@canonmsg/claude-code-plugin 0.31.4 → 0.32.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "Canon",
   "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
-  "version": "0.31.4",
+  "version": "0.32.0",
   "channels": [
     {
       "server": "canon-channel",

package/dist/canon-user-content.d.ts

@@ -1,6 +1,6 @@
 import type { SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import { type AnthropicImageBudgetOptions, type MaterializedCanonAttachment } from '@canonmsg/agent-sdk';
-import { renderCanonHostInboundContent, type CanonReplyContext } from '@canonmsg/core';
+import { renderCanonHostInboundContent, type CanonReplyContext, type HostInboundContentRenderOptions } from '@canonmsg/core';
 type ClaudeRenderableInboundMessage = Parameters<typeof renderCanonHostInboundContent>[0];
 /**
  * Claude-only rendering policy for Canon media. Core deliberately omits all
@@ -8,8 +8,8 @@ type ClaudeRenderableInboundMessage = Parameters<typeof renderCanonHostInboundCo
  * that the bounded runtime did not materialize, while materialized images keep
  * their local-path placeholder without a duplicate link.
  */
-export declare function renderClaudeInboundContent(message: ClaudeRenderableInboundMessage, materialized?: ReadonlyArray<MaterializedCanonAttachment>): string;
-export declare function withClaudeReplyContextMediaReferences(replyContext: CanonReplyContext | null, materialized: ReadonlyArray<MaterializedCanonAttachment>): CanonReplyContext | null;
+export declare function renderClaudeInboundContent(message: ClaudeRenderableInboundMessage, materialized?: ReadonlyArray<MaterializedCanonAttachment>, renderOptions?: HostInboundContentRenderOptions): string;
+export declare function withClaudeReplyContextMediaReferences(replyContext: CanonReplyContext | null, materialized: ReadonlyArray<MaterializedCanonAttachment>, renderOptions?: HostInboundContentRenderOptions): CanonReplyContext | null;
 /**
  * Build the Claude Code SDK's multimodal user content without allowing native
  * image blocks to consume the whole request. The prompt text is preserved

package/dist/canon-user-content.js

@@ -28,8 +28,8 @@ function validatedPromptAttachmentUrl(value) {
  * that the bounded runtime did not materialize, while materialized images keep
  * their local-path placeholder without a duplicate link.
  */
-export function renderClaudeInboundContent(message, materialized = []) {
-    const rendered = renderCanonHostInboundContent(message, materialized);
+export function renderClaudeInboundContent(message, materialized = [], renderOptions = {}) {
+    const rendered = renderCanonHostInboundContent(message, materialized, renderOptions);
     const materializedIndexes = new Set(materialized.map((attachment) => attachment.index));
     const imageLinks = (message.attachments ?? []).flatMap((attachment, index) => {
         if (attachment.kind !== 'image' || materializedIndexes.has(index))
@@ -39,7 +39,7 @@ export function renderClaudeInboundContent(message, materialized = []) {
     });
     return imageLinks.length > 0 ? `${rendered}\n${imageLinks.join('\n')}` : rendered;
 }
-export function withClaudeReplyContextMediaReferences(replyContext, materialized) {
+export function withClaudeReplyContextMediaReferences(replyContext, materialized, renderOptions = {}) {
     if (!replyContext?.found)
         return replyContext;
     return {
@@ -50,7 +50,7 @@ export function withClaudeReplyContextMediaReferences(replyContext, materialized
             attachments: replyContext.attachments,
             contactCard: replyContext.contactCard,
             senderType: replyContext.senderType ?? undefined,
-        }, materialized),
+        }, materialized, renderOptions),
     };
 }
 /**

package/dist/host.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import { type PermissionResult, type SDKControlReloadPluginsResponse } from '@anthropic-ai/claude-agent-sdk';
+import { type RecoveryCheckpointTracker } from '@canonmsg/coding-agent-host';
 import { type CanonRuntimeCommandDescriptor, type HostInboundParticipantContext as InboundParticipantContext, type CanonReplyContext, type MessageCreatedPayload, type ResolvedAgentBehaviorPolicy, type TurnVerbosityConfig } from '@canonmsg/core';
 /**
  * `--turn-verbosity` beats `CANON_TURN_VERBOSITY`; `null` means "unset, use the
@@ -24,7 +25,9 @@ export declare function buildClaudePlanAllowResult(input: Record<string, unknown
  * through. Canon-injected aliases keep precedence over native names.
  */
 export declare function buildNativeSlashCommandDescriptors(native: SDKControlReloadPluginsResponse['commands'], reservedAliases: ReadonlySet<string>): CanonRuntimeCommandDescriptor[];
+export declare function createClaudeRecoveryCheckpointTracker(persist: (messageId: string) => boolean): RecoveryCheckpointTracker;
 export declare const NO_REPLY_TOOL_NAME: string;
+export declare const REACH_OUT_TOOL_NAME = "mcp__canon__send_to";
 export declare function buildCanonPrompt(input: {
     content: string;
     conversationId: string;

