@canonmsg/codex-plugin 0.27.0 → 0.29.0

package/README.md

@@ -109,23 +109,6 @@ discovery it also offers no model picker and a fixed effort list. It registers
 no dynamic tools either, so `no_reply` is unavailable there, the same way rich
 cards are.
 
-On the app-server transport, an owner-started foreground turn also receives a
-small Canon communication surface: `codex_app.canon_send_to`, contact/request
-and conversation listing, and `codex_app.canon_cancel_contact_request` for the
-agent's own pending DM requests. `canon_send_to` accepts one stable contact
-target and visible text; the host supplies trusted source-turn routing. These
-tools are withheld from non-owner turns, service-agent mode, detached threads,
-and the exec fallback. Contact cards only claim reach-out support when this
-exact surface is mounted.
-
-When a reach-out needs target-owner setup or approval, Canon parks the visible
-opener. Terminal request outcomes enter a deduplicated local lifecycle inbox and
-are supplied as trusted context on the next natural owner turn; they never start
-a synthetic model turn. A connected outcome means Canon already delivered the
-opener. After an SSE reconnect or expired replay window, the host refreshes
-memberships, reconciles outbound request phases, and recovers unseen messages
-from its persisted cursors before resuming live delivery.
-
 Set `CANON_CODEX_TRANSPORT=exec` or `CANON_CODEX_TRANSPORT=app-server` to skip
 the probe when it misfires.
 

package/dist/app-server-adapter.js

@@ -638,13 +638,7 @@ function isForegroundCanonToolCall(params) {
     const tool = rawTool.startsWith('codex_app.')
         ? rawTool.slice('codex_app.'.length)
         : rawTool;
-    return tool === 'canon_runtime_control'
-        || tool === 'canon_send_to'
-        || tool === 'canon_list_contacts'
-        || tool === 'canon_list_contact_requests'
-        || tool === 'canon_list_conversations'
-        || tool === 'canon_cancel_contact_request'
-        || tool === 'no_reply';
+    return tool === 'canon_runtime_control' || tool === 'no_reply';
 }
 function parseJson(line) {
     try {

