@iowarp/clio-coder 0.4.5 → 0.4.7

package/src/domains/extensions/runtime-process.ts

@@ -0,0 +1,306 @@
+import { type ChildProcess, fork } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { cpSync, mkdtempSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { parse as parseYaml } from "yaml";
+import { resolvePackageRoot } from "../../core/package-root.js";
+import { buildSafeToolEnv } from "../../core/safe-exec.js";
+import { resolveExtensionEntrypoint } from "./command-schema.js";
+import { parseExtensionManifest } from "./discovery.js";
+import { extensionContentDigestWithCapture } from "./integrity.js";
+import type { ExtensionObservation, ExtensionOutput, ExtensionRuntimeSnapshot } from "./public-api.js";
+import { extensionPlainText, parseExtensionOutput, RUNTIME_LIMITS } from "./runtime-schema.js";
+import type { ExtensionRuntimeDeclaration, LoadableExtension } from "./types.js";
+
+export type RuntimeProcessState = "staging" | "starting" | "ready" | "failed" | "disposed";
+interface Pending {
+	id: string;
+	resolve(output: ExtensionOutput): void;
+	reject(error: Error): void;
+	cleanup(): void;
+}
+/** One process and private package copy; no live host objects cross this boundary. */
+export class ExtensionRuntimeProcess {
+	readonly instance = randomUUID();
+	readonly declaration: ExtensionRuntimeDeclaration;
+	readonly copyRoot: string;
+	readonly startedAt = performance.now();
+	state: RuntimeProcessState = "staging";
+	failure: string | undefined;
+	readyMs = 0;
+	rss = 0;
+	private child: ChildProcess;
+	private pending: Pending | undefined;
+	private stageResolve!: () => void;
+	private stageReject!: (error: Error) => void;
+	private activeResolve: (() => void) | undefined;
+	private activeReject: ((error: Error) => void) | undefined;
+	private startupTimer: ReturnType<typeof setTimeout>;
+	private stopPromise: Promise<void> | undefined;
+	private exited: Promise<void>;
+	private diagnosticBytes = 0;
+	private messageWindow = Date.now();
+	private messages = 0;
+	private onState: () => void;
+	readonly staged: Promise<void>;
+
+	constructor(
+		readonly extension: LoadableExtension,
+		readonly snapshot: ExtensionRuntimeSnapshot,
+		onState: () => void = () => {},
+	) {
+		if (!extension.runtime) throw new Error("extension has no operator runtime");
+		this.declaration = extension.runtime;
+		this.onState = onState;
+		const temporary = mkdtempSync(path.join(os.tmpdir(), "clio-coder-extension-"));
+		this.copyRoot = temporary;
+		const copy = path.join(temporary, "package");
+		try {
+			cpSync(extension.provenance.canonicalRoot, copy, { recursive: true, dereference: false, verbatimSymlinks: true });
+			const manifestName = path.basename(extension.manifestPath);
+			const verified = extensionContentDigestWithCapture(copy, { capture: [manifestName] });
+			if (verified.digest !== extension.provenance.contentDigest)
+				throw new Error("runtime copy does not match installed package digest");
+			const manifestBytes = verified.captured.get(manifestName);
+			if (!manifestBytes) throw new Error("verified runtime manifest bytes are absent");
+			const parsed = parseExtensionManifest(
+				manifestName.endsWith(".json")
+					? JSON.parse(manifestBytes.toString("utf8"))
+					: parseYaml(manifestBytes.toString("utf8")),
+				path.join(copy, manifestName),
+			);
+			if (
+				!parsed.manifest ||
+				parsed.diagnostics.some((diagnostic) => diagnostic.type === "error") ||
+				parsed.manifest.id !== extension.id ||
+				JSON.stringify(parsed.manifest.runtime) !== JSON.stringify(this.declaration)
+			)
+				throw new Error("runtime declarations differ from verified manifest bytes");
+			resolveExtensionEntrypoint(copy, this.declaration.entrypoint);
+		} catch (error) {
+			rmSync(temporary, { recursive: true, force: true });
+			throw error;
+		}
+		this.staged = new Promise((resolve, reject) => {
+			this.stageResolve = resolve;
+			this.stageReject = reject;
+		});
+		// The parent never forwards child stdout/stderr to a terminal or protocol stream.
