@canonmsg/codex-plugin 0.22.0 → 0.22.2

package/dist/host.d.ts

@@ -70,5 +70,17 @@ export declare function buildCodexRuntimeDescriptor(input: {
     supportsRichCards?: boolean;
     skills?: ReadonlyArray<CodexSkillMetadata>;
 }): CanonRuntimeDescriptor;
+export declare function buildCodexTurnResponseRouting(input: {
+    requestingUserId?: string | null;
+    ownerId?: string | null;
+    ownerOnly?: boolean;
+}): {
+    responseUserId?: string;
+    allowSessionRule: boolean;
+};
+export declare function getCodexRequestingUserId(message: {
+    senderId: string;
+    senderType?: 'human' | 'ai_agent';
+}): string | null;
 export declare function main(): Promise<void>;
 export {};

package/dist/host.js

@@ -6,7 +6,7 @@ import { dirname } from 'node:path';
 import { parseArgs } from 'node:util';
 import { getCodexImagePath, materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { captureTurnArtifactSnapshot, collectTurnArtifacts, } from '@canonmsg/coding-agent-host';
-import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseRuntimeCardV1, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, CanonApiError, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, buildBoundedTurnTrail, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseRuntimeCardV1, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, buildBoundedTurnTrail, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { decideAutoReply, } from './inbound-policy.js';
 import { CodexConversationAdapter, } from './adapter.js';
 import { CodexAppServerAdapter } from './app-server-adapter.js';
@@ -19,6 +19,7 @@ import { buildCodexModelGuardMessage, formatCodexTurnFailure, isRecoverableCodex
 import { startCodexStreamInBackground } from './host-lifecycle.js';
 import { createCodexControlPoller } from './control-channel.js';
 import { runCli } from './cli-entry.js';
+import { collectMissedInboundMessages, STARTUP_RECOVERY_MAX_MESSAGES, STARTUP_RECOVERY_PAGE_SIZE, } from './startup-recovery.js';
 import { applyTextSegmentBlock, beginCommandBlock, claimCommandBlock, createCommandBlockTracker, } from './turn-activity.js';
 const HELP = `canon-codex — run a local Codex agent host for Canon
 
@@ -75,6 +76,7 @@ const MAX_SESSIONS = 12;
 const IDLE_TIMEOUT_MS = 30 * 60 * 1000;
 const HEARTBEAT_MS = 30_000;
 const IDLE_CHECK_MS = 60_000;
+const PLAN_REVIEW_TIMEOUT_MS = 10 * 60_000;
 const CODEX_RUNTIME_CAPABILITIES = {
     ...DEFAULT_RUNTIME_CAPABILITIES,
     supportsInterrupt: true,
@@ -228,6 +230,18 @@ export function buildCodexRuntimeDescriptor(input) {
         coreControls: descriptor.coreControls.filter((control) => control.id !== 'model'),
     };
 }
+export function buildCodexTurnResponseRouting(input) {
+    const responseUserId = input.ownerOnly
+        ? input.ownerId ?? undefined
+        : input.requestingUserId ?? input.ownerId ?? undefined;
+    return {
+        ...(responseUserId ? { responseUserId } : {}),
+        allowSessionRule: Boolean(responseUserId && input.ownerId && responseUserId === input.ownerId),
+    };
+}
+export function getCodexRequestingUserId(message) {
+    return message.senderType === 'human' ? message.senderId : null;
+}
 function modelOptionLabel(model) {
     if (/^gpt-5\.5(?:$|[-_:])/i.test(model))
         return 'GPT-5.5';
@@ -534,7 +548,10 @@ export async function main() {
         kind: 'approval',
         generateId: () => randomUUID(),
         create: async ({ client: apiClient, ctx, conversationId, requestId, payload, expiresAt }) => {
-            await apiClient.createRuntimeApprovalRequest({
+            const responseUserId = (payload.responseUserId ?? ctx.ownerId) || undefined;
+            const allowSessionRule = payload.allowSessionRule !== false
+                && Boolean(responseUserId && responseUserId === ctx.ownerId);
+            const created = await apiClient.createRuntimeApprovalRequest({
                 conversationId,
                 approvalId: requestId,
                 toolName: payload.toolName,
@@ -545,14 +562,17 @@ export async function main() {
                 native: payload.native,
                 details: payload.details,
                 ...(payload.diff ? { diff: payload.diff } : {}),
-                responseUserId: ctx.ownerId || undefined,
-                allowSessionRule: true,
+                ...(responseUserId ? { responseUserId } : {}),
+                allowSessionRule,
                 expiresAt,
                 ...(payload.turnId ? { turnId: payload.turnId } : {}),
             });
-            return { requestId };
+            return {
+                requestId,
