@canonmsg/codex-plugin 0.29.4 → 0.31.0

package/dist/work-session-provider.js

@@ -0,0 +1,234 @@
+import { createHash } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { basename } from 'node:path';
+import { buildConfiguredWorkspaceOptionsWithRoots, prepareConversationEnvironment, releaseConversationEnvironment, NativeWorkSessionCreateError, } from '@canonmsg/core';
+import { CodexAttachedSessionAdapter, CodexAttachedSessionError, CodexSharedConnection, CodexSharedRpcError, listLoadedCodexSessions, } from './attached-session-adapter.js';
+import { CODEX_PERMISSION_OPTIONS, mapCanonPermissionToCodex } from './permission-mode.js';
+/** One shared native server; all selections are resolved locally from the advertised catalog. */
+export class CodexWorkSessionProvider {
+    options;
+    connection;
+    projects;
+    permissionModes;
+    executionModes;
+    observers = new Set();
+    environments = new Set();
+    createdSettings = new Map();
+    creationAttempts = new Map();
+    creationFingerprints = new Map();
+    closed = false;
+    constructor(options) {
+        this.options = options;
+        this.connection = new CodexSharedConnection(options);
+        this.projects = buildConfiguredWorkspaceOptionsWithRoots({
+            primaryCwd: options.cwd, configuredWorkspaces: options.workspaces ?? [], workspaceRoots: options.workspaceRoots ?? [],
+        }).workspaceOptions;
+        this.permissionModes = [...new Set(options.permissionModes ?? ['readonly', 'workspace'])];
+        this.executionModes = [...new Set(options.executionModes ?? ['locked', 'worktree'])];
+        if (!this.permissionModes.length || this.permissionModes.some((mode) => !['readonly', 'workspace'].includes(mode))
+            || !this.executionModes.length || this.executionModes.some((mode) => !['locked', 'worktree'].includes(mode))) {
+            throw new Error('Configure at least one supported permission and execution mode.');
+        }
+        if (!this.permissionModes.includes(options.defaultPermissionMode ?? 'workspace')
+            || !this.executionModes.includes(options.defaultExecutionMode ?? 'worktree')) {
+            throw new Error('Default work-session policy must be allowed by this provider.');
+        }
+    }
+    async catalog() {
+        this.assertOpen();
+        await this.connection.connect();
+        const models = await this.models();
+        const loaded = await listLoadedCodexSessions(this.options, this.connection);
+        const configuredModel = models.find((model) => model.id === this.options.defaultModel || model.model === this.options.defaultModel);
+        if (this.options.defaultModel && !configuredModel)
+            throw new Error('The configured default model is not available on the shared server.');
+        const defaultModel = configuredModel
+            ?? models.find((model) => model.isDefault) ?? models[0];
+        const defaultEffort = this.options.defaultReasoningEffort ?? defaultModel?.defaultEffort;
+        if (defaultEffort && !defaultModel?.efforts.some((effort) => effort.id === defaultEffort))
+            throw new Error('The configured reasoning effort is not supported by the default model.');
+        const defaults = {
+            ...(this.projects[0] ? { projectId: this.projects[0].id } : {}),
+            ...(defaultModel ? { modelId: defaultModel.id } : {}),
+            ...(defaultEffort ? { reasoningEffort: defaultEffort } : {}),
+            permissionMode: this.options.defaultPermissionMode ?? 'workspace', executionMode: this.options.defaultExecutionMode ?? 'worktree',
+        };
+        const catalog = {
+            provider: 'codex', canCreate: this.projects.length > 0 && models.length > 0, canAttach: true,
+            projects: this.projects.map(({ id, label }) => ({ id, label: catalogLabel(label, 'Project') })),
+            models: models.map((model) => ({ id: model.id, label: model.label, reasoningEfforts: model.efforts,
+                ...(model.defaultEffort ? { defaultReasoningEffort: model.defaultEffort } : {}),