package/dist/codex-app-tools.d.ts

@@ -1,5 +1,4 @@
-import { type CanonClient, type CanonVerbName, type NoReplyReportClient } from '@canonmsg/core';
-import { type OwnerBoundCanonContactTarget } from '@canonmsg/agent-tools';
+import { type CanonClient, type NoReplyReportClient } from '@canonmsg/core';
 type JsonRecord = Record<string, unknown>;
 interface DynamicToolSpec {
     [key: string]: unknown;
@@ -22,6 +21,8 @@ export interface CodexAppToolRuntime {
     currentThreadId: string | null;
     currentCwd: string;
     workspaces: ReadonlyArray<CodexAppToolWorkspace>;
+    /** Whether detached work may see Canon's autonomous communication surface. */
+    communicationEnabled?: boolean;
     model?: string | null;
     effort?: string | null;
 }
@@ -45,11 +46,7 @@ type DynamicToolCallResponse = {
  */
 export declare const CODEX_NO_REPLY_TOOL_NAME = "no_reply";
 export declare const CANON_RUNTIME_CONTROL_TOOL_NAME = "canon_runtime_control";
-export declare const CODEX_CANON_SEND_TO_TOOL_NAME = "canon_send_to";
-export declare const CODEX_CANON_LIST_CONTACTS_TOOL_NAME = "canon_list_contacts";
-export declare const CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME = "canon_list_contact_requests";
-export declare const CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME = "canon_list_conversations";
-export declare const CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME = "canon_cancel_contact_request";
+export declare const CODEX_COMMUNICATE_TOOL_NAME = "communicate";
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
@@ -59,6 +56,8 @@ export declare const CODEX_NO_REPLY_MODEL_TOOL_NAME = "codex_app.no_reply";
 export declare const CODEX_APP_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
 /** The complete model-visible surface for non-coding service agents. */
 export declare const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS: ReadonlyArray<DynamicToolSpec>;
+/** Closed agents are not shown the optional outbound communication surface. */
+export declare function filterCodexCommunicationTools(tools: ReadonlyArray<DynamicToolSpec>, outboundPolicy: 'open' | 'approval-required' | 'closed' | null): ReadonlyArray<DynamicToolSpec>;
 /**
  * Tools exposed to detached Codex threads created through the bridge. Canon
  * conversation controls belong only to the foreground turn that received the
@@ -71,26 +70,9 @@ export declare function successfulCodexAppToolResult(payload: unknown): DynamicT
 /** True when this dynamic-tool call is the deliberate-silence verb. */
 export declare function isCodexNoReplyToolCall(params: CodexAppToolCallParams): boolean;
 export declare function isCanonRuntimeControlToolCall(params: CodexAppToolCallParams): boolean;
-export declare function codexCanonVerbForToolCall(params: CodexAppToolCallParams): CanonVerbName | null;
-export declare function isCodexCanonVerbToolCall(params: CodexAppToolCallParams): boolean;
+export declare function isCodexCommunicateToolCall(params: CodexAppToolCallParams): boolean;
 export declare function isCodexServiceAgentToolCall(params: CodexAppToolCallParams): boolean;
-export interface CodexCanonVerbTrustedContext {
-    conversationId: string;
-    sourceMessageId: string | null;
-    turnId: string | null;
-    replyContactTarget?: OwnerBoundCanonContactTarget;
-}
-/**
- * Execute the deliberately filtered canonical-verb projection. The model can
- * author only the destination and visible copy. Provenance and turn metadata
- * come exclusively from the active host turn, so a prompt cannot forge its
- * source or make an outbound message look like an unrelated event.
- */
-export declare function answerCodexCanonVerb(input: {
-    client: CanonClient;
-    params: CodexAppToolCallParams;
-    context: CodexCanonVerbTrustedContext;
-}): Promise<DynamicToolCallResponse>;
+export declare function handleCodexCommunicateToolCall(client: CanonClient, params: CodexAppToolCallParams): Promise<DynamicToolCallResponse>;
 export interface CanonRuntimeControlRequest {
     action: 'send_card' | 'request_card' | 'request_input';
     card?: unknown;