package/dist/host.js

@@ -27,11 +27,11 @@ import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { query, } from '@anthropic-ai/claude-agent-sdk';
 import { materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
-import { captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, collectMissedInboundMessages, createReconnectRecoveryGate, STARTUP_RECOVERY_MAX_MESSAGES, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
+import { captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, collectMissedInboundMessages, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
 import { buildCanonUserContent, renderClaudeInboundContent, withClaudeReplyContextMediaReferences, } from './canon-user-content.js';
-import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, sendMessageWithRetry, sendMessageWithRetryChunked, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, formatPendingContactLifecycleContext, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, sendMessageWithRetry, sendMessageWithRetryChunked, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, readLocalRuntimeEntry, reconcileContactLifecycleEvents, recordLocalRuntimeContactLifecycleEvent, saveLocalRuntimeContactLifecycleCursor, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, resolveTurnVerbosity, shouldTriggerAgentTurn, takeLocalRuntimeContactLifecycleEvents, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { runCli } from '@canonmsg/core';
-import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer } from '@canonmsg/agent-tools';
+import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer, } from '@canonmsg/agent-tools';
 import { synthesizeClaudeApprovalDiff } from './approval-diff.js';
 import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
 import { applyClaudeSessionControl, boundClaudeFinalMetadata, buildClaudeFinalChunkingOptions, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudePendingFinalDelivery, buildClaudeTurnFailureNotice, buildTruncatedFinalText, buildUndeliverableFinalNotice, canDrainClaudeQueuedInput, beginClaudeAssistantResponse, claimClaudeTextSegmentId, claudeFinalWillChunk, classifyFinalDeliveryFailure, claudeInputOwnsTurnSlot, createClaudeTurnActivityState, decideClaudeControlSignalAction, decideClaudeInboundDispatch, dispatchClaudeInput, endClaudeAssistantResponse, isClaudeTurnSlotReserved, readClaudeFinalDeliveryResume, releaseClaudeTurnSlot, runClaudeExhaustedFinalDelivery, shouldApplyClaudeEchoedSessionState, shouldReleaseClaudeTurnSlot, isClaudeMainTurnMessage, openClaudeTurn, planClaudeAssistantTrail, planClaudeStreamingWrite, planClaudeToolCallStart, planClaudeToolProgress, planClaudeToolResults, claudeFinalTurnTrail, publishedClaudeTurnState, rememberDispatchedClaudeInput, resetClaudeTurnActivityState, shouldOpenClaudeTurnOnRunning, shouldStopTypingDotsOnStreamedText, isOpenClaudeTurnState, takeClaudeResultOwner, takeClaudeToolBlockIdByIndex, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeTurnFinal, describeUndeliveredClaudeFinal, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, shouldRouteClaudeTurnArtifacts, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
@@ -303,7 +303,11 @@ function buildClaudeRuntimeDescriptor(input) {
                 activation: { kind: 'control', controlId: 'permissionMode', value: 'plan' },
             },
         ],
-        admissionActions: HOST_ADMISSION_ACTIONS_DISABLED,
+        admissionActions: {
+            ...HOST_ADMISSION_ACTIONS_DISABLED,
+            requestContact: true,
+            reachOut: true,
+        },
         presentation: input.presentation,
         commands,
     });
@@ -421,6 +425,7 @@ async function loadSessionConfig(conversationId, agentId, rtdb) {
         agentId,
         rtdb,
         extraStringFields: ['permissionMode', 'effort'],
+        retryMissingMs: 3_000,
     });
     return {
         ...config,
@@ -728,6 +733,9 @@ const FINAL_DELIVERY_RETRY_MS = 30_000;
 // without delaying anything that was going to fail anyway.
 const MAX_FINAL_DELIVERY_RETRIES = 2;
 const CLAUDE_RECOVERY_CURSOR_WORKSPACE_ID = 'claude-recovery-cursor-v1';
+export function createClaudeRecoveryCheckpointTracker(persist) {
+    return createRecoveryCheckpointTracker(persist);
+}
 const CLAUDE_RUNTIME_CAPABILITIES = {
     ...DEFAULT_RUNTIME_CAPABILITIES,
     supportsInterrupt: true,
@@ -749,6 +757,16 @@ const CLAUDE_RUNTIME_CAPABILITIES = {
  */
 const NO_REPLY_VERB = 'no_reply';
 export const NO_REPLY_TOOL_NAME = `mcp__${CANON_VERB_MCP_SERVER_NAME}__${NO_REPLY_VERB}`;
+export const REACH_OUT_TOOL_NAME = `mcp__${CANON_VERB_MCP_SERVER_NAME}__send_to`;
+function ownerBoundRenderOptions(isOwner) {
+    const admissionActions = isOwner
+        ? { ...HOST_ADMISSION_ACTIONS_DISABLED, requestContact: true, reachOut: true }
+        : HOST_ADMISSION_ACTIONS_DISABLED;
+    return {
+        admissionActions,
+        ...(admissionActions.reachOut ? { reachOutToolName: REACH_OUT_TOOL_NAME } : {}),
+    };
+}
 export function buildCanonPrompt(input) {
     return renderCodingHostInboundPrompt(buildCanonInboundFrameV1(buildCanonTurnContextV2({
         content: input.content,
@@ -781,8 +799,8 @@ function resolveClaudeTurnModes(participantContext) {
         }),
     };
 }
-function renderInboundContent(message, materialized) {
-    return renderClaudeInboundContent(message, materialized);
+function renderInboundContent(message, materialized, renderOptions = {}) {
+    return renderClaudeInboundContent(message, materialized, renderOptions);
 }
 async function materializePromptReplyContext(input) {
