@canonmsg/claude-code-plugin 0.28.0 → 0.28.1

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "Canon",
   "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "channels": [
     {
       "server": "canon-channel",

package/dist/host.js

@@ -34,7 +34,7 @@ import { runCli } from './cli-entry.js';
 import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer } from '@canonmsg/agent-tools';
 import { synthesizeClaudeApprovalDiff } from './approval-diff.js';
 import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
-import { applyClaudeSessionControl, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudeTurnFailureNotice, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeFinalText, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
+import { applyClaudeSessionControl, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudeTurnFailureNotice, claudeInputOwnsTurnSlot, rememberDispatchedClaudeInput, takeClaudeResultOwner, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeFinalText, describeUndeliveredClaudeFinal, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
 import { CLAUDE_SUPPORTED_DIALOG_KINDS, buildClaudeAskUserPermissionDenied, buildClaudeAskUserPermissionResult, createClaudeUserDialogCoordinator, parseClaudeAskUserDialog, parseClaudeAskUserToolInput, resolveClaudeUserDialogRequestId, } from './user-dialog.js';
 import { collectMissedInboundMessages, createReconnectRecoveryGate, STARTUP_RECOVERY_MAX_MESSAGES, STARTUP_RECOVERY_PAGE_SIZE, } from './startup-recovery.js';
 function parseRuntimeVisibilityPreset(value) {
@@ -316,10 +316,7 @@ function resolveClaudeCliPath() {
     const override = process.env.CANON_CLAUDE_CLI_PATH?.trim();
     if (override) {
         if (existsSync(override)) {
-            assertExternalClaudeCliVersion(override);
-            cachedClaudeCliPath = override;
-            console.error(`[canon-host] claude CLI override: ${override}`);
-            return override;
+            return acceptClaudeCli('override', override);
         }
         console.error(`[canon-host] CANON_CLAUDE_CLI_PATH=${override} not found; ignoring`);
     }
@@ -340,41 +337,41 @@ function resolveClaudeCliPath() {
         console.error('[canon-host] claude CLI not on PATH; using SDK-bundled binary');
         return undefined;
     }
-    // A stale CLI on PATH would otherwise shadow the newer bundled one and quietly
-    // drop model families from discovery. Prefer the bundle over a silent downgrade.
-    let version = null;
+    return acceptClaudeCli('on PATH', resolved);
+}
+function readClaudeCliVersionSafely(cliPath) {
     try {
-        version = readExternalClaudeCliVersion(resolved);
+        const output = execFileSync(cliPath, ['--version'], { encoding: 'utf8' }).trim();
+        const version = parseClaudeCliVersion(output);
+        if (!version) {
+            console.error(`[canon-host] Could not determine Claude Code version from: ${output}`);
+        }
+        return version;
     }
     catch (error) {
-        console.error(`[canon-host] Could not read the version of the claude CLI at ${resolved}:`, error);
-    }
-    if (!version || !isSupportedClaudeCliVersion(version)) {
-        cachedClaudeCliPath = null;
-        const found = version ? `is ${formatClaudeCliVersion(version)}` : 'has an unreadable version';
-        console.error(`[canon-host] claude CLI on PATH (${resolved}) ${found}; `
-            + `${formatClaudeCliVersion(MINIMUM_CLAUDE_CLI_VERSION)} or newer is required — `
-            + 'using the SDK-bundled binary instead. Run `claude update` to use your own install.');
-        return undefined;
-    }
-    cachedClaudeCliPath = resolved;
-    console.error(`[canon-host] claude CLI on PATH: ${resolved} (${formatClaudeCliVersion(version)})`);
-    return resolved;
-}
-function readExternalClaudeCliVersion(cliPath) {
-    const output = execFileSync(cliPath, ['--version'], { encoding: 'utf8' }).trim();
-    const version = parseClaudeCliVersion(output);
-    if (!version) {
-        throw new Error(`Could not determine Claude Code version from: ${output}`);
+        console.error(`[canon-host] Could not run ${cliPath} --version:`, error);
+        return null;
     }
-    return version;
 }
-function assertExternalClaudeCliVersion(cliPath) {
-    const version = readExternalClaudeCliVersion(cliPath);
-    if (!isSupportedClaudeCliVersion(version)) {
-        throw new Error(`Claude Code ${formatClaudeCliVersion(MINIMUM_CLAUDE_CLI_VERSION)} or newer is required; `
-            + `found ${formatClaudeCliVersion(version)}.`);
-    }
+/**
+ * Take a candidate CLI, or fall back to the SDK-bundled binary. Deliberately
+ * total: this is reached from the runtime heartbeat, so an unusable CLI must
+ * cost a few model options, never take the host down. A stale binary would
+ * otherwise shadow the newer bundled one and quietly shorten model discovery.
+ */
+function acceptClaudeCli(source, cliPath) {
+    const version = readClaudeCliVersionSafely(cliPath);
+    if (version && isSupportedClaudeCliVersion(version)) {
+        cachedClaudeCliPath = cliPath;
+        console.error(`[canon-host] claude CLI ${source}: ${cliPath} (${formatClaudeCliVersion(version)})`);
+        return cliPath;
+    }
+    cachedClaudeCliPath = null;
+    console.error(`[canon-host] claude CLI ${source} (${cliPath}) `
+        + `${version ? `is ${formatClaudeCliVersion(version)}` : 'has an unreadable version'}; `
+        + `${formatClaudeCliVersion(MINIMUM_CLAUDE_CLI_VERSION)} or newer is required — `
+        + 'using the SDK-bundled binary instead. Run `claude update` to use your own install.');
+    return undefined;
 }
 function toModelOptions(models) {
     return models.map(claudeModelInfoToOption);
@@ -785,6 +782,22 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             artifactRoutingMode,
         }));
     };
+    // Envelopes pulled by the SDK, keyed by the uuid stamped on each message, so a
+    // turn result can be matched to its own input. The SDK drains this iterable
+    // eagerly and may coalesce queued messages, so neither arrival order nor a
+    // single mutable slot can attribute results correctly on their own.
+    const dispatchedInputs = new Map();
+    // Only Canon turns may own the active-input slot. Result ownership comes from
+    // UUID correlation, while this slot drives live tool/dialog state.
+    function bindActiveInput(input) {
+        rememberDispatchedClaudeInput(dispatchedInputs, input);
+        // The slot drives in-turn concerns (tool routing, dialogs, interrupts), so
