@rebon/cli-linux-arm64 1.18.0 → 1.19.1

package/bin/compose-runtime/src/remote.mjs

@@ -0,0 +1,237 @@
+// The Host's half of DeepSeek Harness's client contract, for what this realm
+// owns.
+//
+// A dsh client plugin (`lib/client.js`, React on a page) reaches the Host
+// through `ctx.remote.<namespace>.<method>(...)`. dsh's gateway turns that
+// into a call on a Host service with exact named arguments and answers
+// `{ ok: true, value }` or `{ ok: false, error: { code, message, details } }`
+// — never a thrown carrier fault. Rebon's plane is the carrier: the desktop
+// app (or a test) sends `{ endpoint: 'settings/describe', args: {...} }` to
+// the composition's `compose` service as `kind: 'remote'`, and this module
+// answers the namespaces whose facts live in the realm:
+//
+//   * `settings` — upstream `@deepseek-ai/dsh-settings` over rebon's
+//     configuration editor, read redacted and written with dsh's revision
+//     fence, the way dsh's `settings-controller` does;
+//   * `pluginInventory` — the entries mounted here, with their phases;
+//   * `rebon/clientModules` — rebon's own: which mounted entries ship a
+//     browser half (`package.json` `dsh.client`), for the client realm to
+//     load. dsh injects this as `__DSH_BOOT__`; rebon asks for it.
+//
+// Namespaces this realm does not hold (`pluginManager`, `credentials`,
+// sessions, …) are the plane's to answer or `gateway/method-unavailable`, as
+// dsh's gateway says
+// for an endpoint no live service claims. The events the client hears
+// (`settings/document-updated`, …) are published by the control plugin on
+// `compose:remote-event`, see `plugin.mjs`.
+import fs from 'node:fs';
+import path from 'node:path';
+import { realm } from './realm.mjs';
+import { entries } from './entries.mjs';
+
+/** The forwarded events dsh's remotes allowlist names, that a realm emits. */
+export const REMOTE_EVENTS = Object.freeze([
+  'settings/document-updated',
+  'credentials/record-updated',
+  'credentials/reference-updated',
+  'llm/adapters-updated',
+  'commands/change',
+]);
+
+class RemoteError extends Error {
+  constructor(code, message, details = {}) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = 'RemoteError';
+  }
+}
+
+/// One redacted descriptor as the wire carries it, field by field
+/// (`settings-controller`'s `namespaceView`).
+function namespaceView(descriptor) {
+  return {
+    ns: String(descriptor.ns),
+    autoGenerate: descriptor.autoGenerate,
+    schema: descriptor.schema,
+    value: descriptor.value,
+    ...(descriptor.base === undefined ? {} : { base: descriptor.base }),
+    ...(descriptor.user === undefined ? {} : { user: descriptor.user }),
+    applies: descriptor.applies,
+    secrets: (descriptor.secrets ?? []).map((secret) => ({ path: [...secret.path], set: secret.set })),
+    revision: descriptor.revision,
+  };
+}
+
+function settingsService() {
+  const settings = realm().ctx.get('settings');
+  if (settings === undefined) {
+    throw new RemoteError(
+      'gateway/method-unavailable',
+      'no settings service is mounted in this composition: install @deepseek-ai/dsh-settings with the packages it configures',
+    );
+  }
+  return settings;
+}
+
+/// A refusal from the settings service, classified as dsh classifies it: a
+/// stale revision is its own outcome, everything else is a rejection.
+function settingsRefusal(ns, error) {
+  if (error?.code === 'SETTINGS_CONFLICT' && typeof error.expected === 'number' && typeof error.actual === 'number') {
+    return new RemoteError('settings/conflict', String(error.message), { ns, expected: error.expected, actual: error.actual });
+  }
+  return new RemoteError('settings/rejected', String(error?.message ?? error), { ns });
+}
+
+async function settingsWrite(mode, args) {
+  const ns = args?.ns;
+  if (typeof ns !== 'string' || ns.length === 0) {
+    throw new RemoteError('gateway/bad-request', `invalid payload for settings.${mode}`, { field: 'ns' });
+  }
+  const settings = settingsService();
+  const input = mode === 'mutate' ? args.ops : mode === 'replace' ? args.section : args.patch;
+  try {
+    await settings[mode](ns, input, args.expectedRevision ?? undefined);
+  } catch (error) {
+    throw settingsRefusal(ns, error);
+  }
+  const descriptor = settings.describe({ redactSecrets: true }).find((candidate) => candidate.ns === ns);
+  if (descriptor === undefined) {
+    throw new RemoteError('gateway/internal', `settings namespace "${ns}" was disposed after the ${mode}`);
+  }
+  return namespaceView(descriptor);
+}
+
+/// dsh's fiber phases, from a Cordis fiber state.
+function phaseOf(fiber) {
+  switch (fiber?.state) {
+    case 0: return 'pending';
