@canonmsg/claude-code-plugin 0.36.1 → 0.36.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "Canon",
   "description": "Connect Claude Code to Canon — messaging where AI agents are first-class citizens",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "channels": [
     {
       "server": "canon-channel",

package/README.md

@@ -4,7 +4,7 @@ Connect Claude Code to [Canon](https://canonmail.com/agents) — a messaging app
 
 ## Quick start
 
-The package includes a compatible Claude Code runtime. If `claude` is installed on `PATH`, or selected with `CANON_CLAUDE_CLI_PATH`, use Claude Code 2.1.220 or newer — the model picker lists whatever the CLI reports, so an older binary hides newer model families. Either source below that minimum is logged and skipped in favour of the bundled runtime, so a stale install costs model options rather than taking the host down.
+The package includes a compatible Claude Code runtime. If `claude` is installed on `PATH`, or selected with `CANON_CLAUDE_CLI_PATH`, use Claude Code 2.1.278 or newer. The bundled Claude Agent SDK is pinned to 0.3.278; Canon relies on its explicit input/result attribution for merged messages and native errors. An external binary below that minimum is logged and skipped in favour of the bundled runtime.
 
 ```bash
 # Install

package/dist/host.js

@@ -30,12 +30,12 @@ import { materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMes
 import { captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, } from '@canonmsg/coding-agent-host';
 import { buildCanonUserContent, renderClaudeInboundContent, withClaudeReplyContextMediaReferences, } from './canon-user-content.js';
 import { buildClaudeNativeCommandInput, createClaudeCommandContextHook, getClaudeNativeCommandOutput, } from './native-command-input.js';
-import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonGroupContext, buildCompactGroupContextLines, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, hydrateCanonReplyContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, isPendingCanonOperation, sendMessageWithRetry, sendMessageWithRetryChunked, loadRuntimeSessionState, markLocalRuntimeStopped, releaseConversationEnvironment, resolveLocalRuntimeSessionState, saveRuntimeSessionState, clearRuntimeSessionState, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveConfiguredWorkspaceCwd, resolveTurnVerbosity, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { EFFORT_OPTIONS, CLAUDE_PERMISSION_MODE_OPTIONS, RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildCanonInboundFrameV1, buildCanonGroupContext, buildCompactGroupContextLines, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildConversationEnvironmentKey, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, hydrateCanonReplyContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, normalizeRuntimeCommandDescriptors, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createTurnOutputController, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, ControlChannelPoller, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, HOST_ADMISSION_ACTIONS_DISABLED, ApprovalManager, RuntimeRequestManager, FINAL_MESSAGE_HANDOFF_MS, buildLocalRuntimeId, getActiveProfileLock, heartbeatLocalRuntimeEntry, normalizeTurnMetadata, parseTurnVerbosityConfig, prepareConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, decideAutoReply, initRTDBAuth, isChunkedSendMessageError, isPendingCanonOperation, sendMessageWithRetry, sendMessageWithRetryChunked, markLocalRuntimeStopped, releaseConversationEnvironment, resolveLocalRuntimeSessionState, saveRuntimeSessionState, clearRuntimeSessionState, publishHostSessionSnapshots, renderCodingHostInboundPrompt, resolveConfiguredWorkspaceCwd, resolveTurnVerbosity, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { runCli } from '@canonmsg/core';
 import { CANON_VERB_MCP_SERVER_NAME, createCanonVerbMcpServer } from '@canonmsg/agent-tools';
 import { synthesizeClaudeApprovalDiff } from './approval-diff.js';
 import { decideClaudeToolPermissionForMode, parseAllowedNonOwnerClaudeTools, } from './tool-policy.js';
-import { boundClaudeFinalMetadata, buildClaudeFinalChunkingOptions, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudePendingFinalDelivery, buildClaudeTurnFailureNotice, buildTruncatedFinalText, buildUndeliverableFinalNotice, canDrainClaudeQueuedInput, beginClaudeAssistantResponse, claimClaudeTextSegmentId, claudeFinalWillChunk, classifyFinalDeliveryFailure, claudeInputOwnsTurnSlot, createClaudeTurnActivityState, decideClaudeControlSignalAction, decideClaudeInboundDispatch, dispatchClaudeInput, endClaudeAssistantResponse, isClaudeTurnSlotReserved, readClaudeFinalDeliveryResume, releaseClaudeTurnSlot, runClaudeExhaustedFinalDelivery, shouldApplyClaudeEchoedSessionState, shouldReleaseClaudeTurnSlot, isClaudeMainTurnMessage, openClaudeTurn, planClaudeAssistantTrail, planClaudeStreamingWrite, planClaudeToolCallStart, planClaudeToolProgress, planClaudeToolResults, claudeFinalTurnTrail, publishedClaudeTurnState, rememberDispatchedClaudeInput, resetClaudeTurnActivityState, shouldOpenClaudeTurnOnRunning, shouldStopTypingDotsOnStreamedText, isOpenClaudeTurnState, takeClaudeResultOwner, takeClaudeToolBlockIdByIndex, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeTurnFinal, describeUndeliveredClaudeFinal, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, shouldRouteClaudeTurnArtifacts, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
