@frockbot/plugin-shell 0.3.1 → 0.3.3

package/src/backend-iframe-ui.test.ts

@@ -15,13 +15,19 @@ describe("Package iframe server admission", () => {
         packageId: "weather-page",
         displayName: "Weather page",
         provenance: "Bot-authored",
-        artifact: {
-          contentHash: "a".repeat(64),
-          size: 123,
-          mediaType: "text/html",
-          bundlerVersion: "frockbot-inline-html@1",
-        },
-        mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+        pages: [
+          {
+            id: "main",
+            artifact: {
+              contentHash: "a".repeat(64),
+              size: 123,
+              mediaType: "text/html",
+              bundlerVersion: "frockbot-inline-html@1",
+            },
+            mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          },
+        ],
+        entries: [],
         declaredTools: ["weather_lookup"],
       },
     ],
@@ -56,7 +62,7 @@ describe("Package iframe server admission", () => {
       bundlerVersion: "frockbot-inline-html@1",
     };
     const manifest: FrockBotManifest = {
-      schemaVersion: 3,
+      schemaVersion: 5,
       id: "weather-page",
       displayName: "Weather page",
       version: "0.0.1",
@@ -66,8 +72,13 @@ describe("Package iframe server admission", () => {
         runtime: { entry: "./package.js", host: "bot-isolate" },
         client: {
           kind: "iframe",
-          artifact: uiArtifact,
-          mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          pages: [
+            {
+              id: "main",
+              artifact: uiArtifact,
+              mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+            },
+          ],
         },
       },
       tools: [
@@ -122,8 +133,14 @@ describe("Package iframe server admission", () => {
         packageId: "weather-page",
         displayName: "Weather page",
         provenance: "User-installed",
-        artifact: uiArtifact,
-        mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+        pages: [
+          {
+            id: "main",
+            artifact: uiArtifact,
+            mounts: [{ slot: "frockbot.tool-result:weather_lookup" }],
+          },
+        ],
+        entries: [],
         declaredTools: ["weather_lookup"],
       },
     ]);

package/src/backend-isolate.ts

@@ -251,6 +251,16 @@ export function isolateModelEventStreamV1(
  * identity. User, Bot, the resolved model binding, and the pinned Composition
  * generation complete the digest. Package id is deliberately absent: two
  * Packages of one Bot receive the same authority projection.
+ *
+ * `runId` is here because `CAPABILITIES` is one of those bindings and it is
+ * scoped to one Turn: the stub carries that Turn's run, session, and turn id,
+ * and the Bot Durable Object refuses a capability call whose scope is not the
+ * Turn it is currently running. The loader hands back the *cached* worker for a
+ * repeated id, env and all, so leaving the Turn out of the digest gave a second
+ * Turn on one Composition generation an isolate holding the first Turn's stub —
+ * every `ctx.memory`, `ctx.workspace`, and `ctx.applets` call in it answered
+ * "the Package is not running in this Bot's active Composition". The digest is
+ * a statement about what is bound; a per-Turn binding belongs in it.
  */
 export async function isolateBindingDigestV1(input: {
   userId: string;
@@ -261,6 +271,8 @@ export async function isolateBindingDigestV1(input: {
   >[];
   model?: IsolateModelBindingV1;
   compositionGenerationId: string;
+  /** The Turn whose `CAPABILITIES` stub this isolate's env carries. */
+  runId?: string;
 }): Promise<string> {
   const connections = [...input.connections]
     .map(({ connectionId, generation }) => ({ connectionId, generation }))
@@ -270,6 +282,7 @@ export async function isolateBindingDigestV1(input: {
       userId: input.userId,
       botId: input.botId,
       compositionGenerationId: input.compositionGenerationId,
+      runId: input.runId ?? null,
       connections,
       model: input.model ?? null,
     }),
@@ -290,17 +303,30 @@ async function sha256Hex(value: string): Promise<string> {
  * Reads a Bot Package artifact from object storage and verifies its content
  * address before a byte of it becomes code. Artifacts are immutable content,
  * not state; the hash is the only thing that makes them safe to mount.
+ *
+ * `bundled` is a second *place* to find the same immutable bytes, not a second
+ * kind of thing. A first-party Package that ships as an artifact-backed member
+ * (ADR 0022 decision 8) is built at build time and travels inside this bundle,
+ * so its bytes are already here and object storage never has to be seeded for
+ * a deploy to be correct. Object storage still wins when it holds the object,
+ * the digest is still verified either way, and nothing is ever *built* here —
+ * which is what "Composition consumes immutable content-addressed artifacts and
+ * never builds them" asks of this seam.
  */
 export function createR2PackageArtifactStore(
   bucket: R2Bucket,
+  bundled?: ReadonlyMap<string, string>,
 ): BotIsolateArtifactStore {
   return {
     async loadPackageArtifact(contentHash: string): Promise<string> {
-      const object = await bucket.get(`packages/${contentHash}.mjs`);
-      if (!object) {
-        throw new Error(`package artifact "${contentHash}" is missing`);
-      }
-      const module = await object.text();
+      const key = `packages/${contentHash}.mjs`;
+      const object = await bucket.get(key);
+      const module = object
+        ? await object.text()
+        : (bundled?.get(key) ??
+          (() => {
+            throw new Error(`package artifact "${contentHash}" is missing`);
+          })());
       if ((await sha256Hex(module)) !== contentHash) {
         throw new Error(
           `package artifact "${contentHash}" failed hash verification`,

