@canonmsg/codex-plugin 0.27.0 → 0.28.0

package/README.md

@@ -109,23 +109,6 @@ discovery it also offers no model picker and a fixed effort list. It registers
 no dynamic tools either, so `no_reply` is unavailable there, the same way rich
 cards are.
 
-On the app-server transport, an owner-started foreground turn also receives a
-small Canon communication surface: `codex_app.canon_send_to`, contact/request
-and conversation listing, and `codex_app.canon_cancel_contact_request` for the
-agent's own pending DM requests. `canon_send_to` accepts one stable contact
-target and visible text; the host supplies trusted source-turn routing. These
-tools are withheld from non-owner turns, service-agent mode, detached threads,
-and the exec fallback. Contact cards only claim reach-out support when this
-exact surface is mounted.
-
-When a reach-out needs target-owner setup or approval, Canon parks the visible
-opener. Terminal request outcomes enter a deduplicated local lifecycle inbox and
-are supplied as trusted context on the next natural owner turn; they never start
-a synthetic model turn. A connected outcome means Canon already delivered the
-opener. After an SSE reconnect or expired replay window, the host refreshes
-memberships, reconciles outbound request phases, and recovers unseen messages
-from its persisted cursors before resuming live delivery.
-
 Set `CANON_CODEX_TRANSPORT=exec` or `CANON_CODEX_TRANSPORT=app-server` to skip
 the probe when it misfires.
 

package/dist/app-server-adapter.js

@@ -638,13 +638,7 @@ function isForegroundCanonToolCall(params) {
     const tool = rawTool.startsWith('codex_app.')
         ? rawTool.slice('codex_app.'.length)
         : rawTool;
-    return tool === 'canon_runtime_control'
-        || tool === 'canon_send_to'
-        || tool === 'canon_list_contacts'
-        || tool === 'canon_list_contact_requests'
-        || tool === 'canon_list_conversations'
-        || tool === 'canon_cancel_contact_request'
-        || tool === 'no_reply';
+    return tool === 'canon_runtime_control' || tool === 'no_reply';
 }
 function parseJson(line) {
     try {

package/dist/codex-app-tools.d.ts

@@ -1,5 +1,4 @@
-import { type CanonClient, type CanonVerbName, type NoReplyReportClient } from '@canonmsg/core';
-import { type OwnerBoundCanonContactTarget } from '@canonmsg/agent-tools';
+import { type CanonClient, type NoReplyReportClient } from '@canonmsg/core';
 type JsonRecord = Record<string, unknown>;
 interface DynamicToolSpec {
     [key: string]: unknown;
@@ -45,11 +44,7 @@ type DynamicToolCallResponse = {
  */
 export declare const CODEX_NO_REPLY_TOOL_NAME = "no_reply";
 export declare const CANON_RUNTIME_CONTROL_TOOL_NAME = "canon_runtime_control";
-export declare const CODEX_CANON_SEND_TO_TOOL_NAME = "canon_send_to";
-export declare const CODEX_CANON_LIST_CONTACTS_TOOL_NAME = "canon_list_contacts";
-export declare const CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME = "canon_list_contact_requests";
-export declare const CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME = "canon_list_conversations";
-export declare const CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME = "canon_cancel_contact_request";
+export declare const CODEX_COMMUNICATE_TOOL_NAME = "communicate";
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
@@ -59,6 +54,8 @@ export declare const CODEX_NO_REPLY_MODEL_TOOL_NAME = "codex_app.no_reply";
 export declare const CODEX_APP_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
 /** The complete model-visible surface for non-coding service agents. */
 export declare const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
+/** Closed agents are not shown the optional outbound communication surface. */
+export declare function filterCodexCommunicationTools(tools: ReadonlyArray<DynamicToolSpec>, outboundPolicy: 'open' | 'approval-required' | 'closed' | null): ReadonlyArray<DynamicToolSpec>;
 /**
  * Tools exposed to detached Codex threads created through the bridge. Canon
  * conversation controls belong only to the foreground turn that received the
@@ -71,26 +68,9 @@ export declare function successfulCodexAppToolResult(payload: unknown): DynamicT
 /** True when this dynamic-tool call is the deliberate-silence verb. */
 export declare function isCodexNoReplyToolCall(params: CodexAppToolCallParams): boolean;
 export declare function isCanonRuntimeControlToolCall(params: CodexAppToolCallParams): boolean;
-export declare function codexCanonVerbForToolCall(params: CodexAppToolCallParams): CanonVerbName | null;
-export declare function isCodexCanonVerbToolCall(params: CodexAppToolCallParams): boolean;
+export declare function isCodexCommunicateToolCall(params: CodexAppToolCallParams): boolean;
 export declare function isCodexServiceAgentToolCall(params: CodexAppToolCallParams): boolean;
-export interface CodexCanonVerbTrustedContext {
-    conversationId: string;
-    sourceMessageId: string | null;
-    turnId: string | null;
-    replyContactTarget?: OwnerBoundCanonContactTarget;
-}
-/**
- * Execute the deliberately filtered canonical-verb projection. The model can
- * author only the destination and visible copy. Provenance and turn metadata
- * come exclusively from the active host turn, so a prompt cannot forge its
- * source or make an outbound message look like an unrelated event.
- */
-export declare function answerCodexCanonVerb(input: {
-    client: CanonClient;
-    params: CodexAppToolCallParams;
-    context: CodexCanonVerbTrustedContext;
-}): Promise<DynamicToolCallResponse>;
+export declare function handleCodexCommunicateToolCall(client: CanonClient, params: CodexAppToolCallParams): Promise<DynamicToolCallResponse>;
 export interface CanonRuntimeControlRequest {
     action: 'send_card' | 'request_card' | 'request_input';
     card?: unknown;

