@rebon/cli-win32-x64 0.23.2 → 1.0.0

package/README.md

@@ -29,7 +29,7 @@ an optional dependency. Supported platforms: `win32-x64`, `darwin-x64`,
 rebon
 
 # Resume a previous session
-rebon --resume sess-0-1712937600000
+rebon --resume k7m2q-4xr9t-hb3wz-p8ncv
 
 # Override the active provider / model
 rebon --provider openrouter --model gpt-5.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebon/cli-win32-x64",
-  "version": "0.23.2",
+  "version": "1.0.0",
   "description": "Agent cli for coding and more.",
   "license": "MIT OR Apache-2.0",
   "engines": {

package/payload/compose-runtime/src/bridge.mjs

@@ -125,16 +125,69 @@ export function callSignal() {
 /// attributed to a scope; outside one it goes to stderr, which the supervisor
 /// already collects as the host's diagnostic tail. stdout is never touched —
 /// that is the protocol's channel.
+/// A token bucket per level, so one plugin in a logging loop cannot fill the
+/// worker's log.
+///
+/// Here rather than on rebon's side because the cheapest byte is the one that
+/// never crosses the process boundary, and because this side already knows how
+/// many it dropped. Drops are reported, at most once a second: replacing a
+/// blind spot with a quieter blind spot is not an improvement, and a reader who
+/// sees a gap deserves to know it is a gap.
+const RATE = { perSecond: 20, burst: 100 };
+const buckets = new Map();
+
+function admit(level) {
+  const now = Date.now();
+  let bucket = buckets.get(level);
+  if (bucket === undefined) {
+    bucket = { tokens: RATE.burst, last: now, dropped: 0, reportedAt: 0 };
+    buckets.set(level, bucket);
+  }
+  bucket.tokens = Math.min(
+    RATE.burst,
+    bucket.tokens + ((now - bucket.last) / 1000) * RATE.perSecond,
+  );
+  bucket.last = now;
+  if (bucket.tokens >= 1) {
+    bucket.tokens -= 1;
+    return { allowed: true, dropped: 0 };
+  }
+  bucket.dropped += 1;
+  if (now - bucket.reportedAt >= 1000) {
+    bucket.reportedAt = now;
+    const dropped = bucket.dropped;
+    bucket.dropped = 0;
+    return { allowed: false, dropped };
+  }
+  return { allowed: false, dropped: 0 };
+}
+
 const LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
 export const logger = Object.freeze(Object.fromEntries(LEVELS.map((level) => [
   level,
-  (message) => {
+  (message, options = {}) => {
     const line = String(message);
-    const ctx = calls.getStore();
+    // Inside a call, that call is who is speaking. Outside one — a timer, an
+    // agent loop driving its own turn — `via` names the plugin, and the
+    // session it is attached to is the handle that can still reach the seat.
+    //
+    // This is the same ladder `require()` climbs, with one difference that
+    // matters: it does not throw. A log line is not worth failing a plugin
+    // over, and a refusal here would be the very silence this is fixing.
+    // T19/T19b lost three rounds to lines that went to stderr and were only
+    // ever read when the host died.
+    const ctx = calls.getStore() ?? sessionOf(options.via);
     if (ctx === undefined) {
       process.stderr.write(`[compose:${level}] ${line}\n`);
       return;
     }
+    const { allowed, dropped } = admit(level);
+    if (dropped > 0) {
+      void ctx
+        .seat('logger', 'warn', { message: `${dropped} ${level} line(s) dropped: too many, too fast` })
+        .catch(() => {});
+    }
+    if (!allowed) return;
     void ctx.seat('logger', level, { message: line }).catch(() => {
       process.stderr.write(`[compose:${level}] ${line}\n`);
     });

package/payload/plugin-host/src/cli.mjs

@@ -3,6 +3,7 @@ import { pathToFileURL } from 'node:url';
 import { NdjsonDecoder, SerializedWriter } from './framing.mjs';
 import { PluginHost } from './host.mjs';
 import { loadPlugin } from './loader.mjs';
+import { currentOwner } from './ownership.mjs';
 import { ProtocolError } from './protocol.mjs';
 
 export function diagnostic(stream, code, message) {
@@ -84,7 +85,48 @@ export async function runHost({ input, output, error, loader }) {
   }
 }
 