+    case 1: return 'loading';
+    case 2: return 'active';
+    case 3: return 'failed';
+    case 4: return 'unloading';
+    default: return null;
+  }
+}
+
+/// The name of the package an entry's module belongs to, else its id.
+function moduleNameOf(entry) {
+  const root = packageRoot(entry);
+  if (root !== undefined) {
+    try {
+      const name = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).name;
+      if (typeof name === 'string') return name;
+    } catch {}
+  }
+  return entry.options.name;
+}
+
+function inventory() {
+  return {
+    // Which entries run is rebon's composition, changed where rebon's
+    // plugins are configured; a page reads it.
+    managementAvailable: false,
+    entries: [...entries.values()].map((entry) => ({
+      entryId: entry.id,
+      moduleName: moduleNameOf(entry),
+      enabled: true,
+      fiberPhase: phaseOf(entry.fiber),
+    })),
+  };
+}
+
+/// The client half a package ships, as its `package.json` declares it.
+function clientHalf(root) {
+  let manifest;
+  try {
+    manifest = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+  } catch {
+    return undefined;
+  }
+  const client = manifest?.dsh?.client;
+  if (client === null || typeof client !== 'object' || client.platform !== 'web') return undefined;
+  const exported = manifest.exports?.['./client'];
+  const relative = typeof exported === 'string' ? exported : (exported?.default ?? exported?.import ?? 'lib/client.js');
+  const file = path.resolve(root, relative);
+  let stat;
+  try {
+    stat = fs.statSync(file);
+  } catch {
+    return undefined;
+  }
+  return {
+    id: manifest.name,
+    file,
+    // dsh's `rev` changes whenever the bundle does; mtime and size say so.
+    rev: `${Math.trunc(stat.mtimeMs)}-${stat.size}`,
+    inject: Array.isArray(client.inject) ? [...client.inject] : [],
+    immediately: client.immediately === true,
+    external: Array.isArray(client.external) ? [...client.external] : [],
+  };
+}
+
+/// The package an entry's module belongs to: the nearest directory above
+/// it holding a `package.json`, the module's own package as Node reads it.
+function packageRoot(entry) {
+  if (typeof entry.root !== 'string' || typeof entry.module !== 'string') return undefined;
+  let dir = path.dirname(path.resolve(entry.root, entry.module));
+  const top = path.resolve(entry.root);
+  for (;;) {
+    if (fs.existsSync(path.join(dir, 'package.json'))) return dir;
+    if (dir === top || path.dirname(dir) === dir) return undefined;
+    dir = path.dirname(dir);
+  }
+}
+
+function clientModules() {
+  const rows = [];
+  for (const entry of entries.values()) {
+    const root = packageRoot(entry);
+    if (root === undefined) continue;
+    const half = clientHalf(root);
+    if (half !== undefined && !rows.some((row) => row.id === half.id)) rows.push({ entryId: entry.id, ...half });
+  }
+  return { entries: rows };
+}
+
+const ENDPOINTS = {
+  'settings/describe': () => {
+    const settings = settingsService();
+    return {
+      writable: settings.writable,
+      hasDocument: settings.documentPath !== undefined,
+      namespaces: settings.describe({ redactSecrets: true }).map(namespaceView),
+    };
+  },
+  'settings/update': (args) => settingsWrite('update', args),
+  'settings/replace': (args) => settingsWrite('replace', args),
+  'settings/mutate': (args) => settingsWrite('mutate', args),
+  'pluginInventory/list': inventory,
+  'rebon/clientModules': clientModules,
+};
+
+/// Answers one remote call in dsh's wire shape. Never throws: a refusal is a
+/// result the client reads, as dsh's gateway answers.
+export async function remote(endpoint, args = {}) {
+  if (args === null || typeof args !== 'object' || Array.isArray(args)) {
+    return { ok: false, error: { code: 'gateway/bad-request', message: 'remote calls expect named arguments', details: {} } };
+  }
+  const handler = Object.hasOwn(ENDPOINTS, endpoint) ? ENDPOINTS[endpoint] : undefined;
+  if (handler === undefined) {
+    return {
+      ok: false,
+      error: { code: 'gateway/method-unavailable', message: `no live service answers ${JSON.stringify(String(endpoint))} in this composition`, details: {} },
+    };
+  }
+  try {
+    return { ok: true, value: (await handler(args ?? {})) ?? null };
+  } catch (error) {
+    const code = error instanceof RemoteError ? error.code : 'gateway/internal';
+    return { ok: false, error: { code, message: String(error?.message ?? error), details: error?.details ?? {} } };
+  }
+}
+
+/// Whether this realm answers `endpoint`, so the plane routes to it.
+export function answers(endpoint) {
+  return Object.hasOwn(ENDPOINTS, endpoint);
+}