+                state: { allowSessionRule: created.allowSessionRule ?? allowSessionRule },
+            };
         },
-        consume: async ({ client: apiClient, conversationId, requestId }) => {
+        consume: async ({ client: apiClient, conversationId, requestId, state }) => {
             const response = await apiClient
                 .consumeRuntimeApprovalResponse({ conversationId, approvalId: requestId })
                 .catch(() => null);
@@ -561,7 +581,9 @@ export async function main() {
                     state: 'resolved',
                     result: {
                         decision: 'allow',
-                        ...(response.sessionRule ? { sessionRule: response.sessionRule } : {}),
+                        ...(state?.allowSessionRule === true && response.sessionRule
+                            ? { sessionRule: response.sessionRule }
+                            : {}),
                     },
                 };
             }
@@ -609,6 +631,7 @@ export async function main() {
     });
     const sessions = new Map();
     const pendingSessionCreations = new Map();
+    let inboundRecoverySequence = 0;
     const conversationCache = new Map();
     const knownConversationIds = new Set();
     const promptedGroupContextConversationIds = new Set();
@@ -754,6 +777,29 @@ export async function main() {
             return;
         await client.updateMessageDisposition(conversationId, sourceMessageId, 'accepted_now').catch(() => { });
     }
+    function persistInboundRecoveryCursor(conversationId, messageId) {
+        if (!messageId)
+            return;
+        try {
+            saveRuntimeSessionState(runtimeId, {
+                conversationId,
+                baseCwd: workingDir,
+                lastInboundMessageId: messageId,
+            });
+        }
+        catch (error) {
+            console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Failed to persist inbound recovery cursor:`, error instanceof Error ? error.message : error);
+        }
+    }
+    function persistInboundRecoveryCursorWhenIdle(conversationId, messageId) {
+        const session = sessions.get(conversationId);
+        // A later queued turn will advance past this non-triggering message. Do
+        // not write it ahead of earlier work and then let that work regress the
+        // cursor when it completes.
+        if (session?.running || (session?.queue.length ?? 0) > 0)
+            return;
+        persistInboundRecoveryCursor(conversationId, messageId);
+    }
     async function markQueuedPromptsRejected(conversationId, prompts) {
         await Promise.all(prompts.map((prompt) => {
             if (!prompt.markAccepted || !prompt.sourceMessageId)
@@ -761,6 +807,18 @@ export async function main() {
             return client.updateMessageDisposition(conversationId, prompt.sourceMessageId, 'rejected').catch(() => { });
         }));
     }
+    function rememberDroppedRecoveryCursor(session, prompts) {
+        const latest = prompts.reduce((current, prompt) => (prompt.sourceMessageId && (!current || prompt.recoverySequence > current.recoverySequence)
+            ? prompt
+            : current), null)?.sourceMessageId;
+        if (!latest)
+            return;
+        if (session.running) {
+            session.pendingDroppedRecoveryCursor = latest;
+            return;
+        }
+        persistInboundRecoveryCursor(session.conversationId, latest);
+    }
     function removeQueuedPrompt(conversationId, sourceMessageId) {
         const session = sessions.get(conversationId);
         if (!session || session.queue.length === 0)
@@ -888,6 +946,7 @@ export async function main() {
         session.resetRequested = true;
         const droppedPrompts = session.queue.splice(0);
         await markQueuedPromptsRejected(conversationId, droppedPrompts);
+        rememberDroppedRecoveryCursor(session, droppedPrompts);
         clearStoredThreadId(runtimeId, agentId, conversationId, session.environment.baseCwd, session.environment.mode);
         session.adapter.clearThreadId();
         session.activeSelfContextId = null;
@@ -1012,6 +1071,7 @@ export async function main() {
                     currentTurnCanUseCodexAppTools: false,
                     activeSelfContextId: null,
                     lastAcceptedIntent: null,
+                    pendingDroppedRecoveryCursor: null,
                     resetRequested: false,
                     lastActivity: Date.now(),
                     typingKeepaliveTimer: null,
@@ -1040,7 +1100,7 @@ export async function main() {
             pendingSessionCreations.delete(conversationId);
