@fungi.computer/oyster 0.3.1 → 0.3.2

package/README.md

@@ -124,7 +124,8 @@ npx wrangler deploy --var OYSTER_ORIGIN:$OYSTER_URL
 ```
 
 Set `OYSTER_ORIGIN` in `wrangler.jsonc` instead if you deploy again later; every
-deploy replaces the Worker's variables.
+deploy replaces the Worker's variables. If you rename the Worker's `name` in
+`wrangler.jsonc`, update `OYSTER_ORIGIN` to that Worker's URL at the same time.
 
 ### API-token permissions and teardown
 

package/dist/boot-capability.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type BootUi, type UiBootCheckOutcome } from "./boot-gate.js";
 import type { BootPageResult, BootPageTarget } from "./browser/boot.js";
-export declare const BOOT_CAPABILITY_HEADER = "x-oyster-boot-capability";
+export declare const BOOT_CAPABILITY_HEADER = "x-oyster-boot-token";
 declare const bootCapabilityAssetSchema: z.ZodObject<{
     path: z.ZodString;
     contentType: z.ZodString;

package/dist/boot-capability.js

@@ -4,7 +4,7 @@ import { z } from "zod";
 import { parseArtifactRef, parseReleaseId, parseSha256Digest, } from "@fungi.computer/puffball";
 import { BOOT_DEADLINE_MS, BOOT_TRANSPORT_GRACE_MS, BootGateError, bootMountDiagnosticsSchema, } from "./boot-gate.js";
 import { defaultAssetPolicy } from "./release.js";
-export const BOOT_CAPABILITY_HEADER = "x-oyster-boot-capability";
+export const BOOT_CAPABILITY_HEADER = "x-oyster-boot-token";
 const bootCapabilityAssetSchema = z.strictObject({
     path: z.string().min(1).max(4096),
     contentType: z.string().min(1).max(256),

package/dist/mcp.d.ts

@@ -3,8 +3,15 @@ import type { DeclaredOperations, Installation } from "./apps/installation.js";
 import { type CapabilitySource, type Grants, type ModuleRegistration } from "@fungi.computer/mycelium";
 import { appToolSchemas } from "@fungi.computer/forage";
 import type { OysterHost, OysterPrincipal } from "./host.js";
-import type { McpPrincipal, McpCatalogSnapshot } from "@fungi.computer/mycelium/mcp";
+import type { TenantPrincipal } from "./tenant.js";
 import { type VerifiedRelease } from "./release.js";
+/** Captured capabilities and grants offered to one admitted MCP caller. */
+export type OysterMcpCatalogSnapshot = Readonly<{
+    instructions: string;
+    sources: readonly CapabilitySource[];
+    /** An omitted module has no grant. */
+    grants: Grants;
+}>;
 /** An installation ID as a guest binding name: `spawn-git` becomes `SPAWN_GIT`. */
 export declare function appBindingName(installationId: string): string;
 /** Why an App method call from the MCP catalog was refused. */
@@ -98,4 +105,4 @@ export declare function oysterComputerTools(host: Pick<OysterHost, "computerId"
  * still re-admits the key, rechecks that same stored approval, and passes
  * the App's gate.