package/bin/compose-runtime/src/resolve.mjs

@@ -26,10 +26,22 @@ import { pathToFileURL } from 'node:url';
 import { payloadDir } from './payload.mjs';
 import provided from './provided-modules.json' with { type: 'json' };
 
-/// Payload-relative module map, keyed by bare specifier.
-///
-/// Mirrors `build_import_map` entry for entry, minus the `node:` shims.
+/// Payload-relative module map, keyed by bare specifier: what rebon owns and
+/// what its vendored payload is built from, together.
 export function payloadModules(dir) {
+  return new Map([...ownedModules(dir), ...vendoredModules(dir)]);
+}
+
+/// The specifiers rebon answers for every importer.
+export function ownedModules(dir) {
+  const at = (relative) => pathToFileURL(path.join(dir, relative)).href;
+  return new Map(Object.entries(provided.owned).map(([name, relative]) => [name, at(relative)]));
+}
+
+/// The vendored packages rebon's own payload imports. A package installed
+/// from npm brings its own copy of these and gets it; only one that has none
+/// falls back to the vendored build.
+export function vendoredModules(dir) {
   const at = (relative) => pathToFileURL(path.join(dir, relative)).href;
   return new Map(Object.entries(provided.payload).map(([name, relative]) => [name, at(relative)]));
 }
@@ -51,20 +63,25 @@ let installed;
 /// Returns the resolved map so callers can report what a specifier became
 /// without repeating the lookup rules.
 export function installModuleResolution({ dir = payloadDir(), extraModules = {} } = {}) {
-  const map = new Map([...payloadModules(dir), ...localModules()]);
+  const map = new Map([...ownedModules(dir), ...localModules()]);
   for (const [name, file] of Object.entries(extraModules)) {
     map.set(name, pathToFileURL(path.resolve(file)).href);
   }
+  const vendored = vendoredModules(dir);
   if (installed) {
     // Hooks are process-wide and cannot be unregistered per call; re-running
     // with a different map would leave two resolvers disagreeing about the
     // same specifier, which is a debugging trap rather than a feature.
     for (const [name, url] of map) installed.map.set(name, url);
-    return installed.map;
+    return new Map([...installed.vendored, ...installed.map]);
   }
 