+            })),
+            permissionModes: this.permissionModes.map((id) => ({ id, label: CODEX_PERMISSION_OPTIONS.find((entry) => entry.value === id).label })),
+            executionModes: this.executionModes.map((id) => ({ id, label: id === 'worktree' ? 'Git worktree' : 'Project folder' })),
+            defaults,
+            sessions: loaded.map((session) => {
+                const project = this.projects.find((project) => session.cwd && samePath(project.cwd, session.cwd));
+                const model = models.find((model) => model.model === session.model || model.id === session.model);
+                const saved = this.createdSettings.get(session.threadId);
+                return {
+                    id: session.threadId, title: catalogLabel(session.name, 'Untitled Codex session'), status: session.status ?? 'idle',
+                    settings: { ...(saved ?? {}), ...(project ? { projectId: project.id } : {}),
+                        ...(session.model ? { modelId: model?.id ?? modelChoiceId(session.model) } : {}),
+                        ...(session.reasoningEffort ? { reasoningEffort: session.reasoningEffort } : {}),
+                    },
+                    ...(session.cwd ? { projectLabel: catalogLabel(project?.label ?? basename(session.cwd), 'Project') } : {}),
+                    ...(session.model ? { modelLabel: model?.label ?? catalogLabel(session.model, 'Native model') } : {}),
+                };
+            }),
+        };
+        // A revision identifies the entire published catalog, including native
+        // activity and settings. The broker rejects different content at one revision.
+        return { revision: createHash('sha256').update(JSON.stringify(catalog)).digest('hex').slice(0, 24), ...catalog };
+    }
+    create(selection, context) {
+        const fingerprint = JSON.stringify([selection, context]);
+        const prior = this.creationAttempts.get(context.requestId);
+        if (prior)
+            return this.creationFingerprints.get(context.requestId) === fingerprint ? prior
+                : Promise.reject(new NativeWorkSessionCreateError('A work-session request ID was reused with different settings.', 'not_created'));
+        const attempt = this.createOnce(selection, context);
+        this.creationAttempts.set(context.requestId, attempt);
+        this.creationFingerprints.set(context.requestId, fingerprint);
+        return attempt;
+    }
+    async createOnce(selection, context) {
+        let nativeWritten = false;
+        try {
+            this.assertOpen();
+            if (!context.requestId || !context.conversationId || !context.agentId)
+                throw new Error('A stable work-session request context is required.');
+            if (selection.mode !== 'create' || Object.keys(selection).some((key) => !['mode', 'projectId', 'modelId', 'reasoningEffort', 'permissionMode', 'executionMode'].includes(key))) {
+                throw new Error('Unsupported native session creation settings.');
+            }
+            const project = this.projects.find((project) => project.id === selection.projectId);
+            if (!project)
+                throw new Error('The selected project is not configured on this host.');
+            const permissionMode = selection.permissionMode ?? this.options.defaultPermissionMode ?? 'workspace';
+            const executionMode = selection.executionMode ?? this.options.defaultExecutionMode ?? 'worktree';
+            if (!this.permissionModes.includes(permissionMode) || !this.executionModes.includes(executionMode)) {
+                throw new Error('The selected native permission or execution mode is not allowed.');
+            }
+            await this.connection.connect();
+            const models = await this.models();
+            const modelId = selection.modelId ?? this.options.defaultModel;
+            const model = modelId ? models.find((entry) => entry.id === modelId || entry.model === modelId)
+                : models.find((entry) => entry.isDefault) ?? models[0];
