@rebon/cli-darwin-arm64 0.17.2 → 0.18.0

package/bin/compose-runtime/src/loader.mjs

@@ -0,0 +1,78 @@
+// What a plugin package *is*, when the composition is in the picture.
+//
+// The host knows one shape: a module exporting `activate`, which registers
+// through the api it is handed. A Cordis plugin knows nothing about any of
+// that — it exports `apply(ctx, config)` and registers by calling services on
+// a context it shares with every other entry. Both are plugins on the plane;
+// they differ only in what "loading" means, which is exactly the question the
+// host delegates.
+//
+// The rule, in order, and deliberately not a heuristic — a package's shape is
+// something its author decides, so it should be decidable by reading it:
+//
+//   1. `activate` is a function                → the host's own loader
+//   2. `apply` is the module's own function    → a Cordis plugin (the module)
+//   3. `default` is an object with `apply`     → a Cordis plugin
+//   4. `default` is a function                 → a Cordis functional plugin
+//   5. anything else                           → the host's own loader, which
+//                                                refuses it by name
+//
+// Step 1 comes first so a rebon-native plugin is never mistaken for a Cordis
+// one, and step 4 is last so the ambiguous case (a bare default function) goes
+// to the composition rather than being guessed at from argument counts.
+import { resolveEntry } from '../../plugin-host/src/loader.mjs';
+
+const own = (value, key) => value != null && Object.prototype.hasOwnProperty.call(value, key);
+
+class LoaderError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = 'LoaderError';
+  }
+}
+
+/// The Cordis plugin a module holds, or undefined if it does not hold one.
+export function cordisPluginOf(module) {
+  if (typeof module?.activate === 'function') return undefined;
+  if (own(module, 'apply') && typeof module.apply === 'function') return module;
+  const fallback = module?.default;
+  if (fallback && typeof fallback === 'object' && typeof fallback.apply === 'function') return fallback;
+  if (typeof fallback === 'function') return fallback;
+  return undefined;
+}
+
+/// Builds the load/unload seams the host runs with.
+///
+/// `next` is the host's own loader, handed back untouched for anything this
+/// module does not recognise — an adapter that reimplemented it would be a
+/// second set of rules for the same shape.
+export async function createLoader({ next }) {
+  return {
+    async load(request) {
+      const url = resolveEntry(request.root, request.entry);
+      let module;
+      try {
+        module = await import(url);
+      } catch (cause) {
+        throw new LoaderError('[ENTRY_FAILED]', `plugin entry ${request.entry} failed to load: ${cause?.message ?? cause}`);
+      }
+      const plugin = cordisPluginOf(module);
+      // Importing is idempotent, so handing the already-imported module back to
+      // the host's loader costs nothing and keeps one import per entry — which
+      // matters, because a module evaluated twice would register twice.
+      if (plugin === undefined) return next(request, async () => module);
+
+      // Imported lazily: this module is loaded by the host at startup, long
+      // before module resolution for the payload has been installed.
+      const { mountEntry } = await import('./realm.mjs');
+      const sink = await mountEntry(request, plugin);
+      return sink.loaded();
+    },
+
+    async unload(pluginId) {
+      const { disposeEntry } = await import('./realm.mjs');
+      await disposeEntry(pluginId);
+    },
+  };
+}

package/bin/compose-runtime/src/loop-assembly.mjs

@@ -0,0 +1,237 @@
+// The composition-side glue that lets the REAL dsh agent loop drive a turn
+// inside the composition realm.
+//
+// Ported from `js/compose/loop-assembly.js`. Three duties, all rebon-owned
+// (the dsh packages stay unmodified):
+//
+//  1. **Tool-schema supply** — a dsh systemPrompt tool provider merging the
+//     composition's own registered definitions with rebon's core tool catalog,
+//     so what the model is offered and what the scheduler can dispatch stay one
+//     fact (a local definition shadows a core tool name in both places).