     if (!input.replyContext?.found || !input.replyContext.attachments?.length) {
@@ -795,17 +813,27 @@ async function materializePromptReplyContext(input) {
         });
         return {
             ...result,
-            replyContext: withClaudeReplyContextMediaReferences(result.replyContext, result.materialized),
+            replyContext: withClaudeReplyContextMediaReferences(result.replyContext, result.materialized, input.renderOptions),
         };
     }
     catch (error) {
         console.error(`${input.logPrefix} Failed to materialize replied-to media:`, error instanceof Error ? error.message : error);
         return {
-            replyContext: withClaudeReplyContextMediaReferences(input.replyContext, []),
+            replyContext: withClaudeReplyContextMediaReferences(input.replyContext, [], input.renderOptions),
             materialized: [],
         };
     }
 }
+function ownerBoundReplyContactTarget(replyContext) {
+    const card = replyContext?.found ? replyContext.contactCard : undefined;
+    if (!card?.userId)
+        return undefined;
+    return {
+        targetUserId: card.userId,
+        ...(card.canonContactId ? { canonContactId: card.canonContactId } : {}),
+        sourceCardMessageId: replyContext.messageId,
+    };
+}
 // ── Session factory ─────────────────────────────────────────────────
 function createSession(conversationId, environment, agentId, client, typingSignals, runtimeState, onSessionEnd, onRuntimeDescriptorUpdate, config, resumeSessionId) {
     const { cwd } = environment;
@@ -824,7 +852,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             messageQueue.push(input);
         }
     };
-    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => {
+    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => {
         sendInput(createClaudeInputEnvelope({
             kind: 'canon',
             msg,
@@ -833,6 +861,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             markAccepted,
             isOwnerTurn,
             requestingUserId,
+            replyContactTarget,
             ...turnModes,
         }));
     };
@@ -979,6 +1008,23 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                     const turnKey = session.activeInput?.turnKey;
                     if (turnKey)
                         session.silencedTurnKeys.add(turnKey);
+                }, {
+                    ownerBoundCommunication: {
+                        getContext: () => {
+                            const input = session.activeInput;
+                            if (!input?.isOwnerTurn || !input.sourceMessageId)
+                                return null;
+                            return {
+                                isOwnerTurn: true,
+                                conversationId,
+                                sourceMessageId: input.sourceMessageId,
+                                ...(session.currentTurnId ? { turnId: session.currentTurnId } : {}),
+                                ...(input.replyContactTarget
+                                    ? { replyContactTarget: input.replyContactTarget }
+                                    : {}),
+                            };
+                        },
+                    },
                 }),
             },
         },
@@ -1168,7 +1214,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         environment,
         query: q,
         sendInput,
-        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted, isOwnerTurn, requestingUserId, turnModes),
+        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted, isOwnerTurn, requestingUserId, turnModes, replyContactTarget),
         state: {
             model: undefined,
             permissionMode: config.permissionMode,
@@ -1260,19 +1306,6 @@ function createSession(conversationId, environment, agentId, client, typingSigna
     function markInputCompleted(input) {
         if (input?.kind !== 'canon' || !input.sourceMessageId)
             return;
-        if (config.runtimeId) {
-            try {
-                saveRuntimeSessionState(config.runtimeId, {
-                    conversationId,
-                    baseCwd: config.recoveryBaseCwd ?? environment.baseCwd,
-                    workspaceId: CLAUDE_RECOVERY_CURSOR_WORKSPACE_ID,
-                    lastInboundMessageId: input.sourceMessageId,
-                });
-            }
-            catch (error) {
-                console.error(`[canon-host] [${conversationId.slice(0, 8)}] Failed to persist inbound recovery cursor:`, error instanceof Error ? error.message : error);
-            }
-        }
         config.onInputCompleted?.(input.sourceMessageId);
     }
     /**
@@ -1935,7 +1968,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
     function hasInterruptibleSdkInput() {
         return session.activeInput !== null && session.dispatchingInput === null;
     }
-    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => {
+    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => {
         session.lastActivity = Date.now();
         const input = createClaudeInputEnvelope({
             kind: 'canon',
@@ -1945,6 +1978,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             markAccepted,
             isOwnerTurn,
             requestingUserId,
+            replyContactTarget,
             ...turnModes,
         });
         const decision = decideClaudeInboundDispatch({
@@ -2533,6 +2567,15 @@ export async function main() {
         hostMode: true,
         rtdb,
     });