  */
-export declare function oysterMcpCatalogLoad(host: Pick<OysterHost, "installations" | "instances" | "artifacts" | "guestLimits" | "backgroundOriginKey" | "computerId" | "computer" | "capabilities" | "appToolPolicy" | "keys" | "workflows">): (principal: McpPrincipal) => Promise<McpCatalogSnapshot>;
+export declare function oysterMcpCatalogLoad(host: Pick<OysterHost, "installations" | "instances" | "artifacts" | "guestLimits" | "backgroundOriginKey" | "computerId" | "computer" | "capabilities" | "appToolPolicy" | "keys" | "workflows">): (principal: TenantPrincipal) => Promise<OysterMcpCatalogSnapshot>;

package/dist/mcp.js

@@ -388,6 +388,7 @@ export async function oysterComputerTools(host, principal) {
             id,
             name: "workspace",
             namespace: ["computers"],
+            confirmCalls: true,
             computer,
         }),
         grants: { [id]: "write" },

package/dist/standalone/agents.d.ts

@@ -2,11 +2,16 @@ import { type StandaloneTenancyEnv } from "./tenancy.js";
 import type { PostEnvelope } from "@fungi.computer/carrier/post";
 import { type StandaloneMachineLinkBindings, type StandaloneMachineJoinResult } from "./machine-link.js";
 import { type MachineAgentSettlementPrincipal, type MachineAgentHome, type MachineEnrollment, type MachineLinkCaller, type MachineLinkIdentity } from "../machine-link/index.js";
+/** Workers AI binding surface used by the standalone provider adapter. */
+export type AiBinding = {
+    aiGatewayLogId: string | null;
+    /** AI binding transport supplied by the Worker runtime. */
+    fetch?: (input: Request | string | URL, init?: RequestInit) => Promise<Response>;
+};
 import { DurableObject } from "cloudflare:workers";
 import type { StandaloneComputerEnv } from "./computer.js";
 import { ShiitakeDO } from "@fungi.computer/shiitake/cloudflare";
 import type { CloudflareShiitakeOptions } from "@fungi.computer/shiitake/cloudflare";
-import { type AiBinding } from "@earendil-works/pi-ai/api/cloudflare-ai-binding";
 import * as Schema from "effect/Schema";
 import { type FrameBindingProps } from "../cloudflare.js";
 import type { Avatar } from "@fungi.computer/sprite/avatar";

package/dist/standalone/agents.js

@@ -1,3 +1,4 @@
+import { normalizeModel, streamModel } from "@fungi.computer/mule/effect";
 import { observeProviderStatus } from "@fungi.computer/mule/effect";
 import { standaloneTenancy, } from "./tenancy.js";
 import { AcceptedSchema } from "@fungi.computer/shiitake/client";
@@ -41,18 +42,18 @@ const defaultAgentModel = "@cf/moonshotai/kimi-k2.6";
 /** Own transport evidence and exact-message decisions for one model lease. */
 function observedModels(model, defaults) {
     return {
-        acquire: async ({ signal }) => {
-            const streamSimple = await loadStreamSimple();
+        acquire: ({ signal }) => {
+            const streamSimple = streamModel;
             const retryableMessages = new WeakSet();
-            return {
+            return Promise.resolve({
                 model,
                 retryable: (message) => !signal.aborted &&
                     message.stopReason === "error" &&
                     retryableMessages.has(message),
-                stream: (selected, context, options) => {
+                stream: async (selected, context, options) => {
                     const upstream = { ...options, ...defaults };
                     const observed = observeProviderStatus(upstream);
-                    const response = streamSimple(selected, context, {
+                    const response = await streamSimple(selected, context, {
                         ...upstream,
                         fetch: observed.fetch,
                         onProviderStreamEvent: observed.onProviderStreamEvent,
@@ -69,7 +70,7 @@ function observedModels(model, defaults) {
                     return response;
                 },
                 release: () => Promise.resolve(),
-            };
+            });
         },
     };
 }
@@ -89,7 +90,7 @@ function workersAiModels(ai, options = {}) {
         baseUrl: `https://workers-binding.ai/ai-gateway/gateways/${options.gateway ?? "default"}/workers-ai/v1`,
     };
     const fetch = createAiBindingFetch(ai);
-    return observedModels(model, {
+    return observedModels(normalizeModel(model), {
         fetch,
         apiKey: CLOUDFLARE_GATEWAY_BINDING_AUTH_SENTINEL,
         headers: {
@@ -100,11 +101,6 @@ function workersAiModels(ai, options = {}) {
         },
     });
 }
-/**
- * Pi's dispatching `streamSimple` evaluates every provider's model catalog when
- * it loads; only a run needs it, so acquisition loads it instead of startup.