+//  2. **Observability** — every dsh `session/event` (chunks included: the
+//     embedder's session face streams from them) and `agent/error` is published
+//     onto rebon's event plane.
+//  3. **Drive** — `loop:control` is the embedder's inbound face
+//     (followup / steer / cancel / status).
+//
+// Two things moved with the transport:
+//
+//   * **The catalog is configuration, not a call.** It used to be
+//     `describeTools()`, an op straight into rebon. There is no such method on
+//     the plane, and there should not be: what rebon offers a model is settled
+//     when the composition is built, so rebon hands it over at load. A snapshot
+//     either way — the old op was read once during `apply` too.
+//   * **Events publish through a scope handle.** A loop produces turn events on
+//     its own schedule, with no inbound call to hang them on, so the assembly
+//     takes a handle on each open session and fans its events to whichever are
+//     live. A loop exists before any session opens, so the first events are
+//     held — boundedly — until one does, and the self-drive kickoff waits for
+//     the same moment: an agent that ran a whole turn before anyone was
+//     listening would be a turn rebon never saw.
+import { createUserMessage, errorChain } from '@deepseek-ai/dsh-llm';
+import { logger } from './bridge.mjs';
+import { sinkOf } from './registry.mjs';
+
+export const name = 'rebon-loop-assembly';
+export const inject = ['systemPrompt', 'tools'];
+
+/** Topics this assembly publishes; a loop plugin declares exactly these. */
+export const LOOP_TOPICS = Object.freeze([
+  'loop:event',
+  'loop:agent-error',
+  'loop:agent-created',
+]);
+
+export async function apply(ctx, config = {}) {
+  const sink = sinkOf(ctx);
+  if (sink === undefined) {
+    throw new Error('rebon-loop-assembly must be mounted as a composition entry');
+  }
+  // Embedder-chosen discriminator: with several loops in one composition, every
+  // published event carries the owning loop's tag so subscribers can tell them
+  // apart.
+  const tag = typeof config.tag === 'string' && config.tag.length > 0 ? config.tag : undefined;
+  const stamp = (payload) => (tag === undefined ? payload : { tag, ...payload });
+
+  // Sessions this loop is attached to. A published event goes to all of them;
+  // in the ordinary case there is exactly one.
+  const sessions = new Set();
+  // A loop starts existing when it is loaded, and a session opens after — so
+  // the first events (an agent being created, above all) happen with nobody
+  // listening. Holding them until the first session attaches is the difference
+  // between "rebon saw the loop start" and "rebon saw the loop already
+  // running"; the bound is here so a loop nobody ever attaches to cannot grow
+  // without limit, and passing it is said out loud rather than swallowed.
+  const PRE_ATTACH_LIMIT = 256;
+  let attached = false;
+  let dropped = 0;
+  const held = [];
+  const deliver = (session, topic, payload) => {
+    // Best effort, and never a reason for the loop to fail: an event nobody
+    // could be told about is not a turn that went wrong.
+    void session.publish(topic, payload).catch((cause) => {
+      logger.warn(`loop-assembly: publishing ${topic} failed: ${cause?.message ?? cause}`);
+    });
+  };
+  sink.scope((scopeCtx) => {
+    sessions.add(scopeCtx);
+    if (!attached) {
+      attached = true;
+      if (dropped > 0) {
+        logger.warn(`loop-assembly: dropped ${dropped} event(s) produced before any session attached`);
+      }
+      for (const [topic, payload] of held.splice(0)) deliver(scopeCtx, topic, payload);
+    }
+    kickoff();
+    return () => sessions.delete(scopeCtx);
+  });
+  const announce = (topic, payload) => {
+    const stamped = stamp(payload);
+    if (!attached) {
+      if (held.length >= PRE_ATTACH_LIMIT) {
+        held.shift();
+        dropped += 1;
+      }
+      held.push([topic, stamped]);
+      return;
+    }
+    for (const session of sessions) deliver(session, topic, stamped);
+  };
+
+  // Optional prompt contribution into the loop realm's REAL dsh systemPrompt
+  // (the loop's own prompt plane, not rebon's seat — `isolate` keeps them
+  // apart, which is why the composition structure declares it).
