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    source_conversation_id: {
-                        type: 'string',
-                        description: 'The Canon conversation where this cross-session intent originated',
-                    },
-                    target_conversation_id: {
-                        type: 'string',
-                        description: 'The destination Canon conversation to send into',
-                    },
-                    target_user_id: {
-                        type: 'string',
-                        description: 'The destination Canon user/contact to reach out to',
-                    },
-                    text: {
-                        type: 'string',
-                        description: 'Message text to send',
-                    },
-                    self_context: {
-                        type: 'object',
-                        description: 'Required { type: "cross_session", context: "why I am saying this here" }',
-                    },
-                    session_selection: {
-                        type: 'string',
-                        enum: ['new', 'continue_latest', 'continue_or_create'],
-                        description: 'Optional direct-agent session behavior when target_user_id is used',
-                    },
-                    message_options: {
-                        type: 'object',
-                        description: 'Optional Canon send options for the contextual outbound message',
-                    },
-                },
-                required: ['source_conversation_id', 'text', 'self_context'],
-            },
-        },
-        {
-            name: 'list_conversations',
-            description: "List Canon conversations this agent participates in",
-            inputSchema: {
-                type: 'object',
-                properties: {
-                    limit: {
-                        type: 'number',
-                        description: 'Max conversations to return (default: 20)',
-                    },
-                },
-            },
-        },
         {
             name: 'list_agents',
             description: 'List registered Canon agent profiles and their lock status',
@@ -220,6 +169,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
                 required: ['conversation_id', 'typing'],
             },
         },
+        // Canonical verbs — projections of canon.verbs.v1 (@canonmsg/agent-tools).
+        ...canonVerbToolDefinitions(),
     ],
 }));
 // ── Tool handlers ──────────────────────────────────────────────────────
@@ -322,62 +273,6 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 ],
             };
         }
-        case 'send_contextual_message': {
-            const parsed = parseSendContextualMessageArgs(args);
-            if (!parsed.ok)
-                return toolArgumentError(parsed.error);
-            const { sourceConversationId, targetConversationId, targetUserId, text, selfContext, sessionSelection, messageOptions, } = parsed.value;
-            const contextualMessageOptions = messageOptions;
-            const result = await client.sendContextualMessage({
-                sourceConversationId,
-                ...(targetConversationId ? { targetConversationId } : {}),
-                ...(targetUserId ? { targetUserId } : {}),
-                text,
-                selfContext,
-                ...(sessionSelection ? { sessionSelection } : {}),
-                ...(contextualMessageOptions
-                    ? {
-                        messageOptions: {
-                            ...contextualMessageOptions,
-                            metadata: {
-                                ...(contextualMessageOptions.metadata ?? {}),
-                                ...TURN_COMPLETE_METADATA,
-                            },
-                        },
-                    }
-                    : { messageOptions: { metadata: TURN_COMPLETE_METADATA } }),
-            });
-            return {
-                content: [
-                    {
-                        type: 'text',
-                        text: result.status === 'messaged'
-                            ? `Contextual message sent (${result.messageId}) via self-context ${result.selfContextId}`
-                            : `Contextual message not sent: ${result.status}`,
-                    },
-                ],
-            };
-        }
-        case 'list_conversations': {
-            const rawArgs = args && typeof args === 'object' ? args : {};
-            const limit = typeof rawArgs.limit === 'number' && Number.isFinite(rawArgs.limit)
-                ? Math.max(1, Math.min(100, Math.floor(rawArgs.limit)))
-                : 20;
-            const convos = await client.getConversations();
-            const slice = convos.slice(0, limit);