+		this.child = fork(path.join(resolvePackageRoot(), "src/domains/extensions/runtime-child.mjs"), [], {
+			cwd: snapshot.workspace,
+			execArgv: [],
+			env: buildSafeToolEnv(),
+			detached: process.platform !== "win32",
+			stdio: ["ignore", "pipe", "pipe", "ipc"],
+			serialization: "json",
+		});
+		this.exited = new Promise((resolve) => {
+			this.child.once("exit", () => {
+				this.kill("SIGKILL"); // Also settle non-detached descendants after a cooperative parent exits.
+				if (this.state !== "disposed") this.fail("runtime process exited");
+				this.cleanCopy();
+				resolve();
+			});
+			this.child.once("error", (error) => {
+				this.fail(`runtime process error: ${error.message}`);
+				if (!this.child.pid) {
+					this.cleanCopy();
+					resolve();
+				}
+			});
+		});
+		this.startupTimer = setTimeout(() => this.fail("runtime startup timed out"), RUNTIME_LIMITS.startupMs);
+		this.child.on("message", (message) => this.receive(message));
+		const diagnostic = (chunk: Buffer): void => {
+			this.diagnosticBytes += chunk.byteLength;
+			if (this.diagnosticBytes > RUNTIME_LIMITS.diagnosticsBytes) this.fail("runtime diagnostic output exceeded 64 KiB");
+		};
+		this.child.stdout?.on("data", diagnostic);
+		this.child.stderr?.on("data", diagnostic);
+		this.send({
+			kind: "init",
+			entrypoint: path.join(copy, this.declaration.entrypoint),
+			declaration: this.declaration,
+			snapshot,
+		});
+	}
+	get pid(): number | undefined {
+		return this.child.pid;
+	}
+	get busy(): boolean {
+		return this.pending !== undefined;
+	}
+	private cleanCopy(): void {
+		try {
+			rmSync(this.copyRoot, { recursive: true, force: true });
+		} catch (error) {
+			this.failure = `runtime private-copy cleanup failed: ${extensionPlainText(String(error)).slice(0, 400)}`;
+			this.notifyState();
+		}
+	}
+	private notifyState(): void {
+		try {
+			this.onState();
+		} catch {
+			/* Observability cannot break process settlement. */
+		}
+	}
+	private send(value: Record<string, unknown>): void {
+		if (!this.child.connected) return;
+		this.child.send({ protocol: 1, instance: this.instance, ...value }, (error) => {
+			if (error) this.fail(`runtime IPC failed: ${error.message}`);
+		});
+	}
+	private kill(signal: NodeJS.Signals): void {
+		if (this.child.pid && process.platform !== "win32") {
+			try {
+				process.kill(-this.child.pid, signal);
+				return;
+			} catch {
+				/* Direct-child fallback. */
+			}
+		}
+		this.child.kill(signal);
+	}
+	private fail(reason: string): void {
+		if (this.state === "disposed" || this.state === "failed") return;
+		this.failure = extensionPlainText(reason).slice(0, 512);
+		this.state = "failed";
+		clearTimeout(this.startupTimer);
+		const error = new Error(this.failure);
+		this.stageReject(error);
+		this.activeReject?.(error);
+		this.rejectPending(error);
+		this.notifyState();
+		this.kill("SIGKILL");
+	}
+	private rejectPending(error: Error): void {
+		const pending = this.pending;
+		this.pending = undefined;
+		pending?.cleanup();
+		pending?.reject(error);
+	}
+	private receive(value: unknown): void {
+		if (this.state === "disposed" || this.state === "failed") return;
+		try {
+			if (Date.now() - this.messageWindow > 1000) {
+				this.messageWindow = Date.now();
+				this.messages = 0;
+			}
+			if (++this.messages > 128) throw new Error("runtime IPC rate exceeded");
+			if (Buffer.byteLength(JSON.stringify(value)) > RUNTIME_LIMITS.messageBytes)
+				throw new Error("runtime IPC message too large");
+			if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("invalid runtime IPC message");
+			const m = value as Record<string, unknown>;
+			const fields: Record<string, string[]> = {
+				ready: ["commands", "events", "rss"],
+				active: [],
+				result: ["id", "output"],
+				error: ["id", "error"],
+				fatal: ["error"],
+			};
+			if (
+				typeof m.kind !== "string" ||
+				!Object.hasOwn(fields, m.kind) ||
+				Object.keys(m).some((key) => !["protocol", "instance", "kind", ...(fields[m.kind as string] ?? [])].includes(key))
+			)