- */
-const loadStreamSimple = async () => (await import("@earendil-works/pi-ai/compat")).streamSimple;
 const policyDirectorySchema = Schema.Struct({
     directoryName: Schema.NonEmptyString,
     tenantId: tenantIdSchema,
@@ -354,7 +350,7 @@ export class StandaloneAgentBase extends ShiitakeDO {
                     if (listed === undefined)
                         throw new Error("The OpenAI catalog has no Luna model");
                     const model = { ...listed, id: "openai/gpt-6-luna", baseUrl };
-                    return observedModels(model, {
+                    return observedModels(normalizeModel(model), {
                         apiKey: "oyster-provider-egress",
                         fetch: providerFetch(egress, "ai-gateway"),
                     }).acquire(input);

package/dist/standalone/app-builds-binding.js

@@ -203,7 +203,7 @@ export async function dispatchAppsBuildsBinding(env, scope, frame, props, method
         const registry = buildRegistry(env, scope);
         const build = "repo" in input
             ? await registry.readRepositoryBuild(frame.facts.selection.owner.id, input.repo)
-            : await registry.readBuild(input.jobId);
+            : await registry.readInstallationBuild(frame.facts.selection.owner.id, input.jobId);
         frame.signal.throwIfAborted();
         const missingJob = build === null && "jobId" in input;
         return Schema.decodeUnknownSync(Schema.Json)({

package/dist/standalone/registry.d.ts

@@ -37,6 +37,7 @@ export type StandaloneRegistryRpc = {
     registerRepositoryApp(input: Parameters<StandaloneRegistry["registerRepositoryApp"]>[0]): ReturnType<StandaloneRegistry["registerRepositoryApp"]>;
     repositoryBuildSource(installationId: string, repository: string): ReturnType<StandaloneRegistry["repositoryBuildSource"]>;
     readRepositoryBuild(installationId: string, repository: string): ReturnType<StandaloneRegistry["readRepositoryBuild"]>;
+    readInstallationBuild(installationId: string, jobId: string): ReturnType<StandaloneRegistry["readInstallationBuild"]>;
     installWorkflowBuild(jobId: string, target: string, release: Release, memberId: string, callerInstallationId: string): ReturnType<StandaloneRegistry["installWorkflowBuild"]>;
 };
 export declare abstract class StandaloneRegistry extends OysterRegistry implements StandaloneRegistryRpc {
@@ -169,6 +170,8 @@ export declare abstract class StandaloneRegistry extends OysterRegistry implemen
         appId: import("@fungi.computer/puffball").AppId;
     } | null>;
     readBuild(jobId: string): Promise<OysterBuildView | null>;
+    /** A job ID alone never grants another installation access to its status. */
+    readInstallationBuild(installationId: string, jobId: string): Promise<OysterBuildView | null>;
     /** Repository status belongs to the same captured Git owner as registration. */
     readRepositoryBuild(installationId: string, repository: string): Promise<Readonly<{
         jobId: string;

package/dist/standalone/registry.js

@@ -363,6 +363,15 @@ export class StandaloneRegistry extends OysterRegistry {
     async readBuild(jobId) {
         return (await this.#appBuilds()).read(jobId);
     }
+    /** A job ID alone never grants another installation access to its status. */
+    async readInstallationBuild(installationId, jobId) {
+        const builds = await this.#appBuilds();
+        const build = builds.read(jobId);
+        return build !== null &&
+            sourceOwnedBy(builds.readSource(build.appId), installationId)
+            ? build
+            : null;
+    }
     /** Repository status belongs to the same captured Git owner as registration. */
     async readRepositoryBuild(installationId, repository) {
         const latest = (await this.#appBuilds()).latestRepositoryBuild(installationId, repository);

package/dist/standalone/tenancy.d.ts

@@ -7,12 +7,23 @@ export type StandaloneSeed = Readonly<{
     origin: string;
     owner: Identity;
 }>;
+export type StandaloneSeedRefusal = Readonly<{
+    kind: "refused";
+    code: "seed_configuration_changed";
+    seededOrigin: string;
+    configuredOrigin: string;
+    recovery: "fresh_worker_name_or_reset_worker_data";
+}>;
+export declare class StandaloneSeedConfigurationChanged extends Error {
+    readonly refusal: StandaloneSeedRefusal;
+    constructor(refusal: StandaloneSeedRefusal);
+}
 /** A fresh registry namespace with one host-provisioned standalone tenant. */
 export declare class StandaloneTenants extends TenancyRegistryDO {
     #private;
     constructor(state: DurableObjectState);
     /** Reuse only the exact configured tenant and its current canonical owner. */
-    seed(input: StandaloneSeed): Promise<Tenant>;