+            if (!model)
+                throw new Error('The selected model is not available on this shared server.');
+            const reasoningEffort = selection.reasoningEffort ?? this.options.defaultReasoningEffort ?? model.defaultEffort;
+            if (reasoningEffort && !model.efforts.some((effort) => effort.id === reasoningEffort))
+                throw new Error('The selected reasoning effort is not supported by this model.');
+            const environment = (this.options.prepareEnvironment ?? prepareConversationEnvironment)({
+                agentId: context.agentId, conversationId: `work-session:${context.requestId}`,
+                workspaceCwd: project.cwd, allowWorktrees: executionMode === 'worktree',
+            });
+            this.environments.add(environment);
+            if (environment.mode !== executionMode)
+                throw new Error('The requested Git worktree could not be created. Select Project folder explicitly to use the base project.');
+            this.assertOpen();
+            const policy = mapCanonPermissionToCodex(permissionMode);
+            nativeWritten = true;
+            const result = object(await this.connection.createThread({
+                cwd: environment.cwd, model: model.model, sandbox: policy.sandbox, approvalPolicy: 'on-request',
+                ephemeral: false, allowProviderModelFallback: false,
+                ...(reasoningEffort ? { config: { model_reasoning_effort: reasoningEffort } } : {}),
+            }));
+            const thread = object(result?.thread);
+            const nativeSessionId = string(thread?.id);
+            const actualModel = string(result?.model) ?? string(thread?.model);
+            const actualEffort = string(result?.reasoningEffort) ?? string(thread?.reasoningEffort);
+            const actualSandbox = string(object(result?.sandbox)?.type) ?? string(result?.sandbox);
+            const expectedSandbox = permissionMode === 'readonly' ? ['readOnly', 'read-only'] : ['workspaceWrite', 'workspace-write'];
+            if (!nativeSessionId || !actualModel || !expectedSandbox.includes(actualSandbox ?? '') || result?.approvalPolicy !== 'on-request') {
+                throw new Error('The native server returned an incomplete or unexpected creation policy; review the created session before sharing it.');
+            }
+            const actualSettings = {
+                projectId: project.id, modelId: models.find((entry) => entry.model === actualModel)?.id ?? modelChoiceId(actualModel),
+                ...(actualEffort ? { reasoningEffort: actualEffort } : {}), permissionMode, executionMode: environment.mode,
+            };
+            this.createdSettings.set(nativeSessionId, actualSettings);
+            return { nativeSessionId, settings: { ...actualSettings } };
+        }
+        catch (error) {
+            if (error instanceof NativeWorkSessionCreateError)
+                throw error;
+            const rejected = error instanceof CodexSharedRpcError && [-32600, -32601, -32602].includes(error.code ?? 0);
+            const definitelyUnwritten = error instanceof CodexAttachedSessionError && !error.submissionUncertain;
+            throw new NativeWorkSessionCreateError(error instanceof Error ? error.message : String(error), !nativeWritten || rejected || definitelyUnwritten ? 'not_created' : 'uncertain', { cause: error });
+        }
+    }
+    async open(nativeSessionId, interactionBridge) {
+        this.assertOpen();
+        const adapter = new CodexAttachedSessionAdapter({ ...this.options, threadId: nativeSessionId, sharedConnection: this.connection, interactionBridge });
+        this.observers.add(adapter);
+        return adapter;
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        await Promise.allSettled([...this.observers].map((observer) => observer.close()));
+        this.observers.clear();
+        await this.connection.close();
+        // Only advisory usage records are released. Never remove a native worktree.