+import { boundClaudeFinalMetadata, buildClaudeFinalChunkingOptions, buildClaudeFinalMessageId, buildClaudeFinalTurnMetadata, buildClaudePendingFinalDelivery, buildClaudeTurnFailureNotice, buildTruncatedFinalText, buildUndeliverableFinalNotice, canDrainClaudeQueuedInput, beginClaudeAssistantResponse, claimClaudeTextSegmentId, claudeFinalWillChunk, classifyFinalDeliveryFailure, claudeInputOwnsTurnSlot, createClaudeTurnActivityState, decideClaudeControlSignalAction, decideClaudeInboundDispatch, dispatchClaudeInput, endClaudeAssistantResponse, isClaudeTurnSlotReserved, readClaudeFinalDeliveryResume, releaseClaudeTurnSlot, runClaudeExhaustedFinalDelivery, shouldApplyClaudeEchoedSessionState, shouldReleaseClaudeTurnSlot, isClaudeMainTurnMessage, openClaudeTurn, planClaudeAssistantTrail, planClaudeStreamingWrite, planClaudeToolCallStart, planClaudeToolProgress, planClaudeToolResults, claudeFinalTurnTrail, publishedClaudeTurnState, rememberDispatchedClaudeInput, resetClaudeTurnActivityState, shouldOpenClaudeTurnOnRunning, shouldStopTypingDotsOnStreamedText, isOpenClaudeTurnState, takeClaudeResultOwner, claudeCompletedSourceMessageIds, shouldFailClaudeSessionForUnattributedResult, takeClaudeToolBlockIdByIndex, claudeModelInfoToOption, claudeOriginForCanonSender, composeClaudeTurnFinal, describeUndeliveredClaudeFinal, confirmClaudeInterrupt, createClaudeInputEnvelope, deriveClaudeSupplementalModelProbes, formatClaudeCliVersion, formatClaudeControlError, isClaudeCustomModelOption, isSupportedClaudeCliVersion, mergeClaudeDiscoveredModelOptions, parseClaudeCliVersion, resolveClaudeTurnResponseRouting, resolveClaudeModelOptions, resetClaudeCompletedTurnState, shouldDeliverClaudeFinal, shouldRouteClaudeTurnArtifacts, MINIMUM_CLAUDE_CLI_VERSION, } from './session-state.js';
 import { CLAUDE_SUPPORTED_DIALOG_KINDS, buildClaudeAskUserPermissionDenied, buildClaudeAskUserPermissionResult, createClaudeUserDialogCoordinator, parseClaudeAskUserDialog, parseClaudeAskUserToolInput, resolveClaudeUserDialogRequestId, } from './user-dialog.js';
 import { isProactiveCommunicationEnabled } from './communication-policy.js';
 function parseRuntimeVisibilityPreset(value) {
@@ -1059,9 +1059,9 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         return streamingOutput.clear().catch(() => { });
     }
     function markInputCompleted(input) {
-        if (input?.kind !== 'canon' || !input.sourceMessageId)
-            return;
-        config.onInputCompleted?.(input.sourceMessageId);
+        for (const sourceMessageId of claudeCompletedSourceMessageIds(input)) {
+            config.onInputCompleted?.(sourceMessageId);
+        }
     }
     /**
      * The turn trail to attach to the final send. Empty on a quiet turn — see
@@ -1120,6 +1120,8 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         drainPendingInput();
     }
     function scheduleFinalHandoffReset() {
+        if (session.closed)
+            return;
         clearIdleResetTimer();
         session.idleResetTimer = setTimeout(() => {
             session.idleResetTimer = null;
@@ -1177,8 +1179,10 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         session.finalizedTurnKeys.add(turn.turnKey);
         markInputCompleted(turn);
         releaseTurnSlotFor(turn);
-        session.pendingFinalDelivery = null;
-        clearFinalDeliveryTimer();
+        if (session.pendingFinalDelivery?.turnKey === turn.turnKey) {
+            session.pendingFinalDelivery = null;
+            clearFinalDeliveryTimer();
+        }
         writeState();
     }
     /**
@@ -1461,6 +1465,8 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         }, FINAL_DELIVERY_RETRY_MS);
     }
     function writeState() {
+        if (session.closed)
+            return;
         runtimeState.writeSessionState(conversationId, {
             contextUsage: session.state.contextUsage,
             hostMode: true,
@@ -1487,6 +1493,8 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         writeState();
     }
     function writeTurn() {
+        if (session.closed)
+            return;
         const isOpenTurn = isOpenClaudeTurnState(session.turnState);
         if (isOpenTurn) {
             session.currentTurnUpdatedAt = Date.now();
@@ -1635,16 +1643,9 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                 .updateMessageDisposition(conversationId, input.sourceMessageId, 'rejected')
                 .catch(() => { });
         }
-        if (input.kind === 'canon' && input.sourceMessageId) {
-            const id = `message:${conversationId}:${input.sourceMessageId}`;
-            void client.getEndpoint().then(async (engine) => {
-                const entry = await engine.getInbound(id);
-                if (entry && ['observed', 'offered', 'deferred'].includes(entry.state)) {
-                    await engine.setInboundState(id, 'deferred', 'native-preflight');
-                    config.onInputDeferred?.(input.sourceMessageId);
-                }
-            }).catch((error) => console.error('[canon-host] Failed to defer native input:', error));
-        }
+        void input.inboundHandoff?.release('native-preflight').catch((error) => {
+            console.error('[canon-host] Failed to release native input:', error);
+        });
         // resetTurnToIdle releases the slot, tears the published turn down (typing
         // signal, seeded /streaming, turn state) and drains the queue. On a closed
         // session it is a no-op, which is correct: the teardown owns that path.