+    seed(input: StandaloneSeed): Promise<Tenant | StandaloneSeedRefusal>;
 }
 /** The same trusted bindings are used by HTTP, MCP and cold root readers. */
 export type StandaloneTenancyEnv = Pick<OysterGitWorkerEnv, "OYSTER_ORIGIN" | "OYSTER_OWNER_NAME" | "OYSTER_OWNER_KEY" | "KEYS"> & Readonly<{
@@ -38,5 +49,7 @@ export type StandaloneTenancy = Readonly<{
     oyster: OysterTenancy;
     owner(): Promise<StandaloneOwner | null>;
 }>;
+/** A request may seed the standalone tenant only at its configured origin. */
+export declare function standaloneTenancyForRequest(env: StandaloneTenancyEnv, request: Request): Promise<StandaloneTenancy>;
 /** Seed once per environment, then admit every entry from one fresh registry read. */
 export declare function standaloneTenancy(env: StandaloneTenancyEnv): Promise<StandaloneTenancy>;

package/dist/standalone/tenancy.js

@@ -3,6 +3,7 @@ import { createTenancy, } from "../tenancy/index.js";
 import { ownerKey } from "../tenancy/owner-key.js";
 import { hosts } from "../tenancy/resolve.js";
 import { ownerOrKeyAuth } from "../auth.js";
+import { HTTPException } from "hono/http-exception";
 import { defaultTenant, tenantScope, } from "../tenant.js";
 import * as Schema from "effect/Schema";
 const seedSchema = Schema.Struct({
@@ -13,6 +14,14 @@ const seedSchema = Schema.Struct({
     }),
 });
 const seedKey = "standalone-owner-seed";
+export class StandaloneSeedConfigurationChanged extends Error {
+    refusal;
+    constructor(refusal) {
+        super("Standalone seed configuration changed");
+        this.name = "StandaloneSeedConfigurationChanged";
+        this.refusal = refusal;
+    }
+}
 /** A fresh registry namespace with one host-provisioned standalone tenant. */
 export class StandaloneTenants extends TenancyRegistryDO {
     #state;
@@ -31,8 +40,15 @@ export class StandaloneTenants extends TenancyRegistryDO {
                 const marker = Schema.decodeUnknownSync(seedSchema)(raw);
                 if (marker.origin !== scope.origin ||
                     marker.owner.provider !== input.owner.provider ||
-                    marker.owner.subject !== input.owner.subject)
-                    throw new Error("Standalone seed configuration changed");
+                    marker.owner.subject !== input.owner.subject) {
+                    return {
+                        kind: "refused",
+                        code: "seed_configuration_changed",
+                        seededOrigin: marker.origin,
+                        configuredOrigin: scope.origin,
+                        recovery: "fresh_worker_name_or_reset_worker_data",
+                    };
+                }
             }
             let tenant = await this.get(defaultTenant);
             if (tenant === null) {
@@ -69,6 +85,22 @@ export class StandaloneTenants extends TenancyRegistryDO {
         });
     }
 }
+/** A request may seed the standalone tenant only at its configured origin. */
+export async function standaloneTenancyForRequest(env, request) {
+    const configuredOrigin = tenantScope(defaultTenant, env.OYSTER_ORIGIN).origin;
+    const requestOrigin = new URL(request.url).origin;
+    if (requestOrigin !== configuredOrigin)
+        throw new HTTPException(404, {
+            res: Response.json({
+                kind: "refused",
+                code: "origin_mismatch",
+                configuredOrigin,
+                requestOrigin,
+                message: `Request origin ${requestOrigin} does not match configured OYSTER_ORIGIN ${configuredOrigin}. Set OYSTER_ORIGIN to this Worker's URL.`,
+            }, { status: 404 }),
+        });
+    return standaloneTenancy(env);
+}
 const environments = new WeakMap();
 /** Seed once per environment, then admit every entry from one fresh registry read. */
 export function standaloneTenancy(env) {
@@ -90,10 +122,12 @@ async function composeTenancy(env) {
         provider: "standalone-owner",
         subject: env.OYSTER_OWNER_NAME ?? "owner",
     };
-    await env.TENANTS.getByName("registry").seed({
+    const seeded = await env.TENANTS.getByName("registry").seed({
         origin: scope.origin,
         owner: identity,
     });
+    if ("kind" in seeded)
+        throw new StandaloneSeedConfigurationChanged(seeded);
     const registry = durableObjectRegistry(env.TENANTS, { readonly: true });
     /** The canonical owner, only while the one admitted record still proves it. */
     const ownerOf = ({ tenant, membership, }) => tenant.id !== defaultTenant ||

package/dist/standalone/worker.js

@@ -17,7 +17,7 @@ import { StandaloneInstance as ComputerInstance } from "./instance.js";
 // Every guest binding in every frame is this one entrypoint, routed by props.