+        // it tracks the newest Canon turn. Result ownership is resolved by uuid, not
+        // from here.
+        if (!claudeInputOwnsTurnSlot(input))
+            return;
+        session.activeInput = input;
+    }
     const inputStream = {
         [Symbol.asyncIterator]() {
             return {
@@ -794,12 +807,12 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                     // Drain queued messages first (sent before iterator was ready)
                     if (messageQueue.length > 0) {
                         const next = messageQueue.shift();
-                        session.activeInput = next;
+                        bindActiveInput(next);
                         return Promise.resolve({ done: false, value: next.msg });
                     }
                     return new Promise((resolve) => {
                         resolveInput = (input) => {
-                            session.activeInput = input;
+                            bindActiveInput(input);
                             resolve({ done: false, value: input.msg });
                         };
                     });
@@ -1105,7 +1118,6 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         streamingTimer: null,
         idleResetTimer: null,
         finalDeliveryTimer: null,
-        seedResponseHandled: !!resumeSessionId, // Resumed sessions don't need seed handling
         pendingInputs: [],
         activeInput: null,
         finalizedTurnKeys: new Set(),
@@ -1565,10 +1577,13 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                         const assistantSessionId = msg.session_id;
                         if (assistantSessionId)
                             session.sdkSessionId = assistantSessionId;
-                        if (!session.seedResponseHandled) {
-                            session.seedResponseHandled = true;
+                        // Only a Canon turn's text is user-facing. This used to skip the
+                        // FIRST assistant message on the assumption it answered the seed,
+                        // but the seed is pulled after the first real message, so the guard
+                        // swallowed the actual reply — no streamed text and no fallback for
+                        // the final. Gate on the owning turn instead of on arrival order.
+                        if (!claudeInputOwnsTurnSlot(session.activeInput))
                             break;
-                        }
                         const textBlocks = (msg.message?.content ?? [])
                             .filter((b) => b.type === 'text')
                             .map((b) => b.text);
@@ -1657,7 +1672,10 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                         const resultSessionId = msg.session_id;
                         if (resultSessionId)
                             session.sdkSessionId = resultSessionId;
-                        const completedInput = session.activeInput;
+                        // Match the result to the envelope that produced it. Falling back to
+                        // the slot only when the SDK reports no uuid keeps older runtimes
+                        // working, at their existing accuracy.
+                        const completedInput = takeClaudeResultOwner(dispatchedInputs, msg.user_message_uuid) ?? session.activeInput;
                         console.error(`[canon-host] [${conversationId.slice(0, 8)}] Turn complete (${msg.subtype})`);
                         // Turn artifacts land before the final text reply.
                         if (completedInput?.kind === 'canon'
@@ -1690,6 +1708,19 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                                 interruptedTurnKeys: session.interruptedTurnKeys,
                             })
                             : false;
+                        // Gated finals are dropped without sending. That is correct for the
+                        // seed's own turn, but it is also how a misattributed Canon reply
+                        // disappears — silently, which is why this class of bug went unseen.
+                        // Always say why.
+                        if (finalText && !shouldDeliverFinal) {
+                            console.error(`[canon-host] [${conversationId.slice(0, 8)}] `
+                                + `Final not delivered (${finalText.length} chars): `
+                                + describeUndeliveredClaudeFinal({
+                                    turn: completedInput,
+                                    finalizedTurnKeys: session.finalizedTurnKeys,
+                                    interruptedTurnKeys: session.interruptedTurnKeys,
+                                }));
+                        }
                         const finalDelivered = finalText && shouldDeliverFinal
                             ? await deliverFinalReply(finalText, completedInput, Boolean(failureNotice))
                             : true;
@@ -1718,6 +1749,10 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                                 scheduleFinalHandoffReset();
                             }
                             else {
+                                // Nothing durable is coming, so retire the live bubble here.
+                                // The delivering path does this after a handoff delay; without
+                                // it a gated turn leaves an orphaned /streaming node behind.
+                                clearStreaming().catch(() => { });
                                 resetTurnToIdle();
                             }
                         }
@@ -1771,20 +1806,6 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                 console.error(`[canon-host] [${conversationId.slice(0, 8)}] Failed to set initial ultracode:`, err);
             }
         }
-        if (!resumeSessionId) {
-            // New session — send seed message to activate streaming input mode
-            sendInput(createClaudeInputEnvelope({
-                kind: 'seed',
-                msg: {
-                    type: 'user',
-                    message: {
-                        role: 'user',
-                        content: 'You are assisting in an ongoing chat. Reply naturally to the latest participant.',
-                    },
-                    parent_tool_use_id: null,
-                },
-            }));
-        }
         // Refresh the canonical runtime descriptor after Claude reports supported models.
         try {
             const models = await q.supportedModels();