         }
     }
-    function enqueuePrompt(session, prompt, intent = 'queue', toFront = false, sourceMessageId, markAccepted = false, imagePaths = [], mediaAddDirs = [], planMode = false, artifactRoutingMode = 'disabled', canUseCodexAppTools = false) {
+    function enqueuePrompt(session, prompt, intent = 'queue', toFront = false, sourceMessageId, markAccepted = false, imagePaths = [], mediaAddDirs = [], planMode = false, artifactRoutingMode = 'disabled', canUseCodexAppTools = false, requestingUserId = null) {
         const nextPrompt = {
             prompt,
             intent,
@@ -1051,6 +1111,8 @@ export async function main() {
             planMode,
             artifactRoutingMode,
             canUseCodexAppTools,
+            requestingUserId,
+            recoverySequence: ++inboundRecoverySequence,
         };
         if (toFront) {
             session.queue.unshift(nextPrompt);
@@ -1062,6 +1124,19 @@ export async function main() {
         writeTurn(session);
         void runNextTurn(session);
     }
+    function enqueueCodexPlanReviewResult(session, result, responseUserId) {
+        if (result.status === 'cancelled' || result.status === 'timeout') {
+            console.error(`[canon-codex] [${session.conversationId.slice(0, 8)}] Plan review ${result.status}`);
+            return;
+        }
+        const feedback = result.feedback?.trim();
+        const prompt = result.status === 'approve'
+            ? 'The plan was approved. Implement the approved plan now.'
+            : result.status === 'reject'
+                ? `The plan was declined — keep planning and wait for guidance before implementing.${feedback ? `\n\nNotes:\n${feedback}` : ''}`
+                : `Please revise the plan.${feedback ? `\n\nRevision feedback:\n${feedback}` : ''}`;
+        enqueuePrompt(session, prompt, 'queue', false, result.receiptId ?? null, false, [], [], result.status !== 'approve', 'disabled', false, responseUserId);
+    }
     function resolveArtifactRoutingMode(participantContext) {
         return participantContext.conversationType === 'direct' && participantContext.isOwner
             ? 'workspace-generated'
@@ -1076,7 +1151,7 @@ export async function main() {
         const args = isRecord(params.arguments) ? params.arguments : null;
         return params.card ?? params.cardDocument ?? input?.card ?? args?.card ?? null;
     }
-    async function handleCodexServerRequest(session, request) {
+    async function handleCodexServerRequest(session, request, requestingUserId) {
         const requestId = String(request.id);
         const params = request.params;
         const expiresAt = Date.now() + 30 * 60_000;
@@ -1108,11 +1183,10 @@ export async function main() {
                 ?? requestId;
             let requestCreated = false;
             let requestResolved = false;
+            const responseRouting = buildCodexTurnResponseRouting({ requestingUserId, ownerId });
             try {
-                // Built-in card descriptor owns create+poll; codex passes native/turnId
-                // via payload, post-create turn side effects via onCreated. responseUserId
-                // is omitted (default `infer` policy) so the backend targets a reachable
-                // member (owner is often not a member of agent-to-user DMs).
+                // Built-in card descriptor owns create+poll; Codex passes the native
+                // handles, turn context, and the human responder captured for this turn.
                 const cardResult = await runtimeRequests.request('card', session.conversationId, {
                     card,
                     native: {
@@ -1126,6 +1200,9 @@ export async function main() {
                         },
                     },
                     turnId: session.currentTurnId ?? undefined,
+                    ...(responseRouting.responseUserId
+                        ? { responseUserId: responseRouting.responseUserId }
+                        : {}),
                 }, {
                     requestId: cardId,
                     expiresAt,
@@ -1199,8 +1276,12 @@ export async function main() {
             const paramsArguments = isRecord(params.arguments) ? params.arguments : null;
             const questions = mapCodexQuestions(params.questions ?? paramsInput?.questions ?? paramsArguments?.questions);
             const inputId = readString(params, 'itemId') ?? requestId;
-            // Built-in input descriptor owns create+poll; default `owner` responder
-            // policy resolves to ctx.ownerId (matching the former responseUserId).