+				throw new Error("invalid runtime protocol fields");
+			if (m.protocol !== 1 || m.instance !== this.instance) throw new Error("runtime protocol or instance mismatch");
+			if (m.kind === "fatal") throw new Error(typeof m.error === "string" ? m.error : "runtime fatal error");
+			if (m.kind === "ready" && this.state === "staging") {
+				if (
+					JSON.stringify(Array.isArray(m.commands) ? [...m.commands].sort() : null) !==
+						JSON.stringify(this.declaration.commands.map((command) => command.name).sort()) ||
+					JSON.stringify(Array.isArray(m.events) ? [...m.events].sort() : null) !==
+						JSON.stringify([...this.declaration.events].sort())
+				)
+					throw new Error("runtime registration inventory mismatch");
+				if (typeof m.rss !== "number" || !Number.isFinite(m.rss) || m.rss < 0)
+					throw new Error("invalid runtime memory observation");
+				this.rss = m.rss;
+				this.readyMs = performance.now() - this.startedAt;
+				this.state = "starting";
+				clearTimeout(this.startupTimer);
+				this.stageResolve();
+				return;
+			}
+			if (m.kind === "active" && this.state === "starting" && this.activeResolve) {
+				this.state = "ready";
+				clearTimeout(this.startupTimer);
+				this.activeResolve();
+				this.activeResolve = undefined;
+				this.activeReject = undefined;
+				this.notifyState();
+				return;
+			}
+			if (m.kind !== "result" && m.kind !== "error") throw new Error("unexpected runtime IPC message");
+			// Replies without their exact outstanding request have no authority.
+			if (!this.pending || m.id !== this.pending.id || this.state !== "ready") return;
+			if (m.kind === "error") throw new Error(typeof m.error === "string" ? m.error : "runtime handler failed");
+			const output = parseExtensionOutput(m.output, this.declaration);
+			const pending = this.pending;
+			this.pending = undefined;
+			pending.cleanup();
+			pending.resolve(output);
+		} catch (error) {
+			this.fail(error instanceof Error ? error.message : String(error));
+		}
+	}
+	async activate(): Promise<void> {
+		await this.staged;
+		if (this.state !== "starting") throw new Error(this.failure ?? "runtime is not staged");
+		return new Promise((resolve, reject) => {
+			this.activeResolve = resolve;
+			this.activeReject = reject;
+			this.startupTimer = setTimeout(() => this.fail("runtime activation timed out"), RUNTIME_LIMITS.startupMs);
+			this.send({ kind: "activate" });
+		});
+	}
+	request(
+		message: { kind: "command"; name: string; args: string } | { kind: "observe"; observation: ExtensionObservation },
+		timeoutMs: number,
+		signal?: AbortSignal,
+	): Promise<ExtensionOutput> {
+		if (this.state !== "ready" || this.pending)
+			return Promise.reject(new Error(this.failure ?? "runtime not ready or busy"));
+		if (signal?.aborted) return Promise.reject(new Error("extension command cancelled"));
+		return new Promise((resolve, reject) => {
+			const id = randomUUID();
+			const cancel = (): void => {
+				this.send({ kind: "cancel", id });
+				this.rejectPending(new Error("extension command cancelled"));
+				void this.dispose("cancelled");
+			};
+			const timer = setTimeout(() => this.fail("runtime request timed out"), timeoutMs);
+			this.pending = {
+				id,
+				resolve,
+				reject,
+				cleanup: () => {
+					clearTimeout(timer);
+					signal?.removeEventListener("abort", cancel);
+				},
+			};
+			signal?.addEventListener("abort", cancel, { once: true });
+			this.send({ ...message, id });
+		});
+	}
+	dispose(reason = "disposed"): Promise<void> {
+		if (this.stopPromise) return this.stopPromise;
+		this.state = "disposed";
+		clearTimeout(this.startupTimer);
+		const error = new Error(`runtime disposed: ${reason}`);
+		this.stageReject(error);
+		this.activeReject?.(error);
+		this.rejectPending(error);
+		this.notifyState();
+		this.send({ kind: "dispose", reason });
+		this.stopPromise = (async () => {
+			const timer = setTimeout(() => this.kill("SIGKILL"), RUNTIME_LIMITS.disposeMs);
+			await this.exited;
+			clearTimeout(timer);
+		})();
+		return this.stopPromise;
+	}
+}