   const payloadPrefix = pathToFileURL(dir.endsWith(path.sep) ? dir : dir + path.sep).href;
-  const state = { map };
+  const runtimePrefix = new URL('./', import.meta.url).href;
+  // Rebon's own code — the payload and this runtime — always gets the
+  // vendored build it was written against.
+  const ours = (parent) => parent === undefined || parent.startsWith(payloadPrefix) || parent.startsWith(runtimePrefix);
+  const state = { map, vendored };
   registerHooks({
     resolve(specifier, context, next) {
       // The native Cordis, where the host defines it (cordis-rs on Verve's
@@ -75,7 +92,16 @@ export function installModuleResolution({ dir = payloadDir(), extraModules = {}
       }
       const mapped = state.map.get(specifier);
       if (mapped !== undefined) return { url: mapped, format: 'module', shortCircuit: true };
-      return next(specifier, context);
+      const fallback = state.vendored.get(specifier);
+      if (fallback === undefined) return next(specifier, context);
+      if (ours(context?.parentURL)) return { url: fallback, format: 'module', shortCircuit: true };
+      // A package from npm: its own copy if it installed one — dsh's current
+      // packages need their own versions of these — else the vendored one.
+      try {
+        return next(specifier, context);
+      } catch {
+        return { url: fallback, format: 'module', shortCircuit: true };
+      }
     },
     // The payload's ESM is `.js` under no `package.json`, so Node's own rules
     // read it as CommonJS and every `import` in it is a syntax error. The
@@ -87,5 +113,5 @@ export function installModuleResolution({ dir = payloadDir(), extraModules = {}
     },
   });
   installed = state;
-  return state.map;
+  return new Map([...vendored, ...map]);
 }