+  if (config.section !== undefined && config.section !== null && typeof config.section === 'object') {
+    ctx.systemPrompt.section(config.section);
+  }
+
+  const seatSchemas = (Array.isArray(config.toolCatalog) ? config.toolCatalog : []).map((tool) => ({
+    name: String(tool?.name ?? ''),
+    description: String(tool?.description ?? ''),
+    parameters: tool?.inputSchema ?? tool?.parameters ?? { type: 'object' },
+  })).filter((tool) => tool.name.length > 0);
+
+  ctx.systemPrompt.tools(() => {
+    const merged = new Map();
+    for (const schema of seatSchemas) merged.set(schema.name, schema);
+    for (const [toolName, def] of ctx.tools.defs) {
+      merged.set(toolName, {
+        name: toolName,
+        description: String(def.description ?? ''),
+        parameters: def.parameters ?? { type: 'object' },
+      });
+    }
+    return { schemas: [...merged.values()] };
+  });
+
+  // Full-fidelity relay: the dsh session log IS the loop's truth, and the
+  // embedder's session face (streaming UI, transcript projection) needs every
+  // event — chunks included.
+  ctx.on('session/event', (session, event) => {
+    announce('loop:event', {
+      sessionId: String(session.id),
+      seq: event.seq,
+      type: event.type,
+      data: event.data ?? null,
+    });
+  });
+
+  ctx.on('agent/error', (payload) => {
+    announce('loop:agent-error', {
+      agentId: String(payload.agent?.id ?? ''),
+      turn: payload.turn,
+      step: payload.step,
+      error: errorChain(payload.error),
+    });
+  });
+
+  // Which agents are this loop's.
+  //
+  // The dsh `agents` registry is one per composition realm, so with more than
+  // one loop mounted every assembly hears every agent being created. Naming the
+  // configured ids is how an assembly knows which of them it is responsible
+  // for; dsh appends a session suffix to the configured id, so the match is on
+  // that stem. With no list the assembly adopts everything, which is the
+  // single-loop composition and the honest default for it.
+  const owned = Array.isArray(config.agents)
+    ? config.agents.map(String).filter((id) => id.length > 0)
+    : undefined;
+  const isMine = (agentId) => owned === undefined
+    || owned.some((id) => agentId === id || agentId.startsWith(`${id}-`));
+
+  const live = new Map();
+  const kicked = new Set();
+  // The self-drive convenience, deliberately tied to a session rather than to
+  // an agent appearing: an agent created before anyone is listening would run a
+  // whole turn whose events had nowhere to go.
+  function kickoff() {
+    const text = config.kickoff;
+    if (typeof text !== 'string' || text.length === 0) return;
+    if (!attached) return;
+    for (const [id, agent] of live) {
+      if (kicked.has(id)) continue;
+      kicked.add(id);
+      agent.followup(createUserMessage({
+        content: [{ type: 'text', text }],
+        source: { kind: 'user' },
+      }));
+    }
+  }
+  ctx.on('agent/created', ({ agent }) => {
+    const agentId = String(agent.id);
+    if (!isMine(agentId)) return;
+    live.set(agentId, agent);
+    announce('loop:agent-created', { agentId });
+    kickoff();
+  });
+  ctx.on('agent/disposed', ({ agent }) => {
+    live.delete(String(agent.id));
+  });
+
+  // Session events carry no agent, so an assembly cannot tell whose turn it is
+  // from the event alone. Ownership of the *session* is the same question one
+  // step earlier: a session belongs to whichever agent is running in it.