+/// A rejection nobody handled, said out loud instead of swallowed, and
+/// attributed where the async chain reaches back to an entry.
+///
+/// Node does not stop this process for one, and before T20 nothing else looked
+/// either: a plugin could start an async task, have it fail, and leave no trace
+/// anywhere rebon reads. Three rounds of T19 were spent on exactly that.
+///
+/// T20 recorded these as unattributed, believing a failed promise cannot say
+/// who created it. It can: `plugin/load` runs inside a store that survives
+/// timers, microtasks and awaits, so this handler reads the owner straight out
+/// of it. What escapes the chain — through an `EventEmitter`, a native callback
+/// or a third-party library — is still `unattributed`, which is the truthful
+/// answer and is kept distinct from a wrong one.
+///
+/// It never exits. A stray rejection in one plugin must not take down a host
+/// other plugins are being served from; a load still in flight is failed by its
+/// own path instead, which is the caller's to run.
+export function installRejectionDiagnostic(stream) {
+  process.on('unhandledRejection', (reason) => {
+    const first = String(reason?.stack ?? reason ?? '').split('\n')[0];
+    const owner = currentOwner();
+    if (owner === undefined) {
+      diagnostic(stream, 'unhandled_rejection', `unattributed: ${first}`);
+      return;
+    }
+    // `loading` says which of the two this is. While a load is in flight the
+    // entry did not install correctly and nothing depends on it yet, so the
+    // load fails and the composition skips it with a reason. Afterwards the
+    // plugin stays ready: a load that already succeeded cannot be un-failed,
+    // and tearing down a plane other entries serve from would cost far more
+    // than the one bad promise.
+    if (owner.loading) {
+      owner.rejection = first;
+      diagnostic(stream, 'unhandled_rejection', `plugin=${owner.entry} during load: ${first}`);
+      return;
+    }
+    diagnostic(stream, 'unhandled_rejection', `plugin=${owner.entry}: ${first}`);
+  });
+}
+
 if (import.meta.url === pathToFileURL(process.argv[1]).href) {
+  installRejectionDiagnostic(process.stderr);
   const flag = process.argv.indexOf('--loader');
   const specifier = flag >= 0 ? process.argv[flag + 1] : process.env.REBON_PLUGIN_LOADER;
   let loader;

package/payload/plugin-host/src/host.mjs

@@ -2,7 +2,8 @@ import { randomUUID } from 'node:crypto';
 import { createPluginBridge } from './bridge.mjs';
 import { CallLedger } from './lifecycle.mjs';
 import { loadPlugin } from './loader.mjs';
-import { eventDelivery, eventEmitRequest, eventSubscribeRequest, llmStreamRequest, pluginLoadRequest, pluginUnloadRequest, seatCallRequest, serviceCallRequest, toolInvokeRequest } from './methods.mjs';
+import { asEntryLoad } from './ownership.mjs';
+import { commandInvokeRequest, eventDelivery, eventEmitRequest, eventSubscribeRequest, llmControlRequest, llmStreamRequest, pluginLoadRequest, pluginUnloadRequest, seatCallRequest, serviceCallRequest, toolInvokeRequest } from './methods.mjs';
 import { FramingError } from './framing.mjs';
 import { CALL_CANCEL_METHOD, chunk as chunkFrame, identityOf, isPlatformControl, ProtocolError, terminal } from './protocol.mjs';
 