package/dist/codex-app-tools.js

@@ -1,5 +1,5 @@
 import { NO_REPLY_ACK_NOTE, reportNoReplyOutcome, } from '@canonmsg/core';
-import { createOwnerBoundCanonCommunicationBinding, } from '@canonmsg/agent-tools';
+import { canonCommunicateToolDefinition, createCanonCommunicationBinding, } from '@canonmsg/agent-tools';
 const emptyObjectSchema = {
     type: 'object',
     properties: {},
@@ -91,21 +91,7 @@ function tool(name, description, inputSchema, deferLoading = true) {
  */
 export const CODEX_NO_REPLY_TOOL_NAME = 'no_reply';
 export const CANON_RUNTIME_CONTROL_TOOL_NAME = 'canon_runtime_control';
-export const CODEX_CANON_SEND_TO_TOOL_NAME = 'canon_send_to';
-export const CODEX_CANON_LIST_CONTACTS_TOOL_NAME = 'canon_list_contacts';
-export const CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME = 'canon_list_contact_requests';
-export const CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME = 'canon_list_conversations';
-export const CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME = 'canon_cancel_contact_request';
-const CODEX_CANON_COMMUNICATION_BINDING = createOwnerBoundCanonCommunicationBinding({
-    toolNames: {
-        send_to: CODEX_CANON_SEND_TO_TOOL_NAME,
-        list_contacts: CODEX_CANON_LIST_CONTACTS_TOOL_NAME,
-        list_contact_requests: CODEX_CANON_LIST_CONTACT_REQUESTS_TOOL_NAME,
-        list_conversations: CODEX_CANON_LIST_CONVERSATIONS_TOOL_NAME,
-        cancel_contact_request: CODEX_CANON_CANCEL_CONTACT_REQUEST_TOOL_NAME,
-    },
-});
-const CODEX_CANON_FOREGROUND_TOOL_NAMES = new Set(CODEX_CANON_COMMUNICATION_BINDING.tools.map((definition) => definition.name));
+export const CODEX_COMMUNICATE_TOOL_NAME = 'communicate';
 /**
  * What the model actually sees for the tool above, for prompt text that names
  * it (the group posture cue). Only meaningful on the app-server transport —
@@ -137,7 +123,11 @@ const CANON_RUNTIME_CONTROL_TOOL = tool(CANON_RUNTIME_CONTROL_TOOL_NAME, 'Intera
     },
     required: ['action'],
 }, false);
-const CODEX_CANON_COMMUNICATION_TOOLS = CODEX_CANON_COMMUNICATION_BINDING.tools.map((definition) => tool(definition.name, definition.description, definition.inputSchema, false));
+const communicationBinding = createCanonCommunicationBinding({
+    toolName: CODEX_COMMUNICATE_TOOL_NAME,
+});
+const communicateDefinition = canonCommunicateToolDefinition(CODEX_COMMUNICATE_TOOL_NAME);
+const CODEX_COMMUNICATE_TOOL = tool(communicateDefinition.name, communicateDefinition.description, communicateDefinition.inputSchema, false);
 const CODEX_NO_REPLY_TOOL = tool(CODEX_NO_REPLY_TOOL_NAME, 'End your turn without posting anything to the conversation. Use it in group '
     + 'chats when you have nothing to add — no message is created, so no other '
     + 'member or agent is triggered. Optional private reason (logged, never '
@@ -261,8 +251,8 @@ export const CODEX_APP_DYNAMIC_TOOLS = [
         },
         required: ['threadId', 'title'],
     }),
-    ...CODEX_CANON_COMMUNICATION_TOOLS,
     CANON_RUNTIME_CONTROL_TOOL,
+    CODEX_COMMUNICATE_TOOL,
     // Canon's `no_reply` verb, projected into the only model-visible tool surface
     // the Codex transport gives us. It is answered by the Canon host itself.
     CODEX_NO_REPLY_TOOL,
@@ -270,16 +260,24 @@ export const CODEX_APP_DYNAMIC_TOOLS = [
 /** The complete model-visible surface for non-coding service agents. */
 export const CODEX_SERVICE_AGENT_DYNAMIC_TOOLS = [
     CANON_RUNTIME_CONTROL_TOOL,
+    CODEX_COMMUNICATE_TOOL,
     CODEX_NO_REPLY_TOOL,
 ];
+/** Closed agents are not shown the optional outbound communication surface. */
+export function filterCodexCommunicationTools(tools, outboundPolicy) {
+    const communicationEnabled = outboundPolicy === 'open'
+        || outboundPolicy === 'approval-required';
+    return communicationEnabled
+        ? tools
+        : tools.filter((entry) => entry.name !== CODEX_COMMUNICATE_TOOL_NAME);
+}
 /**
  * Tools exposed to detached Codex threads created through the bridge. Canon
  * conversation controls belong only to the foreground turn that received the
  * human message; a child thread has neither that turn nor its responder.
  */
 export const CODEX_DETACHED_THREAD_DYNAMIC_TOOLS = CODEX_APP_DYNAMIC_TOOLS.filter((entry) => (entry.name !== CANON_RUNTIME_CONTROL_TOOL_NAME
-    && entry.name !== CODEX_NO_REPLY_TOOL_NAME
-    && !CODEX_CANON_FOREGROUND_TOOL_NAMES.has(entry.name)));
+    && entry.name !== CODEX_NO_REPLY_TOOL_NAME));
 const CODEX_APP_TOOL_NAMES = new Set(CODEX_APP_DYNAMIC_TOOLS.map((entry) => String(entry.name)));
 const UNSUPPORTED_TOOLS = new Map([
     ['automation_update', 'Canon does not manage Codex Desktop automations.'],
@@ -313,52 +311,21 @@ export function isCodexNoReplyToolCall(params) {