-            const summary = slice.map((c) => ({
-                id: c.id,
-                type: c.type,
-                name: c.name,
-                members: c.memberIds.length,
-                lastMessage: c.lastMessage?.text?.slice(0, 100) || null,
-            }));
-            return {
-                content: [
-                    { type: 'text', text: JSON.stringify(summary, null, 2) },
-                ],
-            };
-        }
         case 'list_agents': {
             const profiles = loadProfiles();
             const entries = Object.entries(profiles).map(([name, p]) => {
@@ -413,13 +308,24 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
                 ],
             };
         }
-        default:
+        default: {
+            const name = request.params.name;
+            if (isCanonToolVerb(name)) {
+                const rawArgs = args && typeof args === 'object' ? { ...args } : {};
+                const verbArgs = name === 'send_to' ? stampSendToTurnComplete(rawArgs) : rawArgs;
+                const verbResult = await executeCanonVerbTool(client, name, verbArgs);
+                return {
+                    content: verbResult.content.map((item) => ({ type: 'text', text: item.text })),
+                    ...(verbResult.isError ? { isError: true } : {}),
+                };
+            }
             return {
                 content: [
-                    { type: 'text', text: `Unknown tool: ${request.params.name}` },
+                    { type: 'text', text: `Unknown tool: ${name}` },
                 ],
                 isError: true,
             };
+        }
     }
 });
 // ── Inbound message handler ────────────────────────────────────────────

package/dist/tool-policy.d.ts

@@ -1,11 +1,14 @@
 import type { ApprovalManager, ApprovalRequestCategory, ApprovalRequestDetail, ApprovalRisk, CanonUnifiedDiff } from '@canonmsg/core';
 export type ClaudeToolPolicyDecision = {
     behavior: 'allow';
+    /** Replacement tool input (the SDK dispatches this instead). */
+    updatedInput?: Record<string, unknown>;
 } | {
     behavior: 'deny';
     message: string;
 };
 export declare const CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE = "default";
+export declare function canonVerbFromToolName(toolName: string): string | null;
 export declare function parseAllowedNonOwnerClaudeTools(value: string | null | undefined): string[];
 export declare function isSensitiveNonOwnerClaudeTool(toolName: string, allowedNonOwnerTools?: Iterable<string>): boolean;
 export declare function decideClaudeToolPermission(input: {

package/dist/tool-policy.js

@@ -1,4 +1,5 @@
 const NON_OWNER_DENY_MESSAGE = 'Only the agent owner can authorize runtime tool use in this chat.';
+const NON_OWNER_CROSS_CONVERSATION_DENY_MESSAGE = 'Non-owner turns may only target the conversation they came from.';
 const NATIVE_APPROVAL_UNAVAILABLE_MESSAGE = 'Runtime action approval is not available for this conversation.';
 const NATIVE_APPROVAL_DENIED_MESSAGE = 'The user denied this action.';
 export const CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE = 'default';
@@ -36,9 +37,52 @@ function isCanonOutboundTool(normalizedToolName) {
     return normalizedToolName.endsWith('__reply')
         || normalizedToolName.endsWith('__send_message')
         || normalizedToolName.endsWith('__send_contextual_message')
+        || normalizedToolName.endsWith('__send_to')
+        || normalizedToolName.endsWith('__share_contact')
         || normalizedToolName === 'reply'
         || normalizedToolName === 'send_message'
-        || normalizedToolName === 'send_contextual_message';
+        || normalizedToolName === 'send_contextual_message'
+        || normalizedToolName === 'send_to'
+        || normalizedToolName === 'share_contact';
+}
+/**
+ * Canon's own verb tools (the in-process `canon` MCP mount): `mcp__canon__<verb>`.
+ * They need their own policy lane — the HITL verbs ARE the approval/input
+ * mechanism, so routing them through approvalManager.requestApproval would
+ * gate an approval card behind an approval card.
+ */
+const CANON_VERB_TOOL_PREFIX = 'mcp__canon__';
+const CANON_HITL_OR_READ_VERBS = new Set([
+    'react',
+    'request_input',
+    'request_approval',
+    'check_approval',
+    'send_card',
+    'request_card',
+    'list_contacts',
+    'list_contact_requests',
+    'list_conversations',
+]);
+/**
+ * Verbs a NON-owner conversation member may trigger: same-conversation HITL
+ * and display surfaces, whose responder routing and owner-only escalation
+ * (secret/sudo, session rules) are enforced server-side. Cross-conversation
+ * verbs (send_to, share_contact) and the reads (contacts, conversation
+ * lists — they expose the agent's other relationships to this conversation)
+ * stay owner-only until the provenance trigger-token primitive lands.