package/dist/session-state.d.ts

@@ -5,6 +5,8 @@ export type ClaudeInputKind = 'seed' | 'canon';
 export type ClaudeArtifactRoutingMode = 'workspace-generated' | 'disabled';
 export interface ClaudeInputEnvelope {
     kind: ClaudeInputKind;
+    /** Correlates this envelope with its turn result's `user_message_uuid`. */
+    messageUuid: string;
     msg: SDKUserMessage;
     intent: DeliveryIntent;
     sourceMessageId: string | null;
@@ -68,6 +70,28 @@ export declare function shouldDeliverClaudeFinal(input: {
     finalizedTurnKeys: ReadonlySet<string>;
     interruptedTurnKeys: ReadonlySet<string>;
 }): boolean;
+export declare function rememberDispatchedClaudeInput(dispatched: Map<string, ClaudeInputEnvelope>, input: ClaudeInputEnvelope): void;
+/**
+ * The envelope a turn result belongs to, matched by `user_message_uuid`.
+ *
+ * The SDK coalesces queued inputs — three rapid messages can produce two turns —
+ * and reports the LAST message of a coalesced batch, which is the correct owner
+ * of the reply. Entries up to and including the match are consumed, so messages
+ * folded into that batch do not linger. Returns null when the result carries no
+ * usable uuid, leaving the caller to fall back.
+ */
+export declare function takeClaudeResultOwner(dispatched: Map<string, ClaudeInputEnvelope>, userMessageUuid: unknown): ClaudeInputEnvelope | null;
+/**
+ * Whether an envelope owns the session's active-turn slot. Only Canon turns do;
+ * any future internal envelope must remain invisible to user-facing turn state.
+ */
+export declare function claudeInputOwnsTurnSlot(input: Pick<ClaudeInputEnvelope, 'kind'> | null | undefined): boolean;
+/** Why a non-empty final was gated instead of sent. Diagnostics only. */
+export declare function describeUndeliveredClaudeFinal(input: {
+    turn: ClaudeInputEnvelope | null;
+    finalizedTurnKeys: ReadonlySet<string>;
+    interruptedTurnKeys: ReadonlySet<string>;
+}): string;
 export declare function resetClaudeCompletedTurnState(session: ClaudeCompletedTurnState): void;
 export declare function claudeOriginForCanonSender(input: {
     senderType?: string | null;