package/dist/codex-app-tools.js

@@ -1,5 +1,5 @@
 import { NO_REPLY_ACK_NOTE, reportNoReplyOutcome, } from '@canonmsg/core';
-import { createOwnerBoundCanonCommunicationBinding, } from '@canonmsg/agent-tools';
+import { canonCommunicateToolDefinition, createCanonCommunicationBinding, } from '@canonmsg/agent-tools';
 const emptyObjectSchema = {
     type: 'object',
     properties: {},
@@ -91,21 +91,7 @@ function tool(name, description, inputSchema, deferLoading = true) {
  */
 export const CODEX_NO_REPLY_TOOL_NAME = 'no_reply';
 export const CANON_RUNTIME_CONTROL_TOOL_NAME = 'canon_runtime_control';
-export const CODEX_CANON_SEND_TO_TOOL_NAME = 'canon_send_to';
-export const CODEX_CANON_LIST_CONTACTS_TOOL_NAME = 'canon_list_contacts';
-export const CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME = 'canon_list_contact_requests';
-export const CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME = 'canon_list_conversations';
-export const CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME = 'canon_cancel_contact_request';
-const CODEX_CANON_COMMUNICATION_BINDING = createOwnerBoundCanonCommunicationBinding({
-    toolNames: {
-        send_to: CODEX_CANON_SEND_TO_TOOL_NAME,
-        list_contacts: CODEX_CANON_LIST_CONTACTS_TOOL_NAME,
-        list_contact_requests: CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME,
-        list_conversations: CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME,
-        cancel_contact_request: CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME,
-    },
-});
-const CODEX_CANON_FOREGROUND_TOOL_NAMES = new Set(CODEX_CANON_COMMUNICATION_BINDING.tools.map((definition) => definition.name));
+export const CODEX_COMMUNICATE_TOOL_NAME = 'communicate';
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
@@ -137,7 +123,11 @@ const CANON_RUNTIME_CONTROL_TOOL = tool(CANON_RUNTIME_CONTROL_TOOL_NAME, 'Intera
     },
     required: ['action'],
 }, false);
-const CODEX_CANON_COMMUNICATION_TOOLS = CODEX_CANON_COMMUNICATION_BINDING.tools.map((definition) => tool(definition.name, definition.description, definition.inputSchema, false));
+const communicationBinding = createCanonCommunicationBinding({
+    toolName: CODEX_COMMUNICATE_TOOL_NAME,
+});
+const communicateDefinition = canonCommunicateToolDefinition(CODEX_COMMUNICATE_TOOL_NAME);
+const CODEX_COMMUNICATE_TOOL = tool(communicateDefinition.name, communicateDefinition.description, communicateDefinition.inputSchema, false);
 const CODEX_NO_REPLY_TOOL = tool(CODEX_NO_REPLY_TOOL_NAME, 'End your turn without posting anything to the conversation. Use it in group '
     + 'chats when you have nothing to add — no message is created, so no other '
     + 'member or agent is triggered. Optional private reason (logged, never '
@@ -261,8 +251,8 @@ export const CODEX_APP_DYNAMIC_TOOLS = [
         },
         required: ['threadId', 'title'],
     }),
-    ...CODEX_CANON_COMMUNICATION_TOOLS,
     CANON_RUNTIME_CONTROL_TOOL,
+    CODEX_COMMUNICATE_TOOL,
     // Canon's `no_reply` verb, projected into the only model-visible tool surface
     // the Codex transport gives us. It is answered by the Canon host itself.
     CODEX_NO_REPLY_TOOL,
@@ -270,16 +260,22 @@ export const CODEX_APP_DYNAMIC_TOOLS = [
 /** The complete model-visible surface for non-coding service agents. */
 export const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS = [
     CANON_RUNTIME_CONTROL_TOOL,
+    CODEX_COMMUNICATE_TOOL,
     CODEX_NO_REPLY_TOOL,
 ];
+/** Closed agents are not shown the optional outbound communication surface. */
+export function filterCodexCommunicationTools(tools, outboundPolicy) {
+    return outboundPolicy === 'closed'
+        ? tools.filter((entry) => entry.name !== CODEX_COMMUNICATE_TOOL_NAME)
+        : tools;
+}
 /**
  * Tools exposed to detached Codex threads created through the bridge. Canon
  * conversation controls belong only to the foreground turn that received the
  * human message; a child thread has neither that turn nor its responder.
  */
 export const CODEX_DETACHED_THREAD_DYNAMIC_TOOLS = CODEX_APP_DYNAMIC_TOOLS.filter((entry) => (entry.name !== CANON_RUNTIME_CONTROL_TOOL_NAME
-    && entry.name !== CODEX_NO_REPLY_TOOL_NAME
-    && !CODEX_CANON_FOREGROUND_TOOL_NAMES.has(entry.name)));
+    && entry.name !== CODEX_NO_REPLY_TOOL_NAME));
 const CODEX_APP_TOOL_NAMES = new Set(CODEX_APP_DYNAMIC_TOOLS.map((entry) => String(entry.name)));