package/src/domains/extensions/runtime-schema.ts

@@ -0,0 +1,146 @@
+import { stripVTControlCharacters } from "node:util";
+import type { ExtensionOutput, ExtensionPanel, ExtensionStatus } from "./public-api.js";
+import type { ExtensionRuntimeDeclaration } from "./types.js";
+
+export const RUNTIME_LIMITS = {
+	processes: 4,
+	messageBytes: 96 * 1024,
+	outputBytes: 64 * 1024,
+	argumentBytes: 16 * 1024,
+	startupMs: 5000,
+	commandMs: 30000,
+	observationMs: 2000,
+	disposeMs: 250,
+	diagnosticsBytes: 64 * 1024,
+} as const;
+
+function record(value: unknown): Record<string, unknown> {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error("expected an object");
+	return value as Record<string, unknown>;
+}
+function keys(value: Record<string, unknown>, allowed: string[]): void {
+	for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new Error(`unknown runtime field '${key}'`);
+}
+function string(value: unknown, max: number): string {
+	if (typeof value !== "string" || value.length === 0 || value.length > max)
+		throw new Error(`expected text of 1-${max} characters`);
+	return value;
+}
+function array(value: unknown, max: number): unknown[] {
+	if (!Array.isArray(value) || value.length > max) throw new Error(`expected an array of at most ${max} entries`);
+	return value;
+}
+function choices<T extends string>(value: unknown, allowed: readonly T[]): T[] {
+	const entries = array(value ?? [], allowed.length).map((item) => {
+		if (!allowed.includes(item as T)) throw new Error(`unsupported runtime capability '${String(item)}'`);
+		return item as T;
+	});
+	if (new Set(entries).size !== entries.length) throw new Error("duplicate runtime capability");
+	return entries;
+}
+export function parseExtensionRuntime(value: unknown): ExtensionRuntimeDeclaration {
+	const raw = record(value);
+	keys(raw, ["api", "entrypoint", "commands", "events", "ui"]);
+	if (raw.api !== 1) throw new Error("runtime.api must be 1");
+	const entrypoint = string(raw.entrypoint, 240);
+	if (!entrypoint.endsWith(".mjs")) throw new Error("runtime.entrypoint must be a shipped .mjs file");
+	const names = new Set<string>();
+	const commands = array(raw.commands ?? [], 32).map((value) => {
+		const command = record(value);
+		keys(command, ["name", "description", "timeoutMs"]);
+		const name = string(command.name, 40);
+		if (!/^[a-z][a-z0-9_]*$/.test(name) || names.has(name))
+			throw new Error(`invalid or duplicate runtime command '${name}'`);
+		names.add(name);
+		const description = string(command.description, 240);
+		const timeoutMs = command.timeoutMs ?? RUNTIME_LIMITS.commandMs;
+		if (!Number.isInteger(timeoutMs) || Number(timeoutMs) < 100 || Number(timeoutMs) > 300000)
+			throw new Error("runtime command timeoutMs must be 100-300000");
+		return { name, description, timeoutMs: Number(timeoutMs) };
+	});
+	return {
+		api: 1,
+		entrypoint,
+		commands,
+		events: choices(raw.events, ["session_open", "turn_end"]),
+		ui: choices(raw.ui, ["status", "panel"]),
+	};
+}
+
+/** Terminal control sequences and C0/C1 controls never reach a host renderer. */
+export function extensionPlainText(value: string): string {
+	return stripVTControlCharacters(value).replace(/[\p{Cc}\p{Cf}]/gu, (char) =>
+		char === "\n" || char === "\t" ? char : "",
+	);
+}
+function text(value: unknown, max: number): string {
+	if (value === "") return "";
+	return extensionPlainText(string(value, max));
+}
+export function parseExtensionOutput(value: unknown, declaration: ExtensionRuntimeDeclaration): ExtensionOutput {
+	if (Buffer.byteLength(JSON.stringify(value) ?? "") > RUNTIME_LIMITS.outputBytes)
+		throw new Error("runtime output exceeds 64 KiB");
+	const raw = record(value);
+	keys(raw, ["text", "status", "panel"]);
+	const output: ExtensionOutput = { text: text(raw.text, 32768) };
+	if (raw.status !== undefined) {
+		if (!declaration.ui.includes("status")) throw new Error("runtime did not declare status UI");
+		if (raw.status === null) output.status = null;
+		else {
+			const status = record(raw.status);
+			keys(status, ["text", "tone"]);
+			const parsed: ExtensionStatus = { text: text(status.text, 160).replaceAll("\n", " ").replaceAll("\t", " ") };
+			if (status.tone !== undefined) {
+				const [tone] = choices([status.tone], ["neutral", "positive", "warning", "error"]);
+				if (tone) parsed.tone = tone;
+			}
+			output.status = parsed;
+		}
+	}
+	if (raw.panel !== undefined) {
+		if (!declaration.ui.includes("panel")) throw new Error("runtime did not declare panel UI");
+		const panel = record(raw.panel);
+		keys(panel, ["title", "sections"]);
+		const parsed: ExtensionPanel = { title: text(panel.title, 120), sections: [] };
+		for (const value of array(panel.sections, 16)) {
+			const section = record(value);
+			if (section.kind === "text") {
+				keys(section, ["kind", "text"]);
+				parsed.sections.push({ kind: "text", text: text(section.text, 8192) });
+			} else if (section.kind === "metrics") {
+				keys(section, ["kind", "items"]);
+				parsed.sections.push({
+					kind: "metrics",
+					items: array(section.items, 32).map((value) => {
+						const item = record(value);
+						keys(item, ["label", "value"]);
+						return { label: text(item.label, 120), value: text(item.value, 240) };
+					}),
+				});
+			} else if (section.kind === "table") {
+				keys(section, ["kind", "columns", "rows"]);
+				const columns = array(section.columns, 8).map((value) => text(value, 80));
+				if (columns.length === 0) throw new Error("table needs columns");
+				const rows = array(section.rows, 100).map((row) => {
+					const cells = array(row, columns.length);
+					if (cells.length !== columns.length) throw new Error("table row width differs from columns");
+					return cells.map((value) => text(value, 240));
+				});
+				parsed.sections.push({ kind: "table", columns, rows });
+			} else throw new Error("unsupported panel section");
+		}
+		output.panel = parsed;
+	}
+	return output;
+}
+
+export function extensionPanelText(panel: ExtensionPanel): string {
+	return [
+		panel.title,
+		...panel.sections.flatMap((section) => {
+			if (section.kind === "text") return [section.text];
+			if (section.kind === "metrics") return section.items.map((item) => `${item.label}: ${item.value}`);
+			return [section.columns.join(" | "), ...section.rows.map((row) => row.join(" | "))];
+		}),
+	].join("\n\n");
+}

