@frockbot/architecture-checks 0.1.4 → 0.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frockbot/architecture-checks",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "description": "Automated checks for the constitutional rules that can be enforced mechanically.",
@@ -9,21 +9,21 @@
     "typecheck": "tsc --noEmit -p tsconfig.json"
   },
   "dependencies": {
-    "@frockbot/computer-core": "0.1.4",
-    "@frockbot/connection-core": "0.1.4",
-    "@frockbot/kernel-agent-loop": "0.1.4",
-    "@frockbot/kernel-composition": "0.1.4",
-    "@frockbot/kernel-contracts": "0.1.4",
-    "@frockbot/kernel-do": "0.1.4",
-    "@frockbot/plugin-authoring": "0.1.4",
-    "@frockbot/plugin-computer": "0.1.4",
-    "@frockbot/plugin-memory": "0.1.4",
-    "@frockbot/plugin-models": "0.1.4",
-    "@frockbot/plugin-prompt": "0.1.4",
-    "@frockbot/plugin-provider-foundation": "0.1.4",
-    "@frockbot/plugin-provider-ollama-cloud": "0.1.4",
-    "@frockbot/plugin-skills": "0.1.4",
-    "@frockbot/plugin-tools": "0.1.4",
+    "@frockbot/computer-core": "0.2.0",
+    "@frockbot/connection-core": "0.2.0",
+    "@frockbot/kernel-agent-loop": "0.2.0",
+    "@frockbot/kernel-composition": "0.2.0",
+    "@frockbot/kernel-contracts": "0.2.0",
+    "@frockbot/kernel-do": "0.2.0",
+    "@frockbot/plugin-authoring": "0.2.0",
+    "@frockbot/plugin-computer": "0.2.0",
+    "@frockbot/plugin-memory": "0.2.0",
+    "@frockbot/plugin-models": "0.2.0",
+    "@frockbot/plugin-prompt": "0.2.0",
+    "@frockbot/plugin-provider-foundation": "0.2.0",
+    "@frockbot/plugin-provider-ollama-cloud": "0.2.0",
+    "@frockbot/plugin-skills": "0.2.0",
+    "@frockbot/plugin-tools": "0.2.0",
     "cordis": "4.0.0-rc.8"
   },
   "devDependencies": {

package/src/package-authority-boundaries.test.ts

@@ -187,15 +187,9 @@ describe("package authority boundaries", () => {
       packageId: "bot-tool",
       displayName: "Bot Tool",
       version: "0.0.1",
-      tool: { name: "do_it", description: "does it", inputSchema: {} },
+      tools: [{ name: "do_it", description: "does it", inputSchema: {} }],
     };
-    for (const manifest of [
-      authoredManifestV1(base),
-      authoredManifestV1({
-        ...base,
-        model: { providerId: "foundation", modelId: "small" },
-      }),
-    ]) {
+    for (const manifest of [authoredManifestV1(base)]) {
       const contributions = manifest.contributions as Record<string, unknown>;
       expect(Object.keys(contributions).sort()).toEqual(
         expect.arrayContaining(["runtime"]),
@@ -208,11 +202,7 @@ describe("package authority boundaries", () => {
           },
         );
       }
-      expect(
-        Object.keys(contributions).every((kind) =>
-          ["runtime", "model"].includes(kind),
-        ),
-      ).toBe(true);
+      expect(Object.keys(contributions)).toEqual(["runtime"]);
       const serialized = JSON.stringify(manifest);
       expect(serialized).not.toContain("trusted-main");
       expect(serialized).not.toContain("desktop");
@@ -227,11 +217,11 @@ describe("package authority boundaries", () => {
     expect(AUTHOR_PACKAGE_INPUT_SCHEMA_V1.additionalProperties).toBe(false);
     expect(
       Object.keys(AUTHOR_PACKAGE_INPUT_SCHEMA_V1.properties).sort(),
-    ).toEqual(["displayName", "model", "packageId", "source", "tool"]);
+    ).toEqual(["displayName", "hooks", "packageId", "source", "tools", "ui"]);
     const valid = {
       packageId: "bot-tool",
       displayName: "Bot Tool",
-      tool: { name: "do_it", description: "does it", inputSchema: {} },
+      tools: [{ name: "do_it", description: "does it", inputSchema: {} }],
       source: "export const tools = [];\n",
     };
     for (const smuggled of [

package/src/package-ui-boundaries.test.ts

@@ -0,0 +1,48 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { authoredManifestV1 } from "@frockbot/plugin-authoring/shared";
+
+const repoRoot = resolve(import.meta.dirname, "..", "..", "..");
+const read = (path: string) => readFileSync(join(repoRoot, path), "utf8");
+
+describe("non-first-party Package UI boundaries", () => {
+  test("a Bot-authored UI page renders with no Package JavaScript in the app origin", () => {
+    const manifest = authoredManifestV1({
+      packageId: "weather-page",
+      displayName: "Weather page",
+      version: "0.0.1",
+      tools: [
+        { name: "weather_lookup", description: "Weather", inputSchema: {} },
+      ],
+      ui: {
+        artifact: {
+          contentHash: "a".repeat(64),
+          size: 1,
+          mediaType: "text/html",
+          bundlerVersion: "frockbot-inline-html@1",
+        },
+        mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+      },
+    });
+    const client = (manifest.contributions as Record<string, unknown>)
+      .client as Record<string, unknown>;
+    expect(client.kind).toBe("iframe");
+    expect(client).not.toHaveProperty("entry");
+    const host = read("packages/plugin-shell/src/client/PackageIframeHost.vue");
+    expect(host).toContain("<iframe");
+    expect(host).toContain(
+      "/packages/${props.contribution.artifact.contentHash}.html",
+    );
+  });
+
+  test("a page cannot read the app's cookies or storage", () => {
+    const host = read("packages/plugin-shell/src/client/PackageIframeHost.vue");
+    expect(host).toContain('sandbox="allow-scripts"');
+    expect(host).not.toContain("allow-same-origin");
+    expect(host).toContain("credentialless");
+    const wrangler = read("apps/cloudflare/wrangler.jsonc");
+    expect(wrangler).toContain('"pattern": "ui.bot.frockbot.com"');
+    expect(wrangler).toContain('"pattern": "bot.frockbot.com"');
+  });
+});