 const UNSUPPORTED_TOOLS = new Map([
     ['automation_update', 'Canon does not manage Codex Desktop automations.'],
@@ -313,52 +309,21 @@ export function isCodexNoReplyToolCall(params) {
 export function isCanonRuntimeControlToolCall(params) {
     return normalizeToolName(params.tool) === CANON_RUNTIME_CONTROL_TOOL_NAME;
 }
-export function codexCanonVerbForToolCall(params) {
-    const toolName = normalizeToolName(params.tool);
-    return toolName ? CODEX_CANON_COMMUNICATION_BINDING.verbForToolName(toolName) : null;
-}
-export function isCodexCanonVerbToolCall(params) {
-    return codexCanonVerbForToolCall(params) !== null;
+export function isCodexCommunicateToolCall(params) {
+    return normalizeToolName(params.tool) === CODEX_COMMUNICATE_TOOL_NAME;
 }
 export function isCodexServiceAgentToolCall(params) {
     const toolName = normalizeToolName(params.tool);
-    return toolName === CANON_RUNTIME_CONTROL_TOOL_NAME || toolName === CODEX_NO_REPLY_TOOL_NAME;
+    return toolName === CANON_RUNTIME_CONTROL_TOOL_NAME
+        || toolName === CODEX_COMMUNICATE_TOOL_NAME
+        || toolName === CODEX_NO_REPLY_TOOL_NAME;
 }
-/**
- * Execute the deliberately filtered canonical-verb projection. The model can
- * author only the destination and visible copy. Provenance and turn metadata
- * come exclusively from the active host turn, so a prompt cannot forge its
- * source or make an outbound message look like an unrelated event.
- */
-export async function answerCodexCanonVerb(input) {
-    const verb = codexCanonVerbForToolCall(input.params);
-    if (!verb)
-        return toolResult(false, { error: 'Unsupported Canon verb tool.' });
-    try {
-        const result = await CODEX_CANON_COMMUNICATION_BINDING.execute({
-            client: input.client,
-            toolName: normalizeToolName(input.params.tool) ?? '',
-            arguments: input.params.arguments,
-            context: input.context.sourceMessageId ? {
-                isOwnerTurn: true,
-                conversationId: input.context.conversationId,
-                sourceMessageId: input.context.sourceMessageId,
-                ...(input.context.turnId ? { turnId: input.context.turnId } : {}),
-                ...(input.context.replyContactTarget
-                    ? { replyContactTarget: input.context.replyContactTarget }
-                    : {}),
-            } : null,
-        });
-        return {
-            success: result.isError !== true,
-            contentItems: result.content.map((item) => ({ type: 'inputText', text: item.text })),
-        };
-    }
-    catch (error) {
-        return toolResult(false, {
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
+export async function handleCodexCommunicateToolCall(client, params) {
+    const result = await communicationBinding.execute(client, CODEX_COMMUNICATE_TOOL_NAME, parseToolArguments(params.arguments));
+    return {
+        success: result.isError !== true,
+        contentItems: result.content.map((item) => ({ type: 'inputText', text: item.text })),
+    };
 }
 export function parseCanonRuntimeControlRequest(params) {
     if (!isCanonRuntimeControlToolCall(params))
@@ -448,12 +413,6 @@ export async function handleCodexAppToolCall(runtime, params) {
             error: 'canon_runtime_control is answered by the Canon host, not the app-tool bridge.',
         });
     }
-    if (CODEX_CANON_FOREGROUND_TOOL_NAMES.has(toolName)) {
-        return toolResult(false, {
-            tool: toolName,
-            error: `${toolName} is answered by the Canon host, not the app-tool bridge.`,
-        });
-    }
     const unsupportedReason = UNSUPPORTED_TOOLS.get(toolName);
     if (unsupportedReason) {
         return toolResult(false, { tool: toolName, error: unsupportedReason });
@@ -702,21 +661,6 @@ function parseToolArguments(value) {
     }
     return {};
 }
-function parseToolArgumentsStrict(value) {
-    if (value === undefined || value === null || value === '')
-        return {};
-    if (isRecord(value))
-        return value;
-    if (typeof value !== 'string' || !value.trim())
-        return null;
-    try {
-        const parsed = JSON.parse(value);
-        return isRecord(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
 function normalizeToolName(value) {
     if (typeof value !== 'string' || !value.trim())
         return null;