@@ -1654,17 +1655,26 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         return dispatchClaudeInput(session, input, {
             openTurn,
             markAccepted: (dispatched) => markQueuedMessageAccepted(dispatched.sourceMessageId, dispatched.markAccepted),
-            prepareArtifacts: async (input) => {
-                await prepareArtifactsForInput(input);
-                if (input.kind === 'canon' && input.sourceMessageId) {
-                    const engine = await client.getEndpoint();
-                    const id = `message:${conversationId}:${input.sourceMessageId}`;
-                    if (!await engine.claimInbound(id)) {
-                        throw new Error('Canon input already has an execution owner.');
-                    }
+            prepareArtifacts: prepareArtifactsForInput,
+            send: async (input) => {
+                if (input.kind !== 'canon' || !input.sourceMessageId) {
+                    sendInput(input);
+                    return;
                 }
+                const engine = await client.getEndpoint();
+                input.inboundHandoff ??= await engine.acquireInbound(`message:${conversationId}:${input.sourceMessageId}`) ?? undefined;
+                if (!input.inboundHandoff)
+                    throw new Error('Canon input already has an execution owner.');
+                if (session.closed)
+                    await input.inboundHandoff.release('session-closed');
+                const started = await engine.startInbound(input.inboundHandoff, () => {
+                    if (session.dispatchingInput === input)
+                        session.dispatchingInput = null;
+                    sendInput(input);
+                });
+                if (started.status !== 'submitted')
+                    throw new Error(`Canon input ${started.status} before native dispatch.`);
             },
-            send: sendInput,
             abandon: abandonDispatchedInput,
         });
     }
@@ -1780,6 +1790,29 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         applyTrailCommands(planClaudeToolResults(session.turnActivity, content));
     }
     // ── Process SDK output messages ──
+    function finishSession() {
+        if (session.closed)
+            return;
+        session.closed = true;
+        inputDone = true;
+        clearIdleResetTimer();
+        clearFinalDeliveryTimer();
+        stopVisibleWorkSignal();
+        try {
+            q.close();
+        }
+        catch { }
+        // A native failure cannot prove whether dispatched work ran. Release local
+        // in-flight claims without completing endpoint receipts or replaying work.
+        const unfinished = new Set([
+            session.activeInput, session.dispatchingInput,
+            ...session.pendingInputs, ...dispatchedInputs.values(),
+        ]);
+        for (const input of unfinished)
+            void input?.inboundHandoff?.release('session-ended').catch(console.error);
+        console.error(`[canon-host] [${conversationId.slice(0, 8)}] Session ended`);
+        onSessionEnd(conversationId, session.sdkSessionId);
+    }
     const processMessages = async () => {
         try {
             for await (const msg of q) {
@@ -1988,10 +2021,17 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                         const resultSessionId = msg.session_id;
                         if (resultSessionId)
                             session.sdkSessionId = resultSessionId;
-                        // Match the result to the envelope that produced it. Falling back to
-                        // the slot only when the SDK reports no uuid keeps older runtimes
-                        // working, at their existing accuracy.
-                        const completedInput = takeClaudeResultOwner(dispatchedInputs, msg.user_message_uuid) ?? session.activeInput;
+                        // A result may acknowledge several coalesced inputs, but never a
+                        // queued input absent from its UUID list. Native background/resume
+                        // results with no known UUID do not belong to the active Canon turn.
+                        const completedInput = takeClaudeResultOwner(dispatchedInputs, msg.user_message_uuid, msg.user_message_uuids);
+                        if (!completedInput) {
+                            if (shouldFailClaudeSessionForUnattributedResult(msg, Boolean(session.activeInput || session.dispatchingInput || session.pendingInputs.length))) {
+                                throw new Error('Claude returned an unattributed result; native session closed with unfinished inputs preserved.');
+                            }
+                            console.error(`[canon-host] [${conversationId.slice(0, 8)}] Ignoring result without a known input UUID`);
+                            break;
+                        }
                         console.error(`[canon-host] [${conversationId.slice(0, 8)}] Turn complete (${msg.subtype})`);
                         const resultText = typeof msg.result === 'string'
                             ? msg.result.trim()
@@ -2014,7 +2054,8 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                         // the artifacts still POST first, ahead of the reply they belong to.
                         const turnFinal = composeClaudeTurnFinal({
                             resultText,
-                            streamedText: session.pendingFinalText,
+                            streamedText: completedInput.turnKey === session.activeInput?.turnKey
+                                ? session.pendingFinalText : null,
                             failureNotice,
                             silenced,
                         });
@@ -2077,6 +2118,14 @@ function createSession(conversationId, environment, agentId, client, typingSigna
                             if (!finalText || !shouldDeliverFinal) {
                                 markInputCompleted(completedInput);
                             }
+                            // Sending the final and fetching usage both await. A newer turn
+                            // may now own the live text, pending delivery and handoff timer.