 export function isCanonRuntimeControlToolCall(params) {
     return normalizeToolName(params.tool) === CANON_RUNTIME_CONTROL_TOOL_NAME;
 }
-export function codexCanonVerbForToolCall(params) {
-    const toolName = normalizeToolName(params.tool);
-    return toolName ? CODEX_CANON_COMMUNICATION_BINDING.verbForToolName(toolName) : null;
-}
-export function isCodexCanonVerbToolCall(params) {
-    return codexCanonVerbForToolCall(params) !== null;
+export function isCodexCommunicateToolCall(params) {
+    return normalizeToolName(params.tool) === CODEX_COMMUNICATE_TOOL_NAME;
 }
 export function isCodexServiceAgentToolCall(params) {
     const toolName = normalizeToolName(params.tool);
-    return toolName === CANON_RUNTIME_CONTROL_TOOL_NAME || toolName === CODEX_NO_REPLY_TOOL_NAME;
+    return toolName === CANON_RUNTIME_CONTROL_TOOL_NAME
+        || toolName === CODEX_COMMUNICATE_TOOL_NAME
+        || toolName === CODEX_NO_REPLY_TOOL_NAME;
 }
-/**
- * Execute the deliberately filtered canonical-verb projection. The model can
- * author only the destination and visible copy. Provenance and turn metadata
- * come exclusively from the active host turn, so a prompt cannot forge its
- * source or make an outbound message look like an unrelated event.
- */
-export async function answerCodexCanonVerb(input) {
-    const verb = codexCanonVerbForToolCall(input.params);
-    if (!verb)
-        return toolResult(false, { error: 'Unsupported Canon verb tool.' });
-    try {
-        const result = await CODEX_CANON_COMMUNICATION_BINDING.execute({
-            client: input.client,
-            toolName: normalizeToolName(input.params.tool) ?? '',
-            arguments: input.params.arguments,
-            context: input.context.sourceMessageId ? {
-                isOwnerTurn: true,
-                conversationId: input.context.conversationId,
-                sourceMessageId: input.context.sourceMessageId,
-                ...(input.context.turnId ? { turnId: input.context.turnId } : {}),
-                ...(input.context.replyContactTarget
-                    ? { replyContactTarget: input.context.replyContactTarget }
-                    : {}),
-            } : null,
-        });
-        return {
-            success: result.isError !== true,
-            contentItems: result.content.map((item) => ({ type: 'inputText', text: item.text })),
-        };
-    }
-    catch (error) {
-        return toolResult(false, {
-            error: error instanceof Error ? error.message : String(error),
-        });
-    }
+export async function handleCodexCommunicateToolCall(client, params) {
+    const result = await communicationBinding.execute(client, CODEX_COMMUNICATE_TOOL_NAME, parseToolArguments(params.arguments));
+    return {
+        success: result.isError !== true,
+        contentItems: result.content.map((item) => ({ type: 'inputText', text: item.text })),
+    };
 }
 export function parseCanonRuntimeControlRequest(params) {
     if (!isCanonRuntimeControlToolCall(params))
@@ -448,12 +415,6 @@ export async function handleCodexAppToolCall(runtime, params) {
             error: 'canon_runtime_control is answered by the Canon host, not the app-tool bridge.',
         });
     }
-    if (CODEX_CANON_FOREGROUND_TOOL_NAMES.has(toolName)) {
-        return toolResult(false, {
-            tool: toolName,
-            error: `${toolName} is answered by the Canon host, not the app-tool bridge.`,
-        });
-    }
     const unsupportedReason = UNSUPPORTED_TOOLS.get(toolName);
     if (unsupportedReason) {
         return toolResult(false, { tool: toolName, error: unsupportedReason });
@@ -506,7 +467,7 @@ async function createThread(runtime, args) {
     const started = await runtime.adapter.requestAppServer('thread/start', {
         cwd,
         ...(readString(args, 'model') ?? runtime.model ? { model: readString(args, 'model') ?? runtime.model } : {}),
-        dynamicTools: CODEX_DETACHED_THREAD_DYNAMIC_TOOLS,
+        dynamicTools: filterCodexCommunicationTools(CODEX_DETACHED_THREAD_DYNAMIC_TOOLS, runtime.communicationEnabled === true ? 'open' : null),
         experimentalRawEvents: false,
         persistExtendedHistory: true,
     });
@@ -702,21 +663,6 @@ function parseToolArguments(value) {
     }
     return {};
 }
-function parseToolArgumentsStrict(value) {
-    if (value === undefined || value === null || value === '')
-        return {};
-    if (isRecord(value))
-        return value;
-    if (typeof value !== 'string' || !value.trim())
-        return null;
-    try {
-        const parsed = JSON.parse(value);
-        return isRecord(parsed) ? parsed : null;
-    }
-    catch {
-        return null;
-    }
-}
 function normalizeToolName(value) {
     if (typeof value !== 'string' || !value.trim())
         return null;