+        for (const environment of this.environments)
+            releaseConversationEnvironment(environment);
+    }
+    assertOpen() { if (this.closed)
+        throw new Error('The native work-session provider is closed.'); }
+    async models() {
+        const models = [];
+        const modelIds = new Set();
+        const seen = new Set();
+        let cursor;
+        do {
+            const page = object(await this.connection.request('model/list', { limit: 100, includeHidden: false, ...(cursor ? { cursor } : {}) }));
+            if (!page || !Array.isArray(page.data))
+                throw new Error('The shared server returned an invalid model catalog.');
+            for (const raw of page.data) {
+                const entry = object(raw);
+                const id = string(entry?.id);
+                const model = string(entry?.model) ?? id;
+                if (!entry || !id || !model || entry.hidden === true)
+                    continue;
+                const choiceId = modelChoiceId(id);
+                if (modelIds.has(choiceId))
+                    continue;
+                modelIds.add(choiceId);
+                const efforts = Array.isArray(entry.supportedReasoningEfforts) ? entry.supportedReasoningEfforts.flatMap((raw) => {
+                    const value = string(object(raw)?.reasoningEffort);
+                    return value ? [{ id: value, label: value[0].toUpperCase() + value.slice(1) }] : [];
+                }) : [];
+                models.push({ id: choiceId, model, label: catalogLabel(string(entry.displayName) ?? model, 'Native model'), efforts, isDefault: entry.isDefault === true,
+                    ...(string(entry.defaultReasoningEffort) ? { defaultEffort: entry.defaultReasoningEffort } : {}),
+                });
+            }
+            if (page.nextCursor != null && !string(page.nextCursor))
+                throw new Error('The shared server returned an invalid model cursor.');
+            cursor = string(page.nextCursor);
+            if (cursor && seen.has(cursor))
+                throw new Error('The shared server repeated a model cursor.');
+            if (cursor)
+                seen.add(cursor);
+        } while (cursor);
+        return models;
+    }
+}
+function object(value) { return value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null; }
+function string(value) { return typeof value === 'string' && value.length ? value : undefined; }
+function samePath(left, right) {
+    try {
+        return realpathSync(left) === realpathSync(right);
+    }
+    catch {
+        return left === right;
+    }
+}
+function modelChoiceId(value) {
+    return /^[A-Za-z0-9_.:-]{1,160}$/.test(value) ? value
+        : `model-${createHash('sha256').update(value).digest('hex').slice(0, 32)}`;
+}
+function catalogLabel(value, fallback) {
+    return value?.replace(/[\u0000-\u001f\u007f]/g, ' ').trim().slice(0, 160) || fallback;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.29.4",
+  "version": "0.31.0",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -13,6 +13,7 @@
   },
   "bin": {
     "canon-codex": "dist/host.js",
+    "canon-codex-attach": "dist/attach.js",
     "canon-codex-register": "dist/register.js",
     "canon-codex-setup": "dist/setup.js"
   },
@@ -25,15 +26,17 @@
     "build": "npm run prepare:workspace-deps && node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc",
     "dev": "npm run prepare:workspace-deps && tsc --watch",
     "smoke": "node scripts/smoke-test.mjs",
+    "smoke:attach": "node scripts/smoke-attach.mjs",
     "test": "vitest run",
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@canonmsg/agent-sdk": "^10.2.1",
-    "@canonmsg/agent-tools": "^0.9.0",
-    "@canonmsg/coding-agent-host": "^0.7.0",
-    "@canonmsg/core": "^12.3.1",
-    "@canonmsg/rich-cards": "^0.10.4"
+    "@canonmsg/agent-sdk": "^10.4.0",
+    "@canonmsg/agent-tools": "^0.10.0",
+    "@canonmsg/coding-agent-host": "^0.8.0",
+    "@canonmsg/core": "^12.5.0",
+    "@canonmsg/rich-cards": "^0.10.5",
+    "ws": "^8.21.3"
   },
   "engines": {
     "node": ">=18.0.0"
@@ -45,12 +48,7 @@
     "messaging",
     "host-mode"
   ],
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/HeyBobChan/canon",
-    "directory": "packages/codex-plugin"
-  },
-  "homepage": "https://github.com/HeyBobChan/canon/tree/main/packages/codex-plugin",
+  "homepage": "https://canonmail.com/agents/integrations#codex",
   "publishConfig": {
     "access": "public"
   },
@@ -59,5 +57,8 @@
     "typescript": "~5.7.0",
     "vitest": "^4.1.8"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "bugs": {
+    "url": "https://canonmail.com/support"
+  }
 }

package/scripts/smoke-attach.mjs

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+
+// Real local Codex protocol, fake localhost model and Canon publisher. No model
+// API or Canon account calls. Build Core, SDK and this package before running.