+    const recoveryCheckpointTrackers = new Map();
+    function recoveryCheckpointsFor(conversationId) {
+        let tracker = recoveryCheckpointTrackers.get(conversationId);
+        if (!tracker) {
+            tracker = createClaudeRecoveryCheckpointTracker((messageId) => persistConversationRecoveryCursor(conversationId, messageId));
+            recoveryCheckpointTrackers.set(conversationId, tracker);
+        }
+        return tracker;
+    }
     let streamConnected = false;
     const hostAvailableExecutionModes = [
         ...EXECUTION_ENVIRONMENT_MODES,
@@ -2844,6 +2887,7 @@ export async function main() {
             ownerName,
             membershipChange: pendingMembershipChanges.get(input.conversationId) ?? null,
             groupContextMode: getGroupContextMode(input.conversationId, conversation),
+            renderOptions: input.renderOptions,
         });
     }
     function closeSession(conversationId, options = {}) {
@@ -2944,10 +2988,12 @@ export async function main() {
         const session = sessions.get(conversationId);
         if (!session || session.pendingInputs.length === 0)
             return;
-        const before = session.pendingInputs.length;
-        session.pendingInputs = session.pendingInputs.filter((input) => input.sourceMessageId !== sourceMessageId);
-        if (session.pendingInputs.length === before)
+        const removed = session.pendingInputs.filter((input) => input.sourceMessageId === sourceMessageId);
+        if (removed.length === 0)
             return;
+        session.pendingInputs = session.pendingInputs.filter((input) => input.sourceMessageId !== sourceMessageId);
+        for (const input of removed)
+            session.markInputCompleted(input);
         session.writeTurn();
     }
     function evictOldestIdle() {
@@ -3045,9 +3091,9 @@ export async function main() {
                     runtimeInputManager,
                     canRequestApproval: () => canRequestCanonApproval(conversationId),
                     runtimeId,
-                    recoveryBaseCwd: workingDir,
                     ownerId,
                     onInputCompleted: (sourceMessageId) => {
+                        recoveryCheckpointsFor(conversationId).settle(sourceMessageId);
                         settleInboundMessageId(sourceMessageId, true);
                     },
                     publishSessionSnapshots: (ids) => { void publishSessionSnapshots(ids); },
@@ -3105,13 +3151,15 @@ export async function main() {
         }
         const sender = m.senderName || m.senderId;
         const isOwner = m.isOwner ?? (ownerId != null && m.senderId === ownerId);
-        const content = renderInboundContent(m, materialized);
+        const renderOptions = ownerBoundRenderOptions(isOwner);
+        const content = renderInboundContent(m, materialized, renderOptions);
         const hydrated = await loadHydratedInboundContext({
             conversationId: input.conversationId,
             message: m,
             senderName: sender,
             isOwner,
             hydratedPage: input.hydratedPage,
+            renderOptions,
         });
         const behavior = input.hydratedPage?.behavior ?? hydrated.behavior;
         const activeSelfContextId = hydrated.activeSelfContextId;
@@ -3121,6 +3169,7 @@ export async function main() {
             agentId,
             conversationId: input.conversationId,
             logPrefix: `[canon-host] [${input.conversationId.slice(0, 8)}]`,
+            renderOptions,
         });
         const replyContext = replyMedia.replyContext;
         const participantContext = hydrated.participantContext;
@@ -3153,7 +3202,7 @@ export async function main() {
             return 'handled';
         }
         session.activeSelfContextId = activeSelfContextId;
-        const promptText = buildCanonPrompt({
+        const basePromptText = buildCanonPrompt({
             content,
             conversationId: input.conversationId,
             participantContext,
@@ -3164,6 +3213,12 @@ export async function main() {
             replyContext,
             message: m,
         });
+        const lifecycleContext = isOwner
+            ? formatPendingContactLifecycleContext(takeLocalRuntimeContactLifecycleEvents(runtimeId, input.conversationId))
+            : null;
+        const promptText = lifecycleContext
+            ? `${basePromptText}\n\n${lifecycleContext}`
+            : basePromptText;
         const messageContent = await buildCanonUserContent({
             promptText,
             materialized: [...replyMedia.materialized, ...materialized],
@@ -3181,7 +3236,7 @@ export async function main() {
                 senderId: m.senderId,
                 senderName: m.senderName,
             }),
-        }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes);
+        }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes, ownerBoundReplyContactTarget(replyContext));
         return 'queued';
     }
     const acceptedInboundMessageIds = new Set();
@@ -3239,16 +3294,65 @@ export async function main() {
             workspaceId: CLAUDE_RECOVERY_CURSOR_WORKSPACE_ID,
         })?.lastInboundMessageId ?? null;
     }
+    function persistConversationRecoveryCursor(conversationId, messageId) {
+        try {
+            saveRuntimeSessionState(runtimeId, {
+                conversationId,
+                baseCwd: workingDir,
+                workspaceId: CLAUDE_RECOVERY_CURSOR_WORKSPACE_ID,
+                lastInboundMessageId: messageId,
+            });
+            return true;
+        }
