@canonmsg/claude-code-plugin 0.32.0 → 0.33.0

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "Canon",
   "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "channels": [
     {
       "server": "canon-channel",

package/dist/canon-user-content.d.ts

@@ -1,6 +1,6 @@
 import type { SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import { type AnthropicImageBudgetOptions, type MaterializedCanonAttachment } from '@canonmsg/agent-sdk';
-import { renderCanonHostInboundContent, type CanonReplyContext, type HostInboundContentRenderOptions } from '@canonmsg/core';
+import { renderCanonHostInboundContent, type CanonReplyContext } from '@canonmsg/core';
 type ClaudeRenderableInboundMessage = Parameters<typeof renderCanonHostInboundContent>[0];
 /**
  * Claude-only rendering policy for Canon media. Core deliberately omits all
@@ -8,8 +8,8 @@ type ClaudeRenderableInboundMessage = Parameters<typeof renderCanonHostInboundCo
  * that the bounded runtime did not materialize, while materialized images keep
  * their local-path placeholder without a duplicate link.
  */
-export declare function renderClaudeInboundContent(message: ClaudeRenderableInboundMessage, materialized?: ReadonlyArray<MaterializedCanonAttachment>, renderOptions?: HostInboundContentRenderOptions): string;
-export declare function withClaudeReplyContextMediaReferences(replyContext: CanonReplyContext | null, materialized: ReadonlyArray<MaterializedCanonAttachment>, renderOptions?: HostInboundContentRenderOptions): CanonReplyContext | null;
+export declare function renderClaudeInboundContent(message: ClaudeRenderableInboundMessage, materialized?: ReadonlyArray<MaterializedCanonAttachment>): string;
+export declare function withClaudeReplyContextMediaReferences(replyContext: CanonReplyContext | null, materialized: ReadonlyArray<MaterializedCanonAttachment>): CanonReplyContext | null;
 /**
  * Build the Claude Code SDK's multimodal user content without allowing native
  * image blocks to consume the whole request. The prompt text is preserved

package/dist/canon-user-content.js

@@ -28,8 +28,8 @@ function validatedPromptAttachmentUrl(value) {
  * that the bounded runtime did not materialize, while materialized images keep
  * their local-path placeholder without a duplicate link.
  */
-export function renderClaudeInboundContent(message, materialized = [], renderOptions = {}) {
-    const rendered = renderCanonHostInboundContent(message, materialized, renderOptions);
+export function renderClaudeInboundContent(message, materialized = []) {
+    const rendered = renderCanonHostInboundContent(message, materialized);
     const materializedIndexes = new Set(materialized.map((attachment) => attachment.index));
     const imageLinks = (message.attachments ?? []).flatMap((attachment, index) => {
         if (attachment.kind !== 'image' || materializedIndexes.has(index))
@@ -39,7 +39,7 @@ export function renderClaudeInboundContent(message, materialized = [], renderOpt
     });
     return imageLinks.length > 0 ? `${rendered}\n${imageLinks.join('\n')}` : rendered;
 }
-export function withClaudeReplyContextMediaReferences(replyContext, materialized, renderOptions = {}) {
+export function withClaudeReplyContextMediaReferences(replyContext, materialized) {
     if (!replyContext?.found)
         return replyContext;
     return {
@@ -50,7 +50,7 @@ export function withClaudeReplyContextMediaReferences(replyContext, materialized
             attachments: replyContext.attachments,
             contactCard: replyContext.contactCard,
             senderType: replyContext.senderType ?? undefined,
-        }, materialized, renderOptions),
+        }, materialized),
     };
 }
 /**

package/dist/host.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { type PermissionResult, type SDKControlReloadPluginsResponse } from '@anthropic-ai/claude-agent-sdk';
 import { type RecoveryCheckpointTracker } from '@canonmsg/coding-agent-host';
-import { type CanonRuntimeCommandDescriptor, type HostInboundParticipantContext as InboundParticipantContext, type CanonReplyContext, type MessageCreatedPayload, type ResolvedAgentBehaviorPolicy, type TurnVerbosityConfig } from '@canonmsg/core';
+import { type CanonRuntimeCommandDescriptor, type ExecutionEnvironmentMode, type HostInboundParticipantContext as InboundParticipantContext, type CanonReplyContext, type MessageCreatedPayload, type ResolvedAgentBehaviorPolicy, type TurnVerbosityConfig } from '@canonmsg/core';
 /**
  * `--turn-verbosity` beats `CANON_TURN_VERBOSITY`; `null` means "unset, use the
  * per-conversation-type default".
@@ -25,9 +25,11 @@ export declare function buildClaudePlanAllowResult(input: Record<string, unknown
  * through. Canon-injected aliases keep precedence over native names.
  */
 export declare function buildNativeSlashCommandDescriptors(native: SDKControlReloadPluginsResponse['commands'], reservedAliases: ReadonlySet<string>): CanonRuntimeCommandDescriptor[];
+export declare function resolveSessionExecutionMode(config: {
+    executionMode?: ExecutionEnvironmentMode;
+} | null | undefined, defaultExecutionMode?: ExecutionEnvironmentMode): ExecutionEnvironmentMode;
 export declare function createClaudeRecoveryCheckpointTracker(persist: (messageId: string) => boolean): RecoveryCheckpointTracker;
 export declare const NO_REPLY_TOOL_NAME: string;
-export declare const REACH_OUT_TOOL_NAME = "mcp__canon__send_to";
 export declare function buildCanonPrompt(input: {
     content: string;
     conversationId: string;