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { createServer as httpServer } from 'node:http';
+import { createServer as netServer } from 'node:net';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import WebSocket from 'ws';
+import { createAttachedNativeSession, createFileAttachedSessionStore } from '@canonmsg/core';
+import { createCanonAttachedSessionPublisher } from '@canonmsg/agent-sdk';
+import { CodexAttachedSessionAdapter } from '../dist/attached-session-adapter.js';
+
+const binary = process.argv[2] ?? 'codex';
+const directory = await mkdtemp(join(tmpdir(), 'canon-attach-smoke-'));
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function until(predicate, description) {
+  for (let attempt = 0; attempt < 300; attempt += 1) {
+    if (await predicate()) return;
+    await sleep(50);
+  }
+  throw new Error(`Timed out: ${description}`);
+}
+async function listen(server) {
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  return server.address().port;
+}
+
+let providerCalls = 0;
+let requestApprovalOnNextModelCall = false;
+const provider = httpServer((request, response) => {
+  request.resume();
+  providerCalls += 1;
+  const item = requestApprovalOnNextModelCall ? {
+    id: 'approval_function', type: 'function_call', call_id: 'approval_call', name: 'exec_command',
+    arguments: JSON.stringify({
+      cmd: 'printf canon-approval-smoke', sandbox_permissions: 'require_escalated',
+      justification: 'Disposable approval routing check; the native client will decline.',
+    }),
+  } : {
+    id: `message_${providerCalls}`, type: 'message', role: 'assistant', status: 'completed',
+    content: [{ type: 'output_text', text: `Mock answer ${providerCalls}.`, annotations: [] }],
+  };
+  requestApprovalOnNextModelCall = false;
+  const result = {
+    id: `response_${providerCalls}`, object: 'response', model: 'probe', status: 'completed',
+    output: [item], usage: { input_tokens: 1, output_tokens: 1, total_tokens: 2 },
+  };
+  response.writeHead(200, { 'content-type': 'text/event-stream' });
+  for (const event of [
+    { type: 'response.created', response: { ...result, status: 'in_progress', output: [] } },
+    { type: 'response.output_item.added', output_index: 0, item: item.type === 'message' ? { ...item, status: 'in_progress', content: [] } : item },
+    ...(item.type === 'message' ? [{ type: 'response.output_text.delta', output_index: 0, content_index: 0, item_id: item.id, delta: item.content[0].text }] : []),
+    { type: 'response.output_item.done', output_index: 0, item },
+    { type: 'response.completed', response: result },
+  ]) response.write(`data: ${JSON.stringify(event)}\n\n`);
+  response.end();
+});
+const modelPort = await listen(provider);
+const reservation = netServer();
+const port = await listen(reservation);
+await new Promise((resolve) => reservation.close(resolve));
+const endpoint = `ws://127.0.0.1:${port}`;
+const { CODEX_INTERNAL_ORIGINATOR_OVERRIDE: _originatorOverride, ...serverEnv } = process.env;
+const server = spawn(binary, ['app-server', '--disable', 'plugins', '--disable', 'apps', '--listen', endpoint], {
+  cwd: directory, env: serverEnv, stdio: ['ignore', 'pipe', 'pipe'],
+});
+let serverError = '';
+server.stderr.on('data', (data) => { serverError = `${serverError}${data}`.slice(-1_000); });
+server.stdout.resume();
+let socket;
+let native;
+let controller;
+let threadId;
+const events = [];
+const nativeRequests = [];
+const observerRequests = [];
+const observerResponses = [];
+const published = new Map();
+const errors = [];
+
+try {
+  await until(async () => {
+    if (server.exitCode !== null) throw new Error(`Codex exited: ${serverError}`);
+    return fetch(`http://127.0.0.1:${port}/readyz`).then((result) => result.ok).catch(() => false);
+  }, 'shared app-server readiness');
+  socket = new WebSocket(endpoint);
+  await new Promise((resolve, reject) => { socket.once('open', resolve); socket.once('error', reject); });
+  let sequence = 0;
+  const pending = new Map();
+  socket.on('message', (data) => {