@@ -335,6 +336,8 @@ export class PluginHost {
       case 'service/call': return this.#planServiceCall(value);
       case 'event/deliver': return this.#planEventDeliver(value);
       case 'llm/stream': return this.#planLlmStream(value);
+      case 'llm/control': return this.#planLlmControl(value);
+      case 'command/invoke': return this.#planCommandInvoke(value);
       case 'tool/call': return this.#planToolCall(value);
       default: return { error: new ProtocolError('unknown_method', 'method is not supported by this host slice') };
     }
@@ -431,7 +434,10 @@ export class PluginHost {
     const request = pluginLoadRequest(value.message.payload);
     const current = this.#plugins.get(request.pluginId);
     if (current && current.phase !== 'unloaded') throw new ProtocolError('[PLUGIN_ALREADY_LOADED]', `plugin ${request.pluginId} is already loaded`);
-    return { run: async () => {
+    // Wrapped so an async task this plugin starts can be traced back to it,
+    // and so a rejection that arrives while the load is still in flight is
+    // known to be this load's rather than someone else's later work.
+    return { run: () => asEntryLoad(request.pluginId, async () => {
       const loaded = await this.load(request);
       this.#plugins.set(request.pluginId, {
         phase: 'ready',
@@ -441,6 +447,7 @@ export class PluginHost {
         topicHandlers: loaded.topicHandlers,
         llmAdapters: loaded.llmAdapters ?? new Map(),
         toolHandlers: loaded.toolHandlers ?? new Map(),
+        commandHandlers: loaded.commandHandlers ?? new Map(),
         // The consuming direction: what this plugin may call, from the
         // manifest alone.
         tools: new Set(request.invokableTools),
@@ -455,9 +462,11 @@ export class PluginHost {
         services: [...loaded.services],
         eventTopics: [...loaded.eventTopics],
         llmProviders: [...(loaded.llmProviders ?? [])],
+        llmAdapters: { ...(loaded.llmAdapterInfo ?? {}) },
         tools: [...(loaded.tools ?? [])],
+        commands: [...(loaded.commands ?? [])],
       };
-    } };
+    }) };
   }
 
   // Draining, not deleting: routing stops immediately and whatever was already
@@ -591,6 +600,64 @@ export class PluginHost {
     } };
   }
 
+  // Something about the conversation around an adapter's turns, rather than
+  // about one turn. An adapter that keeps no state has nothing to do with any
+  // of the three signals, so a missing handler is not an error — the answer is
+  // the same either way, and refusing would make every stateless provider
+  // implement a no-op to stay loadable.
+  #planLlmControl(value) {
+    this.#requireInitialized();
+    if (isPlatformControl(value)) throw new ProtocolError('scope_identity_required', 'llm/control cannot use control identity');
+    const request = llmControlRequest(value.message.payload);
+    const current = this.#plugins.get(value.plugin_id);
+    if (!current) throw new ProtocolError('[UNKNOWN_PLUGIN]', `plugin ${value.plugin_id} is not loaded`);
+    if (current.phase !== 'ready') throw new ProtocolError('[STALE_PROVIDER]', `plugin ${value.plugin_id} is ${current.phase}`);
+    const adapter = current.llmAdapters.get(request.provider);
+    if (!adapter) throw new ProtocolError('[UNKNOWN_PROVIDER]', `plugin ${value.plugin_id} has no adapter for ${request.provider}`);
+    return { run: async () => {
+      current.inFlight.add(value.call_id);
+      const { ctx, close } = this.#contextFor(value);
+      try {
+        return typeof adapter.control === 'function'
+          ? await adapter.control(request.signal, ctx) ?? null
+          : null;
+      } finally {
+        close();
+        current.inFlight.delete(value.call_id);
+        if (current.phase === 'draining' && current.inFlight.size === 0) await this.#retire(value.plugin_id, current);
+      }
+    } };
+  }
+
+  // A slash command someone typed. Like a tool call in direction and unlike it
+  // in audience: the answer is text for the person who typed it, so there is
+  // no schema to validate against and no permission to have asked for — the
+  // person asking *is* the permission.
+  //
+  // Only a `prompt` command has a handler here. An `explain` and a `panel`
+  // answered at registration, so rebon never sends one.
+  #planCommandInvoke(value) {
+    this.#requireInitialized();
+    if (isPlatformControl(value)) throw new ProtocolError('scope_identity_required', 'command/invoke cannot use control identity');
+    const request = commandInvokeRequest(value.message.payload);
+    const current = this.#plugins.get(value.plugin_id);
+    if (!current) throw new ProtocolError('[UNKNOWN_PLUGIN]', `plugin ${value.plugin_id} is not loaded`);
+    if (current.phase !== 'ready') throw new ProtocolError('[STALE_PROVIDER]', `plugin ${value.plugin_id} is ${current.phase}`);
+    const handler = current.commandHandlers.get(request.name);
+    if (!handler) throw new ProtocolError('[UNKNOWN_COMMAND]', `plugin ${value.plugin_id} does not provide command ${request.name}`);
+    return { run: async () => {
+      current.inFlight.add(value.call_id);
+      const { ctx, close } = this.#contextFor(value);
+      try {
+        return await handler(request, ctx) ?? null;
+      } finally {
+        close();
+        current.inFlight.delete(value.call_id);
+        if (current.phase === 'draining' && current.inFlight.size === 0) await this.#retire(value.plugin_id, current);
+      }
+    } };
+  }
+
   // The mirror of a service call: rebon is the caller and the plugin owns the
   // tool. Whether the user permitted this run was settled before it got here.
   #planToolCall(value) {