package/dist/host.js

@@ -29,9 +29,9 @@ import { query, } from '@anthropic-ai/claude-agent-sdk';
 import { materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, collectMissedInboundMessages, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
 import { buildCanonUserContent, renderClaudeInboundContent, withClaudeReplyContextMediaReferences, } from './canon-user-content.js';
-import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, formatPendingContactLifecycleContext, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, sendMessageWithRetry, sendMessageWithRetryChunked, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, readLocalRuntimeEntry, reconcileContactLifecycleEvents, recordLocalRuntimeContactLifecycleEvent, saveLocalRuntimeContactLifecycleCursor, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, resolveTurnVerbosity, shouldTriggerAgentTurn, takeLocalRuntimeContactLifecycleEvents, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, ExecutionEnvironmentError, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, sendMessageWithRetry, sendMessageWithRetryChunked, loadHostSessionConfig, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, saveRuntimeSessionState, clearRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { runCli } from '@canonmsg/core';
-import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer, } from '@canonmsg/agent-tools';
+import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer } from '@canonmsg/agent-tools';
 import { synthesizeClaudeApprovalDiff } from './approval-diff.js';
 import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
 import { applyClaudeSessionControl, boundClaudeFinalMetadata, buildClaudeFinalChunkingOptions, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudePendingFinalDelivery, buildClaudeTurnFailureNotice, buildTruncatedFinalText, buildUndeliverableFinalNotice, canDrainClaudeQueuedInput, beginClaudeAssistantResponse, claimClaudeTextSegmentId, claudeFinalWillChunk, classifyFinalDeliveryFailure, claudeInputOwnsTurnSlot, createClaudeTurnActivityState, decideClaudeControlSignalAction, decideClaudeInboundDispatch, dispatchClaudeInput, endClaudeAssistantResponse, isClaudeTurnSlotReserved, readClaudeFinalDeliveryResume, releaseClaudeTurnSlot, runClaudeExhaustedFinalDelivery, shouldApplyClaudeEchoedSessionState, shouldReleaseClaudeTurnSlot, isClaudeMainTurnMessage, openClaudeTurn, planClaudeAssistantTrail, planClaudeStreamingWrite, planClaudeToolCallStart, planClaudeToolProgress, planClaudeToolResults, claudeFinalTurnTrail, publishedClaudeTurnState, rememberDispatchedClaudeInput, resetClaudeTurnActivityState, shouldOpenClaudeTurnOnRunning, shouldStopTypingDotsOnStreamedText, isOpenClaudeTurnState, takeClaudeResultOwner, takeClaudeToolBlockIdByIndex, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeTurnFinal, describeUndeliveredClaudeFinal, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, shouldRouteClaudeTurnArtifacts, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
@@ -53,6 +53,8 @@ COMMON FLAGS
   --cwd <path>             Project directory to run Claude Code from
   --workspace <path>       Additional project to expose in Canon
   --workspace-root <path>  Discover projects under an approved root
+  --default-execution-mode <worktree|locked>
+                          Default for new Canon conversations
   --runtime-visibility <normal|minimal|full>
                           Detail visibility preset
   --show-runtime-detail <field>
@@ -271,6 +273,7 @@ function buildClaudeRuntimeDescriptor(input) {
         workspaces: input.workspaces,
         workspaceRoots: input.workspaceRoots,
         executionModes: input.executionModes,
+        defaultExecutionMode: input.defaultExecutionMode,
         permissionModes: CLAUDE_PERMISSION_MODE_OPTIONS,
         defaultPermissionMode: 'default',
         effortOptions: [...EFFORT_OPTIONS],
@@ -303,11 +306,7 @@ function buildClaudeRuntimeDescriptor(input) {
                 activation: { kind: 'control', controlId: 'permissionMode', value: 'plan' },
             },
         ],
-        admissionActions: {
-            ...HOST_ADMISSION_ACTIONS_DISABLED,
-            requestContact: true,
-            reachOut: true,
-        },
+        admissionActions: HOST_ADMISSION_ACTIONS_DISABLED,
         presentation: input.presentation,
         commands,
     });
@@ -425,7 +424,6 @@ async function loadSessionConfig(conversationId, agentId, rtdb) {
         agentId,
         rtdb,
         extraStringFields: ['permissionMode', 'effort'],
-        retryMissingMs: 3_000,
     });
     return {
         ...config,
@@ -436,10 +434,15 @@ async function loadSessionConfig(conversationId, agentId, rtdb) {
         ultracode: parseClaudeUltracodeMode(config?.runtimeControlValues?.ultracode),
     };
 }
-function resolveSessionExecutionMode(config) {
-    if (config?.executionMode)
-        return config.executionMode;
-    throw new ExecutionEnvironmentError('Session config is missing an execution mode.', 'Choose Isolated worktree or Use shared project before starting this coding session.');
+export function resolveSessionExecutionMode(config, defaultExecutionMode = 'worktree') {
+    return config?.executionMode ?? defaultExecutionMode;
+}
+function resolveConfiguredDefaultExecutionMode(value) {
+    if (value == null || value === '')
+        return 'worktree';
+    if (value === 'worktree' || value === 'locked')
+        return value;
+    throw new Error('--default-execution-mode must be worktree or locked');
 }
 function resolveWorkspaceCwd(config) {
     return resolveHostWorkspaceCwd({
@@ -757,16 +760,6 @@ const CLAUDE_RUNTIME_CAPABILITIES = {
  */
 const NO_REPLY_VERB = 'no_reply';