+        catch (error) {
+            console.error(`[canon-host] [${conversationId.slice(0, 8)}] Failed to persist inbound recovery cursor:`, error instanceof Error ? error.message : error);
+            return false;
+        }
+    }
+    let startupRecoveryComplete = false;
     async function performMissedInboundRecovery() {
+        const knownBeforeRefresh = new Set(knownConversationIds);
+        await refreshKnownConversationIds(true);
+        const conversationsDiscoveredWhileOffline = startupRecoveryComplete
+            ? new Set([...knownConversationIds].filter((id) => !knownBeforeRefresh.has(id)))
+            : new Set();
+        try {
+            let cursor = readLocalRuntimeEntry(runtimeId)?.contactLifecycleCursor ?? null;
+            for (let pageNumber = 0; pageNumber < 10; pageNumber += 1) {
+                const page = await client.listContactRequestLifecyclePage({
+                    cursor,
+                    limit: 100,
+                });
+                await reconcileContactLifecycleEvents({
+                    requests: page.requests,
+                    requesterId: agentId,
+                    record: (request) => recordLocalRuntimeContactLifecycleEvent(runtimeId, request),
+                });
+                cursor = page.nextCursor;
+                saveLocalRuntimeContactLifecycleCursor(runtimeId, cursor);
+                if (!page.hasMore)
+                    break;
+            }
+        }
+        catch (error) {
+            console.error('[canon-host] Contact lifecycle recovery failed:', error instanceof Error ? error.message : error);
+        }
         for (const conversationId of knownConversationIds) {
+            const recoveryCheckpoints = recoveryCheckpointsFor(conversationId);
+            const recoveryBatch = recoveryCheckpoints.reserveBatch();
             try {
                 const recovered = await collectMissedInboundMessages({
                     fetchPage: (before) => client.getMessagesPage(conversationId, STARTUP_RECOVERY_PAGE_SIZE, before),
                     cursor: persistedConversationCursor(conversationId),
                     agentId,
+                    requireContiguousCursor: true,
+                    noCursorMode: conversationsDiscoveredWhileOffline.has(conversationId)
+                        ? 'bounded-window'
+                        : 'latest-only',
                 });
-                if (recovered.mode === 'truncated-window') {
-                    console.error(`[canon-host] [${conversationId.slice(0, 8)}] Recovery cursor was not found within ${STARTUP_RECOVERY_MAX_MESSAGES} messages; replaying the bounded recent window`);
+                recoveryBatch.commit(recovered.messages.map((message) => message.id), recovered.mode === 'incomplete-gap' ? recovered.recoveryCursor : null);
+                if (recovered.mode === 'incomplete-gap') {
+                    console.error(`[canon-host] [${conversationId.slice(0, 8)}] recovery_incomplete_gap: cursor is missing; replaying ${recovered.messages.length} bounded inbound message(s) before advancing to ${recovered.recoveryCursor ?? 'no cursor'}`);
                 }
                 for (const message of recovered.messages) {
                     if (!claimInboundMessageId(message.id))
@@ -3268,8 +3372,10 @@ export async function main() {
                                 }) === 'queued';
                             }
                         }
-                        if (!queued)
+                        if (!queued) {
+                            recoveryCheckpoints.settle(message.id);
                             settleInboundMessageId(message.id, true);
+                        }
                     }
                     catch (error) {
                         settleInboundMessageId(message.id, false);
@@ -3281,21 +3387,14 @@ export async function main() {
                 }
             }
             catch (error) {
+                recoveryBatch.cancel();
                 console.error(`[canon-host] [${conversationId.slice(0, 8)}] Startup recovery failed:`, error instanceof Error ? error.message : error);
             }
         }
+        startupRecoveryComplete = true;
     }
-    let recoveryInFlight = null;
-    function recoverMissedInboundMessages() {
-        if (recoveryInFlight)
-            return recoveryInFlight;
-        recoveryInFlight = performMissedInboundRecovery().finally(() => {
-            recoveryInFlight = null;
-        });
-        return recoveryInFlight;
-    }
-    const shouldRecoverAfterStreamConnect = createReconnectRecoveryGate();
-    await recoverMissedInboundMessages();
+    const reconnectRecovery = createReconnectRecoveryCoordinator(performMissedInboundRecovery);
+    await reconnectRecovery.recoverNow();
     // ── Connect SSE stream for inbound Canon messages ──
     const stream = new CanonStream({
         apiKey,
@@ -3306,11 +3405,13 @@ export async function main() {
                 const m = payload.message;
                 if (m.senderId === agentId)
                     return;
+                const convoId = payload.conversationId;
                 if (!claimInboundMessageId(m.id))
                     return;
-                const convoId = payload.conversationId;
+                recoveryCheckpointsFor(convoId).track(m.id);
                 knownConversationIds.add(convoId);
                 if (handleRuntimeReplyMessage(convoId, m)) {
+                    recoveryCheckpointsFor(convoId).settle(m.id);
                     settleInboundMessageId(m.id, true);
                     return;
