[dr0uleau]

Why

A plugin tool can wait for task data before it writes. Stop must cancel that exact call, even when a new native turn starts before the wait ends.

For example:

1. An agent calls a plugin tool to update a task.
2. The tool waits for task data.
3. The owner presses Stop, then starts another request.
4. The old tool resumes. Its captured signal is cancelled, so it must refuse the write.

Without a signal tied to the original call, the old tool can still write after Stop. A new active turn does not make that old call valid.

What

Expose the host signal as BuzzClient.signal for native Claude and Codex tools. Codex cancels tool calls when Stop starts, while its process cleanup continues.

How

The callback keeps the signal captured by its native request. Plugins pass it to waits and check it before external writes. Conversation activity does not set ownership. Existing client mutators and access checks remain in place. Hosts without request cancellation omit the property. Signals stay out of saved arguments and session archives.

Risk

This affects native tool cancellation. Stop cannot undo writes already sent. Plugin authors must use the supplied signal for external writes.

Testing

The required push checks pass on Blox for head 387ec05985088f4070cb9e5c2bacf357887d338f and base d52b32363ba02f554896388889b2bb9b5ca6a0f9 (command 28427047). Type checks, 2,969 related tests, design checks, and scoped lint pass. Four files and 14 tests skip. No Rust inputs change. The rebase keeps both independent Codex tests at the conflict.

The four new cancellation cases fail against the original base because no request signal reaches the callback. They pass with this change. They cover Stop during a wait, a new turn, normal completion, and refusal of late publication. No browser cases change. The file-reader fixture waits for its spawn gate before it checks replies. Its assertions and timeout stay unchanged.

Agent review completes with no findings. Native macOS acceptance passes at a905da432c6529cf6d2e357060f2f435405507dc on an isolated macOS arm64 VM (command 28417514). The real app Stop controls abort held plugin calls for both Claude and Codex. Each fresh turn writes while the old call stays held. Releasing the old call then refuses its write. The old files remain absent after the CLI response barrier. The same signed executable restores identity and plugin activation after restart. App controls remove test agents, the channel, and the plugin. Owned processes and listeners stop.

The native test uses generated keys, a local simulated signed relay, and scripted Claude/Codex CLI processes. It does not test provider inference or production relay policy. The rebase preserves the cancellation code and dispatch ownership. Its incoming protection-context and transcript changes do not affect the unprotected turns exercised here. Current-head unit checks cover the merged code. Human testing is explicitly waived by the operator.

buzz-review-completed (human testing waived by the operator)

Generated with Codex

[gilgtm]

🤖 No P0/P1 findings after deep dual review of 65aec926a00e16354c4560556db930d9d7b6450d.

Posted by duel-review skill [driver: codex(high), mode: deep-dual, review synthesized by codex(high)]