+            const sensitive = Boolean(questions?.some((question) => question.isSecret));
+            const responseRouting = buildCodexTurnResponseRouting({
+                requestingUserId,
+                ownerId,
+                ownerOnly: sensitive,
+            });
             const response = await runtimeRequests.request('input', session.conversationId, {
                 kind: 'clarify',
                 title: 'Codex needs input',
@@ -1208,7 +1289,10 @@ export async function main() {
                     ? 'Codex needs your input to continue.'
                     : 'Codex needs input.',
                 ...(questions ? { questions } : {}),
-                sensitive: Boolean(questions?.some((question) => question.isSecret)),
+                sensitive,
+                ...(responseRouting.responseUserId
+                    ? { responseUserId: responseRouting.responseUserId }
+                    : {}),
                 native: {
                     runtime: 'codex',
                     method: request.method,
@@ -1229,11 +1313,15 @@ export async function main() {
         });
         if (mappedApproval) {
             const approvalId = readString(params, 'approvalId') ?? readString(params, 'itemId') ?? requestId;
-            // Approval descriptor's create authors the server request (responder = ctx.ownerId).
+            const responseRouting = buildCodexTurnResponseRouting({ requestingUserId, ownerId });
             const response = await runtimeRequests.request('approval', session.conversationId, {
                 ...mappedApproval,
                 native: { ...mappedApproval.native, requestId, method: request.method },
                 turnId: session.currentTurnId ?? undefined,
+                ...(responseRouting.responseUserId
+                    ? { responseUserId: responseRouting.responseUserId }
+                    : {}),
+                allowSessionRule: responseRouting.allowSessionRule,
             }, { requestId: approvalId, expiresAt });
             if (request.method === 'item/permissions/requestApproval') {
                 return response.decision === 'allow'
@@ -1251,11 +1339,20 @@ export async function main() {
         knownConversationIds.add(input.conversationId);
         if (input.turnDispatch && input.turnDispatch.kind !== 'run_turn') {
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Suppressed server-dispatched turn: ${input.turnDispatch.reason}`);
+            persistInboundRecoveryCursorWhenIdle(input.conversationId, input.message.id);
             return;
         }
         if (isRecord(input.message.metadata)
             && input.message.metadata.type === 'plan_approval_reply'
             && typeof input.message.metadata.decision === 'string') {
+            const planId = readString(input.message.metadata, 'planId');
+            if (planId && runtimeRequests.handleMessage(input.conversationId, {
+                senderId: input.message.senderId,
+                metadata: input.message.metadata,
+            })) {
+                persistInboundRecoveryCursorWhenIdle(input.conversationId, input.message.id);
+                return;
+            }
             const session = await getOrCreateSession(input.conversationId);
             const feedback = readString(input.message.metadata, 'feedback');
             const decision = input.message.metadata.decision;
@@ -1264,7 +1361,7 @@ export async function main() {
                 : decision === 'reject'
                     ? `The plan was declined — keep planning and wait for guidance before implementing.${feedback ? `\n\nNotes:\n${feedback}` : ''}`
                     : `Please revise the plan.${feedback ? `\n\nRevision feedback:\n${feedback}` : ''}`;
-            enqueuePrompt(session, prompt, 'queue', false, input.message.id, false, [], [], decision !== 'approve', 'disabled', input.isOwner);
+            enqueuePrompt(session, prompt, 'queue', false, input.message.id, false, [], [], decision !== 'approve', 'disabled', input.isOwner, getCodexRequestingUserId(input.message));
             return;
         }
         let materialized = [];
@@ -1322,6 +1419,7 @@ export async function main() {
             : decideAutoReply(participantContext, behavior);
         if (!autoReply.allow) {
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Suppressed auto-reply: ${autoReply.reason}`);
+            persistInboundRecoveryCursorWhenIdle(input.conversationId, input.message.id);
             return;
         }
         console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Message from ${input.senderName}: "${content.slice(0, 80)}" (${autoReply.reason})`);
@@ -1345,6 +1443,7 @@ export async function main() {
                     replyBehavior: 'suppress_auto_reply',
                 },
             }).catch(() => { });
+            persistInboundRecoveryCursor(input.conversationId, input.message.id);
             return;
         }
         session.activeSelfContextId = activeSelfContextId;
@@ -1361,7 +1460,7 @@ export async function main() {
         });
         if (session.running && deliveryIntent === 'interrupt') {