package/dist/control-channel.d.ts

@@ -5,18 +5,14 @@
  * codex host characterization profile (the "codex host profile" describe
  * block in core's control-poller.test.ts is the contract):
  *
- * - Keys: `session` + `signal`, plus `primitive` when a primitive handler is
- *   configured; read sequentially per conversation, conversations polled one
- *   at a time.
+ * - Keys: `signal`, plus `primitive` when a primitive handler is configured;
+ *   read sequentially per conversation, conversations polled one at a time.
  * - Cadence: immediate first cycle, then active/idle delays + jitter with
  *   the activity probe sampled BEFORE the cycle runs.
- * - Session controls are always consumed once newer (default consume), even
- *   when no live session applied them; signals are NOT consumed when the
- *   handler throws (consumeOnError stays false).
  * - Dedupe is primed eagerly via `poller.baseline([conversationId])` at
- *   session creation — the second legacy poll site.
+ *   session creation.
  */
-import { ControlChannelPoller, type ControlChannelRTDB, type ControlHandlerResult, type ControlPollerError, type ControlPrimitiveEvent, type ControlSessionEvent, type ControlSignalEvent } from '@canonmsg/core';
+import { ControlChannelPoller, type ControlChannelRTDB, type ControlHandlerResult, type ControlPollerError, type ControlPrimitiveEvent, type ControlSignalEvent } from '@canonmsg/core';
 export declare const CONTROL_POLL_MS = 2000;
 export declare const IDLE_CONTROL_POLL_MS = 10000;
 export declare const CONTROL_POLL_JITTER_MS = 1000;
@@ -28,12 +24,6 @@ export interface CodexControlChannelInput {
     conversationIds: () => Iterable<string>;
     /** Sampled before each cycle to choose the active vs idle delay. */
     hasActiveWork: () => boolean;
-    /**
-     * Applies a newer `/session` control node. The node is always consumed
-     * after the handler resolves; a thrown error leaves it in place (with
-     * dedupe already advanced, so it is never retried).
-     */
-    onSessionControl: (event: ControlSessionEvent) => Promise<ControlHandlerResult> | ControlHandlerResult;
     /**
      * Handles a newer `/signal` node. Return `{ consume: false }` to leave the
      * node in place; thrown errors also leave it (consumeOnError stays false).

package/dist/control-channel.js

@@ -5,16 +5,12 @@
  * codex host characterization profile (the "codex host profile" describe
  * block in core's control-poller.test.ts is the contract):
  *
- * - Keys: `session` + `signal`, plus `primitive` when a primitive handler is
- *   configured; read sequentially per conversation, conversations polled one
- *   at a time.
+ * - Keys: `signal`, plus `primitive` when a primitive handler is configured;
+ *   read sequentially per conversation, conversations polled one at a time.
  * - Cadence: immediate first cycle, then active/idle delays + jitter with
  *   the activity probe sampled BEFORE the cycle runs.
- * - Session controls are always consumed once newer (default consume), even
- *   when no live session applied them; signals are NOT consumed when the
- *   handler throws (consumeOnError stays false).
  * - Dedupe is primed eagerly via `poller.baseline([conversationId])` at
- *   session creation — the second legacy poll site.
+ *   session creation.
  */
 import { ControlChannelPoller, } from '@canonmsg/core';
 export const CONTROL_POLL_MS = 2_000;
@@ -36,9 +32,6 @@ export function createCodexControlPoller(input) {
         pollOnStart: true,
         conversationConcurrency: 'sequential',
         handlers: {
-            session: {
-                handle: input.onSessionControl,
-            },
             signal: {
                 handle: input.onSignal,
             },