+  const ownedSessions = new Set();
+  ctx.on('agent/created', ({ agent }) => {
+    if (isMine(String(agent.id)) && agent.session?.id !== undefined) {
+      ownedSessions.add(String(agent.session.id));
+    }
+  });
+
+  // Inbound control face: the embedder drives the loop with ordinary service
+  // calls. Commands address the single configured agent by default, or a
+  // specific one via `agentId`.
+  const resolveAgent = (input) => {
+    if (typeof input?.agentId === 'string') return live.get(input.agentId);
+    if (live.size === 1) return live.values().next().value;
+    return undefined;
+  };
+  const userMessage = (text) => createUserMessage({
+    content: [{ type: 'text', text: String(text) }],
+    source: { kind: 'user' },
+  });
+  sink.service('loop:control', (input) => {
+    const agent = resolveAgent(input);
+    if (agent === undefined) {
+      const known = [...live.keys()];
+      throw new Error(`loop:control: no live agent${input?.agentId ? ` "${input.agentId}"` : ''} (live: ${known.join(', ') || '(none)'})`);
+    }
+    switch (input?.kind) {
+      case 'followup':
+        agent.followup(userMessage(input.text ?? ''));
+        return { accepted: true, agentId: String(agent.id) };
+      case 'steer':
+        agent.steer(userMessage(input.text ?? ''));
+        return { accepted: true, agentId: String(agent.id) };
+      case 'cancel':
+        agent.cancel({ kind: 'user' });
+        return { accepted: true, agentId: String(agent.id) };
+      case 'status':
+        return { agentId: String(agent.id), status: agent.status };
+      default:
+        throw new Error(`loop:control: unknown command kind ${JSON.stringify(input?.kind)}`);
+    }
+  });
+}
+
+export default { name, inject, apply };

package/bin/compose-runtime/src/payload.mjs

@@ -0,0 +1,49 @@
+// Where the vendored JS payload lives.
+//
+// The payload — Cordis, cosmokit, schemastery and the dsh package set — is this
+// package's own, in `payload/`. It used to be owned by `crates/rebon-kernel-js`
+// and pointed at from here, because the deno_core host was what shipped and two
+// copies of a 600KB vendored tree would diverge. V8 is gone, so the tree moved
+// next to its runtime and this file is the only one that changed.
+//
+// `vendor/cordis/index.js` is the sentinel, for the same reason `bridge.js`
+// is on the Rust side: every consumer loads it, so a directory without it is
+// not a payload.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const SENTINEL = path.join('vendor', 'cordis', 'index.js');
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+const holdsPayload = (dir) => fs.existsSync(path.join(dir, SENTINEL));
+
+/// The payload directory, or a refusal naming what was tried.
+///
+/// A ladder, not a search — the same rule `REBON_PLUGIN_NODE` follows on the
+/// Rust side. `REBON_KERNEL_JS_DIR` is an explicit demand: if what it names
+/// does not hold a payload, that is the answer, not a reason to go looking
+/// somewhere else. Falling back would run the composition against a payload
+/// the operator did not choose and never told them.
+///
+/// Without the override there is one place it can be: `payload/` inside this
+/// package, in a checkout and in a deployment alike.
+///
+/// Throws rather than returning a guess, because every module specifier the
+/// composition resolves is built from this path — a wrong one surfaces later
+/// as two dozen unrelated "cannot find module" errors.
+export function payloadDir() {
+  const override = process.env.REBON_KERNEL_JS_DIR;
+  if (override) {
+    if (holdsPayload(override)) return path.resolve(override);
+    throw new Error(
+      `[NO_PAYLOAD] REBON_KERNEL_JS_DIR names ${override}, which does not hold ${SENTINEL}`,
+    );
+  }
+  const beside = path.join(here, '..', 'payload');
+  if (holdsPayload(beside)) return path.resolve(beside);
+  throw new Error(
+    `[NO_PAYLOAD] no vendored JS payload found (looked for ${SENTINEL} under ${beside}); `
+      + 'set REBON_KERNEL_JS_DIR to the directory holding it',
+  );
+}

package/bin/compose-runtime/src/plugin.mjs

@@ -0,0 +1,59 @@
+// The composition control plugin.