             const artifactRoutingMode = resolveArtifactRoutingMode(participantContext);
-            enqueuePrompt(session, prompt, deliveryIntent, true, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, artifactRoutingMode, participantContext.isOwner);
+            enqueuePrompt(session, prompt, deliveryIntent, true, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, artifactRoutingMode, participantContext.isOwner, getCodexRequestingUserId(input.message));
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Interrupting current turn for explicit human send-now`);
             await session.adapter.interrupt().catch(() => { });
             clearStreaming(input.conversationId);
@@ -1369,7 +1468,7 @@ export async function main() {
             return;
         }
         const artifactRoutingMode = resolveArtifactRoutingMode(participantContext);
-        enqueuePrompt(session, prompt, deliveryIntent, false, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, artifactRoutingMode, participantContext.isOwner);
+        enqueuePrompt(session, prompt, deliveryIntent, false, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, artifactRoutingMode, participantContext.isOwner, getCodexRequestingUserId(input.message));
     }
     function sendTurnArtifactFile(session, file) {
         return sendMediaFileMessage(client, session.conversationId, file.path, '', {
@@ -1568,7 +1667,7 @@ export async function main() {
             };
             const runTurnOnce = () => session.adapter.runTurn(turnPrompt, handleCodexEvent, logCodexLine, turnImagePaths, turnMediaAddDirs, {
                 planMode: nextTurn.planMode,
-                onServerRequest: (request) => handleCodexServerRequest(session, request),
+                onServerRequest: (request) => handleCodexServerRequest(session, request, nextTurn.requestingUserId ?? null),
             });
             let result = await runTurnOnce();
             if (!result.interrupted
@@ -1585,18 +1684,47 @@ export async function main() {
             }
             if (!result.interrupted && result.finalMessage && nextTurn.planMode) {
                 await routeArtifactsOnce();
-                // Route plan-CREATE through the unified spine (`/runtime-plan/request`):
-                // seeds the server-owned pending node/attention/state and authors the
-                // `plan_approval` card. Resolution is UNCHANGED — Codex still re-queues a
-                // fresh turn off the server-authored `plan_approval_reply`.
-                await client.createRuntimePlanRequest({
-                    conversationId: session.conversationId,
-                    planId: session.currentTurnId ?? randomUUID(),
+                const responseRouting = buildCodexTurnResponseRouting({
+                    requestingUserId: nextTurn.requestingUserId,
+                    ownerId,
+                });
+                const planId = session.currentTurnId ?? randomUUID();
+                let planCreated = false;
+                let resolvePlanCreated;
+                let rejectPlanCreated;
+                const planCreatedPromise = new Promise((resolve, reject) => {
+                    resolvePlanCreated = resolve;
+                    rejectPlanCreated = reject;
+                });
+                const planReview = runtimeRequests.request('plan', session.conversationId, {
                     title: 'Codex Plan',
                     body: result.finalMessage,
-                    ...(ownerId ? { responseUserId: ownerId } : {}),
+                    ...(responseRouting.responseUserId
+                        ? { responseUserId: responseRouting.responseUserId }
+                        : {}),
                     ...(session.currentTurnId ? { turnId: session.currentTurnId } : {}),
+                }, {
+                    requestId: planId,
+                    expiresAt: Date.now() + PLAN_REVIEW_TIMEOUT_MS,
+                    responderPolicy: 'infer',
+                    onCreated: () => {
+                        planCreated = true;
+                        session.turnState = 'waiting_input';
+                        writeTurn(session);
+                        resolvePlanCreated();
+                    },
                 });
+                void planReview.then((planResult) => {
+                    resolvePlanCreated();
+                    enqueueCodexPlanReviewResult(session, planResult, responseRouting.responseUserId ?? null);
+                }).catch((error) => {
+                    if (!planCreated) {
+                        rejectPlanCreated(error);
+                        return;
+                    }
+                    console.error(`[canon-codex] [${session.conversationId.slice(0, 8)}] Plan review failed:`, error instanceof Error ? error.message : error);
+                });
+                await planCreatedPromise;
                 await handoffFinalMessage(session.conversationId);
                 console.error(`[canon-codex] [${session.conversationId.slice(0, 8)}] Sent plan approval card`);
             }