package/src/domains/extensions/{resources.ts → snapshot-access.ts}

@@ -2,9 +2,7 @@ import { realpathSync } from "node:fs";
 import path from "node:path";
 import { buildExtensionSnapshot } from "./snapshot.js";
 import { committedExtensionSnapshot } from "./snapshot-store.js";
-import type { ExtensionResourceKind, ExtensionResourceRoot, ExtensionSnapshot } from "./types.js";
-
-export { extensionResourcePath } from "./resource-path.js";
+import type { ExtensionSnapshot } from "./types.js";
 
 /**
  * The committed snapshot when a store is bound for this cwd; otherwise an
@@ -21,17 +19,3 @@ export function extensionSnapshotFor(cwd = process.cwd()): ExtensionSnapshot {
 	}
 	return buildExtensionSnapshot({ cwd, generation: 0 });
 }
-
-/**
- * The canonical accessor for the enabled roots of one extension resource
- * kind. The agent registry, fleet contract, skill and common resource
- * loaders, and the extensions contract all read through it, so each of them
- * sees the committed snapshot for the booted cwd or the ephemeral
- * generation-0 build otherwise. Returns a fresh array the caller may mutate.
- */
-export function enabledExtensionResourceRoots(
-	kind: ExtensionResourceKind,
-	cwd = process.cwd(),
-): ExtensionResourceRoot[] {
-	return [...extensionSnapshotFor(cwd).resourceRoots[kind]];
-}