+//
+// rebon loads this one first, and everything else the composition contains is
+// loaded after it, as an ordinary `plugin/load` each. What this one does is
+// make that possible: install module resolution for the vendored payload,
+// create the shared Cordis realm the entries mount into, and answer for the
+// facts the protocol has no field for.
+//
+// **Why the structure lives in this plugin's config.** Groups and `isolate` are
+// composition structure, not plugin facts: a group is a container that is not a
+// module, and an isolated realm is a relationship between entries. Neither can
+// be said in one entry's own load request, so rebon says it once, here, naming
+// only ids and placement. Each entry's `plugin/load` then carries its module
+// and its own configuration.
+//
+// Module resolution has to be installed before Cordis is imported, and static
+// imports are linked before a module body runs — which is why everything below
+// is imported dynamically. Only Node's own builtins, which need no resolution,
+// could be static, and none are needed.
+export async function activate(api, config = {}) {
+  const { installModuleResolution } = await import('./resolve.mjs');
+  installModuleResolution({
+    ...(config.payloadDir ? { dir: config.payloadDir } : {}),
+    extraModules: config.modules ?? {},
+  });
+
+  const { withCall } = await import('./bridge.mjs');
+  const { builtinSeats, createRealm, mounted, reportFor } = await import('./realm.mjs');
+  await createRealm({ web: config.web ?? null, entries: config.entries ?? [] });
+
+  // Registered before any entry is loaded, so an entry claiming the same
+  // service name hits the registrar's refusal rather than replacing this.
+  //
+  // What it answers is the part of a load report the protocol cannot carry: a
+  // route's model catalog, a prompt section, a web provider. Those belong to
+  // one plugin kind, and the ready report is a shape every plugin shares — so
+  // they are asked for rather than bolted on.
+  api.service('compose', async (request, ctx) => withCall(ctx, async () => {
+    const kind = request?.kind;
+    if (kind === 'list') {
+      return { plugins: mounted(), builtin: builtinSeats() };
+    }
+    if (kind === 'report') {
+      const pluginId = String(request?.pluginId ?? '');
+      const report = reportFor(pluginId);
+      if (report === undefined) {
+        const error = new Error(`no composition entry ${JSON.stringify(pluginId)} is mounted`);
+        error.code = '[UNKNOWN_PLUGIN]';
+        throw error;
+      }
+      return report;
+    }
+    const error = new Error(`compose does not answer kind ${JSON.stringify(kind ?? null)}`);
+    error.code = '[UNKNOWN_CONTROL]';
+    throw error;
+  }));
+}
+
+export default activate;

package/bin/compose-runtime/src/realm.mjs

@@ -0,0 +1,223 @@
+// The composition realm: one Cordis context, shared by every entry.
+//
+// This is the whole reason the composition exists rather than each plugin
+// living alone. Cordis plugins reach each other through services on a context —
+// `inject: ['tools']`, `ctx.llm.registerAdapter(...)` — and that only works if
+// they are mounted on the same one. So the plane's "one plugin, one load" is
+// the outside view, and inside the host they all land here.
+//
+// Two things live here that a flat list of plugins cannot express, and both are
+// composition structure rather than plugin facts, which is why rebon describes
+// them once when the composition is created rather than per load:
+//
+//   * **groups** — a container that is not a module. Unloading one is unloading
+//     its members, which rebon does by naming them; nothing is loaded for the
+//     group itself.
+//   * **isolate** — Cordis's own realm narrowing. The agent loop needs its own
+//     `systemPrompt` because the real dsh service and rebon's seat share that
+//     name; without isolation one of them loses.
+//
+// Ordering note: this module imports Cordis by bare specifier, so it must not
+// be imported before `installModuleResolution()` has run. Everything that
+// reaches it does so through a dynamic import for exactly that reason.