package/bin/compose-runtime/src/subprocess-runtime.mjs

@@ -0,0 +1,169 @@
+// The composition's `ctx.subprocess` seat: dsh's subprocess seam, with rebon
+// starting the program.
+//
+// DeepSeek Harness's shell executors (`dsh-bash-local`, `dsh-pwsh-local`)
+// run commands through `ctx.subprocess.spawn(spec)`. dsh's own backend,
+// `dsh-subprocess-local`, is `child_process` plus native addons (node-pty,
+// and koffi for Windows job objects), none of which a plugin on Verve has.
+// So the realm answers the seam itself, and the program is started by rebon
+// through the `process` seat (`crates/rebon-plugin-host/src/process_seat.rs`):
+// on the shared host only, inside a composition tool call the person
+// allowed.
+//
+// The contract kept is dsh's (`@deepseek-ai/dsh-subprocess`): `spawn`
+// returns a live handle synchronously; `done` settles with
+// `{ exitCode, signal }`; collected streams are read by offset with
+// `readFrom`, keep their tail within `maxBytes`, and say when a read was
+// lossy; `terminate` (and the spec's abort signal) ends the program;
+// `waitForExit` waits for it. What is not offered is refused by name rather
+// than half-done: raw `pipe`/`inherit` streams, a control channel, spill
+// files and terminals.
+import { Service } from 'cordis';
+import { seat } from './bridge.mjs';
+
+class SubprocessError extends Error {
+  constructor(code, message) {
+    super(`${code} ${message}`);
+    this.code = code;
+    this.name = 'SubprocessError';
+  }
+}
+
+/// How long one `wait` holds on rebon's side before answering with nothing.
+const WAIT_SLICE_MS = 10_000;
+
+/// One collect-mode stream: the retained tail, by whole-stream byte offset.
+class Collected {
+  constructor(maxBytes) {
+    this.maxBytes = Math.max(0, Math.floor(maxBytes));
+    this.bytes = Buffer.alloc(0);
+    /** Whole-stream offset of `bytes[0]`. */
+    this.start = 0;
+  }
+
+  push(text, dropped = 0) {
+    if (dropped > 0) {
+      // 丢失发生在旧尾部之后；只保留新连续区间，否则 readFrom 会返回不存在的拼接。
+      this.start += this.bytes.length + dropped;
+      this.bytes = Buffer.alloc(0);
+    }
+    if (text.length === 0) return;
+    this.bytes = Buffer.concat([this.bytes, Buffer.from(text, 'utf8')]);
+    if (this.bytes.length > this.maxBytes) {
+      const excess = this.bytes.length - this.maxBytes;
+      this.bytes = this.bytes.subarray(excess);
+      this.start += excess;
+    }
+  }
+
+  /// dsh's `SubprocessOutputReader.readFrom`.
+  readFrom(fromByte) {
+    const end = this.start + this.bytes.length;
+    if (fromByte < this.start) {
+      return { text: this.bytes.toString('utf8'), nextOffset: end, lossy: true };
+    }
+    const at = Math.min(fromByte, end) - this.start;
+    return { text: this.bytes.subarray(at).toString('utf8'), nextOffset: end, lossy: false };
+  }
+}
+
+function collectMode(mode, stream) {
+  if (mode !== null && typeof mode === 'object' && Number.isFinite(mode.maxBytes)) return mode;
+  throw new SubprocessError(
+    '[UNSUPPORTED]',
+    `${stream} ${JSON.stringify(mode)} is not offered: rebon's subprocess seam collects output (\`{ maxBytes }\`)`,
+  );
+}
+
+export default class RebonSubprocess extends Service {
+  constructor(ctx) {
+    super(ctx, 'subprocess');
+  }
+
+  /// dsh `SubprocessRuntime.spawn`.
+  spawn(spec) {
+    const argv = spec?.argv;
+    if (!Array.isArray(argv) || argv.length === 0 || !argv.every((part) => typeof part === 'string')) {
+      throw new TypeError('subprocess.spawn needs a non-empty argv of strings');
+    }
+    const stdio = spec.stdio ?? {};
+    if (stdio.control !== undefined) {
+      throw new SubprocessError('[UNSUPPORTED]', 'a control channel is not offered by rebon\'s subprocess seam');
+    }
+    const stdin = stdio.stdin;
+    if (stdin !== 'ignore' && !(stdin !== null && typeof stdin === 'object' && typeof stdin.data === 'string')) {
+      throw new SubprocessError('[UNSUPPORTED]', `stdin ${JSON.stringify(stdin)} is not offered: use 'ignore' or { data }`);
+    }
+    const stdout = new Collected(collectMode(stdio.stdout, 'stdout').maxBytes);
+    const stderr = new Collected(collectMode(stdio.stderr, 'stderr').maxBytes);
+    // `undefined` is dsh's tombstone for an ambient entry; JSON says null.
+    const env = Object.fromEntries(Object.entries(spec.env ?? {}).map(([name, value]) => [name, value ?? null]));
+    const via = this.ctx;
+    let id;
+    let terminated = false;
+    let exited = false;
+    const exitWaiters = new Set();
+    const kill = () => {
+      if (id === undefined || exited) return;
+      void seat('process', 'kill', { id }, { via }).catch(() => {});
+    };
+    const onAbort = () => terminate();
+    const done = (async () => {
+      const started = await seat('process', 'spawn', {
+        argv: [...argv],
+        ...(typeof spec.cwd === 'string' ? { cwd: spec.cwd } : {}),
+        env,
+        ...(typeof stdin === 'object' ? { stdin: stdin.data } : {}),
+      }, { via });
+      id = started.id;
+      if (terminated) kill();
+      for (;;) {
+        const answer = await seat('process', 'wait', { id, timeoutMs: WAIT_SLICE_MS }, { via });
+        stdout.push(answer.stdout?.text ?? '', answer.stdout?.dropped ?? 0);
+        stderr.push(answer.stderr?.text ?? '', answer.stderr?.dropped ?? 0);
+        if (answer.exit !== null && answer.exit !== undefined) {
+          return { exitCode: answer.exit.exitCode ?? null, signal: answer.exit.signal ?? null };
+        }
+      }
+    })().finally(() => {
+      exited = true;
+      spec.signal?.removeEventListener?.('abort', onAbort);
+      for (const resolve of exitWaiters) resolve(true);
+      exitWaiters.clear();
+    });
+    const terminate = () => {
+      terminated = true;
+      kill();
+    };
+    if (spec.signal?.aborted) terminate();
+    spec.signal?.addEventListener?.('abort', onAbort, { once: true });
+    return {
+      stdin: undefined,
+      stdout: undefined,
+      stderr: undefined,
+      control: undefined,
+      collected: { stdout, stderr },
+      done,
+      terminate,
+      waitForExit(signal) {
+        if (exited) return Promise.resolve(true);
+        if (signal?.aborted) return Promise.resolve(false);
+        return new Promise((resolve) => {
+          const finish = (value) => {
+            exitWaiters.delete(finish);
+            signal?.removeEventListener?.('abort', abort);
+            resolve(value);
+          };
+          const abort = () => finish(false);
+          exitWaiters.add(finish);
+          signal?.addEventListener?.('abort', abort, { once: true });
+        });
+      },
+    };
+  }
+
+  /// dsh's terminal primitive, which rebon does not offer.
+  spawnTerminal() {
+    throw new SubprocessError('[UNSUPPORTED]', 'terminals are not offered by rebon\'s subprocess seam');
+  }
+}