 export const NO_REPLY_TOOL_NAME = `mcp__${CANON_VERB_MCP_SERVER_NAME}__${NO_REPLY_VERB}`;
-export const REACH_OUT_TOOL_NAME = `mcp__${CANON_VERB_MCP_SERVER_NAME}__send_to`;
-function ownerBoundRenderOptions(isOwner) {
-    const admissionActions = isOwner
-        ? { ...HOST_ADMISSION_ACTIONS_DISABLED, requestContact: true, reachOut: true }
-        : HOST_ADMISSION_ACTIONS_DISABLED;
-    return {
-        admissionActions,
-        ...(admissionActions.reachOut ? { reachOutToolName: REACH_OUT_TOOL_NAME } : {}),
-    };
-}
 export function buildCanonPrompt(input) {
     return renderCodingHostInboundPrompt(buildCanonInboundFrameV1(buildCanonTurnContextV2({
         content: input.content,
@@ -799,8 +792,8 @@ function resolveClaudeTurnModes(participantContext) {
         }),
     };
 }
-function renderInboundContent(message, materialized, renderOptions = {}) {
-    return renderClaudeInboundContent(message, materialized, renderOptions);
+function renderInboundContent(message, materialized) {
+    return renderClaudeInboundContent(message, materialized);
 }
 async function materializePromptReplyContext(input) {
     if (!input.replyContext?.found || !input.replyContext.attachments?.length) {
@@ -813,27 +806,17 @@ async function materializePromptReplyContext(input) {
         });
         return {
             ...result,
-            replyContext: withClaudeReplyContextMediaReferences(result.replyContext, result.materialized, input.renderOptions),
+            replyContext: withClaudeReplyContextMediaReferences(result.replyContext, result.materialized),
         };
     }
     catch (error) {
         console.error(`${input.logPrefix} Failed to materialize replied-to media:`, error instanceof Error ? error.message : error);
         return {
-            replyContext: withClaudeReplyContextMediaReferences(input.replyContext, [], input.renderOptions),
+            replyContext: withClaudeReplyContextMediaReferences(input.replyContext, []),
             materialized: [],
         };
     }
 }
-function ownerBoundReplyContactTarget(replyContext) {
-    const card = replyContext?.found ? replyContext.contactCard : undefined;
-    if (!card?.userId)
-        return undefined;
-    return {
-        targetUserId: card.userId,
-        ...(card.canonContactId ? { canonContactId: card.canonContactId } : {}),
-        sourceCardMessageId: replyContext.messageId,
-    };
-}
 // ── Session factory ─────────────────────────────────────────────────
 function createSession(conversationId, environment, agentId, client, typingSignals, runtimeState, onSessionEnd, onRuntimeDescriptorUpdate, config, resumeSessionId) {
     const { cwd } = environment;
@@ -852,7 +835,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             messageQueue.push(input);
         }
     };
-    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => {
+    let enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => {
         sendInput(createClaudeInputEnvelope({
             kind: 'canon',
             msg,
@@ -861,7 +844,6 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             markAccepted,
             isOwnerTurn,
             requestingUserId,
-            replyContactTarget,
             ...turnModes,
         }));
     };
@@ -1008,24 +990,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                     const turnKey = session.activeInput?.turnKey;
                     if (turnKey)
                         session.silencedTurnKeys.add(turnKey);
-                }, {
-                    ownerBoundCommunication: {
-                        getContext: () => {
-                            const input = session.activeInput;
-                            if (!input?.isOwnerTurn || !input.sourceMessageId)
-                                return null;
-                            return {
-                                isOwnerTurn: true,
-                                conversationId,
-                                sourceMessageId: input.sourceMessageId,
-                                ...(session.currentTurnId ? { turnId: session.currentTurnId } : {}),
-                                ...(input.replyContactTarget
-                                    ? { replyContactTarget: input.replyContactTarget }
-                                    : {}),
-                            };
-                        },
-                    },
-                }),
+                }, { communication: config.communicationEnabled !== false }),
             },
         },
         ...(claudeCliPath ? { pathToClaudeCodeExecutable: claudeCliPath } : {}),
@@ -1214,7 +1179,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         environment,
         query: q,
         sendInput,
-        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted, isOwnerTurn, requestingUserId, turnModes, replyContactTarget),
+        enqueueInbound: (msg, intent = 'queue', sourceMessageId, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => enqueueInboundMessage(msg, intent, sourceMessageId, markAccepted, isOwnerTurn, requestingUserId, turnModes),
         state: {
             model: undefined,
             permissionMode: config.permissionMode,
@@ -1968,7 +1933,7 @@ function createSession(conversationId, environment, agentId, client, typingSigna
     function hasInterruptibleSdkInput() {
         return session.activeInput !== null && session.dispatchingInput === null;
     }
-    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}, replyContactTarget) => {
+    enqueueInboundMessage = (msg, intent = 'queue', sourceMessageId = null, markAccepted = false, isOwnerTurn = false, requestingUserId = null, turnModes = {}) => {
         session.lastActivity = Date.now();
         const input = createClaudeInputEnvelope({
