@canonmsg/codex-plugin 0.31.0 → 0.32.0

package/dist/host.js

@@ -5,8 +5,8 @@ import { spawnSync } from 'node:child_process';
 import { dirname } from 'node:path';
 import { parseArgs } from 'node:util';
 import { getCodexImagePath, materializeMessageMedia, materializeReplyContextMedia, sendMediaFileMessage, } from '@canonmsg/agent-sdk';
-import { buildTrailBlockId, buildUndeliverableFinalNotice, captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, PLAN_BLOCK_TITLE, resolveTurnArtifactRouting, collectMissedInboundMessages, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, STARTUP_RECOVERY_PAGE_SIZE, } from '@canonmsg/coding-agent-host';
-import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildCanonGroupContext, buildCompactGroupContextLines, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, releaseConversationEnvironment, resolveLocalRuntimeSessionState, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, loadRuntimeSessionState, sendMessageWithRetry, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveConfiguredWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, shouldTriggerAgentTurn, upsertLocalRuntimeEntry, } from '@canonmsg/core';
+import { buildTrailBlockId, buildUndeliverableFinalNotice, captureTurnArtifactSnapshot, createTurnArtifactRouter, IDLE_TIMEOUT_MS, PLAN_BLOCK_TITLE, resolveTurnArtifactRouting, createRecoveryCheckpointTracker, createReconnectRecoveryCoordinator, } from '@canonmsg/coding-agent-host';
+import { RUNTIME_NEW_SESSION_ACTION, RUNTIME_STOP_ACTION, RUNTIME_STOP_AND_DROP_ACTION, buildRuntimeCardOutcome, resolveQuestionAllowOther, buildCanonTurnContextV2, buildCanonGroupContext, buildCompactGroupContextLines, buildConfiguredWorkspaceOptionsWithRoots, buildFirstPartyCodingRuntimeDescriptor, buildHydratedInboundContext, diffCanonMemberIds, buildPublicWorkspaceRoots, buildPublicWorkspaceOptions, buildRuntimePresentationPolicy, buildCanonInboundFrameV1, DEFAULT_FIRST_PARTY_RUNTIME_PRESENTATION, createConversationMetadataLoader, createRuntimeStatePublisher, createRuntimeHeartbeat, createTypingStatusPublisher, EXECUTION_ENVIRONMENT_MODES, ExecutionEnvironmentError, CanonClient, CanonStream, DEFAULT_PARTICIPATION_HISTORY_FETCH_LIMIT, DEFAULT_RUNTIME_CAPABILITIES, FINAL_MESSAGE_HANDOFF_MS, getActiveProfileLock, decideAutoReply, initRTDBAuth, buildLocalRuntimeId, heartbeatLocalRuntimeEntry, markLocalRuntimeStopped, normalizeTurnMetadata, parseTurnVerbosityConfig, RuntimeRequestManager, prepareConversationEnvironment, releaseConversationEnvironment, resolveLocalRuntimeSessionState, resolveCanonAgent, verifyResolvedAgentEnvironment, CanonApiError, sendMessageWithRetry, isPendingCanonOperation, sendMessageWithRetryChunked, saveRuntimeSessionState, publishHostSessionSnapshots, renderCanonHostInboundContent, renderCodingHostInboundPrompt, resolveConfiguredWorkspaceCwd, isSilentTurnSuppressed, resolveSilentTurnDelivery, resolveTurnVerbosity, upsertLocalRuntimeEntry, } from '@canonmsg/core';
 import { validateCard } from '@canonmsg/rich-cards';
 import { CodexConversationAdapter, } from './adapter.js';
 import { CodexAppServerAdapter, } from './app-server-adapter.js';
@@ -688,7 +688,8 @@ export async function main() {
         lockHandle?.release();
         throw error;
     }
-    const client = new CanonClient(apiKey, baseUrl);
+    const client = new CanonClient(apiKey, baseUrl, { environmentId: resolvedAgent.environmentId, streamUrl });
+    const endpoint = await client.getEndpoint();
     const rtdb = initRTDBAuth(client, { rtdbUrl, firebaseApiKey });
     const typingSignals = createTypingStatusPublisher({
         setTyping: (conversationId, typing, status) => status
@@ -861,6 +862,8 @@ export async function main() {
                 ...payload.changes,
                 memberIds,
             });
+            void client.rememberConversation(conversationCache.get(payload.conversationId))
+                .catch((error) => console.error('[canon] Failed to persist conversation update:', error));
         }
         if (membershipChange) {
             pendingMembershipChanges.set(payload.conversationId, membershipChange);
@@ -1787,6 +1790,7 @@ export async function main() {
         if (input.turnDispatch && input.turnDispatch.kind !== 'run_turn') {
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Suppressed server-dispatched turn: ${input.turnDispatch.reason}`);
             recoveryCheckpointsFor(input.conversationId).settle(input.message.id);
+            await endpoint.setInboundState(`message:${input.conversationId}:${input.message.id}`, 'settled', 'not-dispatched');
             return;
         }
         if (input.message.metadata?.type === 'plan_approval_reply') {
@@ -1795,6 +1799,7 @@ export async function main() {
                 // replies left by an older coding descriptor instead of turning them
                 // into hidden plan/implementation prompts after an upgrade or restart.