+                            if (!shouldReleaseClaudeTurnSlot({
+                                dispatching: session.dispatchingInput !== null,
+                                activeTurnKey: session.activeInput?.turnKey ?? null,
+                                completedTurnKey: completedInput.turnKey,
+                            }))
+                                break;
                             if (completedInput?.turnKey === session.activeInput?.turnKey) {
                                 session.activeInput = null;
                             }
@@ -2118,16 +2167,14 @@ function createSession(conversationId, environment, agentId, client, typingSigna
         catch (err) {
             console.error(`[canon-host] [${conversationId.slice(0, 8)}] Query stream error:`, err);
         }
-        // Only call onSessionEnd if not already closed (avoids double cleanup from closeSession)
-        if (!session.closed) {
-            console.error(`[canon-host] [${conversationId.slice(0, 8)}] Session ended`);
-            onSessionEnd(conversationId, session.sdkSessionId);
-        }
+        finishSession();
     };
     // Start processing loop and initialize session
     const init = async () => {
         processMessages().catch((err) => console.error(`[canon-host] [${conversationId.slice(0, 8)}] processMessages crashed:`, err));
         await q.initializationResult();
+        if (session.closed)
+            return;
         if (config.model) {
             try {
                 await q.setModel(config.model);
@@ -2160,6 +2207,8 @@ function createSession(conversationId, environment, agentId, client, typingSigna
             const models = await q.supportedModels();
             const discoveredOptions = toModelOptions(models);
             const supplemental = await detectSupplementalRuntimeModels(cwd, deriveClaudeSupplementalModelProbes(discoveredOptions));
+            if (session.closed)
+                return;
             const modelList = resolveClaudeModelOptions({
                 discovered: mergeClaudeDiscoveredModelOptions(discoveredOptions, ...supplemental),
                 selectedModel: session.state.model,
@@ -2194,10 +2243,9 @@ function createSession(conversationId, environment, agentId, client, typingSigna
     };
     init().catch((err) => {
         console.error(`[canon-host] [${conversationId.slice(0, 8)}] Init failed:`, err);
-        if (resumeSessionId) {
+        if (resumeSessionId)
             session.sdkSessionId = null;
-            onSessionEnd(conversationId, null);
-        }
+        finishSession();
     });
     return session;
 }
@@ -2642,6 +2690,9 @@ export async function main() {
             return;
         const saveResume = options.saveResume !== false;
         session.closed = true;
+        for (const input of [session.dispatchingInput, ...session.pendingInputs]) {
+            void input?.inboundHandoff?.release('session-closed').catch(console.error);
+        }
         if (session.typingKeepaliveTimer) {
             clearInterval(session.typingKeepaliveTimer);
             session.typingKeepaliveTimer = null;
@@ -2687,6 +2738,11 @@ export async function main() {
         console.error(`[canon-host] [${conversationId.slice(0, 8)}] Session ${options.reason ?? (saveResume ? 'suspended (sessionId saved for resume)' : 'cleared')}`);
     }
     async function resetRuntimeSession(session) {
+        const dispatching = session.dispatchingInput;
+        void dispatching?.inboundHandoff?.cancel('canceled-before-execution').then((canceled) => {
+            if (canceled)
+                session.markInputCompleted(dispatching);
+        }).catch(console.error);
         const conversationId = session.conversationId;
         // `dispatchingInput` excludes the dispatch window: the slot is reserved but
         // the SDK has nothing in flight, so there is nothing to interrupt. The
@@ -2711,8 +2767,10 @@ export async function main() {
         const droppedInputs = session.pendingInputs.splice(0);
         await markSessionPendingInputsRejected(conversationId, droppedInputs);
         session.markInputCompleted(session.activeInput);
-        for (const input of droppedInputs)
-            session.markInputCompleted(input);
+        for (const input of droppedInputs) {
+            if (!input.inboundHandoff || input.inboundHandoff.phase === 'settled')
+                session.markInputCompleted(input);
+        }
         if (session.activeInput) {
             session.interruptedTurnKeys.add(session.activeInput.turnKey);
         }
@@ -2724,13 +2782,14 @@ export async function main() {
         closeSession(conversationId, { saveResume: false, reason: 'reset for new Canon session' });
     }
     async function markSessionPendingInputsRejected(conversationId, inputs) {
-        await Promise.all(inputs.map((input) => {
+        await Promise.all(inputs.map(async (input) => {
+            await input.inboundHandoff?.cancel('canceled-before-execution');
             if (!input.markAccepted || !input.sourceMessageId)
                 return Promise.resolve();
             return client.updateMessageDisposition(conversationId, input.sourceMessageId, 'rejected').catch(() => { });
         }));
     }
-    function removeQueuedInput(conversationId, sourceMessageId) {
+    async function removeQueuedInput(conversationId, sourceMessageId) {
         const session = sessions.get(conversationId);
         if (!session || session.pendingInputs.length === 0)
             return;
@@ -2738,8 +2797,10 @@ export async function main() {
         if (removed.length === 0)
             return;
         session.pendingInputs = session.pendingInputs.filter((input) => input.sourceMessageId !== sourceMessageId);