package/dist/host.d.ts

@@ -61,6 +61,7 @@ export declare function buildCodexRuntimeDescriptor(input: {
     workspaces: WorkspaceOption[];
     workspaceRoots?: CanonWorkspaceRootMetadata[];
     executionModes: ExecutionEnvironmentMode[];
+    defaultExecutionMode?: ExecutionEnvironmentMode;
     permissionModes: Array<{
         value: string;
         label: string;
@@ -70,7 +71,6 @@ export declare function buildCodexRuntimeDescriptor(input: {
     supportsPlanMode: boolean;
     supportsCompact?: boolean;
     supportsRichCards?: boolean;
-    supportsCanonCommunicationTools?: boolean;
     skills?: ReadonlyArray<CodexSkillMetadata>;
     serviceAgentMode?: boolean;
 }): CanonRuntimeDescriptor;
@@ -88,7 +88,7 @@ export declare function getCodexRequestingUserId(message: {
 }): string | null;
 export declare function resolveSessionExecutionMode(config: {
     executionMode?: ExecutionEnvironmentMode;
-} | null | undefined, serviceAgentMode?: boolean): ExecutionEnvironmentMode;
+} | null | undefined, serviceAgentMode?: boolean, defaultExecutionMode?: ExecutionEnvironmentMode): ExecutionEnvironmentMode;
 export declare function resolveCodexSessionConfig<T extends Record<string, unknown>>(config: T | null | undefined, serviceAgentMode?: boolean): T | null;
 export declare function resolveWorkspaceCwd(config: {
     workspaceId?: string;