+import { Context } from 'cordis';
+import { OWNER, RegistrationSink, SINK } from './registry.mjs';
+import RebonLlmRuntime from './llm-runtime.mjs';
+import RebonCredentials from './credentials-runtime.mjs';
+import RebonToolsRuntime from './tools-runtime.mjs';
+import RebonWebRuntime from './web-runtime.mjs';
+import RebonSystemPromptRuntime from './systemprompt-runtime.mjs';
+
+/** The built-in seats, in mount order: a dsh `inject` is satisfied at mount
+ *  time, so a seat that arrives after the plugin needing it never arrives. */
+const BUILTIN_SEATS = ['llm', 'credentials', 'tools', 'web', 'systemPrompt'];
+
+let state;
+
+class ComposeError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = 'ComposeError';
+  }
+}
+
+/// Applies one node's `isolate` declaration to its parent context.
+///
+/// Cordis semantics, unchanged: `true` mints an entry-local realm; a string
+/// labels a realm SHARED by every node using the same label, so an in-group
+/// provider serves in-group consumers while the outside world keeps its own
+/// service under the same name.
+function derive(parent, node, realms) {
+  let derived = parent;
+  if (node.isolate && typeof node.isolate === 'object') {
+    for (const [service, label] of Object.entries(node.isolate)) {
+      if (label === true) {
+        derived = derived.isolate(service);
+        continue;
+      }
+      const key = `${service} ${label}`;
+      if (!realms.has(key)) realms.set(key, Symbol(`${service}#${label}`));
+      derived = derived.isolate(service, realms.get(key));
+    }
+  }
+  return derived;
+}
+
+/// Walks the declared structure into a placement per entry id.
+///
+/// The value is the context an entry is mounted *under*, not the entry's own —
+/// that one is derived per load, because it carries the load's registration
+/// sink and each load needs its own.
+function place(nodes, parent, placements, groups, realms) {
+  for (const node of nodes ?? []) {
+    const id = node?.id;
+    if (typeof id !== 'string' || id.length === 0) {
+      throw new ComposeError('[BAD_STRUCTURE]', 'every entry in the composition structure needs an id');
+    }
+    if (placements.has(id) || groups.has(id)) {
+      throw new ComposeError('[BAD_STRUCTURE]', `duplicate entry id ${JSON.stringify(id)}`);
+    }
+    const derived = derive(parent, node, realms);
+    if (Array.isArray(node.group)) {
+      groups.set(id, derived);
+      place(node.group, derived, placements, groups, realms);
+      continue;
+    }
+    placements.set(id, derived);
+  }
+}
+
+/// Creates the realm. Called once, by the composition control plugin.
+export async function createRealm({ web = null, entries = [] } = {}) {
+  if (state !== undefined) {
+    throw new ComposeError('[REALM_EXISTS]', 'the composition realm is already created');
+  }
+  const ctx = new Context();
+  const placements = new Map();
+  const groups = new Map();
+  const realms = new Map();
+  place(entries, ctx, placements, groups, realms);
+
+  await ctx.plugin(RebonLlmRuntime);
+  await ctx.plugin(RebonCredentials);
+  await ctx.plugin(RebonToolsRuntime);
+  await ctx.plugin(RebonWebRuntime, { web });
+  await ctx.plugin(RebonSystemPromptRuntime);
+
+  state = { ctx, placements, groups, realms, fibers: new Map(), sinks: new Map() };
+  return state;
+}
+
+/// The realm, or a refusal that names the ordering mistake.
+export function realm() {
+  if (state === undefined) {
+    throw new ComposeError(
+      '[NO_REALM]',
+      'the composition realm does not exist yet; rebon loads the composition control plugin before any entry',
+    );
+  }
+  return state;
+}
+
+/// Tears the realm down. Only tests need this; a real host exits instead.