                 }
@@ -3318,6 +3419,7 @@ export async function main() {
                 const isOwner = m.isOwner ?? (ownerId != null && m.senderId === ownerId);
                 if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
                     console.error(`[canon-host] [${convoId.slice(0, 8)}] Ignoring server-dispatched observe-only message: ${payload.turnDispatch.reason}`);
+                    recoveryCheckpointsFor(convoId).settle(m.id);
                     settleInboundMessageId(m.id, true);
                     return;
                 }
@@ -3334,7 +3436,8 @@ export async function main() {
                             console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to materialize media:`, error instanceof Error ? error.message : error);
                         }
                     }
-                    const content = renderInboundContent(m, materialized);
+                    const renderOptions = ownerBoundRenderOptions(isOwner);
+                    const content = renderInboundContent(m, materialized, renderOptions);
                     const hydrated = await loadHydratedInboundContext({
                         conversationId: convoId,
                         message: m,
@@ -3343,6 +3446,7 @@ export async function main() {
                         activeSelfContextId: payload.activeSelfContextId,
                         selfContexts: payload.selfContexts,
                         provenance: payload.provenance,
+                        renderOptions,
                     });
                     const behavior = payload.behavior ?? hydrated.behavior;
                     const activeSelfContextId = hydrated.activeSelfContextId;
@@ -3352,6 +3456,7 @@ export async function main() {
                         agentId,
                         conversationId: convoId,
                         logPrefix: `[canon-host] [${convoId.slice(0, 8)}]`,
+                        renderOptions,
                     });
                     const replyContext = replyMedia.replyContext;
                     const participantContext = hydrated.participantContext;
@@ -3390,7 +3495,7 @@ export async function main() {
                         return false;
                     }
                     session.activeSelfContextId = activeSelfContextId;
-                    const promptText = buildCanonPrompt({
+                    const basePromptText = buildCanonPrompt({
                         content,
                         conversationId: convoId,
                         participantContext,
@@ -3401,6 +3506,12 @@ export async function main() {
                         replyContext,
                         message: m,
                     });
+                    const lifecycleContext = isOwner
+                        ? formatPendingContactLifecycleContext(takeLocalRuntimeContactLifecycleEvents(runtimeId, convoId))
+                        : null;
+                    const promptText = lifecycleContext
+                        ? `${basePromptText}\n\n${lifecycleContext}`
+                        : basePromptText;
                     const messageContent = await buildCanonUserContent({
                         promptText,
                         materialized: [...replyMedia.materialized, ...materialized],
@@ -3418,11 +3529,13 @@ export async function main() {
                             senderId: m.senderId,
                             senderName: m.senderName,
                         }),
-                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes);
+                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes, ownerBoundReplyContactTarget(replyContext));
                     return true;
                 })().then((queued) => {
-                    if (!queued)
+                    if (!queued) {
+                        recoveryCheckpointsFor(convoId).settle(m.id);
                         settleInboundMessageId(m.id, true);
+                    }
                 }).catch((error) => {
                     settleInboundMessageId(m.id, false);
                     console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to process inbound message:`, error instanceof Error ? error.message : error);
@@ -3434,12 +3547,24 @@ export async function main() {
             onConversationUpdated: (payload) => {
                 handleConversationUpdated(payload);
             },
+            onContactRequestUpdated: (payload) => {
+                if (payload.requesterId !== agentId || !payload.sourceConversationId)
+                    return;
+                recordLocalRuntimeContactLifecycleEvent(runtimeId, payload);
+            },
+            onReplayExpired: () => {
+                void reconnectRecovery.onReplayExpired().catch((error) => {
+                    console.error('[canon-host] Replay-expired recovery failed:', error);
+                });
+            },
             onConnected: () => {
                 streamConnected = true;
                 void publishRuntimeHeartbeat();
-                if (shouldRecoverAfterStreamConnect()) {
-                    void recoverMissedInboundMessages();
-                }
+                const recovery = reconnectRecovery.onConnected();
+                if (recovery)
+                    void recovery.catch((error) => {
+                        console.error('[canon-host] Reconnect recovery failed:', error);
+                    });
                 console.error('[canon-host] SSE connected');
             },
             onDisconnected: () => {

