@frockbot/plugin-shell 0.1.4 → 0.2.1

package/src/backend-isolate.ts

@@ -1,119 +1,61 @@
 // The Bot Durable Object half of the isolate capability boundary.
 //
-// A loaded Bot Package sees exactly two bindings: `IDENTITY` (a plain object)
-// and `CAPABILITIES` (a loopback service binding). Every method behind
-// `CAPABILITIES` ends up here, in the authority that owns the Bot's durable
-// state — so an authority-widening request becomes a durable pending decision
-// rather than a grant, and a model call records its normalized request and
-// acquires its credential lease through the existing provider path before a
-// single byte leaves the account.
+// Every Package mounted for one Bot receives the same authority projection:
+// the User's ready Connections, the Bot's configured model, and the shared
+// tool, Memory, Workspace, and notification surfaces. Package identity remains
+// in props only for attribution; it never narrows the authority list.
 import type {
-  IsolateCapabilityFailureV1,
-  IsolateAuthorityRequestV1,
-  IsolateCapabilityDescriptorV1,
-  IsolateModelOutcomeV1,
-  IsolatePendingDecisionV1,
+  IsolateCapabilityListV1,
+  IsolateConnectionLeaseV1,
+  IsolateConnectionOutcomeV1,
+  IsolateConnectionV1,
+  IsolateModelBindingV1,
+  IsolateModelInvocationV1,
   LlmStreamEvent,
   NormalizedModelRequest,
 } from "@frockbot/kernel-contracts";
-import {
-  decodeIsolateAuthorityRequestV1,
-  encodeIsolateModelEventLineV1,
-} from "@frockbot/kernel-contracts";
+import { encodeIsolateModelEventLineV1 } from "@frockbot/kernel-contracts";
 import type { BotIsolateArtifactStore } from "@frockbot/kernel-composition/isolate";
-import type { EnabledCapabilityV1 } from "@frockbot/configuration-core";
 
-/**
- * The compatibility date every Bot isolate is loaded with. Pinned beside the
- * gateway Worker's own so Bot-authored code cannot outrun the kernel wrapper.
- */
+export type { IsolateModelBindingV1 } from "@frockbot/kernel-contracts";
+
 export const BOT_ISOLATE_COMPATIBILITY_DATE = "2026-08-27";
 
-/**
- * What travels in `ctx.exports.BotCapabilities({ props })`. Structured-clonable
- * by necessity: props cross into a loopback service binding.
- */
 export interface BotCapabilitiesPropsV1 {
   userId: string;
   botId: string;
+  runId: string;
+  sessionId: string;
+  turnId: string;
   generationId: string;
   packageId: string;
-  /** The User's enabled set, already resolved by the authority. */
-  capabilities: IsolateCapabilityV1[];
+  connections: IsolateConnectionV1[];
+  model?: IsolateModelBindingV1;
+  memory: boolean;
+  workspace: boolean;
 }
 
-export const ISOLATE_DECISION_PREFIX = "isolate:decision:";
 export const ISOLATE_MODEL_REQUEST_PREFIX = "isolate:model-request:";
 
-/** A durable record that the Bot asked for authority it does not hold. */
-export interface IsolatePendingAuthorityDecisionV1 {
-  schemaVersion: 1;
-  decisionId: string;
-  botId: string;
-  packageId: string;
-  generationId: string;
-  capabilityId: string;
-  reason: string;
-  requestedAt: string;
-  status: "pending";
-}
-
-/** The intent recorded before a Bot-authored adapter's model call is forwarded. */
 export interface IsolateModelRequestRecordV1 {
   schemaVersion: 1;
-  /** Minted by this Durable Object; the record is keyed by it. */
   recordId: string;
-  /** The Bot's own correlation id. Bounded, and never a storage key. */
   requestId: string;
   botId: string;
   packageId: string;
   generationId: string;
-  capabilityId: string;
   request: NormalizedModelRequest;
   recordedAt: string;
 }
 
-/** The narrow storage surface this module needs from the Durable Object. */
 export interface IsolateCapabilityStore {
   put(key: string, value: unknown): Promise<void>;
-  get<T>(key: string): Promise<T | undefined>;
   list<T>(options: { prefix: string }): Promise<Map<string, T>>;
 }
 