-        for (const input of removed)
-            session.markInputCompleted(input);
+        await Promise.all(removed.map(async (input) => {
+            if (!input.inboundHandoff || await input.inboundHandoff.cancel('message-deleted'))
+                session.markInputCompleted(input);
+        }));
         session.writeTurn();
     }
     function evictOldestIdle() {
@@ -2840,12 +2901,6 @@ export async function main() {
                         }
                     }
                     existing?.clearStreaming().catch(() => { });
-                    if (existing) {
-                        settleInboundMessageId(existing.activeInput?.sourceMessageId, false);
-                        for (const input of existing.pendingInputs) {
-                            settleInboundMessageId(input.sourceMessageId, false);
-                        }
-                    }
                     typingSignals.clear(convoId).catch(() => { });
                     typingSignals.dispose(convoId);
                     sessions.delete(convoId);
@@ -2876,14 +2931,13 @@ export async function main() {
                         return roster ? buildCompactGroupContextLines(roster, 'initial').join('\n') : '';
                     },
                     currentArtifactAudience: () => ({ memberIds: conversationCache.get(conversationId)?.memberIds, agentId, ownerId }),
-                    onInputDeferred: (sourceMessageId) => settleInboundMessageId(sourceMessageId, false),
                     onInputCompleted: (sourceMessageId) => {
-                        recoveryCheckpointsFor(conversationId).settle(sourceMessageId);
-                        settleInboundMessageId(sourceMessageId, true);
                         const id = `message:${conversationId}:${sourceMessageId}`;
-                        void endpoint.getInbound(id).then((entry) => entry
-                            ? endpoint.setInboundState(id, 'settled', 'native-completed') : undefined)
-                            .catch((error) => console.error('[canon-host] Failed to settle native input:', error));
+                        void endpoint.getInbound(id).then(async (entry) => {
+                            if (entry)
+                                await endpoint.setInboundState(id, 'settled', 'native-completed');
+                            recoveryCheckpointsFor(conversationId).settle(sourceMessageId);
+                        }).catch((error) => console.error('[canon-host] Failed to settle native input:', error));
                     },
                     publishSessionSnapshots: (ids) => { void publishSessionSnapshots(ids); },
                 }, resumeId);
@@ -2908,30 +2962,6 @@ export async function main() {
             pendingSessionCreations.delete(conversationId);
         }
     }
-    const acceptedInboundMessageIds = new Set();
-    const inFlightInboundMessageIds = new Set();
-    function claimInboundMessageId(messageId) {
-        if (!messageId)
-            return true;
-        if (acceptedInboundMessageIds.has(messageId) || inFlightInboundMessageIds.has(messageId))
-            return false;
-        inFlightInboundMessageIds.add(messageId);
-        return true;
-    }
-    function settleInboundMessageId(messageId, accepted) {
-        if (!messageId)
-            return;
-        inFlightInboundMessageIds.delete(messageId);
-        if (!accepted)
-            return;
-        acceptedInboundMessageIds.add(messageId);
-        while (acceptedInboundMessageIds.size > 2_048) {
-            const oldest = acceptedInboundMessageIds.values().next().value;
-            if (!oldest)
-                break;
-            acceptedInboundMessageIds.delete(oldest);
-        }
-    }
     function handleRuntimeReplyMessage(conversationId, message) {
         if (message.metadata?.type === 'approval_reply' || (approvalManager?.pendingCount ?? 0) > 0) {
             const consumed = approvalManager?.handleMessage(conversationId, {
@@ -2956,13 +2986,6 @@ export async function main() {
         }
         return consumed;
     }
-    function persistedConversationCursor(conversationId) {
-        return loadRuntimeSessionState(runtimeId, {
-            conversationId,
-            baseCwd: workingDir,
-            workspaceId: CLAUDE_RECOVERY_CURSOR_WORKSPACE_ID,
-        })?.lastInboundMessageId ?? null;
-    }
     function persistConversationRecoveryCursor(conversationId, messageId) {
         try {
             saveRuntimeSessionState(runtimeId, {
@@ -2993,23 +3016,24 @@ export async function main() {
                 return;
             }
             const convoId = payload.conversationId;
-            if (!claimInboundMessageId(m.id))
+            const handoff = await endpoint.acquireInbound(event.id);
+            if (!handoff)
                 return;
             recoveryCheckpointsFor(convoId).track(m.id);
             knownConversationIds.add(convoId);
             if (handleRuntimeReplyMessage(convoId, m)) {
-                recoveryCheckpointsFor(convoId).settle(m.id);
-                settleInboundMessageId(m.id, true);
-                await endpoint.setInboundState(`message:${convoId}:${m.id}`, 'settled', 'not-dispatched');
+                if (await handoff.settle('not-dispatched')) {
+                    recoveryCheckpointsFor(convoId).settle(m.id);
+                }
                 return;
             }
             const sender = m.senderName || m.senderId;
             const isOwner = m.isOwner ?? (ownerId != null && m.senderId === ownerId);
             if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
                 console.error(`[canon-host] [${convoId.slice(0, 8)}] Ignoring server-dispatched observe-only message: ${payload.turnDispatch.reason}`);
