@canonmsg/codex-plugin 0.22.4 → 0.23.0

package/README.md

@@ -13,6 +13,9 @@ npm install -g @canonmsg/codex-plugin
 # Make sure Codex itself is logged in the way you want Canon to use
 codex login status
 
+# Select the Canon trust domain supplied for your account
+export CANON_ENVIRONMENT_ID=canon-legacy-v1
+
 # Register (approve in Canon when prompted)
 canon-codex-register --name "My Codex" --description "My local coding agent" --phone "+15551234567"
 
@@ -20,7 +23,12 @@ canon-codex-register --name "My Codex" --description "My local coding agent" --p
 canon-codex --cwd /path/to/project
 ```
 
-Registration saves a Canon profile in `~/.canon/agents.json`, the same shared profile store used by the Claude Code integration and supported by the OpenClaw plugin.
+Registration verifies the selected Canon API and stream before sending the
+request, then saves the environment ID and complete endpoint snapshot with the
+credential in `~/.canon/agents.json`. The same environment-bound profile store
+is used by the Claude Code integration and supported by the OpenClaw plugin.
+An older profile without this binding must be reconnected or migrated before a
+new host will start it.
 
 `canon-codex` is the local agent process. Keep that terminal open while you want Canon to reach the agent. Closing it, logging out, rebooting, or sleeping long enough to stop the process takes the local agent offline until you revive it.
 
@@ -120,7 +128,7 @@ canon-codex --cwd /path/to/project --codex-bin /absolute/path/to/codex
 If Canon rejects authenticated requests with `401 Invalid API key`, the stored Canon profile needs a fresh key. Reconnect the same profile to overwrite `~/.canon/agents.json`, then restart or revive the host:
 
 ```bash
-canon-codex-register --name "My Codex" --description "My local coding agent" --phone "+15551234567" --profile my-codex
+canon-codex-register --environment canon-legacy-v1 --name "My Codex" --description "My local coding agent" --phone "+15551234567" --profile my-codex
 ```
 
 If Codex reports API-key quota errors while another local tool on the same machine uses OpenAI API keys, check Codex's own stored login state:
@@ -142,7 +150,7 @@ Restart `canon-codex` after changing the Codex login state.
 ## Multiple agents
 