+export async function destroyRealm() {
+  if (state === undefined) return;
+  for (const pluginId of [...state.fibers.keys()].reverse()) await disposeEntry(pluginId);
+  await state.ctx.dispose?.();
+  state = undefined;
+}
+
+export function builtinSeats() {
+  return [...BUILTIN_SEATS];
+}
+
+/// The services a Cordis plugin cannot start without.
+///
+/// Cordis accepts both spellings: a bare array is all-required, an object
+/// separates `required` from `optional`.
+function requiredInjects(plugin) {
+  const inject = plugin?.inject;
+  if (Array.isArray(inject)) return inject;
+  if (inject && typeof inject === 'object' && Array.isArray(inject.required)) return inject.required;
+  return [];
+}
+
+/// Mounts one Cordis entry and hands back what it registered.
+///
+/// The sink rides on the entry's own derived context, which is what lets a seat
+/// attribute a registration synchronously — the moment a plugin registers, the
+/// context it registered through says which plugin it was.
+export async function mountEntry(request, plugin) {
+  const live = realm();
+  const { pluginId } = request;
+  if (live.groups.has(pluginId)) {
+    throw new ComposeError(
+      '[GROUP_NOT_LOADABLE]',
+      `${pluginId} is a group in the composition structure, not a module; load its members`,
+    );
+  }
+  if (live.fibers.has(pluginId)) {
+    throw new ComposeError('[PLUGIN_ALREADY_LOADED]', `${pluginId} is already mounted`);
+  }
+  const parent = live.placements.get(pluginId) ?? live.ctx;
+  const sink = new RegistrationSink(pluginId, request);
+  const derived = parent.extend({ [OWNER]: pluginId, [SINK]: sink });
+  // Refused before mounting rather than waited for. Cordis lets a plugin wait
+  // for a service that has not arrived yet, and inside one composition that is
+  // a feature — but a load is a call rebon is waiting on, and a plugin waiting
+  // forever is a call that never answers. So a composition entry's required
+  // services must be there when it loads, and rebon orders entries so they
+  // are. Saying which one is missing turns a hang into a diagnosis.
+  for (const service of requiredInjects(plugin)) {
+    if (derived.get(service) === undefined) {
+      throw new ComposeError(
+        '[MISSING_INJECT]',
+        `${pluginId} requires service ${JSON.stringify(service)}, which nothing provides where it is mounted`,
+      );
+    }
+  }
+  let fiber;
+  try {
+    fiber = derived.plugin(plugin, request.config ?? undefined);
+    await fiber;
+  } catch (cause) {
+    // Whatever half-mounted has to go: a fiber left behind would keep serving
+    // through registrations rebon was never told about.
+    try {
+      await fiber?.dispose();
+    } catch {}
+    if (cause?.code) throw cause;
+    throw new ComposeError('[ACTIVATE_FAILED]', `mounting ${pluginId} failed: ${cause?.message ?? cause}`);
+  }
+  // Every catalog read has to finish before the report is sealed: a provider
+  // reported without its models would have rebon resolving against a table
+  // that is still being filled in.
+  await live.ctx.llm.settle();
+  sink.seal();
+  live.fibers.set(pluginId, fiber);
+  live.sinks.set(pluginId, sink);
+  return sink;
+}
+
+/// Disposes one entry. Idempotent: the host retires a plugin once, but a realm
+/// torn down underneath it must not turn that into a second failure.
+export async function disposeEntry(pluginId) {
+  if (state === undefined) return;
+  const fiber = state.fibers.get(pluginId);
+  state.fibers.delete(pluginId);
+  state.sinks.delete(pluginId);
+  if (fiber === undefined) return;
+  await fiber.dispose();
+}
+
+/// What one entry reported beyond the protocol's own fields.
+export function reportFor(pluginId) {
+  const sink = realm().sinks.get(pluginId);
+  return sink === undefined ? undefined : sink.report();
+}
+
+/// Every entry currently mounted, in load order.
+export function mounted() {
+  return [...realm().fibers.keys()];
+}