                 recoveryCheckpointsFor(input.conversationId).settle(input.message.id);
+                await endpoint.setInboundState(`message:${input.conversationId}:${input.message.id}`, 'settled', 'not-dispatched');
                 return;
             }
             const planId = readString(input.message.metadata, 'planId');
@@ -1803,6 +1808,7 @@ export async function main() {
                 metadata: input.message.metadata,
             })) {
                 recoveryCheckpointsFor(input.conversationId).settle(input.message.id);
+                await endpoint.setInboundState(`message:${input.conversationId}:${input.message.id}`, 'settled', 'not-dispatched');
                 return;
             }
             const session = await getOrCreateSession(input.conversationId);
@@ -1877,6 +1883,7 @@ export async function main() {
         if (!autoReply.allow) {
             console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Suppressed auto-reply: ${autoReply.reason}`);
             recoveryCheckpointsFor(input.conversationId).settle(input.message.id);
+            await endpoint.setInboundState(`message:${input.conversationId}:${input.message.id}`, 'settled', 'not-dispatched');
             return;
         }
         console.error(`[canon-codex] [${input.conversationId.slice(0, 8)}] Message from ${input.senderName}: "${content.slice(0, 80)}" (${autoReply.reason})`);
@@ -1907,6 +1914,7 @@ export async function main() {
                 ...(input.replyAuthority ? { replyAuthority: input.replyAuthority } : {}),
             }).catch(() => { });
             recoveryCheckpointsFor(input.conversationId).settle(input.message.id);
+            await endpoint.setInboundState(`message:${input.conversationId}:${input.message.id}`, 'settled', 'not-dispatched');
             return;
         }
         session.activeSelfContextId = activeSelfContextId;
@@ -1963,6 +1971,8 @@ export async function main() {
         if (!nextTurn)
             return;
         session.running = true;
+        const inboundId = nextTurn.sourceMessageId ? `message:${session.conversationId}:${nextTurn.sourceMessageId}` : null;
+        let journaledInput = false;
         session.state.lastError = undefined;
         session.state.state = 'running';
         session.currentTurnId = randomUUID();
@@ -2180,6 +2190,12 @@ export async function main() {
                 skillInvocationText: nextTurn.skillInvocationText,
                 onServerRequest: (request) => handleCodexServerRequest(session, request, nextTurn.requestingUserId ?? null, nextTurn.sourceMessageId ?? null),
             });
+            // Canon-origin queues must retain a durable execution owner, including
+            // legacy queues restored before endpoint migration. Native continuations
+            // without a Canon source message remain a separate operator path.
+            if (inboundId && !await endpoint.claimInbound(inboundId))
+                return;
+            journaledInput = !!inboundId;
             let result = await runTurnOnce();
             if (!result.interrupted
                 && !result.finalMessage
@@ -2195,6 +2211,8 @@ export async function main() {
                 session.currentTurnSilenced = false;
                 result = await runTurnOnce();
             }
+            if (journaledInput)
+                await endpoint.setInboundState(inboundId, 'settled', 'native-completed');
             // Both the artifact gate and the final delivery weigh silence against
             // this text, and they must weigh the same one — set it before any
             // completion branch runs, including the ones that route first.
@@ -2359,6 +2377,11 @@ export async function main() {
             }
         }
         catch (error) {
+            if (isPendingCanonOperation(error)) {
+                session.state.lastError = 'Canon delivery remains pending reconciliation.';
+                writeState(session);
+                return;
+            }
             const message = error instanceof ExecutionEnvironmentError
                 ? error.userMessage
                 : error instanceof CanonApiError
@@ -2653,75 +2676,10 @@ export async function main() {
             console.error(`[canon-codex] Runtime ${operation} failed:`, error);
         },
     });
-    let startupRecoveryComplete = false;
     async function recoverInboundMessageGaps() {
-        // A reconnect can reveal conversations created while this host was
-        // offline. Refresh before sweeping cursors; this is one REST reconciliation
-        // pass, not an automatic retry loop.