 export { OysterBinding } from "./instance.js";
 import { StandaloneWorkflowRunsBase, } from "./workflows.js";
-import { standaloneTenancy } from "./tenancy.js";
+import { standaloneTenancyForRequest, StandaloneSeedConfigurationChanged, } from "./tenancy.js";
 export { StandaloneTenants } from "./tenancy.js";
 import { standalonePreviewRequest } from "./preview.js";
 import { standaloneMachineLinkRoutes, } from "./machine-link.js";
@@ -25,6 +25,7 @@ export { MachineLinkDO } from "./machine-link.js";
 import { standaloneWorkflowControl } from "./workflow-control.js";
 import { standaloneWorkflowWebhookRoutes, standaloneWorkflowWebhookControls, } from "./workflow-webhooks.js";
 import { Hono } from "hono";
+import { HTTPException } from "hono/http-exception";
 import { standaloneBuildRoutes } from "./builds.js";
 import { standaloneComputerFleetRoutes, standaloneComputerSelection, } from "./computer-fleet.js";
 import { serveOysterComputerEgress, } from "./computer-egress.js";
@@ -59,7 +60,7 @@ export { AgentDirectory } from "./agents.js";
 const standaloneRoot = (selectComputer) => {
     const root = oysterGitRoot({
         tenancy: (env) => ({
-            resolve: async (request) => (await standaloneTenancy(env)).oyster.resolve(request),
+            resolve: async (request) => (await standaloneTenancyForRequest(env, request)).oyster.resolve(request),
         }),
         homeInstallationId: (env) => env.OYSTER_HOME_INSTALLATION,
         agents: standaloneAgents,
@@ -153,14 +154,21 @@ export class OysterComputerEgress extends WorkerEntrypoint {
         });
     }
 }
+const standaloneWorkerErrorHandler = (error, context) => {
+    if (error instanceof StandaloneSeedConfigurationChanged) {
+        const { refusal } = error;
+        return context.json({
+            ...refusal,
+            message: `Standalone seed/origin mismatch: existing data was seeded for ${refusal.seededOrigin}, but OYSTER_ORIGIN is ${refusal.configuredOrigin}. Deploy under a fresh Worker name or reset this Worker's data.`,
+        }, 409);
+    }
+    if (error instanceof HTTPException)
+        return error.getResponse();
+    console.error(error);
+    return context.text("Internal Server Error", 500);
+};
 export default {
     async fetch(request, env, context) {
-        const path = new URL(request.url).pathname;
-        if (path === "/local/mesh/join" ||
-            new URLPattern({
-                pathname: "/api/teams/:teamId/local/mesh/:deviceId/connect",
-            }).test(request.url))
-            return standaloneMachineLinkRoutes(env).fetch(request);
         const preview = await standalonePreviewRequest(request, env, (computerId) => computerRegistry(env).ownsComputer(computerId), (computerId, signature, port, service) => env.COMPUTER.getByName(computerId).portPreview(signature, port, service));
         if (preview !== null)
             return preview;
@@ -171,6 +179,13 @@ export default {
         if (fetchOyster === undefined)
             throw new Error("Oyster fetch handler is missing");
         return new Hono()
+            .onError(standaloneWorkerErrorHandler)
+            .all("/local/mesh/join", () => standaloneMachineLinkRoutes(env)
+            .onError(standaloneWorkerErrorHandler)
+            .fetch(request, env, context))
+            .all("/api/teams/:teamId/local/mesh/:deviceId/connect", () => standaloneMachineLinkRoutes(env)
+            .onError(standaloneWorkerErrorHandler)
+            .fetch(request, env, context))
             .route("/", standaloneWorkflowWebhookRoutes(env, async (incoming) => {