package/payload/plugin-host/src/loader.mjs

@@ -13,7 +13,7 @@
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { ProtocolError } from './protocol.mjs';
-import { pluginToolDefinition, validateName } from './methods.mjs';
+import { pluginCommandDefinition, pluginToolDefinition, validateName } from './methods.mjs';
 
 /// Resolves an entry against its package root and refuses anything outside it.
 ///
@@ -30,14 +30,36 @@ export function resolveEntry(root, entry) {
 }
 
 class Registrar {
-  #declaredServices; #declaredTopics; #declaredProviders; #declaredTools;
+  #declaredServices; #declaredTopics; #declaredProviders; #declaredTools; #declaredCommands;
+  #commands = new Map(); #commandHandlers = new Map();
   #services = new Map(); #topics = new Map(); #adapters = new Map();
+  #adapterInfo = new Map();
   #tools = new Map(); #toolHandlers = new Map(); #scopes = []; #sealed = false;
-  constructor(declaredServices, declaredTopics, declaredProviders, declaredTools) {
+  constructor(declaredServices, declaredTopics, declaredProviders, declaredTools, declaredCommands) {
     this.#declaredServices = new Set(declaredServices);
     this.#declaredTopics = new Set(declaredTopics);
     this.#declaredProviders = new Set(declaredProviders);
     this.#declaredTools = new Set(declaredTools);
+    this.#declaredCommands = new Set(declaredCommands);
+  }
+
+  /// A command is a tool for a person: the manifest declares the name, and
+  /// the registration says what it looks like in a menu. Only a `prompt`
+  /// command carries a handler — an `explain` says its sentence at
+  /// registration and a `panel` names a dialog, so neither has anything left
+  /// to ask the plugin at invoke time.
+  #admitCommand(definition, handler) {
+    if (this.#sealed) throw new ProtocolError('[REGISTRATION_CLOSED]', 'a command was registered after activation finished');
+    const command = pluginCommandDefinition(definition);
+    if (!this.#declaredCommands.has(command.name)) throw new ProtocolError('[UNAUTHORIZED_REGISTER]', `command ${JSON.stringify(command.name)} is not declared by this plugin's manifest`);
+    if (this.#commands.has(command.name)) throw new ProtocolError('[DUPLICATE_DECLARATION]', `command ${JSON.stringify(command.name)} is registered twice`);
+    if (command.kind.type === 'prompt') {
+      if (typeof handler !== 'function') throw new ProtocolError('[WRONG_SHAPE]', `prompt command ${JSON.stringify(command.name)} needs a function`);
+      this.#commandHandlers.set(command.name, handler);
+    } else if (handler !== undefined) {
+      throw new ProtocolError('[WRONG_SHAPE]', `${command.kind.type} command ${JSON.stringify(command.name)} takes no handler`);
+    }
+    this.#commands.set(command.name, command);
   }
 