-        const knownBeforeRefresh = new Set(knownConversationIds);
+        // Refresh discovery only. Timeline reconstruction is never authorization to
+        // execute historical turns; admitted pending work lives in the endpoint inbox.
         await refreshKnownConversationIds(true);
-        const conversationsDiscoveredWhileOffline = startupRecoveryComplete
-            ? new Set([...knownConversationIds].filter((id) => !knownBeforeRefresh.has(id)))
-            : new Set();
-        for (const conversationId of knownConversationIds) {
-            const recoveryCheckpoints = recoveryCheckpointsFor(conversationId);
-            const recoveryBatch = recoveryCheckpoints.reserveBatch();
-            try {
-                const cursor = loadRuntimeSessionState(runtimeId, {
-                    conversationId,
-                    baseCwd: workingDir,
-                })?.lastInboundMessageId ?? null;
-                const recovered = await collectMissedInboundMessages({
-                    fetchPage: (before) => client.getMessagesPage(conversationId, STARTUP_RECOVERY_PAGE_SIZE, before),
-                    cursor,
-                    agentId,
-                    requireContiguousCursor: true,
-                    noCursorMode: conversationsDiscoveredWhileOffline.has(conversationId)
-                        ? 'bounded-window'
-                        : 'latest-only',
-                });
-                recoveryBatch.commit(recovered.messages.map((message) => message.id), recovered.mode === 'incomplete-gap' ? recovered.recoveryCursor : null);
-                if (recovered.mode === 'incomplete-gap') {
-                    console.error(`[canon-codex] [${conversationId.slice(0, 8)}] recovery_incomplete_gap: cursor is missing; replaying ${recovered.messages.length} bounded inbound message(s) before advancing to ${recovered.recoveryCursor ?? 'no cursor'}`);
-                }
-                for (const message of recovered.messages) {
-                    const isPlanReply = isCodexPlanApprovalReply(message.metadata, serviceAgentMode);
-                    if (!isPlanReply && !shouldTriggerAgentTurn({
-                        senderType: message.senderType,
-                        metadata: message.metadata,
-                    }).allow) {
-                        recoveryCheckpoints.settle(message.id);
-                        continue;
-                    }
-                    if (!claimInboundMessageId(message.id))
-                        continue;
-                    try {
-                        await enqueueInboundMessage({
-                            conversationId,
-                            message,
-                            senderName: message.senderName || message.senderId,
-                            isOwner: message.senderId === ownerId,
-                            behavior: recovered.newestPage.behavior,
-                            activeSelfContextId: recovered.newestPage.activeSelfContextIdByMessageId?.[message.id] ?? null,
-                            selfContexts: recovered.newestPage.selfContexts,
-                            hydratedPage: recovered.newestPage,
-                        });
-                        settleInboundMessageId(message.id, true);
-                    }
-                    catch (error) {
-                        settleInboundMessageId(message.id, false);
-                        throw error;
-                    }
-                }
-                if (recovered.messages.length > 0) {
-                    console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Recovered ${recovered.messages.length} inbound message(s) (${recovered.mode})`);
-                }
-            }
-            catch (error) {
-                recoveryBatch.cancel();
-                console.error(`[canon-codex] [${conversationId.slice(0, 8)}] Recovery failed:`, error instanceof Error ? error.message : error);
-            }
-        }
     }
     const reconnectRecovery = createReconnectRecoveryCoordinator(recoverInboundMessageGaps);
     const observeReconnectRecovery = (reason, recovery) => {
@@ -2731,39 +2689,51 @@ export async function main() {
             console.error(`[canon-codex] ${reason} recovery failed:`, error instanceof Error ? error.message : error);
         });
     };
+    const inbound = endpoint.acceptInbound({ kind: 'message.created',
+        offer: async (event) => {
+            const payload = event.data;
+            const message = payload.message;
+            if (message.senderId === agentId) {
+                await endpoint.setInboundState(event.id, 'settled', 'own-message');
+                return;
+            }
+            if (!claimInboundMessageId(message.id))
+                return;
+            recoveryCheckpointsFor(payload.conversationId).track(message.id);
+            if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
+                console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Ignoring server-dispatched observe-only message: ${payload.turnDispatch.reason}`);
+                recoveryCheckpointsFor(payload.conversationId).settle(message.id);