+    const message = JSON.parse(data.toString());
+    if (message.method) {
+      if ('id' in message) nativeRequests.push(message);
+      else events.push(message);
+      return;
+    }
+    const waiter = pending.get(message.id);
+    if (!waiter) { events.push(message); return; }
+    pending.delete(message.id);
+    clearTimeout(waiter.timer);
+    if (message.error) waiter.reject(new Error(JSON.stringify(message.error)));
+    else waiter.resolve(message.result);
+  });
+  native = (method, params = {}) => new Promise((resolve, reject) => {
+    const id = ++sequence;
+    const timer = setTimeout(() => { pending.delete(id); reject(new Error(`Timeout: ${method}`)); }, 10_000);
+    pending.set(id, { resolve, reject, timer });
+    socket.send(JSON.stringify({ id, method, params }));
+  });
+  await native('initialize', { clientInfo: { name: 'canon_attachment_smoke', version: '0.0.0' }, capabilities: { experimentalApi: true } });
+  socket.send(JSON.stringify({ method: 'initialized' }));
+  const started = await native('thread/start', {
+    cwd: directory, ephemeral: false, model: 'probe', modelProvider: 'canon_smoke',
+    approvalPolicy: 'on-request', sandbox: 'read-only',
+    config: {
+      mcp_servers: {}, 'features.apps': false, 'features.plugins': false,
+      'model_providers.canon_smoke': {
+        name: 'Canon local mock provider', base_url: `http://127.0.0.1:${modelPort}/v1`,
+        wire_api: 'responses', requires_openai_auth: false,
+      },
+    },
+  });
+  threadId = started.thread.id;
+  async function nativeTurn(text) {
+    const result = await native('turn/start', { threadId, input: [{ type: 'text', text }] });
+    await until(() => events.some((event) => event.method === 'turn/completed' && event.params.turn.id === result.turn.id), 'native turn completion');
+    return result.turn.id;
+  }
+  await nativeTurn('Private text from before attachment.');
+  const binding = { environmentId: 'smoke', agentId: 'smoke-agent', conversationId: 'smoke-room', provider: 'codex', nativeSessionId: threadId };
+  const publisher = createCanonAttachedSessionPublisher({
+    async sendProactiveMessage(conversationId, text, options) {
+      assert.equal(conversationId, binding.conversationId);
+      const payload = JSON.stringify({ text, options });
+      if (published.has(options.messageId)) assert.equal(published.get(options.messageId), payload);
+      published.set(options.messageId, payload);
+      return { messageId: options.messageId, conversationId };
+    },
+  }, binding);
+  const attach = async () => {
+    const value = createAttachedNativeSession({
+      binding, adapter: new CodexAttachedSessionAdapter({ endpoint, threadId, createSocket(url) {
+        const observer = new WebSocket(url);
+        observer.on('message', (data) => {
+          const message = JSON.parse(data.toString());
+          if (message.method && 'id' in message) observerRequests.push(message);
+        });
+        const send = observer.send.bind(observer);
+        observer.send = (data, ...args) => {
+          const message = JSON.parse(data.toString());
+          if ('id' in message && !message.method) observerResponses.push(message);
+          return send(data, ...args);
+        };
+        return observer;
+      } }),
+      store: createFileAttachedSessionStore(join(directory, 'attachment.json')), publisher,
+      onError: (error, operation) => errors.push(`${operation}: ${error.message}`),
+    });
+    await value.start();
+    return value;
+  };
+  controller = await attach();
+  assert.equal(published.size, 0, 'Private history must not be imported');
+  await nativeTurn('New input on the native surface.');
+  await controller.reconcile();
+  assert.equal(published.size, 2, 'Local user and assistant messages should both publish');
+  const accepted = await controller.submit({ messageId: 'canon-input-1', text: 'Input from the Canon surface.' });
+  assert.equal(accepted.status, 'accepted');
+  await until(() => events.some((event) => event.method === 'turn/completed' && event.params.turn.id === accepted.turnId), 'Canon-triggered native completion');