   /// A tool differs from a service in one way that matters: it has to be
@@ -78,8 +100,24 @@ class Registrar {
       // An llm adapter is a service under a different routing key: declared in
       // the manifest, registered here, and answered with chunks instead of one
       // value.
-      llm: (provider, adapter) => this.#admit('provider', provider, adapter, this.#declaredProviders, this.#adapters),
+      //
+      // The optional third argument is what the adapter says about itself —
+      // which models, which default, what the provider can do. It is reported
+      // once with the ready report rather than asked for per turn, because a
+      // caller has to know whether a provider streams reasoning text before it
+      // decides how to budget the turn it is about to send. Opaque to the
+      // host: reading it is the model layer's business.
+      llm: (provider, adapter, info) => {
+        this.#admit('provider', provider, adapter, this.#declaredProviders, this.#adapters);
+        if (info !== undefined) {
+          if (info === null || typeof info !== 'object' || Array.isArray(info)) {
+            throw new ProtocolError('[WRONG_SHAPE]', `adapter info for ${JSON.stringify(provider)} must be a plain object`);
+          }
+          this.#adapterInfo.set(provider, info);
+        }
+      },
       tool: (definition, handler) => this.#admitTool(definition, handler),
+      command: (definition, handler) => this.#admitCommand(definition, handler),
       // Not a capability, so nothing to declare: everything a scope handle can
       // do is gated by the declarations above. What it is, is a lifetime — the
       // session, rather than one call inside it. A plugin that produces facts
@@ -100,7 +138,10 @@ class Registrar {
       services: Object.freeze([...this.#services.keys()]),
       eventTopics: Object.freeze([...this.#topics.keys()]),
       llmProviders: Object.freeze([...this.#adapters.keys()]),
+      llmAdapterInfo: Object.freeze(Object.fromEntries(this.#adapterInfo)),
       tools: Object.freeze([...this.#tools.values()]),
+      commands: Object.freeze([...this.#commands.values()]),
+      commandHandlers: this.#commandHandlers,
       serviceHandlers: this.#services,
       topicHandlers: this.#topics,
       llmAdapters: this.#adapters,
@@ -131,7 +172,7 @@ export async function loadPlugin(request, importModule = (url) => import(url)) {
   if (typeof activate !== 'function') {
     throw new ProtocolError('[NO_ACTIVATE]', `plugin entry ${request.entry} exports no activate function`);
   }
-  const registrar = new Registrar(request.services, request.eventTopics, request.llmProviders, request.tools);
+  const registrar = new Registrar(request.services, request.eventTopics, request.llmProviders, request.tools, request.commands);
   try {
     await activate(registrar.api(), request.config);
   } catch (cause) {

package/payload/plugin-host/src/methods.mjs

@@ -18,6 +18,15 @@ export const EVENT_UNSUBSCRIBE_METHOD = 'event/unsubscribe';
 export const EVENT_EMIT_METHOD = 'event/emit';
 export const TOOL_INVOKE_METHOD = 'tool/invoke';
 export const LLM_STREAM_METHOD = 'llm/stream';
+export const LLM_CONTROL_METHOD = 'llm/control';
+export const COMMAND_INVOKE_METHOD = 'command/invoke';
+// The surfaces a command can say it works on, and the two groupings a menu
+// knows. Closed sets, mirroring `rebon-slash-commands`.
+export const COMMAND_SURFACES = Object.freeze(['tui', 'desktop', 'acp', 'web', 'mobile']);
+export const COMMAND_CATEGORIES = Object.freeze(['command', 'agent']);
+// The conversation-level signals an adapter can be told about. A closed set:
+// an open string would make every unknown signal look like a typo.
+export const LLM_CONTROL_SIGNALS = Object.freeze(['reset', 'endTurn', 'invalidate']);
 export const TOOL_CALL_METHOD = 'tool/call';
 export const SEAT_CALL_METHOD = 'seat/call';
 