package/dist/host.js

@@ -6,11 +6,11 @@ import { dirname } from 'node:path';
 import { parseArgs } from 'node:util';
 import { getCodexImagePath, materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
 import { buildTrailBlockId, buildUndeliverableFinalNotice, captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, PLAN_BLOCK_TITLE, resolveTurnArtifactRouting, collectMissedInboundMessages, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
-import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, HOST_ADMISSION_ACTIONS_DISABLED, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, formatPendingContactLifecycleContext, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, readLocalRuntimeEntry, reconcileContactLifecycleEvents, recordLocalRuntimeContactLifecycleEvent, saveLocalRuntimeContactLifecycleCursor, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, shouldTriggerAgentTurn, takeLocalRuntimeContactLifecycleEvents, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, loadHostSessionConfig, releaseConversationEnvironment, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostAgentRuntime, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveHostWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { validateCard } from '@canonmsg/rich-cards';
 import { CodexConversationAdapter, } from './adapter.js';
 import { CodexAppServerAdapter, } from './app-server-adapter.js';
-import { CODEX_APP_DYNAMIC_TOOLS, CODEX_NO_REPLY_MODEL_TOOL_NAME, CODEX_SERVICE_AGENT_DYNAMIC_TOOLS, answerCodexCanonVerb, answerCodexNoReply, classifyCodexAppToolRequest, deniedCodexAppToolResult, handleCodexAppToolCall, isCanonRuntimeControlToolCall, isCodexAppToolCall, isCodexCanonVerbToolCall, isCodexServiceAgentToolCall, parseCanonRuntimeControlRequest, readCodexNoReplyReason, successfulCodexAppToolResult, } from './codex-app-tools.js';
+import { CODEX_APP_DYNAMIC_TOOLS, CODEX_NO_REPLY_MODEL_TOOL_NAME, CODEX_SERVICE_AGENT_DYNAMIC_TOOLS, answerCodexNoReply, classifyCodexAppToolRequest, deniedCodexAppToolResult, filterCodexCommunicationTools, handleCodexAppToolCall, handleCodexCommunicateToolCall, isCanonRuntimeControlToolCall, isCodexAppToolCall, isCodexCommunicateToolCall, isCodexServiceAgentToolCall, parseCanonRuntimeControlRequest, readCodexNoReplyReason, successfulCodexAppToolResult, } from './codex-app-tools.js';
 import { mapCanonApprovalResultToCodexDecision, mapCodexAppServerApprovalRequest, } from './app-server-approval.js';
 import { clearStoredThreadId, buildCodexThreadPolicyFingerprint, loadStoredThreadId, saveStoredThreadId, } from './session-store.js';
 import { deriveCodexPermissionEnvelope, mapCanonPermissionToCodex, } from './permission-mode.js';
@@ -30,6 +30,7 @@ COMMON FLAGS
   --cwd <path>                         Project directory to run Codex from
   --workspace <path>                   Additional project to expose in Canon
   --workspace-root <path>              Discover projects under an approved root
+  --default-execution-mode <mode>      New-conversation default: worktree or locked
   --model <model>                      Default Codex model for new turns
   --sandbox <mode>                     Codex sandbox mode
   --full-auto                          Allow non-interactive write access
@@ -199,6 +200,7 @@ export function buildCodexRuntimeDescriptor(input) {
         workspaces: serviceAgentMode ? [] : input.workspaces,
         workspaceRoots: serviceAgentMode ? undefined : input.workspaceRoots,
         executionModes: serviceAgentMode ? [] : input.executionModes,
+        defaultExecutionMode: serviceAgentMode ? 'locked' : input.defaultExecutionMode,
         permissionModes: serviceAgentMode ? [] : input.permissionModes,
         defaultPermissionMode: serviceAgentMode ? undefined : input.defaultPermissionMode,
         permissionModeLabel: 'Execution policy',
@@ -210,9 +212,6 @@ export function buildCodexRuntimeDescriptor(input) {
         effortLiveBehavior: 'next_turn',
         presentation: input.presentation,
         streamingTextMode: 'snapshot',
-        admissionActions: input.supportsCanonCommunicationTools && !serviceAgentMode
-            ? { ...HOST_ADMISSION_ACTIONS_DISABLED, requestContact: true, reachOut: true }
-            : HOST_ADMISSION_ACTIONS_DISABLED,
         ...(input.supportsPlanMode && !serviceAgentMode
             ? {
                 turnModes: [
@@ -284,21 +283,25 @@ export function getCodexRequestingUserId(message) {
 async function publishAgentRuntime(agentId, runtime, rtdb) {
     await publishHostAgentRuntime(agentId, 'codex', runtime, rtdb);
 }
-async function loadSessionConfig(conversationId, agentId, rtdb, retryMissing = true) {
+async function loadSessionConfig(conversationId, agentId, rtdb) {
     return loadHostSessionConfig({
         conversationId,
         agentId,
         rtdb,
         extraStringFields: CODEX_SESSION_CONFIG_FIELDS,
-        retryMissingMs: retryMissing ? 3_000 : 0,
     });
 }
-export function resolveSessionExecutionMode(config, serviceAgentMode = false) {
+export function resolveSessionExecutionMode(config, serviceAgentMode = false, defaultExecutionMode = 'worktree') {
     if (serviceAgentMode)
         return 'locked';
-    if (config?.executionMode)
-        return config.executionMode;
-    throw new ExecutionEnvironmentError('Session config is missing an execution mode.', 'Choose Isolated worktree or Use shared project before starting this coding session.');
+    return config?.executionMode ?? defaultExecutionMode;
+}
+function resolveConfiguredDefaultExecutionMode(value) {
+    if (value == null || value === '')
+        return 'worktree';
+    if (value === 'worktree' || value === 'locked')
+        return value;
+    throw new Error('--default-execution-mode must be worktree or locked');
 }
 export function resolveCodexSessionConfig(config, serviceAgentMode = false) {
     return serviceAgentMode ? null : config ?? null;
@@ -377,8 +380,8 @@ function buildCanonPrompt(input) {
         message: input.message,
     })), input.noReplyToolName ? { noReplyToolName: input.noReplyToolName } : {});
 }
-function renderInboundContent(message, materialized, options) {
-    return renderCanonHostInboundContent(message, materialized, options);
+function renderInboundContent(message, materialized) {