-/** One account-wide Capability, already resolved from User enablement. */
-export type IsolateCapabilityV1 = EnabledCapabilityV1;
-
-/**
- * The Bot's effective model binding, resolved by the authority from generic
- * Package settings and the User's Connection — never from anything the Bot
- * supplied. An `invokeModel` request is authorized only when it names exactly
- * this provider and this model, and it is forwarded carrying exactly this
- * binding.
- */
-export interface IsolateModelBindingV1 {
-  packageId: string;
-  capabilityId: string;
-  connectionId: string;
-  provider: string;
-  providerModelId: string;
-  connectionGeneration?: string;
-  catalogGeneration?: string;
-}
-
-/** A configured model binding whose Connection cannot currently be used. */
-export interface IsolateUnavailableModelBindingV1 {
-  provider?: string;
-  providerModelId: string;
-}
-
-export const ISOLATE_MODEL_UNAVAILABLE_MESSAGE =
-  "the enabled model binding is unavailable";
-
-/** The bound Bot-supplied correlation id: a field, never a key, and never unbounded. */
 export const MAX_ISOLATE_REQUEST_ID = 256;
 
 export interface IsolateModelPath {
-  /** Streams through the mounted provider Plugin; the lease is taken inside it. */
   stream(
     request: NormalizedModelRequest,
     signal: AbortSignal,
@@ -125,56 +67,56 @@ export interface IsolateCapabilityHostOptions {
   botId: string;
   packageId: string;
   generationId: string;
-  /** User-enabled and nothing else. */
-  capabilities: readonly IsolateCapabilityV1[];
-  /**
-   * The one ready model binding resolved for this Bot. Absent without an
-   * unavailable binding means every model request is an authority-widening
-   * pending decision.
-   */
+  connections: readonly IsolateConnectionV1[];
   modelBinding?: IsolateModelBindingV1;
-  /** Present when the configured binding is held but its Connection is unavailable. */
-  unavailableModelBinding?: IsolateUnavailableModelBindingV1;
-  /** Present only while the ready binding can reach its provider path. */
   modelPath?: IsolateModelPath;
+  memory: boolean;
+  workspace: boolean;
   now?(): Date;
   newId?(): string;
 }
 
 export interface IsolateCapabilityHost {
-  list(): Promise<IsolateCapabilityDescriptorV1[]>;
-  requestAuthority(request: unknown): Promise<IsolatePendingDecisionV1>;
-  invokeModel(request: NormalizedModelRequest): Promise<IsolateModelOutcomeV1>;
-  pendingDecisions(): Promise<IsolatePendingAuthorityDecisionV1[]>;
+  list(): Promise<IsolateCapabilityListV1>;
+  invokeModel(
+    request: NormalizedModelRequest,
+  ): Promise<IsolateModelInvocationV1>;
   recordedModelRequests(): Promise<IsolateModelRequestRecordV1[]>;
 }
 
-/**
- * The enabled model Capability that can serve this request, if any.
- *
- * The authority resolves the effective model against one User-enabled
- * Package, Connection, and Capability. A request naming any other provider or
- * model resolves to nothing, whatever the Bot claims about it — the
- * Bot-supplied `modelBinding` is never read here or anywhere downstream.
- */
-export function matchingModelCapabilityV1(
-  capabilities: readonly IsolateCapabilityV1[],
+export function matchingModelBindingV1(
   binding: IsolateModelBindingV1 | undefined,
   request: NormalizedModelRequest,
-): IsolateCapabilityV1 | undefined {
-  if (!binding) return undefined;
+): IsolateModelBindingV1 | undefined {
+  const admitted = request.modelBinding;
   if (
+    !binding ||
+    !admitted ||
     request.provider !== binding.provider ||
-    request.model !== binding.providerModelId
+    request.model !== binding.providerModelId ||
+    admitted.connectionId !== binding.connectionId ||
+    admitted.connectionGeneration !== binding.connectionGeneration ||
+    admitted.catalogGeneration !== binding.catalogGeneration
   ) {
     return undefined;
   }
-  return capabilities.find(
-    (capability) =>
-      capability.kind === "model" &&
-      capability.packageId === binding.packageId &&
-      capability.capabilityId === binding.capabilityId &&
-      capability.connectionId === binding.connectionId,
+  return binding;
+}
+
+/**
+ * A loaded isolate may receive only the Connection generation baked into its
+ * admitted authority snapshot. A later User Connection change gets a new
+ * binding digest and isolate identity; it must not leak through this old stub.
+ */
+export function matchesAdmittedConnectionV1(
+  admitted: IsolateConnectionV1 | undefined,
+  outcome: IsolateConnectionOutcomeV1,
+): outcome is IsolateConnectionLeaseV1 {
+  return (
+    admitted !== undefined &&
+    outcome.status === "available" &&
+    outcome.connectionId === admitted.connectionId &&
+    outcome.generation === admitted.generation
   );
 }
 