package/src/domains/extensions/snapshot.ts

@@ -2,13 +2,10 @@ import { createHash } from "node:crypto";
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { parse as parseYaml } from "yaml";
-import { extensionResourcePath } from "./resource-path.js";
 import { type InstalledExtensionRecord, listInstalledExtensionRecords } from "./state.js";
 import {
 	type ExtensionDiagnostic,
 	type ExtensionHookSource,
-	type ExtensionResourceKind,
-	type ExtensionResourceRoot,
 	type ExtensionSnapshot,
 	type ExtensionSnapshotDiagnostics,
 	isLoadableExtension,
@@ -18,8 +15,6 @@ export const EXTENSION_SNAPSHOT_DIAGNOSTIC_CAP = 200;
 export const EXTENSION_SNAPSHOT_DIAGNOSTIC_PER_PACKAGE_CAP = 20;
 export const EXTENSION_SNAPSHOT_DIAGNOSTIC_MESSAGE_CAP = 512;
 
-const RESOURCE_KINDS: ReadonlyArray<ExtensionResourceKind> = ["skills", "prompts", "agents", "fleets", "themes"];
-
 export interface BuildExtensionSnapshotInput {
 	cwd: string;
 	generation: number;
@@ -74,37 +69,15 @@ function boundedDiagnostics(records: ReadonlyArray<InstalledExtensionRecord>): E
 export function buildExtensionSnapshot(input: BuildExtensionSnapshotInput): ExtensionSnapshot {
 	const cwd = realpathSync(path.resolve(input.cwd));
 	const records = (input.listRecords ?? listInstalledExtensionRecords)(cwd, { all: true });
-	const resourceRoots: Record<ExtensionResourceKind, ExtensionResourceRoot[]> = {
-		skills: [],
-		prompts: [],
-		agents: [],
-		fleets: [],
-		themes: [],
-	};
 	const hookSources: ExtensionHookSource[] = [];
 	const digestPackages: unknown[] = [];
 
 	for (const record of records) {
 		const { entry } = record;
-		const packageRoots: Array<{ kind: ExtensionResourceKind; path: string }> = [];
+		const commandTools: string[] = [];
 		let hooksDigest: string | undefined;
 		if (isLoadableExtension(entry)) {
-			for (const kind of RESOURCE_KINDS) {
-				const relative = entry.resources[kind];
-				if (!relative) continue;
-				const resolved = extensionResourcePath(entry.rootPath, relative);
-				if (!resolved) continue;
-				resourceRoots[kind].push({
-					id: entry.id,
-					scope: entry.scope,
-					path: resolved,
-					rootPath: entry.rootPath,
-					source: `extension:${entry.scope}:${entry.id}`,
-					provenance: entry.provenance,
-					generation: input.generation,
-				});
-				packageRoots.push({ kind, path: resolved });
-			}
+			for (const tool of entry.capabilities?.tools ?? []) commandTools.push(tool.name);
 			const hookBytes = record.captured?.get("hooks.yaml");
 			if (hookBytes !== undefined) {
 				hooksDigest = createHash("sha256").update(hookBytes).digest("hex");
@@ -128,7 +101,7 @@ export function buildExtensionSnapshot(input: BuildExtensionSnapshotInput): Exte
 			scope: entry.scope,
 			loadable: entry.loadable,
 			...(entry.provenance ? { provenance: entry.provenance } : {}),
-			resourceRoots: packageRoots,
+			commandTools,
 			...(hooksDigest ? { hooksDigest } : {}),
 		});
 	}
@@ -140,7 +113,6 @@ export function buildExtensionSnapshot(input: BuildExtensionSnapshotInput): Exte
 		builtAt: (input.now ?? (() => new Date()))().toISOString(),
 		digest: createHash("sha256").update(canonicalJson(digestPackages)).digest("hex"),
 		packages: records.map((record) => record.entry),
-		resourceRoots,
 		hookSources,
 		diagnostics: boundedDiagnostics(records),
 	};
@@ -155,7 +127,7 @@ function packageFingerprints(snapshot: ExtensionSnapshot): Map<string, string> {
 			scope: entry.scope,
 			loadable: entry.loadable,
 			provenance: entry.provenance ?? null,
-			resources: entry.resources,
+			capabilities: entry.capabilities ?? null,
 		});
 		grouped.set(entry.id, list);
 	}