package/bin/compose-runtime/src/systemprompt-runtime.mjs

@@ -13,15 +13,77 @@
 // to rebon with the rest of the load report, and withdrawn when the plugin
 // unloads.
 //
-// Deliberately NOT provided (v1 honesty boundary, unchanged): provider-function
-// `text` (dsh resolves it per assembly with an AssembleContext this side does
-// not have — a static composition registers static text), `complete` sections
-// (replacing rebon's own prompt belongs to the loop seat, not a side door),
-// `context()` / variables / tool-order surfaces. All fail loudly rather than
-// silently degrade.
+// Provider-function `text` is resolved once, when rebon asks the entry what it
+// registered — after the entry finished loading, so a section that says
+// something about the entry's own tools (`ctx.tools.get('read', scope)`) sees
+// them. It is resolved with an empty AssembleContext: rebon assembles one
+// prompt from what a composition reported, so the global, subject-less
+// answer is the one there is. A section whose text resolves empty
+// contributes nothing, as in dsh.
+//
+// Deliberately NOT provided (v1 honesty boundary, unchanged): `complete`
+// sections (replacing rebon's own prompt belongs to the loop seat, not a side
+// door), `context()` / variables / tool-order surfaces. All fail loudly rather
+// than silently degrade.
 import { Service } from 'cordis';
 import { sinkOf } from './registry.mjs';
 