@@ -184,103 +126,47 @@ export function createIsolateCapabilityHost(
   const now = options.now ?? (() => new Date());
   const newId = options.newId ?? (() => crypto.randomUUID());
 
-  async function recordDecision(
-    capabilityId: string,
-    reason: string,
-  ): Promise<IsolatePendingDecisionV1> {
-    const decisionId = `decision-${newId()}`;
-    const record: IsolatePendingAuthorityDecisionV1 = {
-      schemaVersion: 1,
-      decisionId,
-      botId: options.botId,
-      packageId: options.packageId,
-      generationId: options.generationId,
-      capabilityId,
-      reason,
-      requestedAt: now().toISOString(),
-      status: "pending",
-    };
-    await options.storage.put(
-      `${ISOLATE_DECISION_PREFIX}${decisionId}`,
-      record,
-    );
-    return { status: "pending-user-decision", decisionId };
-  }
-
   return {
-    list(): Promise<IsolateCapabilityDescriptorV1[]> {
-      return Promise.resolve(
-        options.capabilities.map((capability) => ({
-          capabilityId: capability.capabilityId,
-          kind: capability.kind,
-        })),
-      );
-    },
-
-    async requestAuthority(
-      request: unknown,
-    ): Promise<IsolatePendingDecisionV1> {
-      const decoded: IsolateAuthorityRequestV1 =
-        decodeIsolateAuthorityRequestV1(request);
-      // Self-modification never widens authority, even when the capability is
-      // already enabled: the answer is a decision the User makes.
-      return await recordDecision(decoded.capabilityId, decoded.reason);
+    list(): Promise<IsolateCapabilityListV1> {
+      return Promise.resolve({
+        status: "available",
+        connections: structuredClone([...options.connections]),
+        ...(options.modelBinding
+          ? { model: structuredClone(options.modelBinding) }
+          : {}),
+        tools: true,
+        memory: options.memory,
+        workspace: options.workspace,
+        notify: true,
+        schedule: true,
+      });
     },
 
     async invokeModel(
       request: NormalizedModelRequest,
-    ): Promise<IsolateModelOutcomeV1> {
+    ): Promise<IsolateModelInvocationV1> {
       if (request.requestId.length > MAX_ISOLATE_REQUEST_ID) {
         throw new Error("isolate model request requestId is not bounded");
       }
-      const binding = options.modelBinding;
-      const capability = matchingModelCapabilityV1(
-        options.capabilities,
-        binding,
-        request,
-      );
-      const unavailableBinding = options.unavailableModelBinding;
-      if (
-        unavailableBinding &&
-        request.model === unavailableBinding.providerModelId &&
-        (unavailableBinding.provider === undefined ||
-          request.provider === unavailableBinding.provider)
-      ) {
-        return {
-          status: "unavailable",
-          reason: ISOLATE_MODEL_UNAVAILABLE_MESSAGE,
-        } satisfies IsolateCapabilityFailureV1;
-      }
-      if (capability && binding && !options.modelPath) {
+      const binding = matchingModelBindingV1(options.modelBinding, request);
+      if (!binding || !options.modelPath) {
         return {
           status: "unavailable",
-          reason: ISOLATE_MODEL_UNAVAILABLE_MESSAGE,
-        } satisfies IsolateCapabilityFailureV1;
+          reason: options.modelBinding
+            ? "the request does not match this Bot's configured model"
+            : "this Bot has no configured model",
+        };
       }
-      if (!capability || !binding || !options.modelPath) {
-        return await recordDecision(
-          `models:${request.provider}:${request.model}`,
-          `Bot Package "${options.packageId}" asked to invoke a model with no matching enabled Capability`,
-        );
-      }
-      // The binding the provider path receives is the authority's, never the
-      // Bot's: a Bot-composed request carries no Connection authority.
       const forwarded: NormalizedModelRequest = {
         ...structuredClone(request),
         modelBinding: {
           connectionId: binding.connectionId,
-          ...(binding.connectionGeneration
-            ? { connectionGeneration: binding.connectionGeneration }
-            : {}),
+          connectionGeneration: binding.connectionGeneration,
           ...(binding.catalogGeneration
             ? { catalogGeneration: binding.catalogGeneration }
             : {}),
         },
       };
-      // Record the exact normalized request before forwarding; the provider
-      // path takes the credential lease on the way through. The record is
-      // keyed by an id this authority mints, so a Bot cannot overwrite one of
-      // its own earlier records by reusing a `requestId`.
       const recordId = `model-request-${newId()}`;
       const record: IsolateModelRequestRecordV1 = {
         schemaVersion: 1,
@@ -289,7 +175,6 @@ export function createIsolateCapabilityHost(
         botId: options.botId,
         packageId: options.packageId,
         generationId: options.generationId,
-        capabilityId: capability.capabilityId,
         request: forwarded,
         recordedAt: now().toISOString(),
       };
@@ -298,22 +183,16 @@ export function createIsolateCapabilityHost(
         record,
       );
       const controller = new AbortController();
-      const events = options.modelPath.stream(forwarded, controller.signal);
       return {
         status: "streaming",
         requestId: request.requestId,
-        events: isolateModelEventStreamV1(events, controller),
+        events: isolateModelEventStreamV1(
+          options.modelPath.stream(forwarded, controller.signal),
+          controller,
+        ),
       };
     },
 