             kind: 'canon',
@@ -1978,7 +1943,6 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             markAccepted,
             isOwnerTurn,
             requestingUserId,
-            replyContactTarget,
             ...turnModes,
         });
         const decision = decideClaudeInboundDispatch({
@@ -2430,11 +2394,13 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                 availableModels: modelList,
                 availableWorkspaces: buildPublicWorkspaceOptions(workspaceOptions),
                 availableExecutionModes: config.availableExecutionModes,
+                defaultExecutionMode: config.defaultExecutionMode,
                 runtimeDescriptor: buildClaudeRuntimeDescriptor({
                     models: modelList,
                     workspaces: buildPublicWorkspaceOptions(workspaceOptions),
                     workspaceRoots: workspaceRootMetadata,
                     executionModes: config.availableExecutionModes,
+                    defaultExecutionMode: config.defaultExecutionMode,
                     presentation: config.runtimePresentation,
                 }),
             });
@@ -2464,6 +2430,7 @@ export async function main() {
             cwd: { type: 'string' },
             workspace: { type: 'string', multiple: true },
             'workspace-root': { type: 'string', multiple: true },
+            'default-execution-mode': { type: 'string' },
             'runtime-visibility': { type: 'string' },
             'show-runtime-detail': { type: 'string', multiple: true },
             'hide-runtime-detail': { type: 'string', multiple: true },
@@ -2476,6 +2443,7 @@ export async function main() {
         env: process.env.CANON_TURN_VERBOSITY,
         onWarning: (message) => console.error(`[canon-host] ${message}`),
     });
+    const defaultExecutionMode = resolveConfiguredDefaultExecutionMode(args['default-execution-mode']);
     workingDir = (typeof args.cwd === 'string' ? args.cwd : null) || process.cwd();
     const configuredWorkspaces = (args.workspace ?? []).filter((value) => typeof value === 'string');
     const configuredWorkspaceRoots = (args['workspace-root'] ?? []).filter((value) => typeof value === 'string');
@@ -2516,11 +2484,13 @@ export async function main() {
     let agentId;
     let ownerId = null;
     let ownerName = null;
+    let communicationEnabled = true;
     try {
         const ctx = await client.getAgentMe();
         agentId = ctx.agentId;
         ownerId = ctx.ownerId;
         ownerName = ctx.ownerName;
+        communicationEnabled = ctx.outboundPolicy !== 'closed';
         console.error(`[canon-host] Connected as ${ctx.displayName || agentId}`);
     }
     catch {
@@ -2567,15 +2537,6 @@ export async function main() {
         hostMode: true,
         rtdb,
     });
-    const recoveryCheckpointTrackers = new Map();
-    function recoveryCheckpointsFor(conversationId) {
-        let tracker = recoveryCheckpointTrackers.get(conversationId);
-        if (!tracker) {
-            tracker = createClaudeRecoveryCheckpointTracker((messageId) => persistConversationRecoveryCursor(conversationId, messageId));
-            recoveryCheckpointTrackers.set(conversationId, tracker);
-        }
-        return tracker;
-    }
     let streamConnected = false;
     const hostAvailableExecutionModes = [
         ...EXECUTION_ENVIRONMENT_MODES,
@@ -2587,6 +2548,7 @@ export async function main() {
         hide: stringArgs(args['hide-runtime-detail']),
     });
     let runtimeDescriptor = {
+        defaultExecutionMode,
         defaultWorkspaceId: workspaceOptions[0]?.id,
         defaultPermissionMode: 'default',
         availablePermissionModes: [...CLAUDE_PERMISSION_MODE_OPTIONS],
@@ -2597,6 +2559,7 @@ export async function main() {
             workspaces: buildPublicWorkspaceOptions(workspaceOptions),
             workspaceRoots: workspaceRootMetadata,
             executionModes: hostAvailableExecutionModes,
+            defaultExecutionMode,
             presentation: runtimePresentation,
         }),
     };
@@ -2675,6 +2638,7 @@ export async function main() {
                     workspaces: buildPublicWorkspaceOptions(workspaceOptions),
                     workspaceRoots: workspaceRootMetadata,
                     executionModes: hostAvailableExecutionModes,
+                    defaultExecutionMode,
                     presentation: runtimePresentation,
                 }),
             };
@@ -2709,6 +2673,7 @@ export async function main() {
     try {
         runtimeModels = await detectRuntimeModels(workingDir);
         runtimeDescriptor = {
+            defaultExecutionMode,
             defaultWorkspaceId: workspaceOptions[0]?.id,
             defaultModel: runtimeModels[0]?.value,
             defaultPermissionMode: 'default',
@@ -2721,12 +2686,14 @@ export async function main() {
                 workspaces: buildPublicWorkspaceOptions(workspaceOptions),
                 workspaceRoots: workspaceRootMetadata,
                 executionModes: hostAvailableExecutionModes,
+                defaultExecutionMode,
                 presentation: runtimePresentation,
             }),
         };
     }
     catch {
         runtimeDescriptor = {
+            defaultExecutionMode,
             defaultWorkspaceId: workspaceOptions[0]?.id,
             defaultPermissionMode: 'default',
             availablePermissionModes: [...CLAUDE_PERMISSION_MODE_OPTIONS],
@@ -2737,6 +2704,7 @@ export async function main() {
                 workspaces: buildPublicWorkspaceOptions(workspaceOptions),
                 workspaceRoots: workspaceRootMetadata,
                 executionModes: hostAvailableExecutionModes,