@@ -112,8 +121,64 @@ function declarations(value, kind, where) {
   return Object.freeze([...value]);
 }
 
+// A command as a plugin describes it: one-to-one with `CommandSpec`, minus
+// the two kinds a plugin may not claim (`native` has no front-end function to
+// map an id to, `session` is rebon's own engine state).
+export function pluginCommandDefinition(input) {
+  shape(input, ['name', 'description', 'kind'], ['aliases', 'zhAliases', 'hint', 'category', 'surfaces'], 'command definition');
+  const name = validateName('command', string(input.name, 'name'));
+  for (const alias of input.aliases ?? []) validateName('command', string(alias, 'alias'));
+  for (const alias of input.zhAliases ?? []) validateName('command', string(alias, 'zh alias'));
+  const description = string(input.description, 'description');
+  if (description.length === 0) throw new ProtocolError('[EMPTY_DESCRIPTION]', `command ${JSON.stringify(name)} has no description`);
+  if (byteLength(description) > MAX_DESCRIPTION_BYTES) throw new ProtocolError('[DESCRIPTION_TOO_LONG]', `command ${JSON.stringify(name)} has a description over the ${MAX_DESCRIPTION_BYTES} byte limit`);
+  if (input.category !== undefined && !COMMAND_CATEGORIES.includes(input.category)) {
+    throw new ProtocolError('[WRONG_SHAPE]', `command category must be one of ${COMMAND_CATEGORIES.join(', ')}`);
+  }
+  for (const surface of input.surfaces ?? []) {
+    if (!COMMAND_SURFACES.includes(surface)) {
+      throw new ProtocolError('[WRONG_SHAPE]', `command surface must be one of ${COMMAND_SURFACES.join(', ')}`);
+    }
+  }
+  const kind = input.kind;
+  if (!plain(kind)) throw new ProtocolError('[WRONG_SHAPE]', 'command kind must be a plain object');
+  switch (kind.type) {
+    case 'prompt':
+      shape(kind, ['type'], [], 'command kind');
+      break;
+    case 'explain': {
+      shape(kind, ['type', 'text'], [], 'command kind');
+      const text = string(kind.text, 'kind text');
+      if (text.length === 0) throw new ProtocolError('[EMPTY_DESCRIPTION]', `command ${JSON.stringify(name)} explains nothing`);
+      break;
+    }
+    case 'panel':
+      shape(kind, ['type', 'dialog'], [], 'command kind');
+      validateName('dialog', string(kind.dialog, 'kind dialog'));
+      break;
+    default:
+      throw new ProtocolError('[WRONG_SHAPE]', 'command kind must be prompt, explain or panel');
+  }
+  return Object.freeze({ ...input });
+}
+
+function commandDefinitions(value, where) {
+  if (value === undefined) return Object.freeze([]);
+  if (!Array.isArray(value)) throw new ProtocolError('[WRONG_SHAPE]', `${where} must be an array`);
+  if (value.length > MAX_DECLARATIONS) throw new ProtocolError('[TOO_MANY_DECLARATIONS]', `${where} declares ${value.length} entries, over the ${MAX_DECLARATIONS} limit`);
+  const seen = new Set();
+  const out = [];
+  for (const entry of value) {
+    const command = pluginCommandDefinition(entry);
+    if (seen.has(command.name)) throw new ProtocolError('[DUPLICATE_DECLARATION]', `${where} declares ${JSON.stringify(command.name)} twice`);
+    seen.add(command.name);
+    out.push(command);
+  }
+  return Object.freeze(out);
+}
+
 export function pluginLoadRequest(input) {
-  shape(input, ['pluginId', 'root', 'entry'], ['services', 'eventTopics', 'publishedTopics', 'llmProviders', 'tools', 'invokableTools', 'seats', 'config'], 'plugin/load payload');
+  shape(input, ['pluginId', 'root', 'entry'], ['services', 'eventTopics', 'publishedTopics', 'llmProviders', 'tools', 'commands', 'invokableTools', 'seats', 'config'], 'plugin/load payload');
   return Object.freeze({
     pluginId: validatePluginId(string(input.pluginId, 'pluginId')),
     root: validateAbsolutePath('root', string(input.root, 'root')),
@@ -125,6 +190,10 @@ export function pluginLoadRequest(input) {
     publishedTopics: declarations(input.publishedTopics, 'topic', 'publishedTopics'),
     llmProviders: declarations(input.llmProviders, 'provider', 'llmProviders'),
     tools: declarations(input.tools, 'tool', 'tools'),
+    // Command names only. What a command looks like in a menu comes with the
+    // registration; the name is the reviewable part, and the part that can
+    // collide with a built-in.
+    commands: declarations(input.commands, 'command', 'commands'),
     // The one declared list with no registered counterpart: a plugin calls
     // these rather than providing them, which is why its name says so.
     invokableTools: declarations(input.invokableTools, 'tool', 'invokableTools'),
@@ -160,14 +229,41 @@ function toolDefinitions(value, where) {
   return Object.freeze(out);
 }
 