-                recoveryCheckpointsFor(convoId).settle(m.id);
-                settleInboundMessageId(m.id, true);
-                await endpoint.setInboundState(`message:${convoId}:${m.id}`, 'settled', 'not-dispatched');
+                if (await handoff.settle('not-dispatched')) {
+                    recoveryCheckpointsFor(convoId).settle(m.id);
+                }
                 return;
             }
             await (async () => {
@@ -3109,6 +3133,7 @@ export async function main() {
                     materialized: [...replyMedia.materialized, ...materialized],
                 });
                 const turnModes = {
+                    inboundHandoff: handoff,
                     ...resolveClaudeTurnModes(participantContext),
                     commandContext: commandInput.commandContext,
                     replyAuthority: payload.replyAuthority ?? null,
@@ -3129,12 +3154,12 @@ export async function main() {
                 return true;
             })().then(async (queued) => {
                 if (!queued) {
-                    recoveryCheckpointsFor(convoId).settle(m.id);
-                    settleInboundMessageId(m.id, true);
-                    await endpoint.setInboundState(`message:${convoId}:${m.id}`, 'settled', 'not-dispatched');
+                    if (await handoff.settle('not-dispatched')) {
+                        recoveryCheckpointsFor(convoId).settle(m.id);
+                    }
                 }
-            }).catch((error) => {
-                settleInboundMessageId(m.id, false);
+            }).catch(async (error) => {
+                await handoff.release('queue-failed');
                 console.error(`[canon-host] [${convoId.slice(0, 8)}] Failed to process inbound message:`, error instanceof Error ? error.message : error);
                 throw error;
             });
@@ -3151,7 +3176,7 @@ export async function main() {
                     data: payload });
             },
             onMessageDeleted: (payload) => {
-                removeQueuedInput(payload.conversationId, payload.messageId);
+                void removeQueuedInput(payload.conversationId, payload.messageId).catch(console.error);
             },
             onConversationUpdated: (payload) => {
                 handleConversationUpdated(payload);
@@ -3209,6 +3234,22 @@ export async function main() {
             queueDepth: session.pendingInputs.length,
         });
         if (action === 'defer') {
+            const dispatching = session.dispatchingInput;
+            if (dispatching?.inboundHandoff) {
+                // Stop owns the pre-submit window too. Register cancellation before
+                // any queued-disposition write; the shared claim fence prevents send.
+                const canceled = dispatching.inboundHandoff.cancel('canceled-before-execution');
+                const dropped = event.type === 'stop_and_drop' ? session.pendingInputs.splice(0) : [];
+                await markSessionPendingInputsRejected(convoId, dropped);
+                for (const input of dropped) {
+                    if (!input.inboundHandoff || input.inboundHandoff.phase === 'settled')
+                        session.markInputCompleted(input);
+                }
+                if (await canceled) {
+                    session.markInputCompleted(dispatching);
+                    return;
+                }
+            }
             // Reserved but not yet dispatched: there is nothing in the SDK to stop
             // YET. Consuming the signal here would make a Stop pressed in the
             // accept/artifact window do nothing while the turn it was aimed at ran to
@@ -3240,8 +3281,10 @@ export async function main() {
             await markSessionPendingInputsRejected(convoId, droppedInputs);
         }
         session.markInputCompleted(session.activeInput);
-        for (const input of droppedInputs)
-            session.markInputCompleted(input);
+        for (const input of droppedInputs) {
+            if (!input.inboundHandoff || input.inboundHandoff.phase === 'settled')
+                session.markInputCompleted(input);
+        }
         if (session.activeInput) {
             session.interruptedTurnKeys.add(session.activeInput.turnKey);
         }

package/dist/session-state.d.ts

@@ -1,14 +1,18 @@
-import type { SDKMessageOrigin, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
+import type { SDKMessageOrigin, SDKResultMessage, SDKUserMessage } from '@anthropic-ai/claude-agent-sdk';
 import type { DeliveryIntent, ModelOption, RuntimeStreamingPayload, TurnLifecycleState, TurnOutputBlock, TurnOutputSnapshot, TurnVerbosity } from '@canonmsg/core';
+import type { EndpointInboundHandoff } from '@canonmsg/core';
 import type { AgentReplyAuthorityV1 } from '@canonmsg/backend-contracts';
 import type { TurnArtifactRoutingDecision, TurnArtifactSnapshot } from '@canonmsg/coding-agent-host';
 export type ClaudeInputKind = 'seed' | 'canon';
 export type ClaudeArtifactRoutingMode = 'workspace-generated' | 'disabled';
 export interface ClaudeInputEnvelope {
+    inboundHandoff?: EndpointInboundHandoff;
     commandContext?: string;
     kind: ClaudeInputKind;
-    /** Correlates this envelope with its turn result's `user_message_uuid`. */
+    /** Correlates this envelope with its turn result's user-message UUIDs. */
     messageUuid: string;
+    /** Other Canon inputs acknowledged by the same result; settle with its final. */
+    resultSourceMessageIds?: string[];
     msg: SDKUserMessage;
     intent: DeliveryIntent;
     sourceMessageId: string | null;
@@ -33,6 +37,7 @@ export interface ClaudeInputEnvelope {
  * grouped so they travel together from the enqueue site onto the envelope.