+                defaultExecutionMode,
                 presentation: runtimePresentation,
             }),
         };
@@ -2759,6 +2727,15 @@ export async function main() {
     }
     // ── Session manager ──
     const sessions = new Map();
+    const recoveryCheckpointTrackers = new Map();
+    function recoveryCheckpointsFor(conversationId) {
+        let tracker = recoveryCheckpointTrackers.get(conversationId);
+        if (!tracker) {
+            tracker = createClaudeRecoveryCheckpointTracker((messageId) => persistConversationRecoveryCursor(conversationId, messageId));
+            recoveryCheckpointTrackers.set(conversationId, tracker);
+        }
+        return tracker;
+    }
     const approvalManager = ownerId ? new ApprovalManager(client, agentId, ownerId) : null;
     // Interactive runtime input (AskUserQuestion) works with or without an owner,
     // so its poll engine is always present. Create + poll fold onto the built-in
@@ -2887,7 +2864,6 @@ export async function main() {
             ownerName,
             membershipChange: pendingMembershipChanges.get(input.conversationId) ?? null,
             groupContextMode: getGroupContextMode(input.conversationId, conversation),
-            renderOptions: input.renderOptions,
         });
     }
     function closeSession(conversationId, options = {}) {
@@ -3025,7 +3001,7 @@ export async function main() {
         }
         const creation = (async () => {
             const config = await loadSessionConfig(conversationId, agentId, rtdb);
-            const sessionExecutionMode = resolveSessionExecutionMode(config);
+            const sessionExecutionMode = resolveSessionExecutionMode(config, defaultExecutionMode);
             const workspaceCwd = resolveWorkspaceCwd(config);
             const environment = prepareConversationEnvironment({
                 agentId,
@@ -3086,12 +3062,14 @@ export async function main() {
                     ultracode: config?.ultracode,
                     availableModels: runtimeModels,
                     availableExecutionModes: hostAvailableExecutionModes,
+                    defaultExecutionMode,
                     runtimePresentation,
                     approvalManager,
                     runtimeInputManager,
                     canRequestApproval: () => canRequestCanonApproval(conversationId),
                     runtimeId,
                     ownerId,
+                    communicationEnabled,
                     onInputCompleted: (sourceMessageId) => {
                         recoveryCheckpointsFor(conversationId).settle(sourceMessageId);
                         settleInboundMessageId(sourceMessageId, true);
@@ -3151,15 +3129,13 @@ export async function main() {
         }
         const sender = m.senderName || m.senderId;
         const isOwner = m.isOwner ?? (ownerId != null && m.senderId === ownerId);
-        const renderOptions = ownerBoundRenderOptions(isOwner);
-        const content = renderInboundContent(m, materialized, renderOptions);
+        const content = renderInboundContent(m, materialized);
         const hydrated = await loadHydratedInboundContext({
             conversationId: input.conversationId,
             message: m,
             senderName: sender,
             isOwner,
             hydratedPage: input.hydratedPage,
-            renderOptions,
         });
         const behavior = input.hydratedPage?.behavior ?? hydrated.behavior;
         const activeSelfContextId = hydrated.activeSelfContextId;
@@ -3169,7 +3145,6 @@ export async function main() {
             agentId,
             conversationId: input.conversationId,
             logPrefix: `[canon-host] [${input.conversationId.slice(0, 8)}]`,
-            renderOptions,
         });
         const replyContext = replyMedia.replyContext;
         const participantContext = hydrated.participantContext;
@@ -3202,7 +3177,7 @@ export async function main() {
             return 'handled';
         }
         session.activeSelfContextId = activeSelfContextId;
-        const basePromptText = buildCanonPrompt({
+        const promptText = buildCanonPrompt({
             content,
             conversationId: input.conversationId,
             participantContext,
@@ -3213,12 +3188,6 @@ export async function main() {
             replyContext,
             message: m,
         });
-        const lifecycleContext = isOwner
-            ? formatPendingContactLifecycleContext(takeLocalRuntimeContactLifecycleEvents(runtimeId, input.conversationId))
-            : null;
-        const promptText = lifecycleContext
-            ? `${basePromptText}\n\n${lifecycleContext}`
-            : basePromptText;
         const messageContent = await buildCanonUserContent({
             promptText,
             materialized: [...replyMedia.materialized, ...materialized],
@@ -3236,7 +3205,7 @@ export async function main() {
                 senderId: m.senderId,
                 senderName: m.senderName,
             }),
-        }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes, ownerBoundReplyContactTarget(replyContext));
+        }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes);
         return 'queued';
     }
     const acceptedInboundMessageIds = new Set();
@@ -3316,27 +3285,6 @@ export async function main() {
         const conversationsDiscoveredWhileOffline = startupRecoveryComplete
             ? new Set([...knownConversationIds].filter((id) => !knownBeforeRefresh.has(id)))
             : new Set();
-        try {
-            let cursor = readLocalRuntimeEntry(runtimeId)?.contactLifecycleCursor ?? null;
-            for (let pageNumber = 0; pageNumber < 10; pageNumber += 1) {
-                const page = await client.listContactRequestLifecyclePage({