+// What each adapter says about itself, keyed by the provider it serves. The
+// values stay opaque — the wire layer decides only whether a route may be
+// served, and `llmProviders` answers that — so the only rule here is that a
+// description must belong to a route the same report claims.
+function llmAdapters(value, providers, where) {
+  if (value === undefined) return Object.freeze({});
+  if (!plain(value)) throw new ProtocolError('[WRONG_SHAPE]', `${where} must be a plain object`);
+  const declared = new Set(providers);
+  for (const provider of Object.keys(value)) {
+    validateName('provider', provider);
+    if (!declared.has(provider)) {
+      throw new ProtocolError('[UNDECLARED_ADAPTER]', `adapter info describes provider ${JSON.stringify(provider)}, which this report does not serve`);
+    }
+  }
+  return Object.freeze({ ...value });
+}
+
 export function pluginReadyReport(input) {
-  shape(input, ['pluginId'], ['services', 'eventTopics', 'llmProviders', 'tools'], 'plugin/load terminal payload');
+  shape(input, ['pluginId'], ['services', 'eventTopics', 'llmProviders', 'llmAdapters', 'tools', 'commands'], 'plugin/load terminal payload');
+  // Field order, not convenience order: a payload with two problems has to
+  // report the same one here and in Rust, and `llmAdapters` is checked against
+  // `llmProviders` so the providers have to be read first — but not before the
+  // fields Rust reads before them.
+  const pluginId = validatePluginId(string(input.pluginId, 'pluginId'));
+  const services = declarations(input.services, 'service', 'services');
+  const eventTopics = declarations(input.eventTopics, 'topic', 'eventTopics');
+  const providers = declarations(input.llmProviders, 'provider', 'llmProviders');
   return Object.freeze({
-    pluginId: validatePluginId(string(input.pluginId, 'pluginId')),
-    services: declarations(input.services, 'service', 'services'),
-    eventTopics: declarations(input.eventTopics, 'topic', 'eventTopics'),
-    llmProviders: declarations(input.llmProviders, 'provider', 'llmProviders'),
+    pluginId,
+    services,
+    eventTopics,
+    llmProviders: providers,
+    llmAdapters: llmAdapters(input.llmAdapters, providers, 'llmAdapters'),
     tools: toolDefinitions(input.tools, 'tools'),
+    commands: commandDefinitions(input.commands, 'commands'),
   });
 }
 
@@ -230,6 +326,29 @@ export function llmStreamRequest(input) {
   return Object.freeze({ provider: validateName('provider', string(input.provider, 'provider')), request: input.request });
 }
 