package/src/backend-package-catalog.test.ts

@@ -28,7 +28,7 @@ const UI_SIZE = 42;
 const CREATED_AT = "2026-09-02T00:00:00.000Z";
 
 const manifest = {
-  schemaVersion: 3 as const,
+  schemaVersion: 5 as const,
   id: "parcel-tracking",
   displayName: "Parcel tracking",
   version: "0.0.1",
@@ -38,13 +38,18 @@ const manifest = {
     runtime: { entry: "./package.js", host: "bot-isolate" as const },
     client: {
       kind: "iframe" as const,
-      artifact: {
-        contentHash: UI_CONTENT_HASH,
-        size: UI_SIZE,
-        mediaType: "text/html" as const,
-        bundlerVersion: "frockbot-inline-html@1",
-      },
-      mounts: [{ slot: "frockbot.tool-result:track_parcel" }],
+      pages: [
+        {
+          id: "main",
+          artifact: {
+            contentHash: UI_CONTENT_HASH,
+            size: UI_SIZE,
+            mediaType: "text/html" as const,
+            bundlerVersion: "frockbot-inline-html@1",
+          },
+          mounts: [{ slot: "frockbot.tool-result:track_parcel" }],
+        },
+      ],
     },
   },
   configuration: {

package/src/backend-package-catalog.ts

@@ -259,13 +259,15 @@ export function createPackageCatalogHost(
     }
     const client = entry.bundle.manifest.contributions.client;
     if (client && isClientIframeContribution(client)) {
-      const uiArtifact = await options.catalog.headUiArtifact(
-        client.artifact.contentHash,
-      );
-      if (!uiArtifact || uiArtifact.size !== client.artifact.size) {
-        throw new Error(
-          `Catalog iframe artifact "${client.artifact.contentHash}" is absent or has the wrong size`,
+      for (const page of client.pages) {
+        const uiArtifact = await options.catalog.headUiArtifact(
+          page.artifact.contentHash,
         );
+        if (!uiArtifact || uiArtifact.size !== page.artifact.size) {
+          throw new Error(
+            `Catalog iframe artifact "${page.artifact.contentHash}" is absent or has the wrong size`,
+          );
+        }
       }
     }
   }

package/src/backend-recovery-integration.test.ts

@@ -8,6 +8,7 @@ import {
   initializeBotSettingsV1,
   type UserSettingsViewV1,
 } from "@frockbot/configuration-core";
+import { compileFoundationApplication } from "@frockbot/application-foundation/runtime";
 import { createShellBotBackendContribution } from "./backend.js";
 import {
   botTurnCommandFingerprintV1,
@@ -85,6 +86,27 @@ class MemoryStorage {
   }
 }
 