-                    cursor,
-                    limit: 100,
-                });
-                await reconcileContactLifecycleEvents({
-                    requests: page.requests,
-                    requesterId: agentId,
-                    record: (request) => recordLocalRuntimeContactLifecycleEvent(runtimeId, request),
-                });
-                cursor = page.nextCursor;
-                saveLocalRuntimeContactLifecycleCursor(runtimeId, cursor);
-                if (!page.hasMore)
-                    break;
-            }
-        }
-        catch (error) {
-            console.error('[canon-host] Contact lifecycle recovery failed:', error instanceof Error ? error.message : error);
-        }
         for (const conversationId of knownConversationIds) {
             const recoveryCheckpoints = recoveryCheckpointsFor(conversationId);
             const recoveryBatch = recoveryCheckpoints.reserveBatch();
@@ -3436,8 +3384,7 @@ export async function main() {
                             console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to materialize media:`, error instanceof Error ? error.message : error);
                         }
                     }
-                    const renderOptions = ownerBoundRenderOptions(isOwner);
-                    const content = renderInboundContent(m, materialized, renderOptions);
+                    const content = renderInboundContent(m, materialized);
                     const hydrated = await loadHydratedInboundContext({
                         conversationId: convoId,
                         message: m,
@@ -3446,7 +3393,6 @@ export async function main() {
                         activeSelfContextId: payload.activeSelfContextId,
                         selfContexts: payload.selfContexts,
                         provenance: payload.provenance,
-                        renderOptions,
                     });
                     const behavior = payload.behavior ?? hydrated.behavior;
                     const activeSelfContextId = hydrated.activeSelfContextId;
@@ -3456,7 +3402,6 @@ export async function main() {
                         agentId,
                         conversationId: convoId,
                         logPrefix: `[canon-host] [${convoId.slice(0, 8)}]`,
-                        renderOptions,
                     });
                     const replyContext = replyMedia.replyContext;
                     const participantContext = hydrated.participantContext;
@@ -3495,7 +3440,7 @@ export async function main() {
                         return false;
                     }
                     session.activeSelfContextId = activeSelfContextId;
-                    const basePromptText = buildCanonPrompt({
+                    const promptText = buildCanonPrompt({
                         content,
                         conversationId: convoId,
                         participantContext,
@@ -3506,12 +3451,6 @@ export async function main() {
                         replyContext,
                         message: m,
                     });
-                    const lifecycleContext = isOwner
-                        ? formatPendingContactLifecycleContext(takeLocalRuntimeContactLifecycleEvents(runtimeId, convoId))
-                        : null;
-                    const promptText = lifecycleContext
-                        ? `${basePromptText}\n\n${lifecycleContext}`
-                        : basePromptText;
                     const messageContent = await buildCanonUserContent({
                         promptText,
                         materialized: [...replyMedia.materialized, ...materialized],
@@ -3529,7 +3468,7 @@ export async function main() {
                             senderId: m.senderId,
                             senderName: m.senderName,
                         }),
-                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes, ownerBoundReplyContactTarget(replyContext));
+                    }, deliveryIntent, m.id ?? null, shouldMarkAccepted, isOwner, m.senderType === 'human' ? m.senderId : null, turnModes);
                     return true;
                 })().then((queued) => {
                     if (!queued) {
@@ -3547,24 +3486,20 @@ export async function main() {
             onConversationUpdated: (payload) => {
                 handleConversationUpdated(payload);
             },
-            onContactRequestUpdated: (payload) => {
-                if (payload.requesterId !== agentId || !payload.sourceConversationId)
-                    return;
-                recordLocalRuntimeContactLifecycleEvent(runtimeId, payload);
-            },
             onReplayExpired: () => {
                 void reconnectRecovery.onReplayExpired().catch((error) => {
-                    console.error('[canon-host] Replay-expired recovery failed:', error);
+                    console.error('[canon-host] Replay-expiry recovery failed:', error instanceof Error ? error.message : error);
                 });
             },
             onConnected: () => {
                 streamConnected = true;
                 void publishRuntimeHeartbeat();
                 const recovery = reconnectRecovery.onConnected();
-                if (recovery)
+                if (recovery) {
                     void recovery.catch((error) => {
-                        console.error('[canon-host] Reconnect recovery failed:', error);
+                        console.error('[canon-host] Reconnect recovery failed:', error instanceof Error ? error.message : error);
                     });
+                }
                 console.error('[canon-host] SSE connected');
             },
             onDisconnected: () => {