+ */
+const CANON_NON_OWNER_ALLOWED_VERBS = new Set([
+    'request_input',
+    'request_approval',
+    'check_approval',
+    'send_card',
+    'request_card',
+]);
+export function canonVerbFromToolName(toolName) {
+    const normalized = normalizeToolName(toolName);
+    if (!normalized.startsWith(CANON_VERB_TOOL_PREFIX))
+        return null;
+    return normalized.slice(CANON_VERB_TOOL_PREFIX.length) || null;
 }
 function isMcpTool(normalizedToolName) {
     return normalizedToolName.startsWith('mcp__');
@@ -100,12 +144,12 @@ export function classifyClaudeApprovalCategory(toolName) {
     if (normalized === 'webfetch' || normalized === 'websearch') {
         return 'network';
     }
+    if (isCanonOutboundTool(normalized) || canonVerbFromToolName(normalized)) {
+        return 'canon';
+    }
     if (isMcpTool(normalized) || normalized === 'listmcpresources' || normalized === 'readmcpresource') {
         return 'mcp';
     }
-    if (isCanonOutboundTool(normalized)) {
-        return 'canon';
-    }
     return 'tool';
 }
 export function classifyClaudeApprovalRisk(toolName, toolInput) {
@@ -161,6 +205,39 @@ export function buildClaudeApprovalDetails(toolName, toolInput) {
     return details;
 }
 export async function decideClaudeToolPermissionForMode(input) {
+    const canonVerb = canonVerbFromToolName(input.toolName);
+    if (canonVerb) {
+        // Non-owner turns: same-conversation HITL/display verbs are allowed
+        // (members may instruct the agent; the server enforces responder
+        // membership and owner-only escalation); everything cross-conversation
+        // stays owner-only. "Same-conversation" is ENFORCED here, not assumed:
+        // the server only checks agent membership in the target, so without this
+        // pin a member of conversation A could aim cards/questions at any other
+        // conversation the agent belongs to. A mismatching explicit target is
+        // denied; otherwise the turn's own conversation is stamped into the
+        // input (updatedInput is what the SDK actually dispatches).
+        if (!input.isOwnerTurn) {
+            if (CANON_NON_OWNER_ALLOWED_VERBS.has(canonVerb)) {
+                const target = input.toolInput.conversationId;
+                if (typeof target === 'string' && target !== input.conversationId) {
+                    return { behavior: 'deny', message: NON_OWNER_CROSS_CONVERSATION_DENY_MESSAGE };
+                }
+                return {
+                    behavior: 'allow',
+                    updatedInput: { ...input.toolInput, conversationId: input.conversationId },
+                };
+            }
+            return { behavior: 'deny', message: NON_OWNER_DENY_MESSAGE };
+        }
+        // HITL + read verbs are allowed without an approval card: the HITL verbs
+        // themselves render the human-facing card (recursion otherwise), and the
+        // reads are side-effect free. Outbound verbs (send_to, share_contact)
+        // fall through to the mode policy — in native-approval mode they gate
+        // like any other side effect; in default mode owner turns allow.
+        if (CANON_HITL_OR_READ_VERBS.has(canonVerb)) {
+            return { behavior: 'allow' };
+        }
+    }
     if (input.permissionMode !== CLAUDE_NATIVE_APPROVAL_PERMISSION_MODE) {
         return decideClaudeToolPermission({
             toolName: input.toolName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     ".claude-plugin"
   ],
   "scripts": {
-    "prepare:workspace-deps": "node ../../scripts/run-workspace-prep.mjs ../core ../agent-sdk ../coding-agent-host",
+    "prepare:workspace-deps": "node ../../scripts/run-workspace-prep.mjs ../core ../rich-cards ../agent-sdk ../coding-agent-host ../agent-tools",
     "build": "npm run prepare:workspace-deps && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
     "dev": "npm run prepare:workspace-deps && tsc --watch",
     "prepack": "npm run build",
@@ -31,9 +31,11 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.204",
-    "@canonmsg/agent-sdk": "^5.1.1",
+    "@canonmsg/agent-sdk": "^5.1.2",
     "@canonmsg/coding-agent-host": "^0.2.2",
-    "@canonmsg/core": "^4.2.3",
+    "@canonmsg/agent-tools": "^0.2.0",
+    "@canonmsg/core": "^4.3.0",
+    "@canonmsg/rich-cards": "^0.8.1",
     "@modelcontextprotocol/sdk": "^1.29.0"
   },
   "engines": {