+/*
+ * The application as a host with no Worker Loader can mount it.
+ *
+ * This suite runs under `bun test`, where there is no `BOT_PACKAGES` binding
+ * and no `BotCapabilities` loopback, so an artifact-backed member — the
+ * Applets Package, ADR 0022 decision 8 — has nowhere to load from and the
+ * Composition fails verification closed, which is correct and is not what
+ * these tests are about. Dropping those members is the honest way to say
+ * "this host cannot run isolate code"; it is not a switch over any Package's
+ * identity, and workerd's suites mount the real thing.
+ */
+async function compileWithoutIsolateMembers(): ReturnType<
+  typeof compileFoundationApplication
+> {
+  const application = await compileFoundationApplication();
+  return {
+    ...application,
+    packages: application.packages.filter((pkg) => pkg.artifact === undefined),
+  };
+}
+
 describe("Bot recovery", () => {
   test("executes and reconstructs an Ollama-bound Bot without Foundation fallback", async () => {
     const storage = new MemoryStorage();
@@ -216,6 +238,7 @@ describe("Bot recovery", () => {
           typeof createShellBotBackendContribution
         >[0]["env"],
         outboundFetch,
+        compileApplication: compileWithoutIsolateMembers,
       });
 
     const configured = host();

package/src/backend-recovery.ts

@@ -22,24 +22,32 @@ export {
   type ModelRequestJournalState,
 } from "@frockbot/kernel-do";
 
-/** How a stopped run's unresolved effects settle. */
-export type StoppedRunRecoveryPlan =
+/** How an interrupted run's unresolved effects settle. */
+export type InterruptedRunRecoveryPlanV1 =
   { kind: "cancel"; events: SessionEvent[] } | { kind: "reconcile" };
 
 /**
- * Classifies the unresolved effects of a stopped run from their durable
- * admission records. With no compatibility data, a missing admission is the
- * same definitive no-start outcome as `fenced`; only explicit `admitted`
- * remains uncertain.
+ * Classifies the unresolved effects of a run that has been fenced — by a
+ * durable Stop, or by a later user message that superseded it — from their
+ * durable admission records. With no compatibility data, a missing admission
+ * is the same definitive no-start outcome as `fenced`; only explicit
+ * `admitted` remains uncertain.
+ *
+ * The two intents share this function because they share the whole question:
+ * an effect that may already have run is never assumed not to have, whichever
+ * intent stopped the Turn.
  */
-export function planStoppedRunRecovery(
+export function planInterruptedRunRecoveryV1(
   run: StoredRun,
   latest: readonly SessionEvent[],
-): StoppedRunRecoveryPlan {
+): InterruptedRunRecoveryPlanV1 {
   requireStoredRunV1(run);
-  if (!run.stopRequestedAt) {
-    throw new Error(`run "${run.runId}" has no durable stop intent`);
+  if (!run.stopRequestedAt && !run.supersededAt) {
+    throw new Error(
+      `run "${run.runId}" has no durable stop or supersede intent`,
+    );
   }
+  const fenceReason = run.stopRequestedAt ? "Durable Stop" : "A supersede";
   const admissionFor = (kind: "model" | "tool", effectId: string) => {
     const admission = run.effectAdmissions.find(
       (candidate) => candidate.effectId === effectId,
@@ -75,7 +83,7 @@ export function planStoppedRunRecovery(
       turn: model.request.turn,
       step: model.request.step,
       requestId: model.request.request.requestId,
-      reason: "Durable Stop fenced provider execution before admission",
+      reason: `${fenceReason} fenced provider execution before admission`,
     });
   }
   for (const entry of openTools) {
@@ -86,7 +94,7 @@ export function planStoppedRunRecovery(
       step: intent.step,
       occurrenceId: intent.occurrenceId,
       name: intent.name,
-      content: "Durable Stop fenced tool execution before admission.",
+      content: `${fenceReason} fenced tool execution before admission.`,
       isError: true,
       status: "interrupted",
     });