package/dist/register.js

@@ -37,7 +37,6 @@ After approval, start it with CANON_AGENT=<profile> canon-claude --cwd /path/to/
 const OPTIONS = {
     moduleUrl: import.meta.url,
     clientType: 'claude-code',
-    sessionSetupPolicy: 'runtime_descriptor_required',
     cliName: 'canon-register',
     hostBinName: 'canon-claude',
     developerInfo: 'Claude Code plugin',

package/dist/server.js

@@ -16,8 +16,7 @@ import { ApprovalHttpServer } from './approval-server.js';
 import { renderClaudeInboundContent } from './canon-user-content.js';
 import { runCli } from '@canonmsg/core';
 import { parseReplyArgs, parseSendMessageArgs, parseSetTypingArgs, } from './mcp-args.js';
-import { OWNER_BOUND_CANON_COMMUNICATION_VERBS, canonVerbToolDefinitions, executeCanonVerbTool, isCanonToolVerb, stampSendToTurnComplete, } from '@canonmsg/agent-tools';
-const OWNER_BOUND_COMMUNICATION_VERBS = new Set(OWNER_BOUND_CANON_COMMUNICATION_VERBS);
+import { canonVerbToolDefinitions, createCanonCommunicationBinding, executeCanonVerbTool, isCanonToolVerb, } from '@canonmsg/agent-tools';
 const HELP = `canon-channel-server — Claude Code MCP channel server for Canon
 
 USAGE
@@ -46,6 +45,7 @@ const conversationCache = new Map();
 const TURN_COMPLETE_METADATA = {
     turnSemantics: 'turn_complete',
 };
+const communicationBinding = createCanonCommunicationBinding();
 /** Last owner-visible conversation to route approval cards into. */
 let approvalConversationId = null;
 /** Whether the message that most recently triggered work came from the owner. */
@@ -175,7 +175,8 @@ server.setRequestHandler(ListToolsRequestSchema, async () => ({
         // Canonical verbs — projections of canon.verbs.v1 (@canonmsg/agent-tools).
         // Channel mode owns no turn, so `no_reply` is an ack-only no-op here: the
         // standalone session has no final delivery for it to suppress.
-        ...canonVerbToolDefinitions().filter((definition) => !OWNER_BOUND_COMMUNICATION_VERBS.has(definition.name)),
+        ...canonVerbToolDefinitions(),
+        ...(agentContext?.outboundPolicy === 'closed' ? [] : communicationBinding.tools),
     ],
 }));
 // ── Tool handlers ──────────────────────────────────────────────────────
@@ -315,13 +316,16 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         }
         default: {
             const name = request.params.name;
-            if (OWNER_BOUND_COMMUNICATION_VERBS.has(name)) {
-                return toolArgumentError(`${name} requires an owner-authored Canon turn and is unavailable in standalone channel mode.`);
+            if (communicationBinding.isToolName(name)) {
+                const result = await communicationBinding.execute(client, name, args);
+                return {
+                    content: result.content.map((item) => ({ type: 'text', text: item.text })),
+                    ...(result.isError ? { isError: true } : {}),
+                };
             }
             if (isCanonToolVerb(name)) {
                 const rawArgs = args && typeof args === 'object' ? { ...args } : {};
-                const verbArgs = name === 'send_to' ? stampSendToTurnComplete(rawArgs) : rawArgs;
-                const verbResult = await executeCanonVerbTool(client, name, verbArgs);
+                const verbResult = await executeCanonVerbTool(client, name, rawArgs);
                 return {
                     content: verbResult.content.map((item) => ({ type: 'text', text: item.text })),
                     ...(verbResult.isError ? { isError: true } : {}),