+    return renderCanonHostInboundContent(message, materialized);
 }
 async function materializePromptReplyContext(input) {
     if (!input.replyContext?.found || !input.replyContext.attachments?.length) {
@@ -395,16 +398,6 @@ async function materializePromptReplyContext(input) {
         return { replyContext: input.replyContext, materialized: [] };
     }
 }
-function ownerBoundReplyContactTarget(replyContext) {
-    const card = replyContext?.found ? replyContext.contactCard : undefined;
-    if (!card?.userId)
-        return undefined;
-    return {
-        targetUserId: card.userId,
-        ...(card.canonContactId ? { canonContactId: card.canonContactId } : {}),
-        sourceCardMessageId: replyContext.messageId,
-    };
-}
 function summarizeCommand(command) {
     const trimmed = command.trim();
     if (!trimmed)
@@ -650,6 +643,7 @@ export async function main() {
             'add-dir': { type: 'string', multiple: true },
             workspace: { type: 'string', multiple: true },
             'workspace-root': { type: 'string', multiple: true },
+            'default-execution-mode': { type: 'string' },
             config: { type: 'string', multiple: true },
             'codex-bin': { type: 'string' },
             'runtime-visibility': { type: 'string' },
@@ -674,8 +668,11 @@ export async function main() {
         onWarning: (message) => console.error(`[canon-codex] ${message}`),
     });
     const serviceAgentMode = args['service-agent'] === true;
+    const defaultExecutionMode = serviceAgentMode
+        ? 'locked'
+        : resolveConfiguredDefaultExecutionMode(args['default-execution-mode']);
     const nativeVisionEnabled = args['no-native-vision'] !== true;
-    const codexDynamicTools = serviceAgentMode
+    const baseCodexDynamicTools = serviceAgentMode
         ? CODEX_SERVICE_AGENT_DYNAMIC_TOOLS
         : CODEX_APP_DYNAMIC_TOOLS;
     workingDir = (typeof args.cwd === 'string' ? args.cwd : null) || process.cwd();
@@ -720,11 +717,13 @@ export async function main() {
     let agentId;
     let ownerId = null;
     let ownerName = null;
+    let outboundPolicy = null;
     try {
         const ctx = await client.getAgentMe();
         agentId = ctx.agentId;
         ownerId = ctx.ownerId;
         ownerName = ctx.ownerName;
+        outboundPolicy = ctx.outboundPolicy;
         console.error(`[canon-codex] Connected as ${ctx.displayName || agentId}`);
     }
     catch {
@@ -737,6 +736,7 @@ export async function main() {
         }
         console.error(`[canon-codex] Authenticated as ${agentId}`);
     }
+    const codexDynamicTools = filterCodexCommunicationTools(baseCodexDynamicTools, outboundPolicy);
     // Shared poll/timeout engine. Built-in `input`/`card` descriptors own
     // create+poll (codex passes native/responder policy via payload/options).
     // Approval keeps codex's own resolution shape (no owner-authored outcome
@@ -927,7 +927,6 @@ export async function main() {
             ownerName,
             membershipChange: pendingMembershipChanges.get(input.conversationId) ?? null,
             groupContextMode: getGroupContextMode(input.conversationId, conversation),
-            renderOptions: input.renderOptions,
         });
     }
     function writeState(session) {
@@ -1225,7 +1224,6 @@ export async function main() {
             session.currentTurnOpenedAt = null;
             session.currentTurnUpdatedAt = null;
             session.currentTurnCanUseCodexAppTools = false;
-            session.currentTurnCanUseCodexCanonTools = false;
             session.currentTurnSilenced = false;
             session.lastAcceptedIntent = null;
             session.resetRequested = false;
@@ -1263,8 +1261,8 @@ export async function main() {
             evictOldestIdle();
         }
         const creation = (async () => {
-            const config = resolveCodexSessionConfig(await loadSessionConfig(conversationId, agentId, rtdb, !serviceAgentMode), serviceAgentMode);
-            const sessionExecutionMode = resolveSessionExecutionMode(config, serviceAgentMode);
+            const config = resolveCodexSessionConfig(await loadSessionConfig(conversationId, agentId, rtdb), serviceAgentMode);
+            const sessionExecutionMode = resolveSessionExecutionMode(config, serviceAgentMode, defaultExecutionMode);
             const workspaceCwd = resolveWorkspaceCwd(config, serviceAgentMode);
             const environment = prepareConversationEnvironment({
                 agentId,
@@ -1338,8 +1336,6 @@ export async function main() {
                     currentTurnOpenedAt: null,
                     currentTurnUpdatedAt: null,
                     currentTurnCanUseCodexAppTools: false,
-                    currentTurnCanUseCodexCanonTools: false,
-                    currentTurnReplyContactTarget: null,
                     currentTurnAbortController: null,
                     // Corrected by the first turn that runs; a session with no turn
                     // publishes nothing anyway, and quiet is never an accident.
@@ -1386,10 +1382,8 @@ export async function main() {
             planMode,
             artifactRoutingMode: turn.artifactRoutingMode ?? 'disabled',
             canUseCodexAppTools: turn.canUseCodexAppTools ?? false,
-            canUseCodexCanonTools: turn.canUseCodexCanonTools ?? false,
             ...(turn.turnVerbosity ? { turnVerbosity: turn.turnVerbosity } : {}),
             requestingUserId: turn.requestingUserId ?? null,
-            ...(turn.replyContactTarget ? { replyContactTarget: turn.replyContactTarget } : {}),
         };
         if (toFront) {
             session.queue.unshift(nextPrompt);
@@ -1420,38 +1414,6 @@ export async function main() {
             requestingUserId: responseUserId,
         });
     }
-    function recordContactLifecycleEvent(request) {
-        if (request.requesterId !== agentId || !request.sourceConversationId)
-            return false;
-        return recordLocalRuntimeContactLifecycleEvent(runtimeId, request);
-    }
-    async function reconcileContactLifecycleInbox() {
-        let cursor = readLocalRuntimeEntry(runtimeId)?.contactLifecycleCursor ?? null;
-        let recorded = 0;
-        let duplicate = 0;
-        let ignored = 0;