package/src/backend-runner-iframe.test.ts

@@ -12,8 +12,14 @@ describe("Package iframe direct tool Turn", () => {
     await root.plugin(ToolRegistry);
     const session = root.sessions.create("user:bot");
     let calls = 0;
+    root.tools.registerNamespace({
+      name: "weather-page",
+      external: true,
+      status: "ready",
+    });
     root.tools.register({
       name: "weather_lookup",
+      namespace: "weather-page",
       description: "Weather",
       inputSchema: {},
       idempotent: true,
@@ -69,6 +75,9 @@ describe("Package iframe direct tool Turn", () => {
     );
     expect(
       result.events.find((event) => event.type === "tool/result"),
-    ).toMatchObject({ name: "weather_lookup", content: '{"temperature":21}' });
+    ).toMatchObject({
+      name: "call_dynamic_tool",
+      content: '{"temperature":21}',
+    });
   });
 });

package/src/backend-runner.ts

@@ -177,8 +177,15 @@ export async function executeDirectToolTurn(
   const session = composition.runtime.agent.agent.session;
   const call = {
     id: command.runId,
-    name: command.directTool.name,
-    input: command.directTool.input,
+    name: "call_dynamic_tool",
+    input: {
+      namespace: command.directTool.packageId,
+      toolName: command.directTool.name,
+      arguments: command.directTool.input,
+      mcpDetails: {
+        description: `The User invoked ${command.directTool.name} from the Package UI.`,
+      },
+    },
   };
   try {
     let turnStart = [...session.events].findLast(

package/src/backend-stop.test.ts

@@ -12,7 +12,7 @@ import {
   botTurnCommandFingerprintV1,
   type StoredRun,
 } from "./backend-contracts.js";
-import { planStoppedRunRecovery } from "./backend-recovery.js";
+import { planInterruptedRunRecoveryV1 } from "./backend-recovery.js";
 
 class MemoryStorage {
   readonly values = new Map<string, unknown>();
@@ -298,7 +298,7 @@ describe("stopped run recovery", () => {
       ],
     });
 
-    const plan = planStoppedRunRecovery(run, run.events);
+    const plan = planInterruptedRunRecoveryV1(run, run.events);
 
     expect(plan.kind).toBe("cancel");
     if (plan.kind !== "cancel") throw new Error("expected cancellation");
@@ -323,7 +323,7 @@ describe("stopped run recovery", () => {
       ],
     });
 
-    const plan = planStoppedRunRecovery(run, run.events);
+    const plan = planInterruptedRunRecoveryV1(run, run.events);
 
     expect(plan.kind).toBe("cancel");
     if (plan.kind !== "cancel") throw new Error("expected cancellation");
@@ -341,7 +341,7 @@ describe("stopped run recovery", () => {
       ],
     });
 
-    expect(planStoppedRunRecovery(run, run.events)).toEqual({
+    expect(planInterruptedRunRecoveryV1(run, run.events)).toEqual({
       kind: "reconcile",
     });
   });
@@ -349,8 +349,8 @@ describe("stopped run recovery", () => {
   test("refuses to plan recovery for a run carrying no durable Stop intent", () => {
     const run = storedRun({ events: modelIntentEvents() });
 
-    expect(() => planStoppedRunRecovery(run, run.events)).toThrow(
-      `run "${turn.runId}" has no durable stop intent`,
+    expect(() => planInterruptedRunRecoveryV1(run, run.events)).toThrow(
+      `run "${turn.runId}" has no durable stop or supersede intent`,
     );
   });
 });