 ```bash
-canon-codex-register --name "Frontend" --description "React work" --phone "+1..." --profile frontend
+canon-codex-register --environment canon-legacy-v1 --name "Frontend" --description "React work" --phone "+1..." --profile frontend
 CANON_AGENT=frontend canon-codex --cwd ~/projects/frontend
 ```
 

package/dist/host.js

@@ -6,7 +6,7 @@ import { dirname } from 'node:path';
 import { parseArgs } from 'node:util';
 import { getCodexImagePath, materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { captureTurnArtifactSnapshot, collectTurnArtifacts, } from '@canonmsg/coding-agent-host';
-import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseRuntimeCardV1, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, buildBoundedTurnTrail, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseRuntimeCardV1, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, buildBoundedTurnTrail, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { decideAutoReply, } from './inbound-policy.js';
 import { CodexConversationAdapter, } from './adapter.js';
 import { CodexAppServerAdapter, } from './app-server-adapter.js';
@@ -45,7 +45,7 @@ COMMON FLAGS
 
 AUTH
   CANON_AGENT=<profile> canon-codex --cwd /path/to/project
-  CANON_API_KEY=agk_live_... canon-codex --cwd /path/to/project
+  CANON_ENVIRONMENT_ID=<id> CANON_API_KEY=agk_live_... canon-codex --cwd /path/to/project
 
 EXAMPLES
   canon-codex --cwd ~/dev/canon
@@ -487,10 +487,18 @@ export async function main() {
         console.error(`[canon-codex] Could not detect Codex CLI version for ${codexBin}: ${codexCliStatus.error ?? 'unknown result'}`);
     }
     console.error(`[canon-codex] Codex transport: ${useAppServer ? 'app-server' : 'exec --json'}`);
-    const { apiKey, agentId: profileAgentId, agentName: profileAgentName, profile, baseUrl, lockHandle, } = resolveCanonAgent({ logPrefix: '[canon-codex]', expectedClientType: 'codex' });
+    const resolvedAgent = resolveCanonAgent({ logPrefix: '[canon-codex]', expectedClientType: 'codex' });
+    const { apiKey, agentId: profileAgentId, agentName: profileAgentName, profile, baseUrl, streamUrl, rtdbUrl, firebaseApiKey, lockHandle, } = resolvedAgent;
     console.error(`[canon-codex] Starting${profile ? ` (profile: ${profile})` : ''} in ${workingDir}`);
+    try {
+        await verifyResolvedAgentEnvironment(resolvedAgent);
+    }
+    catch (error) {
+        lockHandle?.release();
+        throw error;
+    }
     const client = new CanonClient(apiKey, baseUrl);
-    const rtdb = initRTDBAuth(client);
+    const rtdb = initRTDBAuth(client, { rtdbUrl, firebaseApiKey });
     const typingSignals = createTypingStatusPublisher({
         setTyping: (conversationId, typing, status) => status
             ? client.setTyping(conversationId, typing, status)
@@ -2202,6 +2210,7 @@ export async function main() {
     const stream = new CanonStream({
         apiKey,
         agentId,
+        streamUrl,
         handler: {
             onMessage: (payload) => {
                 const message = payload.message;

package/dist/register.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 import { setDefaultResultOrder } from 'node:dns';
-import { readFileSync } from 'node:fs';
 import { parseArgs } from 'node:util';
-import { ackRegistrationApproval, clearPendingRegistration, getOrCreatePendingRegistration, registerAndWaitForApproval, updatePendingRegistration, upsertAgentProfile, AGENTS_PATH, } from '@canonmsg/core';
+import { ackRegistrationApproval, clearPendingRegistration, getOrCreatePendingRegistration, registerAndWaitForApproval, resolveCanonRuntimeConnection, loadProfiles, updatePendingRegistration, upsertAgentProfile, verifyCanonRuntimeConnection, } from '@canonmsg/core';
 import { runCli } from './cli-entry.js';
 const HELP = `canon-codex-register — register or reconnect a Codex agent in Canon
 
@@ -16,13 +15,17 @@ REQUIRED
 
 FLAGS
   --profile <name>           Local profile name in ~/.canon/agents.json
+  --environment <id>        Canon environment ID (or CANON_ENVIRONMENT_ID)
   --base-url <url>           Canon API base URL override
+  --stream-url <url>         Canon stream URL override
+  --rtdb-url <url>           Canon RTDB URL override
+  --firebase-api-key <key>   Firebase web API key override (public config)
   --help, -h                 Show this help
   --version, -V              Show package version
 
 EXAMPLES
-  canon-codex-register --name "My Codex" --description "Local coding agent" --phone "+15551234567"
-  canon-codex-register --name "Frontend" --description "React work" --phone "+15551234567" --profile frontend
+  canon-codex-register --environment canon-legacy-v1 --name "My Codex" --description "Local coding agent" --phone "+15551234567"
+  canon-codex-register --environment canon-legacy-v1 --name "Frontend" --description "React work" --phone "+15551234567" --profile frontend
 
 After approval, start it with CANON_AGENT=<profile> canon-codex --cwd /path/to/project.`;
 export async function main() {
@@ -33,7 +36,11 @@ export async function main() {
             description: { type: 'string' },
             phone: { type: 'string' },
             profile: { type: 'string' },
+            environment: { type: 'string' },
             'base-url': { type: 'string' },
+            'stream-url': { type: 'string' },
+            'rtdb-url': { type: 'string' },
+            'firebase-api-key': { type: 'string' },
         },
         strict: true,
     });
@@ -42,23 +49,31 @@ export async function main() {
         process.exit(1);
     }
     const profileName = values.profile || values.name.toLowerCase().replace(/[^a-z0-9-]/g, '-').replace(/-+/g, '-');
-    let existingAgentId;
-    try {
-        const profiles = JSON.parse(readFileSync(AGENTS_PATH, 'utf-8'));
-        existingAgentId = profiles[profileName]?.agentId;
-    }
-    catch {
-        // No existing profile state.
+    const environmentId = values.environment || process.env.CANON_ENVIRONMENT_ID;
+    if (!environmentId) {
+        throw new Error('--environment or CANON_ENVIRONMENT_ID is required');
     }
+    const connection = resolveCanonRuntimeConnection({
+        environmentId,
+        apiBaseUrl: values['base-url'],
+        streamUrl: values['stream-url'],
+        rtdbUrl: values['rtdb-url'],
+        firebaseWebApiKey: values['firebase-api-key'],
+    });
+    await verifyCanonRuntimeConnection(connection);
+    const existingProfile = loadProfiles()[profileName];
+    const existingAgentId = existingProfile?.environmentId === connection.environmentId
+        ? existingProfile.agentId
+        : undefined;
     console.log(`Registering Codex agent "${values.name}" (profile: ${profileName})...`);
-    const pending = getOrCreatePendingRegistration(profileName, 'codex');
+    const pending = getOrCreatePendingRegistration(profileName, 'codex', connection);
     const result = await registerAndWaitForApproval({
         name: values.name,
         description: values.description,
         ownerPhone: values.phone,
         developerInfo: 'Codex host plugin',
         clientType: 'codex',
-        baseUrl: values['base-url'],
+        baseUrl: connection.apiBaseUrl,
         requestedAgentId: existingAgentId,
         localRegistrationId: pending.localRegistrationId,
     }, {
@@ -87,11 +102,15 @@ export async function main() {
                 agentId: result.agentId,
                 agentName: result.agentName,
                 registeredAt: new Date().toISOString(),
+                environmentId: connection.environmentId,
+                baseUrl: connection.apiBaseUrl,
+                streamUrl: connection.streamUrl,
+                rtdbUrl: connection.rtdbUrl,
+                firebaseApiKey: connection.firebaseWebApiKey,
                 clientType: 'codex',
-                ...(typeof values['base-url'] === 'string' ? { baseUrl: values['base-url'] } : {}),
             });
             if (result.requestId) {
-                await ackRegistrationApproval(values['base-url'], result.requestId, result.pollToken);
+                await ackRegistrationApproval(connection.apiBaseUrl, result.requestId, result.pollToken);
             }
             clearPendingRegistration(profileName);
             console.log(`Approved! Agent: ${result.agentName} (${result.agentId})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.22.4",
+  "version": "0.23.0",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -29,9 +29,9 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@canonmsg/agent-sdk": "^5.1.3",
+    "@canonmsg/agent-sdk": "^6.0.0",
     "@canonmsg/coding-agent-host": "^0.2.2",
-    "@canonmsg/core": "^5.0.0"
+    "@canonmsg/core": "^6.0.0"
   },
   "engines": {
     "node": ">=18.0.0"