package/dist/session-state.d.ts

@@ -1,6 +1,5 @@
 import type { PermissionMode, SDKMessageOrigin, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { DeliveryIntent, ModelOption, RuntimeStreamingPayload, TurnLifecycleState, TurnOutputBlock, TurnOutputSnapshot, TurnVerbosity } from '@canonmsg/core';
-import type { OwnerBoundCanonContactTarget } from '@canonmsg/agent-tools';
 import type { TurnArtifactRoutingDecision, TurnArtifactSnapshot } from '@canonmsg/coding-agent-host';
 export type ClaudeInputKind = 'seed' | 'canon';
 export type ClaudeArtifactRoutingMode = 'workspace-generated' | 'disabled';
@@ -24,8 +23,6 @@ export interface ClaudeInputEnvelope {
     turnKey: string;
     isOwnerTurn: boolean;
     requestingUserId: string | null;
-    /** Trusted contact-card target resolved from the owner message's reply. */
-    replyContactTarget?: OwnerBoundCanonContactTarget;
 }
 /**
  * The per-turn modes an inbound message resolves from its participant context,
@@ -105,7 +102,6 @@ export declare function createClaudeInputEnvelope(input: {
     artifactBaseline?: TurnArtifactSnapshot | null;
     isOwnerTurn?: boolean;
     requestingUserId?: string | null;
-    replyContactTarget?: OwnerBoundCanonContactTarget;
 }): ClaudeInputEnvelope;
 export declare function resolveClaudeTurnResponseRouting(turn: Pick<ClaudeInputEnvelope, 'kind' | 'isOwnerTurn' | 'requestingUserId'> | null | undefined, ownerId: string | null | undefined, ownerOnly?: boolean): {
     isOwnerTurn: boolean;

package/dist/session-state.js

@@ -28,9 +28,6 @@ export function createClaudeInputEnvelope(input) {
         requestingUserId: input.kind === 'canon' && input.requestingUserId
             ? input.requestingUserId
             : null,
-        ...(input.kind === 'canon' && input.replyContactTarget
-            ? { replyContactTarget: input.replyContactTarget }
-            : {}),
         turnKey: input.kind === 'canon' && sourceMessageId
             ? `canon:${sourceMessageId}`
             : `${input.kind}:${fallbackId}`,

package/dist/tool-policy.js

@@ -37,13 +37,9 @@ function normalizeToolName(toolName) {
 function isCanonOutboundTool(normalizedToolName) {
     return normalizedToolName.endsWith('__reply')
         || normalizedToolName.endsWith('__send_message')
-        || normalizedToolName.endsWith('__send_contextual_message')
-        || normalizedToolName.endsWith('__send_to')
         || normalizedToolName.endsWith('__share_contact')
         || normalizedToolName === 'reply'
         || normalizedToolName === 'send_message'
-        || normalizedToolName === 'send_contextual_message'
-        || normalizedToolName === 'send_to'
         || normalizedToolName === 'share_contact';
 }
 /**
@@ -79,7 +75,7 @@ const CANON_INTERACTION_LIFECYCLE_VERBS = new Set([
  * Verbs a NON-owner conversation member may trigger: same-conversation HITL
  * and display surfaces, whose responder routing and owner-only escalation
  * (secret/sudo, session rules) are enforced server-side. Cross-conversation
- * verbs (send_to, share_contact) and the reads (contacts, conversation
+ * cross-conversation verbs (share_contact) and the reads (contacts, conversation
  * lists — they expose the agent's other relationships to this conversation)
  * stay owner-only until the provenance trigger-token primitive lands.
  */
@@ -257,7 +253,7 @@ export async function decideClaudeToolPermissionForMode(input) {
         }
         // HITL + read verbs are allowed without an approval card: the HITL verbs
         // themselves render the human-facing card (recursion otherwise), and the
-        // reads are side-effect free. Outbound verbs (send_to, share_contact)
+        // reads are side-effect free. Outbound verbs (share_contact)
         // fall through to the mode policy — in native-approval mode they gate
         // like any other side effect; in default mode owner turns allow.
         if (CANON_HITL_OR_READ_VERBS.has(canonVerb) && !input.ruleForcedAsk) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",
@@ -31,11 +31,11 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.228",
-    "@canonmsg/agent-sdk": "^8.9.0",
-    "@canonmsg/agent-tools": "^0.6.0",
-    "@canonmsg/coding-agent-host": "^0.6.0",
-    "@canonmsg/core": "^10.7.0",
-    "@canonmsg/rich-cards": "^0.10.2",
+    "@canonmsg/agent-sdk": "^9.0.0",
+    "@canonmsg/agent-tools": "^0.7.0",
+    "@canonmsg/coding-agent-host": "^0.7.0",
+    "@canonmsg/core": "^11.0.0",
+    "@canonmsg/rich-cards": "^0.10.3",
     "@modelcontextprotocol/sdk": "^1.30.0"
   },
   "engines": {