@@ -1614,6 +1742,7 @@ export async function main() {
                     metadata: {
                         turnId: session.currentTurnId,
                         turnSemantics: 'turn_complete',
+                        ...(nextTurn.sourceMessageId ? { sourceMessageId: nextTurn.sourceMessageId } : {}),
                         deliveryIntent: session.lastAcceptedIntent ?? undefined,
                         ...(turnTrail.length > 0 ? { turnTrail } : {}),
                     },
@@ -1638,6 +1767,7 @@ export async function main() {
                     metadata: {
                         turnId: session.currentTurnId,
                         turnSemantics: 'turn_complete',
+                        ...(nextTurn.sourceMessageId ? { sourceMessageId: nextTurn.sourceMessageId } : {}),
                         deliveryIntent: session.lastAcceptedIntent ?? undefined,
                         ...(turnTrail.length > 0 ? { turnTrail } : {}),
                     },
@@ -1674,6 +1804,7 @@ export async function main() {
                 metadata: {
                     turnId: session.currentTurnId,
                     turnSemantics: 'turn_complete',
+                    ...(nextTurn.sourceMessageId ? { sourceMessageId: nextTurn.sourceMessageId } : {}),
                     deliveryIntent: session.lastAcceptedIntent ?? undefined,
                 },
             }).catch(() => { });
@@ -1684,6 +1815,11 @@ export async function main() {
             console.error(`[canon-codex] [${session.conversationId.slice(0, 8)}] Turn failed:`, error);
         }
         finally {
+            persistInboundRecoveryCursor(session.conversationId, nextTurn.sourceMessageId);
+            if (session.pendingDroppedRecoveryCursor) {
+                persistInboundRecoveryCursor(session.conversationId, session.pendingDroppedRecoveryCursor);
+                session.pendingDroppedRecoveryCursor = null;
+            }
             stopVisibleWorkSignal(session);
             session.running = false;
             session.state.state = 'idle';
@@ -1702,6 +1838,30 @@ export async function main() {
             }
         }
     }
+    const acceptedInboundMessageIds = new Set();
+    const inFlightInboundMessageIds = new Set();
+    function claimInboundMessageId(messageId) {
+        if (!messageId)
+            return true;
+        if (acceptedInboundMessageIds.has(messageId) || inFlightInboundMessageIds.has(messageId))
+            return false;
+        inFlightInboundMessageIds.add(messageId);
+        return true;
+    }
+    function settleInboundMessageId(messageId, accepted) {
+        if (!messageId)
+            return;
+        inFlightInboundMessageIds.delete(messageId);
+        if (!accepted)
+            return;
+        acceptedInboundMessageIds.add(messageId);
+        while (acceptedInboundMessageIds.size > 2_048) {
+            const oldest = acceptedInboundMessageIds.values().next().value;
+            if (!oldest)
+                break;
+            acceptedInboundMessageIds.delete(oldest);
+        }
+    }
     let streamConnected = false;
     const hostAvailableExecutionModes = [
         ...EXECUTION_ENVIRONMENT_MODES,
@@ -1821,6 +1981,7 @@ export async function main() {
         if (type === 'stop_and_drop') {
             const droppedPrompts = session.queue.splice(0);
             await markQueuedPromptsRejected(conversationId, droppedPrompts);
+            rememberDroppedRecoveryCursor(session, droppedPrompts);
         }
         if (session.running) {
             await session.adapter.interrupt();
@@ -2004,8 +2165,12 @@ export async function main() {
                 const message = payload.message;
                 if (message.senderId === agentId)
                     return;
+                if (!claimInboundMessageId(message.id))
+                    return;
                 if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
                     console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Ignoring server-dispatched observe-only message: ${payload.turnDispatch.reason}`);
+                    persistInboundRecoveryCursorWhenIdle(payload.conversationId, message.id);
+                    settleInboundMessageId(message.id, true);
                     return;
                 }
                 void enqueueInboundMessage({
@@ -2018,14 +2183,10 @@ export async function main() {
                     selfContexts: payload.selfContexts,
                     provenance: payload.provenance,
                     turnDispatch: payload.turnDispatch,
+                }).then(() => settleInboundMessageId(message.id, true), (error) => {
+                    settleInboundMessageId(message.id, false);
+                    console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Failed to queue inbound message:`, error instanceof Error ? error.message : error);
                 });
-                if (message.id) {
-                    saveRuntimeSessionState(runtimeId, {
-                        conversationId: payload.conversationId,
-                        baseCwd: workingDir,
-                        lastInboundMessageId: message.id,