  */
 export interface ClaudeTurnModes {
+    inboundHandoff?: EndpointInboundHandoff;
     commandContext?: string;
     artifactRoutingMode?: ClaudeArtifactRoutingMode;
     turnVerbosity?: TurnVerbosity;
@@ -98,6 +103,7 @@ export interface ClaudeCompletedTurnState {
     turnActivity?: ClaudeTurnActivityState;
 }
 export declare function createClaudeInputEnvelope(input: {
+    inboundHandoff?: EndpointInboundHandoff;
     commandContext?: string;
     kind: ClaudeInputKind;
     msg: SDKUserMessage;
@@ -150,15 +156,24 @@ export declare function shouldRouteClaudeTurnArtifacts(input: {
 }): TurnArtifactRoutingDecision;
 export declare function rememberDispatchedClaudeInput(dispatched: Map<string, ClaudeInputEnvelope>, input: ClaudeInputEnvelope): void;
 /**
- * The envelope a turn result belongs to, matched by `user_message_uuid`.
- *
- * The SDK coalesces queued inputs — three rapid messages can produce two turns —
- * and reports the LAST message of a coalesced batch, which is the correct owner
- * of the reply. Entries up to and including the match are consumed, so messages
- * folded into that batch do not linger. Returns null when the result carries no
- * usable uuid, leaving the caller to fall back.
+ * Match only the inputs the SDK explicitly acknowledges. Its plural list is in
+ * consumption order and can include messages folded in after the first reply.
+ * The last known Canon input owns the final; internal seeds cannot displace it.
+ * A singular UUID acknowledges only itself, never everything earlier in our map.
+ * Missing/unknown attribution must not fall back to an unrelated active turn.
+ */
+export declare function takeClaudeResultOwner(dispatched: Map<string, ClaudeInputEnvelope>, userMessageUuid: unknown, userMessageUuids?: unknown): ClaudeInputEnvelope | null;
+/** Keep coalesced inputs pending until their shared final is delivered or retired. */
+export declare function claudeCompletedSourceMessageIds(input: ClaudeInputEnvelope | null | undefined): string[];
+/**
+ * A zeroed/session error may have no input UUID. Treat it as a session failure,
+ * never as successful completion of whichever Canon input happens to be active.
+ * An unattributed success while foreground work is outstanding is ambiguous too:
+ * waiting for an idle echo would wedge that input, because its slot rejects idle
+ * until completion. Close the native session and preserve the unsettled input.
+ * Explicit foreign/replayed UUIDs remain unrelated results and are ignored.
  */
-export declare function takeClaudeResultOwner(dispatched: Map<string, ClaudeInputEnvelope>, userMessageUuid: unknown): ClaudeInputEnvelope | null;
+export declare function shouldFailClaudeSessionForUnattributedResult(result: Pick<SDKResultMessage, 'subtype' | 'is_error' | 'user_message_uuid' | 'user_message_uuids'>, hasForegroundWork: boolean): boolean;
 /**
  * Whether an envelope owns the session's active-turn slot. Only Canon turns do;
  * any future internal envelope must remain invisible to user-facing turn state.
@@ -304,7 +319,7 @@ export interface ClaudeDispatchDeps {
     /** Capture the artifact baseline — a workspace walk. */
     prepareArtifacts: (input: ClaudeInputEnvelope) => Promise<void>;
     /** Hand the input to the SDK. */
-    send: (input: ClaudeInputEnvelope) => void;
+    send: (input: ClaudeInputEnvelope) => void | Promise<void>;
     /** Settle an input that will never be answered, and retire its turn. */
     abandon: (input: ClaudeInputEnvelope, reason: ClaudeDispatchAbandonReason, error?: unknown) => void;
 }

package/dist/session-state.js

@@ -12,6 +12,7 @@ export function createClaudeInputEnvelope(input) {
     return {
         ...(input.commandContext ? { commandContext: input.commandContext } : {}),
         kind: input.kind,
+        ...(input.inboundHandoff ? { inboundHandoff: input.inboundHandoff } : {}),
         messageUuid,
         msg: { ...input.msg, uuid: messageUuid },
         intent: input.intent ?? 'queue',
@@ -99,28 +100,54 @@ export function rememberDispatchedClaudeInput(dispatched, input) {
     }
 }
 /**
- * The envelope a turn result belongs to, matched by `user_message_uuid`.
- *
- * The SDK coalesces queued inputs — three rapid messages can produce two turns —
- * and reports the LAST message of a coalesced batch, which is the correct owner
- * of the reply. Entries up to and including the match are consumed, so messages
- * folded into that batch do not linger. Returns null when the result carries no
- * usable uuid, leaving the caller to fall back.
+ * Match only the inputs the SDK explicitly acknowledges. Its plural list is in
+ * consumption order and can include messages folded in after the first reply.
+ * The last known Canon input owns the final; internal seeds cannot displace it.
+ * A singular UUID acknowledges only itself, never everything earlier in our map.
+ * Missing/unknown attribution must not fall back to an unrelated active turn.