package/dist/host.d.ts

@@ -21,38 +21,9 @@ export declare function buildCodexInitialSessionState(input: {
     permissionMode?: string;
     effort?: string | null;
 }): HostSessionState;
-export declare function buildCodexLiveSessionConfig(input: {
-    model?: string;
-    permissionMode?: string;
-    effort?: string;
-    workspaceId?: string | null;
-    executionMode: ExecutionEnvironmentMode;
-    executionBranch?: string | null;
-}): {
-    executionMode: ExecutionEnvironmentMode;
-    executionBranch: string | null;
-    workspaceId?: string | undefined;
-    effort?: string | undefined;
-    permissionMode?: string | undefined;
-    model?: string | undefined;
-};
-export declare function buildCodexServiceSnapshotConfig(input: {
-    model?: string;
-    permissionMode?: string;
-    effort?: string;
-    workspaceId?: string;
-}): {
-    model: string | undefined;
-    permissionMode: string | undefined;
-    effort: string | undefined;
-    workspaceId: string | undefined;
-    executionMode: "locked";
-    executionBranch: null;
-};
 export declare function createCodexRecoveryCheckpointTracker(persist: (messageId: string) => boolean): RecoveryCheckpointTracker;
 /** Conservative fallback used only when native app-server discovery is unavailable. */
 export declare const CODEX_EFFORT_OPTIONS: readonly CodexControlOption[];
-export declare const CODEX_SESSION_CONFIG_FIELDS: readonly ["permissionMode", "effort"];
 export declare function buildCodexSkillCommands(skills: ReadonlyArray<CodexSkillMetadata>): CanonRuntimeCommandDescriptor[];
 export declare function buildCodexRuntimeDescriptor(input: {
     models: CodexControlOption[];
@@ -61,6 +32,7 @@ export declare function buildCodexRuntimeDescriptor(input: {
     workspaces: WorkspaceOption[];
     workspaceRoots?: CanonWorkspaceRootMetadata[];
     executionModes: ExecutionEnvironmentMode[];
+    defaultExecutionMode?: ExecutionEnvironmentMode;
     permissionModes: Array<{
         value: string;
         label: string;
@@ -70,7 +42,6 @@ export declare function buildCodexRuntimeDescriptor(input: {
     supportsPlanMode: boolean;
     supportsCompact?: boolean;
     supportsRichCards?: boolean;
-    supportsCanonCommunicationTools?: boolean;
     skills?: ReadonlyArray<CodexSkillMetadata>;
     serviceAgentMode?: boolean;
 }): CanonRuntimeDescriptor;
@@ -86,14 +57,8 @@ export declare function getCodexRequestingUserId(message: {
     senderId: string;
     senderType?: 'human' | 'ai_agent';
 }): string | null;
-export declare function resolveSessionExecutionMode(config: {
-    executionMode?: ExecutionEnvironmentMode;
-} | null | undefined, serviceAgentMode?: boolean): ExecutionEnvironmentMode;
-export declare function resolveCodexSessionConfig<T extends Record<string, unknown>>(config: T | null | undefined, serviceAgentMode?: boolean): T | null;
-export declare function resolveWorkspaceCwd(config: {
-    workspaceId?: string;
-    retiredWorkspaceConfig?: boolean;
-} | null, serviceAgentMode?: boolean): string;
+export declare function resolveSessionExecutionMode(serviceAgentMode?: boolean, defaultExecutionMode?: ExecutionEnvironmentMode): ExecutionEnvironmentMode;
+export declare function resolveWorkspaceCwd(): string;
 interface CodexEffectiveRuntimePolicy {
     model?: string;
     permissionMode?: string;