package/dist/register.js

@@ -37,6 +37,7 @@ After approval, start it with CANON_AGENT=<profile> canon-claude --cwd /path/to/
 const OPTIONS = {
     moduleUrl: import.meta.url,
     clientType: 'claude-code',
+    sessionSetupPolicy: 'runtime_descriptor_required',
     cliName: 'canon-register',
     hostBinName: 'canon-claude',
     developerInfo: 'Claude Code plugin',

package/dist/server.js

@@ -16,7 +16,8 @@ import { ApprovalHttpServer } from './approval-server.js';
 import { renderClaudeInboundContent } from './canon-user-content.js';
 import { runCli } from '@canonmsg/core';
 import { parseReplyArgs, parseSendMessageArgs, parseSetTypingArgs, } from './mcp-args.js';
-import { canonVerbToolDefinitions, executeCanonVerbTool, isCanonToolVerb, stampSendToTurnComplete, } from '@canonmsg/agent-tools';
+import { OWNER_BOUND_CANON_COMMUNICATION_VERBS, canonVerbToolDefinitions, executeCanonVerbTool, isCanonToolVerb, stampSendToTurnComplete, } from '@canonmsg/agent-tools';
+const OWNER_BOUND_COMMUNICATION_VERBS = new Set(OWNER_BOUND_CANON_COMMUNICATION_VERBS);
 const HELP = `canon-channel-server — Claude Code MCP channel server for Canon
 