  */
-export function takeClaudeResultOwner(dispatched, userMessageUuid) {
-    if (typeof userMessageUuid !== 'string' || !dispatched.has(userMessageUuid)) {
-        return null;
-    }
-    let owner = null;
-    for (const [key, envelope] of dispatched) {
-        dispatched.delete(key);
-        if (key === userMessageUuid) {
-            owner = envelope;
-            break;
-        }
+export function takeClaudeResultOwner(dispatched, userMessageUuid, userMessageUuids) {
+    const uuids = Array.isArray(userMessageUuids)
+        ? userMessageUuids.filter((uuid) => typeof uuid === 'string' && uuid.length > 0)
+        : [];
+    if (typeof userMessageUuid === 'string' && !uuids.includes(userMessageUuid)) {
+        uuids.push(userMessageUuid);
     }
+    const inputs = [...new Set(uuids)].flatMap((uuid) => {
+        const input = dispatched.get(uuid);
+        return input ? [input] : [];
+    });
+    const owner = [...inputs].reverse().find((input) => input.kind === 'canon') ?? inputs.at(-1) ?? null;
+    if (!owner)
+        return null;
+    owner.resultSourceMessageIds = [...new Set(inputs.flatMap(claudeCompletedSourceMessageIds))];
+    for (const input of inputs)
+        dispatched.delete(input.messageUuid);
     return owner;
 }
+/** Keep coalesced inputs pending until their shared final is delivered or retired. */
+export function claudeCompletedSourceMessageIds(input) {
+    if (input?.kind !== 'canon')
+        return [];
+    return [...new Set([
+            ...(input.sourceMessageId ? [input.sourceMessageId] : []),
+            ...(input.resultSourceMessageIds ?? []),
+        ])];
+}
+/**
+ * A zeroed/session error may have no input UUID. Treat it as a session failure,
+ * never as successful completion of whichever Canon input happens to be active.
+ * An unattributed success while foreground work is outstanding is ambiguous too:
+ * waiting for an idle echo would wedge that input, because its slot rejects idle
+ * until completion. Close the native session and preserve the unsettled input.
+ * Explicit foreign/replayed UUIDs remain unrelated results and are ignored.
+ */
+export function shouldFailClaudeSessionForUnattributedResult(result, hasForegroundWork) {
+    const hasUuid = (typeof result.user_message_uuid === 'string' && result.user_message_uuid.length > 0)
+        || (Array.isArray(result.user_message_uuids)
+            && result.user_message_uuids.some((uuid) => typeof uuid === 'string' && uuid.length > 0));
+    return !hasUuid && (hasForegroundWork || result.is_error || result.subtype !== 'success');
+}
 /**
  * Whether an envelope owns the session's active-turn slot. Only Canon turns do;
  * any future internal envelope must remain invisible to user-facing turn state.
@@ -305,17 +332,30 @@ export async function dispatchClaudeInput(session, input, deps) {
     catch (error) {
         failure = { error };
     }
-    if (session.dispatchingInput === input)
-        session.dispatchingInput = null;
     if (failure) {
+        if (session.dispatchingInput === input)
+            session.dispatchingInput = null;
         deps.abandon(input, 'error', failure.error);
         return;
     }
     if (session.closed) {
+        if (session.dispatchingInput === input)
+            session.dispatchingInput = null;
         deps.abandon(input, 'closed');
         return;
     }
-    deps.send(input);
+    try {
+        await deps.send(input);
+    }
+    catch (error) {
+        if (session.dispatchingInput === input)
+            session.dispatchingInput = null;
+        deps.abandon(input, 'error', error);
+    }
+    finally {
+        if (session.dispatchingInput === input)
+            session.dispatchingInput = null;
+    }
 }
 // ── Turn lifecycle: opening a turn before the SDK says anything ──────
 //
@@ -1188,12 +1228,9 @@ export async function runClaudeExhaustedFinalDelivery(session, pending, deps) {
     }
     deps.retireTurn();
 }
-// Model options are discovery-driven: the host publishes whatever the Claude
-// Code CLI it spawns reports. A CLI older than this predates whole model
-// families (2.1.220 is the first to know Opus 5), so an old binary silently
-// shortens the picker instead of failing. Keep this at or above the CLI the
-// pinned SDK bundles, so the bundled fallback always satisfies it.
-export const MINIMUM_CLAUDE_CLI_VERSION = [2, 1, 220];
+// External CLIs must support the same input/result attribution contract as the
+// pinned SDK. Older binaries fall back to the bundled, audited runtime.
+export const MINIMUM_CLAUDE_CLI_VERSION = [2, 1, 278];
 export function parseClaudeCliVersion(output) {
     const match = output.trim().match(/^(\d+)\.(\d+)\.(\d+)/);
     return match ? match.slice(1, 4).map(Number) : null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/claude-code-plugin",
-  "version": "0.36.1",
+  "version": "0.36.3",
   "description": "Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens",
   "type": "module",
   "main": "dist/index.js",
@@ -30,11 +30,11 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.228",
-    "@canonmsg/agent-sdk": "^11.0.1",
+    "@anthropic-ai/claude-agent-sdk": "0.3.278",
+    "@canonmsg/agent-sdk": "^11.0.2",
     "@canonmsg/agent-tools": "^0.11.0",
-    "@canonmsg/coding-agent-host": "^0.9.0",
-    "@canonmsg/core": "^13.0.4",
+    "@canonmsg/coding-agent-host": "^0.10.0",
+    "@canonmsg/core": "^13.0.5",
     "@canonmsg/rich-cards": "^0.10.6",
     "@modelcontextprotocol/sdk": "^1.30.0"
   },