+  await controller.reconcile();
+  assert.equal(published.size, 3, 'The Canon input echo must be suppressed');
+  const sameInput = await controller.submit({ messageId: 'canon-input-1', text: 'Input from the Canon surface.' });
+  assert.equal(sameInput.replayed, true, 'Duplicate Canon delivery must not execute twice');
+  assert.equal(providerCalls, 3);
+  const observed = await native('thread/read', { threadId, includeTurns: true });
+  assert.ok(JSON.stringify(observed.thread.turns).includes('Input from the Canon surface.'), 'Native client must see Canon input in its own transcript');
+  await controller.stop();
+  await nativeTurn('Private work after a graceful detach.');
+  controller = await attach();
+  assert.equal(published.size, 3, 'Graceful detachment must exclude later private work');
+  await nativeTurn('New shared input after reattaching.');
+  await controller.reconcile();
+  assert.equal(published.size, 5);
+  requestApprovalOnNextModelCall = true;
+  const approvalTurn = await controller.submit({ messageId: 'canon-approval-input', text: 'Exercise native approval routing with the disposable mock command.' });
+  assert.equal(approvalTurn.status, 'accepted');
+  const approvalForTurn = (request) => request.method === 'item/commandExecution/requestApproval' && request.params.turnId === approvalTurn.turnId;
+  await until(() => nativeRequests.some(approvalForTurn) && observerRequests.some(approvalForTurn), 'approval delivered to both native and attached clients');
+  const nativeApproval = nativeRequests.find(approvalForTurn);
+  assert.equal(nativeApproval.id, observerRequests.find(approvalForTurn).id, 'Both clients should see the same pending approval');
+  assert.equal(observerResponses.length, 0, 'The Canon observer must not answer native approval requests');
+  assert.ok(!events.some((event) => event.method === 'turn/completed' && event.params.turn.id === approvalTurn.turnId), 'The turn must wait for the native approval decision');
+  // Decline from the native surface. The mock command is never executed.
+  socket.send(JSON.stringify({ id: nativeApproval.id, result: { decision: 'decline' } }));
+  await until(() => events.some((event) => event.method === 'turn/completed' && event.params.turn.id === approvalTurn.turnId), 'completion after native approval decline');
+  assert.ok(events.some((event) => event.method === 'serverRequest/resolved' && event.params.requestId === nativeApproval.id), 'Native decision should resolve the shared approval');
+  assert.ok(events.some((event) => event.method === 'item/completed' && event.params.item.id === nativeApproval.params.itemId && event.params.item.status === 'declined'), 'The requested command must be declined without execution');
+  await controller.reconcile();
+  assert.equal(published.size, 6, 'Only the final assistant text should mirror from the Canon approval turn');
+  assert.equal(observerResponses.length, 0);
+  assert.equal(errors.length, 0, errors.join('\n'));
+  await controller.stop();
+  const alive = await native('thread/read', { threadId });
+  assert.equal(alive.thread.id, threadId, 'Detachment must leave the shared runner available');
+  console.log(JSON.stringify({ passed: true, nativeAndCanonInput: true, privateHistoryExcluded: true, echoSuppressed: true, replayDeduplicated: true, nativeApprovalRouting: true, detachKeepsNativeAlive: true, publishedMessages: published.size, localMockModelCalls: providerCalls }));
+} finally {
+  await controller?.stop().catch(() => {});
+  if (threadId && socket?.readyState === WebSocket.OPEN) {
+    await native('thread/delete', { threadId }).catch((error) => console.error(`Could not delete disposable thread ${threadId}: ${error.message}`));
+  }
+  socket?.terminate();
+  server.kill('SIGTERM');
+  await sleep(500);
+  if (server.exitCode === null) server.kill('SIGKILL');
+  provider.closeAllConnections();
+  await new Promise((resolve) => provider.close(resolve));
+  await rm(directory, { recursive: true, force: true });
+}