Address PR review comments

- Rust+Node canvas dispatch: require instanceId for lifecycle verbs and
  custom actions (was silently defaulting to empty string).
- Rust hostExtension.invoke: validate envelope.session_id matches the
  session handling the request; return a structured session_mismatch
  error envelope on mismatch.
- Node handleHostExtensionInvoke: return { ok:false, error } envelopes
  for invalid payloads, missing sessions, and unsupported inner methods
  instead of throwing (which would have surfaced as JSON-RPC transport
  errors and broken the runtime-side contract).
- Re-export CanvasInstanceRehydrate from @github/copilot-sdk/extension
  so extension consumers can type ResumeSessionConfig.openCanvasInstances
  without reaching into internal paths.
- Fix canvas test that called canvas.open without instance_id.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jmoseley

nodejs/src/canvas.ts

@@ -350,6 +350,12 @@ export async function dispatchCanvasAction(
         case RESERVED_CANVAS_ACTIONS.focus:
         case RESERVED_CANVAS_ACTIONS.close:
         case RESERVED_CANVAS_ACTIONS.reload: {
+            if (!params.instanceId) {
+                throw new CanvasError(
+                    "canvas_missing_instance_id",
+                    `Lifecycle verb '${params.actionName}' requires an instanceId`
+                );
+            }
             const hook =
                 params.actionName === RESERVED_CANVAS_ACTIONS.focus
                     ? canvas.onFocus
@@ -360,7 +366,7 @@ export async function dispatchCanvasAction(
             const ctx: CanvasLifecycleContext = {
                 sessionId,
                 canvasId: params.canvasId,
-                instanceId: params.instanceId ?? "",
+                instanceId: params.instanceId,
             };
             await hook(ctx);
             return undefined;
@@ -369,10 +375,16 @@ export async function dispatchCanvasAction(
             if (!canvas.onAction) {
                 throw CanvasError.noHandler();
             }
+            if (!params.instanceId) {
+                throw new CanvasError(
+                    "canvas_missing_instance_id",
+                    `Action '${params.actionName}' requires an instanceId`
+                );
+            }
             return canvas.onAction({
                 sessionId,
                 canvasId: params.canvasId,
-                instanceId: params.instanceId ?? "",
+                instanceId: params.instanceId,
                 actionName: params.actionName,
                 input: params.input,
             });

nodejs/src/client.ts

@@ -2150,22 +2150,46 @@ export class CopilotClient {
         sessionId: string;
         request: { id?: string; method: string; params?: unknown };
     }): Promise<{ ok: true; result: unknown } | { ok: false; error: CanvasError }> {
+        const invalidEnvelope = (message: string) =>
+            ({
+                ok: false as const,
+                error: {
+                    code: "invalid_payload",
+                    message,
+                    name: "CanvasError",
+                } as CanvasError,
+            }) satisfies { ok: false; error: CanvasError };
+
         if (!params || typeof params.sessionId !== "string" || !params.request) {
-            throw new Error("Invalid hostExtension.invoke payload");
+            return invalidEnvelope("Invalid hostExtension.invoke payload");
         }
         const session = this.sessions.get(params.sessionId);
         if (!session) {
-            throw new Error(`Session not found: ${params.sessionId}`);
+            return {
+                ok: false,
+                error: {
+                    code: "session_not_found",
+                    message: `Session not found: ${params.sessionId}`,
+                    name: "CanvasError",
+                } as CanvasError,
+            };
         }
         const { method, params: inner } = params.request;
         // Only `canvas.action.invoke` is accepted as an inner method; reject
         // anything else explicitly so misrouted calls don't silently no-op.
         if (method !== "canvas.action.invoke") {
-            throw new Error(`Unsupported hostExtension.invoke method: ${method}`);
+            return {
+                ok: false,
+                error: {
+                    code: "unsupported_method",
+                    message: `hostExtension.invoke only supports canvas.action.invoke, got '${method}'`,
+                    name: "CanvasError",
+                } as CanvasError,
+            };
         }
         const actionParams = inner as CanvasActionInvokeParams;
         if (!actionParams || typeof actionParams.canvasId !== "string") {
-            throw new Error("Invalid canvas.action.invoke params: missing canvasId");
+            return invalidEnvelope("Invalid canvas.action.invoke params: missing canvasId");
         }
         const canvas = session.getCanvas(actionParams.canvasId);
         if (!canvas) {

nodejs/src/extension.ts

@@ -17,6 +17,7 @@ export {
     type CanvasActionContext,
     type CanvasAgentActionDeclaration,
     type CanvasDeclaration,
+    type CanvasInstanceRehydrate,
     type CanvasLifecycleContext,
     type CanvasOpenContext,
     type CanvasOpenResponse,

rust/src/canvas.rs

@@ -430,13 +430,18 @@ pub async fn dispatch_canvas_invoke(
             }
             Ok(Value::Null)
         }
-        _ => {
-            let instance_id = params.instance_id.unwrap_or_default();
+        other => {
+            let instance_id = params.instance_id.ok_or_else(|| {
+                CanvasError::new(
+                    "canvas_missing_instance_id",
+                    format!("Action '{other}' requires an instanceId"),
+                )
+            })?;
             let ctx = CanvasActionContext {
                 session_id,
                 canvas_id: params.canvas_id,
                 instance_id,
-                action_name: params.action_name,
+                action_name: other.to_string(),
                 input: params.input,
             };
             handler.on_action(ctx).await
@@ -729,7 +734,7 @@ mod tests {
             SessionId::from("s1"),
             CanvasInvokeParams {
                 canvas_id: "dup".into(),
-                instance_id: None,
+                instance_id: Some("inst-1".into()),
                 action_name: "canvas.open".into(),
                 input: Value::Null,
                 toolbar: None,

rust/src/session.rs

@@ -1848,6 +1848,27 @@ async fn handle_request(
                 }
             };
 
+            if envelope.session_id != sid {
+                let result = serde_json::json!({
+                    "ok": false,
+                    "error": {
+                        "code": "session_mismatch",
+                        "message": format!(
+                            "hostExtension.invoke session id '{}' does not match this session '{}'",
+                            envelope.session_id, sid
+                        ),
+                    },
+                });
+                let rpc_response = JsonRpcResponse {
+                    jsonrpc: "2.0".to_string(),
+                    id: request.id,
+                    result: Some(result),
+                    error: None,
+                };
+                let _ = client.send_response(&rpc_response).await;
+                return;
+            }
+
             if envelope.request.method != "canvas.action.invoke" {
                 let result = serde_json::json!({
                     "ok": false,