             const admitted = await oysterRoot.admit(env, incoming);
             return admitted === null
@@ -178,6 +193,6 @@ export default {
                 : oysterRoot.hostFor(env, admitted.scope);
         }))
             .all("*", () => fetchOyster(request, env, context))
-            .fetch(request);
+            .fetch(request, env, context);
     },
 };

package/dist/workers-git.js

@@ -889,7 +889,15 @@ export function createOysterGitWorker(root) {
                 hosts = new Map();
                 environments.set(env, hosts);
             }
-            const resolved = await root.admit(env, request);
+            let resolved;
+            try {
+                resolved = await root.admit(env, request);
+            }
+            catch (error) {
+                if (error instanceof HTTPException)
+                    return error.getResponse();
+                throw error;
+            }
             if (resolved === null)
                 return new Response("Not found", { status: 404 });
             const { scope } = resolved;

package/docs/api/mcp.md

@@ -67,6 +67,20 @@ readonly code: string;
 
 ## Type Aliases
 
+### OysterMcpCatalogSnapshot
+
+```ts
+type OysterMcpCatalogSnapshot = Readonly<{
+  instructions: string;
+  sources: readonly CapabilitySource[];
+  grants: Grants;
+}>;
+```
+
+Captured capabilities and grants offered to one admitted MCP caller.
+
+---
+
 ### OysterCallerAccess
 
 ```ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/oyster",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "author": "Levi <levi@technomancy.dev>",
   "description": "Run your own Apps on Cloudflare Workers or celld: installable App Releases, each with its own Durable Object, SQLite database and declared bindings",
   "type": "module",
@@ -246,33 +246,33 @@
     "@earendil-works/pi-ai": "1.3.0",
     "@fungi.computer/agar": "0.3.0",
     "@fungi.computer/bird-dog": "0.1.0",
-    "@fungi.computer/braid": "0.2.0",
+    "@fungi.computer/braid": "0.2.1",
     "@fungi.computer/burrow": "0.1.0",
     "@fungi.computer/cairn": "0.1.0",
     "@fungi.computer/capnweb": "0.12.0",
     "@fungi.computer/caps": "0.2.0",
     "@fungi.computer/carrier": "0.1.0",
-    "@fungi.computer/computer": "0.2.1",
-    "@fungi.computer/computer-contract": "0.0.1",
+    "@fungi.computer/computer": "0.2.2",
+    "@fungi.computer/computer-contract": "0.0.2",
     "@fungi.computer/darkroom": "0.2.0",
     "@fungi.computer/ear-tag": "0.1.0",
     "@fungi.computer/forage": "0.2.0",
     "@fungi.computer/gills": "0.2.0",
-    "@fungi.computer/knapsack": "0.2.0",
-    "@fungi.computer/mycelium": "0.2.0",
+    "@fungi.computer/knapsack": "0.2.1",
+    "@fungi.computer/mycelium": "0.2.1",
     "@fungi.computer/nacre": "0.0.1",
     "@fungi.computer/puffball": "0.2.0",
     "@fungi.computer/seam": "0.1.0",
-    "@fungi.computer/shiitake": "0.3.0",
-    "@fungi.computer/shiitake-extensions": "0.1.0",
+    "@fungi.computer/shiitake": "0.3.1",
+    "@fungi.computer/shiitake-extensions": "0.1.1",
     "@fungi.computer/sigils": "0.2.0",
     "@fungi.computer/sprite": "0.2.0",
     "@fungi.computer/sprite-zdog": "0.2.0",
     "@fungi.computer/veil": "0.2.0",
     "@fungi.computer/watchdog": "0.1.0",
     "@fungi.computer/whistle": "0.1.0",
-    "@fungi.computer/workflows-wire": "0.2.0",
-    "@fungi.computer/zookeeper": "0.0.1",
+    "@fungi.computer/workflows-wire": "0.2.1",
+    "@fungi.computer/zookeeper": "0.0.2",
     "@modelcontextprotocol/server": "2.0.0",
     "@pnpm/lockfile.fs": "1100.2.13",
     "@pnpm/lockfile.pruner": "1100.0.27",