-        for (let pageNumber = 0; pageNumber < 10; pageNumber += 1) {
-            const page = await client.listContactRequestLifecyclePage({
-                cursor,
-                limit: 100,
-            });
-            const result = await reconcileContactLifecycleEvents({
-                requests: page.requests,
-                requesterId: agentId,
-                record: (request) => recordLocalRuntimeContactLifecycleEvent(runtimeId, request),
-            });
-            recorded += result.recorded;
-            duplicate += result.duplicate;
-            ignored += result.ignored;
-            cursor = page.nextCursor;
-            saveLocalRuntimeContactLifecycleCursor(runtimeId, cursor);
-            if (!page.hasMore)
-                break;
-        }
-        if (recorded > 0) {
-            console.error(`[canon-codex] Contact lifecycle recovery: recorded=${recorded} duplicate=${duplicate} ignored=${ignored}`);
-        }
-    }
     function resolveArtifactRoutingMode(participantContext) {
         return participantContext.conversationType === 'direct' && participantContext.isOwner
             ? 'workspace-generated'
@@ -1463,19 +1425,15 @@ export async function main() {
      * so a prompt that waits behind another still runs under the answer it
      * arrived with.
      */
-    function resolveCodexTurnModes(participantContext, message, replyContext) {
+    function resolveCodexTurnModes(participantContext, message) {
         return {
             artifactRoutingMode: resolveArtifactRoutingMode(participantContext),
             canUseCodexAppTools: participantContext.isOwner || serviceAgentMode,
-            canUseCodexCanonTools: participantContext.isOwner && !serviceAgentMode,
             turnVerbosity: resolveTurnVerbosity({
                 configured: configuredTurnVerbosity,
                 conversationType: participantContext.conversationType,
             }),
             requestingUserId: getCodexRequestingUserId(message),
-            ...(participantContext.isOwner && replyContext
-                ? { replyContactTarget: ownerBoundReplyContactTarget(replyContext) }
-                : {}),
         };
     }
     function runtimeCardRequestPayload(method, params) {
@@ -1492,6 +1450,12 @@ export async function main() {
         const params = request.params;
         const expiresAt = Date.now() + 30 * 60_000;
         if (request.method === 'item/tool/call' && isCodexAppToolCall(params)) {
+            if (isCodexCommunicateToolCall(params)) {
+                if (!(session.adapter instanceof CodexAppServerAdapter)) {
+                    return deniedCodexAppToolResult('This Codex transport does not support dynamic tools.');
+                }
+                return handleCodexCommunicateToolCall(client, params);
+            }
             if (serviceAgentMode && !isCodexServiceAgentToolCall(params)) {
                 return deniedCodexAppToolResult('This service agent exposes only Canon conversation tools.');
             }
@@ -1517,23 +1481,6 @@ export async function main() {
             if (disposition === 'denied-non-owner') {
                 return deniedCodexAppToolResult('Only the Canon owner can use codex_app tools.');
             }
-            if (isCodexCanonVerbToolCall(params)) {
-                if (!session.currentTurnCanUseCodexCanonTools) {
-                    return deniedCodexAppToolResult('Canon contact and conversation tools require a real owner-authored inbound turn.');
-                }
-                return await answerCodexCanonVerb({
-                    client,
-                    params,
-                    context: {
-                        conversationId: session.conversationId,
-                        sourceMessageId,
-                        turnId: session.currentTurnId,
-                        ...(session.currentTurnReplyContactTarget
-                            ? { replyContactTarget: session.currentTurnReplyContactTarget }
-                            : {}),
-                    },
-                });
-            }
             if (isCanonRuntimeControlToolCall(params)) {
                 const command = parseCanonRuntimeControlRequest(params);
                 if (!command) {
@@ -1873,8 +1820,7 @@ export async function main() {
                 console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Failed to materialize media:`, error instanceof Error ? error.message : error);
             }
         }
-        const renderOptions = resolveInboundContentRenderOptions(input.isOwner);
-        const renderedContent = renderInboundContent(input.message, materialized, renderOptions);
+        const renderedContent = renderInboundContent(input.message, materialized);
         const turnMetadata = normalizeTurnMetadata(input.message.metadata);
         const requestedPlanMode = turnMetadata?.requestedTurnMode === 'plan';
         const planCommand = resolveCodexPlanCommand({
@@ -1893,7 +1839,6 @@ export async function main() {
             selfContexts: input.selfContexts,
             provenance: input.provenance,
             hydratedPage: input.hydratedPage,
-            renderOptions,
         });
         const behavior = input.behavior ?? hydrated.behavior;
         const activeSelfContextId = hydrated.activeSelfContextId;
@@ -1948,7 +1893,7 @@ export async function main() {
             return;
         }
         session.activeSelfContextId = activeSelfContextId;
-        const basePrompt = buildCanonPrompt({
+        const prompt = buildCanonPrompt({
             content,
             conversationId: input.conversationId,
             participantContext,
@@ -1960,12 +1905,8 @@ export async function main() {
             message: input.message,
             ...(useAppServer ? { noReplyToolName: CODEX_NO_REPLY_MODEL_TOOL_NAME } : {}),
         });
-        const lifecycleContext = input.isOwner
-            ? formatPendingContactLifecycleContext(takeLocalRuntimeContactLifecycleEvents(runtimeId, input.conversationId))
-            : null;
-        const prompt = lifecycleContext ? `${basePrompt}\n\n${lifecycleContext}` : basePrompt;
         if (session.running && deliveryIntent === 'interrupt') {