+export function llmControlRequest(input) {
+  shape(input, ['provider', 'signal'], [], 'llm/control payload');
+  // Provider first, matching the Rust validator's field order.
+  const provider = validateName('provider', string(input.provider, 'provider'));
+  const signal = string(input.signal, 'signal');
+  if (!LLM_CONTROL_SIGNALS.includes(signal)) {
+    throw new ProtocolError('[UNKNOWN_LLM_SIGNAL]', `llm control signal ${JSON.stringify(signal)} is not one of ${LLM_CONTROL_SIGNALS.join(', ')}`);
+  }
+  return Object.freeze({ provider, signal });
+}
+
+export function commandInvokeRequest(input) {
+  shape(input, ['name', 'raw', 'rest', 'surface'], [], 'command/invoke payload');
+  const name = validateName('command', string(input.name, 'name'));
+  const raw = string(input.raw, 'raw');
+  const rest = string(input.rest, 'rest');
+  const surface = string(input.surface, 'surface');
+  if (!COMMAND_SURFACES.includes(surface)) {
+    throw new ProtocolError('[WRONG_SHAPE]', `surface must be one of ${COMMAND_SURFACES.join(', ')}`);
+  }
+  return Object.freeze({ name, raw, rest, surface });
+}
+
 export function seatCallRequest(input) {
   shape(input, ['seat', 'method', 'params'], [], 'seat/call payload');
   return Object.freeze({
@@ -252,5 +371,7 @@ export const VALIDATORS = Object.freeze({
   event_emit: eventEmitRequest,
   tool_invoke: toolInvokeRequest,
   llm_stream: llmStreamRequest,
+  llm_control: llmControlRequest,
+  command_invoke: commandInvokeRequest,
   seat_call: seatCallRequest,
 });

package/payload/plugin-host/src/ownership.mjs

@@ -0,0 +1,57 @@
+// Which entry a stray promise belonged to.
+//
+// Node does not stop this process for an unhandled rejection, and before T20
+// nothing looked either: a plugin could start an async task, have it fail, and
+// leave no trace anywhere rebon reads. T20 made it visible but unattributed,
+// on the belief that a failed promise cannot say who created it.
+//
+// Measured on Node 24.19.0, it can. An `AsyncLocalStorage` store survives
+// `setTimeout`, `queueMicrotask` and `await`, and the `unhandledRejection`
+// handler reads it directly — so wrapping each `plugin/load` is enough, with no
+// per-promise `async_hooks` and therefore no standing cost.
+//
+// **The store follows the async chain, not the clock**, and that distinction is
+// the whole reason `loading` exists. A timer started during `apply` that
+// rejects ten seconds later still carries its entry, long after that load
+// returned. So there are two questions, not one:
+//
+//   * whose is it — `entry`, always, whenever the chain reaches back;
+//   * does it fail the load — `loading`, true only while the load is in flight,
+//     because a load that already succeeded cannot be un-failed.
+//
+// The flag is flipped on the same object rather than by entering a second
+// store: a new store would not be seen by promises already rooted in the first.
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+const owners = new AsyncLocalStorage();
+
+/// Runs `fn` as `entry`'s work, with the load marked in flight for its
+/// duration. Returns whatever `fn` returns; the flag is cleared either way,
+/// because a load that threw is over too.
+export async function asEntryLoad(entry, fn) {
+  const store = { entry, loading: true };
+  try {
+    const value = await owners.run(store, fn);
+    // One turn of the loop before deciding. `unhandledRejection` fires after
+    // the microtask queue drains, so a task this load started that failed
+    // immediately has not been reported yet at the moment `fn` resolves —
+    // checking without this yield would call a broken load a good one.
+    await new Promise((resolve) => setImmediate(resolve));
+    if (store.rejection !== undefined) {
+      throw new Error(`[ENTRY_FAILED] ${entry} left a rejection unhandled while loading: ${store.rejection}`);
+    }
+    return value;
+  } finally {
+    store.loading = false;
+  }
+}
+
+/// The entry whose async chain this code is on, or `undefined` outside one.
+///
+/// Undefined is normal and not a failure: a rejection can escape the chain
+/// through an `EventEmitter`, a native callback or a third-party library, and
+/// "could not be determined" is a truthful answer worth keeping distinct from a
+/// wrong one.
+export function currentOwner() {
+  return owners.getStore();
+}