-                    });
-                }
             },
             onMessageDeleted: (payload) => {
                 removeQueuedPrompt(payload.conversationId, payload.messageId);
@@ -2061,6 +2222,57 @@ export async function main() {
     catch (error) {
         console.error('[canon-codex] Failed to load startup conversations:', error);
     }
+    for (const conversationId of knownConversationIds) {
+        try {
+            const cursor = loadRuntimeSessionState(runtimeId, {
+                conversationId,
+                baseCwd: workingDir,
+            })?.lastInboundMessageId ?? null;
+            const recovered = await collectMissedInboundMessages({
+                fetchPage: (before) => client.getMessagesPage(conversationId, STARTUP_RECOVERY_PAGE_SIZE, before),
+                cursor,
+                agentId,
+            });
+            if (recovered.mode === 'truncated-window') {
+                console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Recovery cursor was not found within ${STARTUP_RECOVERY_MAX_MESSAGES} messages; replaying the bounded recent window`);
+            }
+            for (const message of recovered.messages) {
+                const isPlanReply = message.metadata?.type === 'plan_approval_reply';
+                if (!isPlanReply && !shouldTriggerAgentTurn({
+                    senderType: message.senderType,
+                    metadata: message.metadata,
+                }).allow) {
+                    persistInboundRecoveryCursorWhenIdle(conversationId, message.id);
+                    continue;
+                }
+                if (!claimInboundMessageId(message.id))
+                    continue;
+                try {
+                    await enqueueInboundMessage({
+                        conversationId,
+                        message,
+                        senderName: message.senderName || message.senderId,
+                        isOwner: message.senderId === ownerId,
+                        behavior: recovered.newestPage.behavior,
+                        activeSelfContextId: recovered.newestPage.activeSelfContextIdByMessageId?.[message.id] ?? null,
+                        selfContexts: recovered.newestPage.selfContexts,
+                        hydratedPage: recovered.newestPage,
+                    });
+                    settleInboundMessageId(message.id, true);
+                }
+                catch (error) {
+                    settleInboundMessageId(message.id, false);
+                    throw error;
+                }
+            }
+            if (recovered.messages.length > 0) {
+                console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Recovered ${recovered.messages.length} inbound message(s) (${recovered.mode})`);
+            }
+        }
+        catch (error) {
+            console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Startup recovery failed:`, error instanceof Error ? error.message : error);
+        }
+    }
     startCodexStreamInBackground(stream, (error) => {
         console.error('[canon-codex] SSE start error:', error instanceof Error ? error.message : error);
     });

package/dist/startup-recovery.d.ts

@@ -16,6 +16,7 @@ export interface StartupRecoveryMessage {
     id: string;
     senderId: string;
     createdAt?: string;
+    metadata?: Record<string, unknown>;
 }
 export interface StartupRecoveryPage {
     messages: StartupRecoveryMessage[];

package/dist/startup-recovery.js

@@ -37,8 +37,21 @@ export async function collectMissedInboundMessages(input) {
             cursorFound = hasCursor(fresh);
         }
     }
-    const ascending = [...collected].sort((a, b) => String(a.createdAt ?? '').localeCompare(String(b.createdAt ?? '')));
-    const inboundOnly = (messages) => messages.filter((message) => message.senderId !== input.agentId);
+    // The REST API already gives us a deterministic newest-first sequence,
+    // including messages with equal or missing timestamps. Reverse that wire
+    // order rather than re-sorting on a lossy display timestamp.
+    const ascending = [...collected].reverse();
+    const completedSourceMessageIds = new Set(collected.flatMap((message) => {
+        if (message.senderId !== input.agentId)
+            return [];
+        const metadata = message.metadata;
+        if (metadata?.turnSemantics !== 'turn_complete')
+            return [];
+        return typeof metadata.sourceMessageId === 'string'
+            ? [metadata.sourceMessageId]
+            : [];
+    }));
+    const inboundOnly = (messages) => messages.filter((message) => message.senderId !== input.agentId && !completedSourceMessageIds.has(message.id));
     let mode;
     let missed;
     if (cursorFound) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -29,9 +29,9 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@canonmsg/agent-sdk": "^5.1.0",
+    "@canonmsg/agent-sdk": "^5.1.1",
     "@canonmsg/coding-agent-host": "^0.2.2",
-    "@canonmsg/core": "^4.2.0"
+    "@canonmsg/core": "^4.2.3"
   },
   "engines": {
     "node": ">=18.0.0"