-            enqueuePrompt(session, prompt, deliveryIntent, true, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, resolveCodexTurnModes(participantContext, input.message, replyContext));
+            enqueuePrompt(session, prompt, deliveryIntent, true, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, resolveCodexTurnModes(participantContext, input.message));
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Interrupting current turn for explicit human send-now`);
             session.currentTurnAbortController?.abort(new Error('Codex turn interrupted by a newer message'));
             await session.adapter.interrupt().catch(() => { });
@@ -1973,7 +1914,7 @@ export async function main() {
             typingSignals.clear(input.conversationId).catch(() => { });
             return;
         }
-        enqueuePrompt(session, prompt, deliveryIntent, false, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, resolveCodexTurnModes(participantContext, input.message, replyContext));
+        enqueuePrompt(session, prompt, deliveryIntent, false, input.message.id, shouldMarkAccepted, imagePaths, mediaAddDirs, planCommand.planMode, resolveCodexTurnModes(participantContext, input.message));
     }
     function sendTurnArtifactFile(session, file) {
         return sendMediaFileMessage(client, session.conversationId, file.path, '', {
@@ -2004,8 +1945,6 @@ export async function main() {
         session.currentTurnOpenedAt = Date.now();
         session.currentTurnUpdatedAt = session.currentTurnOpenedAt;
         session.currentTurnCanUseCodexAppTools = nextTurn.canUseCodexAppTools === true;
-        session.currentTurnCanUseCodexCanonTools = nextTurn.canUseCodexCanonTools === true;
-        session.currentTurnReplyContactTarget = nextTurn.replyContactTarget ?? null;
         session.currentTurnAbortController = new AbortController();
         // A continuation prompt (a plan-review result) carries none, and keeps the
         // conversation's last answer rather than silently reverting to verbose.
@@ -2419,8 +2358,6 @@ export async function main() {
             session.currentTurnOpenedAt = null;
             session.currentTurnUpdatedAt = null;
             session.currentTurnCanUseCodexAppTools = false;
-            session.currentTurnCanUseCodexCanonTools = false;
-            session.currentTurnReplyContactTarget = null;
             session.currentTurnSilenced = false;
             session.lastAcceptedIntent = null;
             session.resetRequested = false;
@@ -2479,6 +2416,7 @@ export async function main() {
     });
     let codexSkills = [];
     const buildCurrentRuntimeDescriptor = () => ({
+        defaultExecutionMode,
         ...(serviceAgentMode
             ? {}
             : {
@@ -2498,31 +2436,18 @@ export async function main() {
             workspaces: buildPublicWorkspaceOptions(workspaceOptions),
             workspaceRoots: workspaceRootMetadata,
             executionModes: hostAvailableExecutionModes,
+            defaultExecutionMode,
             permissionModes: [...codexPermissionEnvelope.availablePermissionModes],
             defaultPermissionMode: codexPermissionEnvelope.defaultPermissionMode,
             presentation: runtimePresentation,
             supportsPlanMode: useAppServer,
             supportsCompact: useAppServer,
             supportsRichCards: useAppServer,
-            supportsCanonCommunicationTools: useAppServer,
             skills: codexSkills,
             serviceAgentMode,
         }),
     });
     let runtimeDescriptor = buildCurrentRuntimeDescriptor();
-    const resolveInboundContentRenderOptions = (isOwnerTurn) => {
-        const descriptorActions = runtimeDescriptor.runtimeDescriptor?.admissionActions
-            ?? HOST_ADMISSION_ACTIONS_DISABLED;
-        const admissionActions = isOwnerTurn && useAppServer && !serviceAgentMode
-            ? descriptorActions
-            : HOST_ADMISSION_ACTIONS_DISABLED;
-        return {
-            admissionActions,
-            ...(admissionActions.reachOut
-                ? { reachOutToolName: 'codex_app.canon_send_to' }
-                : {}),
-        };
-    };
     async function refreshCodexSkillInventory(forceReload = false) {
         if (!useAppServer)
             return;
@@ -2844,12 +2769,6 @@ export async function main() {
         const conversationsDiscoveredWhileOffline = startupRecoveryComplete
             ? new Set([...knownConversationIds].filter((id) => !knownBeforeRefresh.has(id)))
             : new Set();
-        try {
-            await reconcileContactLifecycleInbox();
-        }
-        catch (error) {
-            console.error('[canon-codex] Contact lifecycle recovery failed:', error instanceof Error ? error.message : error);
-        }
         for (const conversationId of knownConversationIds) {
             const recoveryCheckpoints = recoveryCheckpointsFor(conversationId);
             const recoveryBatch = recoveryCheckpoints.reserveBatch();
@@ -2957,9 +2876,6 @@ export async function main() {
             onConversationUpdated: (payload) => {
                 handleConversationUpdated(payload);
             },
-            onContactRequestUpdated: (payload) => {
-                recordContactLifecycleEvent(payload);
-            },
             onConnected: () => {
                 streamConnected = true;
                 void publishRuntimeHeartbeat();

package/dist/register.js

@@ -28,7 +28,6 @@ After approval, start it with CANON_AGENT=<profile> canon-codex --cwd /path/to/p
 const OPTIONS = {
     moduleUrl: import.meta.url,
     clientType: 'codex',
-    sessionSetupPolicy: 'runtime_descriptor_required',
     cliName: 'canon-codex-register',
     hostBinName: 'canon-codex',
     developerInfo: 'Codex host plugin',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -29,11 +29,11 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@canonmsg/agent-sdk": "^8.9.0",
-    "@canonmsg/agent-tools": "^0.6.0",
-    "@canonmsg/coding-agent-host": "^0.6.0",
-    "@canonmsg/core": "^10.7.0",
-    "@canonmsg/rich-cards": "^0.10.0"
+    "@canonmsg/agent-sdk": "^9.0.0",
+    "@canonmsg/agent-tools": "^0.7.0",
+    "@canonmsg/coding-agent-host": "^0.7.0",
+    "@canonmsg/core": "^11.0.0",
+    "@canonmsg/rich-cards": "^0.10.3"
   },
   "engines": {
     "node": ">=18.0.0"