+                settleInboundMessageId(message.id, true);
+                await endpoint.setInboundState(`message:${payload.conversationId}:${message.id}`, 'settled', 'observe-only');
+                return;
+            }
+            await enqueueInboundMessage({
+                conversationId: payload.conversationId,
+                message,
+                senderName: message.senderName || message.senderId,
+                isOwner: message.isOwner ?? (ownerId != null && message.senderId === ownerId),
+                behavior: payload.behavior,
+                activeSelfContextId: payload.activeSelfContextId,
+                selfContexts: payload.selfContexts,
+                provenance: payload.provenance,
+                turnDispatch: payload.turnDispatch,
+                replyAuthority: payload.replyAuthority,
+            }).then(() => settleInboundMessageId(message.id, true), (error) => {
+                settleInboundMessageId(message.id, false);
+                console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Failed to queue inbound message:`, error instanceof Error ? error.message : error);
+                throw error;
+            });
+        },
+        onError: (error) => console.error('[canon-codex] Endpoint input deferred:', error), });
+    inbound.start();
     const stream = new CanonStream({
-        apiKey,
+        endpoint,
         agentId,
-        streamUrl,
         handler: {
             onMessage: (payload) => {
-                const message = payload.message;
-                if (message.senderId === agentId)
-                    return;
-                if (!claimInboundMessageId(message.id))
-                    return;
-                recoveryCheckpointsFor(payload.conversationId).track(message.id);
-                if (payload.turnDispatch && payload.turnDispatch.kind !== 'run_turn') {
-                    console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Ignoring server-dispatched observe-only message: ${payload.turnDispatch.reason}`);
-                    recoveryCheckpointsFor(payload.conversationId).settle(message.id);
-                    settleInboundMessageId(message.id, true);
-                    return;
-                }
-                void enqueueInboundMessage({
-                    conversationId: payload.conversationId,
-                    message,
-                    senderName: message.senderName || message.senderId,
-                    isOwner: message.isOwner ?? (ownerId != null && message.senderId === ownerId),
-                    behavior: payload.behavior,
-                    activeSelfContextId: payload.activeSelfContextId,
-                    selfContexts: payload.selfContexts,
-                    provenance: payload.provenance,
-                    turnDispatch: payload.turnDispatch,
-                    replyAuthority: payload.replyAuthority,
-                }).then(() => settleInboundMessageId(message.id, true), (error) => {
-                    settleInboundMessageId(message.id, false);
-                    console.error(`[canon-codex] [${payload.conversationId.slice(0, 8)}] Failed to queue inbound message:`, error instanceof Error ? error.message : error);
-                });
+                void inbound.receive({ id: `message:${payload.conversationId}:${payload.message.id}`,
+                    kind: 'message.created', conversationId: payload.conversationId, durable: true,
+                    data: payload });
             },
             onMessageDeleted: (payload) => {
                 removeQueuedPrompt(payload.conversationId, payload.messageId);
@@ -2809,7 +2779,6 @@ export async function main() {
     await reconnectRecovery.recoverNow().catch((error) => {
         console.error('[canon-codex] Startup recovery failed:', error instanceof Error ? error.message : error);
     });
-    startupRecoveryComplete = true;
     startCodexStreamInBackground(stream, (error) => {
         console.error('[canon-codex] SSE start error:', error instanceof Error ? error.message : error);
     });
@@ -2845,6 +2814,7 @@ export async function main() {
         }
         runtimeRequests.dispose();
         stream.stop();
+        await inbound.close();
         await runtimeHeartbeat.dispose();
         for (const session of [...sessions.values()]) {
             await session.adapter.interrupt().catch(() => { });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@canonmsg/codex-plugin",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Canon host integration for Codex CLI",
   "type": "module",
   "main": "dist/index.js",
@@ -31,15 +31,15 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@canonmsg/agent-sdk": "^10.4.0",
-    "@canonmsg/agent-tools": "^0.10.0",
-    "@canonmsg/coding-agent-host": "^0.8.0",
-    "@canonmsg/core": "^12.5.0",
-    "@canonmsg/rich-cards": "^0.10.5",
+    "@canonmsg/agent-sdk": "^11.0.0",
+    "@canonmsg/agent-tools": "^0.11.0",
+    "@canonmsg/coding-agent-host": "^0.9.0",
+    "@canonmsg/core": "^13.0.0",
+    "@canonmsg/rich-cards": "^0.10.6",
     "ws": "^8.21.3"
   },
   "engines": {
-    "node": ">=18.0.0"
+    "node": ">=22.22.3"
   },
   "keywords": [
     "canon",