-    async pendingDecisions(): Promise<IsolatePendingAuthorityDecisionV1[]> {
-      const stored =
-        await options.storage.list<IsolatePendingAuthorityDecisionV1>({
-          prefix: ISOLATE_DECISION_PREFIX,
-        });
-      return [...stored.values()];
-    },
-
     async recordedModelRequests(): Promise<IsolateModelRequestRecordV1[]> {
       const stored = await options.storage.list<IsolateModelRequestRecordV1>({
         prefix: ISOLATE_MODEL_REQUEST_PREFIX,
@@ -366,51 +245,37 @@ export function isolateModelEventStreamV1(
 }
 
 /**
- * The content address of every binding baked into an isolate's `env`: User,
- * Bot, and Composition generation from `IDENTITY` and the `CAPABILITIES` props,
- * plus the User-enabled capability set. A loader id is served from cache, so
- * any change must produce a different digest or a stale isolate will answer
- * under the wrong identity or authority. Identical artifacts share an isolate
- * only when all of these binding inputs are identical (AGENTS.md Package
- * composition; ADR 0019).
+ * The content address of the bindings baked into a loaded isolate's env.
+ *
+ * Connection order is irrelevant; ids and generations are the authority
+ * identity. User, Bot, the resolved model binding, and the pinned Composition
+ * generation complete the digest. Package id is deliberately absent: two
+ * Packages of one Bot receive the same authority projection.
  */
 export async function isolateBindingDigestV1(input: {
   userId: string;
   botId: string;
-  generationId: string;
-  capabilities: readonly IsolateCapabilityV1[];
+  connections: readonly Pick<
+    IsolateConnectionV1,
+    "connectionId" | "generation"
+  >[];
+  model?: IsolateModelBindingV1;
+  compositionGenerationId: string;
 }): Promise<string> {
-  const ordered = [...input.capabilities]
-    .map((capability) => ({
-      packageId: capability.packageId,
-      capabilityId: capability.capabilityId,
-      kind: capability.kind,
-      connectionId: capability.connectionId ?? null,
-    }))
-    .sort(
-      (left, right) =>
-        compareIsolateIdentifierV1(left.packageId, right.packageId) ||
-        compareIsolateIdentifierV1(left.capabilityId, right.capabilityId) ||
-        compareIsolateIdentifierV1(left.kind, right.kind) ||
-        compareIsolateIdentifierV1(
-          left.connectionId ?? "",
-          right.connectionId ?? "",
-        ),
-    );
+  const connections = [...input.connections]
+    .map(({ connectionId, generation }) => ({ connectionId, generation }))
+    .sort((left, right) => left.connectionId.localeCompare(right.connectionId));
   return await sha256Hex(
     JSON.stringify({
       userId: input.userId,
       botId: input.botId,
-      generationId: input.generationId,
-      ordered,
+      compositionGenerationId: input.compositionGenerationId,
+      connections,
+      model: input.model ?? null,
     }),
   );
 }
 
-function compareIsolateIdentifierV1(left: string, right: string): number {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
 async function sha256Hex(value: string): Promise<string> {
   const digest = await crypto.subtle.digest(
     "SHA-256",