fix(omni): intercept SendMessage(to: omni) in SDK executor → NATS reply path

[vasconceloscezar]

Summary

Fixes #1088. Agents spawned via the omni bridge SDK executor (eugenia-seller, etc.) call SendMessage(recipient: "omni", message: "...") to send replies. In SDK mode this was a silent no-op — the done MCP tool was the only NATS publish path, and SendMessage calls fell through with no interception. Bridge logs showed sessions spawning and messages arriving, but replies never reached omni.reply.{instance}.{chatId} and tests timed out.

Approach

Added a PreToolUse hook in _processDelivery() that fires only when OMNI_INSTANCE is set in the executor env (non-bridge SDK sessions are unaffected). The hook:

1. Intercepts SendMessage to recipient "omni"
2. Side-effect publishes the body to omni.reply.{instance}.{chatId} — mirrors handleDoneTool's text action exactly
3. Returns permissionDecision: 'deny' with reason "Message delivered to user via omni bridge." — the deny reason becomes the tool result the agent reads, so the agent treats it as a successful send

The provider's existing mergeHooks() deep-merges this with the permission gate hook, so both run on every PreToolUse.

Why not an MCP tool replacement? Namespacing (mcp__genie-omni-tools__SendMessage) would break the agent's expectation that SendMessage is the bare tool name — the same name it uses in tmux mode. A hook keeps the call site identical across transports.

Field shape: defensive — accepts both recipient/to and message/content (matches identity-inject.ts's pattern).

Bonus fix

turn-based-prompt.ts previously taught agents to use omni say / omni speak CLI verbs. These don't exist in SDK mode (no shell, in-process query) — so even though the issue title is about SendMessage interception, the prompt was steering agents toward a dead path. Updated the prompt to make SendMessage(recipient: "omni", ...) the canonical reply verb, with omni done still serving the turn-close protocol via the existing MCP tool.

Test plan

• bun run typecheck passes
• bunx biome check clean on all touched files
• bun test src/services/executors/__tests__/claude-sdk.test.ts — 32 pass / 0 fail (24 existing + 8 new)
• bun test full suite — 2251 pass / 0 fail

New test coverage (SendMessage omni interception describe block)

• publish + deny when recipient === 'omni'
• alternate to/content field shape accepted
• passthrough (no decision) for non-omni recipients
• passthrough for non-SendMessage tool calls
• bridge-unavailable deny when natsPublish is null
• passthrough when OMNI_INSTANCE is absent (non-bridge session)
• wiring proof: SendMessage matcher present in runQuery options when env set
• wiring proof: matcher absent when env unset

Files

• src/services/executors/claude-sdk.ts (+88 -2) — parseSendMessageInput(), createSendMessageOmniHook(), _processDelivery wiring
• src/services/executors/turn-based-prompt.ts (+14 -10) — SendMessage as canonical reply verb
• src/services/executors/__tests__/claude-sdk.test.ts (+180 -3) — 8 new tests + 1 prompt assertion update

Sibling work

#1089 (omni-bridge missing omni.session.reset.* subscription) is the matching reset-path fix — different file, different abstraction, lands as a separate PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: a2511f2c-2b7a-473a-8048-edfb9bfd4176

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1088-sdk-sendmessage-omni-routing

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gemini-code-assist]

Code Review

This pull request introduces a mechanism to intercept SendMessage tool calls within the Claude SDK executor, specifically routing messages directed to the 'omni' recipient through a NATS bridge. It includes a new PreToolUse hook, createSendMessageOmniHook, which handles the interception and publication of these messages. Additionally, the turn-based system prompt has been updated to promote SendMessage as the primary reply method, replacing the legacy omni say command. Comprehensive unit tests have been added to verify the routing logic and hook integration. I have no feedback to provide.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e65e35a42

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Avoid publishing empty omni replies on malformed SendMessage

When SendMessage targets recipient: "omni" but omits/invalidates the message field (for example, the model emits text instead of message/content), this hook still publishes content: "" and returns a success-like deny reason. In that scenario the agent believes delivery succeeded and won’t retry, so users can receive a blank message (or no usable reply) instead of an explicit tool error. Guarding on a non-empty parsed body before publishing would prevent this silent failure mode.

Useful? React with 👍 / 👎.