package/dist/session-state.js

@@ -3,9 +3,14 @@ import { USAGE_LIMIT_ERROR_PREFIXES } from '@anthropic-ai/claude-agent-sdk';
 export function createClaudeInputEnvelope(input) {
     const sourceMessageId = input.sourceMessageId ?? null;
     const fallbackId = randomUUID();
+    // Stamped so each turn result can be matched back to the envelope that caused
+    // it via SDKResultMessage.user_message_uuid, instead of inferring ownership
+    // from a mutable slot and arrival order.
+    const messageUuid = randomUUID();
     return {
         kind: input.kind,
-        msg: input.msg,
+        messageUuid,
+        msg: { ...input.msg, uuid: messageUuid },
         intent: input.intent ?? 'queue',
         sourceMessageId,
         markAccepted: Boolean(input.markAccepted),
@@ -49,6 +54,59 @@ export function shouldDeliverClaudeFinal(input) {
         return false;
     return true;
 }
+/** Bounds the correlation map if the SDK ever stops reporting a uuid we sent. */
+const MAX_TRACKED_DISPATCHED_INPUTS = 64;
+export function rememberDispatchedClaudeInput(dispatched, input) {
+    dispatched.set(input.messageUuid, input);
+    while (dispatched.size > MAX_TRACKED_DISPATCHED_INPUTS) {
+        const oldest = dispatched.keys().next();
+        if (oldest.done)
+            break;
+        dispatched.delete(oldest.value);
+    }
+}
+/**
+ * The envelope a turn result belongs to, matched by `user_message_uuid`.
+ *
+ * The SDK coalesces queued inputs — three rapid messages can produce two turns —
+ * and reports the LAST message of a coalesced batch, which is the correct owner
+ * of the reply. Entries up to and including the match are consumed, so messages
+ * folded into that batch do not linger. Returns null when the result carries no
+ * usable uuid, leaving the caller to fall back.
+ */
+export function takeClaudeResultOwner(dispatched, userMessageUuid) {
+    if (typeof userMessageUuid !== 'string' || !dispatched.has(userMessageUuid)) {
+        return null;
+    }
+    let owner = null;
+    for (const [key, envelope] of dispatched) {
+        dispatched.delete(key);
+        if (key === userMessageUuid) {
+            owner = envelope;
+            break;
+        }
+    }
+    return owner;
+}
+/**
+ * Whether an envelope owns the session's active-turn slot. Only Canon turns do;
+ * any future internal envelope must remain invisible to user-facing turn state.
+ */
+export function claudeInputOwnsTurnSlot(input) {
+    return input?.kind === 'canon';
+}
+/** Why a non-empty final was gated instead of sent. Diagnostics only. */
+export function describeUndeliveredClaudeFinal(input) {
+    if (!input.turn)
+        return 'no Canon turn owns this result';
+    if (input.turn.kind !== 'canon')
+        return `owning turn is '${input.turn.kind}'`;
+    if (input.interruptedTurnKeys.has(input.turn.turnKey))
+        return 'turn was interrupted';
+    if (input.finalizedTurnKeys.has(input.turn.turnKey))
+        return 'turn was already finalized';
+    return 'turn did not qualify for delivery';
+}
 export function resetClaudeCompletedTurnState(session) {
     session.state.state = 'idle';
     session.currentTurnId = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",