 USAGE
@@ -174,7 +175,7 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         // Canonical verbs — projections of canon.verbs.v1 (@canonmsg/agent-tools).
         // Channel mode owns no turn, so `no_reply` is an ack-only no-op here: the
         // standalone session has no final delivery for it to suppress.
-        ...canonVerbToolDefinitions(),
+        ...canonVerbToolDefinitions().filter((definition) => !OWNER_BOUND_COMMUNICATION_VERBS.has(definition.name)),
     ],
 }));
 // ── Tool handlers ──────────────────────────────────────────────────────
@@ -314,6 +315,9 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         default: {
             const name = request.params.name;
+            if (OWNER_BOUND_COMMUNICATION_VERBS.has(name)) {
+                return toolArgumentError(`${name} requires an owner-authored Canon turn and is unavailable in standalone channel mode.`);
+            }
             if (isCanonToolVerb(name)) {
                 const rawArgs = args && typeof args === 'object' ? { ...args } : {};
                 const verbArgs = name === 'send_to' ? stampSendToTurnComplete(rawArgs) : rawArgs;

package/dist/session-state.d.ts

@@ -1,5 +1,6 @@
 import type { PermissionMode, SDKMessageOrigin, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { DeliveryIntent, ModelOption, RuntimeStreamingPayload, TurnLifecycleState, TurnOutputBlock, TurnOutputSnapshot, TurnVerbosity } from '@canonmsg/core';
+import type { OwnerBoundCanonContactTarget } from '@canonmsg/agent-tools';
 import type { TurnArtifactRoutingDecision, TurnArtifactSnapshot } from '@canonmsg/coding-agent-host';
 export type ClaudeInputKind = 'seed' | 'canon';
 export type ClaudeArtifactRoutingMode = 'workspace-generated' | 'disabled';
@@ -23,6 +24,8 @@ export interface ClaudeInputEnvelope {
     turnKey: string;
     isOwnerTurn: boolean;
     requestingUserId: string | null;
+    /** Trusted contact-card target resolved from the owner message's reply. */
+    replyContactTarget?: OwnerBoundCanonContactTarget;
 }
 /**
  * The per-turn modes an inbound message resolves from its participant context,
@@ -102,6 +105,7 @@ export declare function createClaudeInputEnvelope(input: {
     artifactBaseline?: TurnArtifactSnapshot | null;
     isOwnerTurn?: boolean;
     requestingUserId?: string | null;
+    replyContactTarget?: OwnerBoundCanonContactTarget;
 }): ClaudeInputEnvelope;
 export declare function resolveClaudeTurnResponseRouting(turn: Pick<ClaudeInputEnvelope, 'kind' | 'isOwnerTurn' | 'requestingUserId'> | null | undefined, ownerId: string | null | undefined, ownerOnly?: boolean): {
     isOwnerTurn: boolean;

package/dist/session-state.js

@@ -28,6 +28,9 @@ export function createClaudeInputEnvelope(input) {
         requestingUserId: input.kind === 'canon' && input.requestingUserId
             ? input.requestingUserId
             : null,
+        ...(input.kind === 'canon' && input.replyContactTarget
+            ? { replyContactTarget: input.replyContactTarget }
+            : {}),
         turnKey: input.kind === 'canon' && sourceMessageId
             ? `canon:${sourceMessageId}`
             : `${input.kind}:${fallbackId}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.31.4",
+  "version": "0.32.0",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",
@@ -31,10 +31,10 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.228",
-    "@canonmsg/agent-sdk": "^8.6.0",
-    "@canonmsg/agent-tools": "^0.5.3",
-    "@canonmsg/coding-agent-host": "^0.5.0",
-    "@canonmsg/core": "^10.4.0",
+    "@canonmsg/agent-sdk": "^8.9.0",
+    "@canonmsg/agent-tools": "^0.6.0",
+    "@canonmsg/coding-agent-host": "^0.6.0",
+    "@canonmsg/core": "^10.7.0",
     "@canonmsg/rich-cards": "^0.10.2",
     "@modelcontextprotocol/sdk": "^1.30.0"
   },