+/** dsh's centrally allocated section positions (dsh-system-prompt
+ *  `SECTION_ORDERS`), so a package placing itself by name lands where it
+ *  would in dsh. */
+const SECTION_ORDERS = Object.freeze({
+  HARNESS_IDENTITY: -1000,
+  DEPLOYMENT_PERSONA_PREFIX: 0,
+  PLAN_POLICY: 500,
+  TEAM_POLICY: 600,
+  PTC_ONLY: 800,
+  FILE_REFERENCE: 900,
+  TOOL_BASH: 1000,
+  TOOL_PWSH: 1010,
+  TOOL_READ: 1100,
+  TOOL_WRITE: 1200,
+  TOOL_EDIT: 1300,
+  TOOL_GLOB: 1400,
+  TOOL_GREP: 1500,
+  TOOL_JOBS: 1600,
+  TOOL_PTY: 1700,
+  TOOL_WEB_SEARCH: 2000,
+  TOOL_WEB_FETCH: 2100,
+  TOOL_LSP: 2200,
+  TOOL_SESSION_QUERY: 2300,
+  TOOL_GOAL: 2400,
+  TOOL_WORKFLOW: 2600,
+  TOOL_RALPH: 2700,
+  TOOL_SUBAGENT: 2800,
+  TOOL_REPORT: 2900,
+  TOOL_COMPUTER_USE: 3000,
+  MCP_SERVERS: 3100,
+  TOOLS_SDK: 5000,
+  DELIVERABLE_FILE_REFERENCES: 9000,
+  STRUCTURED_OUTPUT: 9900,
+  HARNESS_SOURCE: 10000,
+  WEB_SURFACE: 10100,
+  DEPLOYMENT_PERSONA_SUFFIX: 10200,
+});
+
+/** dsh's runtime-context positions (`CONTEXT_ORDERS`). */
+const CONTEXT_ORDERS = Object.freeze({
+  WORKING_DIRECTORY: 100,
+  SANDBOX_POLICY: 110,
+  APPROVAL_POLICY: 115,
+  SUBAGENT_DELEGATION: 120,
+  TEAM_IDENTITY: 125,
+  HARNESS_SOURCE: 200,
+  WEB_SURFACE: 210,
+});
+
+function placement(table, kind, name) {
+  if (!Object.hasOwn(table, name)) {
+    throw new TypeError(`unknown prompt ${kind} placement ${JSON.stringify(name)}`);
+  }
+  return table[name];
+}
+
 export default class RebonSystemPromptRuntime extends Service {
   constructor(ctx) {
     super(ctx, 'systemPrompt');
@@ -37,13 +99,8 @@ export default class RebonSystemPromptRuntime extends Service {
     if (!Number.isFinite(entry.order)) {
       throw new TypeError(`prompt section "${name}" order must be a finite number`);
     }
-    if (typeof entry.text === 'function') {
-      throw new Error(
-        `prompt section "${name}": provider-function text is not supported in the composition (register static text)`,
-      );
-    }
-    if (typeof entry.text !== 'string') {
-      throw new TypeError(`prompt section "${name}" text must be a string`);
+    if (typeof entry.text !== 'string' && typeof entry.text !== 'function') {
+      throw new TypeError(`prompt section "${name}" text must be a string or a provider`);
     }
     if (entry.complete) {
       throw new Error(
@@ -64,4 +121,14 @@ export default class RebonSystemPromptRuntime extends Service {
       };
     });
   }
+
+  /** dsh `getSectionOrder`: a section's centrally owned position. */
+  getSectionOrder(name) {
+    return placement(SECTION_ORDERS, 'section', name);
+  }
+
+  /** dsh `getContextOrder`: a runtime context's centrally owned position. */
+  getContextOrder(name) {
+    return placement(CONTEXT_ORDERS, 'context', name);
+  }
 }

package/bin/compose-runtime/src/tools-runtime.mjs

@@ -148,6 +148,17 @@ export default class RebonToolsRuntime extends Service {
     return { kind: 'exclusive' };
   }
 
+  /**
+   * dsh `ToolRuntime.get`: the definition registered under `name` in this
+   * composition, or undefined. The scope is accepted and not consulted:
+   * rebon offers a composition's tools to every session alike, so the
+   * global answer is the scoped one. A prompt section that mentions a tool
+   * only while it exists asks this.
+   */
+  get(name, _scope) {
+    return this.defs.get(name);
+  }
+
   /**
    * Register one dsh-shaped tool definition. Mirrors dsh
    * `ToolRuntime.register` validation; returns the exact disposer.
@@ -222,7 +233,17 @@ export default class RebonToolsRuntime extends Service {
       // On the plane that is a published event: the tool is telling rebon
       // something happened, and rebon decides who hears it.
       agent: {
+        // The session's scope is the agent's identity here: rebon's engine
+        // runs the turn, and the scope is what rebon calls its session.
+        id: callCtx.scopeId,
         session: {
+          id: callCtx.scopeId,
+          // What a dsh tool reads off the session's header: its id (the
+          // shell exports it as `DSH_SESSION_ID`) and where it started.
+          header: Object.freeze({ id: callCtx.scopeId, cwd: callCtx.workspaceRoot }),
+          // A session's model request settings are rebon's own; a tool that
+          // asks finds none and takes its default.
+          requestHeader: () => undefined,
           append(type, data) {
             void publish(SESSION_APPEND_TOPIC, { type, data, tool: name, callId })
               .catch(() => {});