@rebon/cli-win32-x64 1.2.0 → 1.4.0

package/payload/compose-runtime/payload-manifests.json

@@ -1,48 +1,48 @@
-{
-  "version": 1,
-  "note": "What rebon declares on behalf of the packages it ships. Every plugin on the plane loads against a manifest — the ceiling on what it may register and reach — and a third-party package declares its own under `capabilities.kernelPlugins` in its `rebon-plugin.json`. These packages are vendored into rebon's payload, so rebon is the one that has to say what they do. `root` names which package the `entry` is relative to. It defaults to `package`, which in this table means the vendored JS tree an entry belongs to; `payload` says the same thing explicitly, and `runtime` names the composition runtime itself. `invokableTools: \"$rebon/tools\"` expands to every tool this build exposes to the plane — the honest declaration for a plugin that runs whatever tool a model picks.",
-  "packages": {
-    "cordis": { "entry": "vendor/cordis/index.js" },
-    "@deepseek-ai/cordis-plugin-timer": { "entry": "vendor/dsh/timer.js" },
-    "@deepseek-ai/cordis-plugin-logger-console": { "entry": "vendor/dsh/logger-console.js" },
-
-    "@deepseek-ai/dsh-llm-deepseek": {
-      "entry": "vendor/dsh/llm-deepseek.js",
-      "llmProviders": ["deepseek-official"],
-      "seats": ["credentials"]
-    },
-    "@deepseek-ai/dsh-tool-todo": {
-      "entry": "vendor/dsh/tool-todo.js",
-      "tools": ["todo_write"],
-      "publishedTopics": ["compose:session/append"]
-    },
-    "@deepseek-ai/dsh-tool-web": {
-      "entry": "vendor/dsh/tool-web.js",
-      "tools": ["web_search", "web_fetch"],
-      "invokableTools": ["WebSearch", "WebFetch"],
-      "publishedTopics": ["compose:session/append"]
-    },
-    "@deepseek-ai/dsh-web-search-exa": {
-      "entry": "vendor/dsh/web-search-exa.js",
-      "services": ["web:search:exa"],
-      "seats": ["credentials"]
-    },
-
-    "@deepseek-ai/dsh-session": { "entry": "vendor/dsh/session.js" },
-    "@deepseek-ai/dsh-agent": { "entry": "vendor/dsh/agent.js" },
-    "@deepseek-ai/dsh-system-prompt": { "entry": "vendor/dsh/system-prompt.js" },
-    "@deepseek-ai/dsh-agent-loop": {
-      "entry": "vendor/dsh/agent-loop.js",
-      "invokableTools": "$rebon/tools",
-      "seats": ["credentials"]
-    },
-
-    "rebon-loop-assembly": {
-      "root": "runtime",
-      "entry": "src/loop-assembly.mjs",
-      "services": ["loop:control"],
-      "publishedTopics": ["loop:event", "loop:agent-error", "loop:agent-created"],
-      "seats": ["logger"]
-    }
-  }
-}
+{
+  "version": 1,
+  "note": "What rebon declares on behalf of the packages it ships. Every plugin on the plane loads against a manifest — the ceiling on what it may register and reach — and a third-party package declares its own under `capabilities.kernelPlugins` in its `rebon-plugin.json`. These packages are vendored into rebon's payload, so rebon is the one that has to say what they do. `root` names which package the `entry` is relative to. It defaults to `package`, which in this table means the vendored JS tree an entry belongs to; `payload` says the same thing explicitly, and `runtime` names the composition runtime itself. `invokableTools: \"$rebon/tools\"` expands to every tool this build exposes to the plane — the honest declaration for a plugin that runs whatever tool a model picks.",
+  "packages": {
+    "cordis": { "entry": "vendor/cordis/index.js" },
+    "@deepseek-ai/cordis-plugin-timer": { "entry": "vendor/dsh/timer.js" },
+    "@deepseek-ai/cordis-plugin-logger-console": { "entry": "vendor/dsh/logger-console.js" },
+
+    "@deepseek-ai/dsh-llm-deepseek": {
+      "entry": "vendor/dsh/llm-deepseek.js",
+      "llmProviders": ["deepseek-official"],
+      "seats": ["credentials"]
+    },
+    "@deepseek-ai/dsh-tool-todo": {
+      "entry": "vendor/dsh/tool-todo.js",
+      "tools": ["todo_write"],
+      "publishedTopics": ["compose:session/append"]
+    },
+    "@deepseek-ai/dsh-tool-web": {
+      "entry": "vendor/dsh/tool-web.js",
+      "tools": ["web_search", "web_fetch"],
+      "invokableTools": ["WebSearch", "WebFetch"],
+      "publishedTopics": ["compose:session/append"]
+    },
+    "@deepseek-ai/dsh-web-search-exa": {
+      "entry": "vendor/dsh/web-search-exa.js",
+      "services": ["web:search:exa"],
+      "seats": ["credentials"]
+    },
+
+    "@deepseek-ai/dsh-session": { "entry": "vendor/dsh/session.js" },
+    "@deepseek-ai/dsh-agent": { "entry": "vendor/dsh/agent.js" },
+    "@deepseek-ai/dsh-system-prompt": { "entry": "vendor/dsh/system-prompt.js" },
+    "@deepseek-ai/dsh-agent-loop": {
+      "entry": "vendor/dsh/agent-loop.js",
+      "invokableTools": "$rebon/tools",
+      "seats": ["credentials"]
+    },
+
+    "rebon-loop-assembly": {
+      "root": "runtime",
+      "entry": "src/loop-assembly.mjs",
+      "services": ["loop:control"],
+      "publishedTopics": ["loop:event", "loop:agent-error", "loop:agent-created"],
+      "seats": ["logger"]
+    }
+  }
+}

package/payload/compose-runtime/src/bridge.mjs

@@ -1,195 +1,193 @@
-// The composition's doorway to rebon, on the plugin plane.
-//
-// On deno_core this was `js/bridge.js`: seven synchronous ops reaching a
-// kernel that lived in the same process. Across a process boundary none of
-// that survives unchanged, and the differences are the protocol's, not this
-// module's:
-//
-//   * **Everything is async.** `callService` returned a value from an op; a
-//     `seat/call` is a request that has to be answered. The one place this
-//     bites is a cordis disposer, which is synchronous and cannot await — see
-//     the note on `seat()` below.
-//   * **There is no ambient kernel.** A call is only meaningful inside the
-//     scope incarnation it was made for, so the doorway exists only inside a
-//     handler. `AsyncLocalStorage` is what carries the handler's context down
-//     to code that has no way to be handed it — a dsh credential provider is
-//     called by an adapter that knows nothing about rebon.
-//   * **Registration is not a call.** `op_rebon_call_service('model-router',
-//     'register', …)` and its compensating `unregister` are gone. What a
-//     composition provides is reported once, in the `plugin/load` ready
-//     report, and revoked by `plugin/unload` draining. That is the only shape
-//     that works: the unregisters lived in cordis disposers.
-import { AsyncLocalStorage } from 'node:async_hooks';
-import { sessionOf } from './registry.mjs';
-
-const calls = new AsyncLocalStorage();
-
-/// Runs `fn` with `ctx` as the call everything underneath reaches through.
-///
-/// Every handler the composition serves — service, tool, llm adapter, event
-/// delivery — is wrapped in this, so anything it calls can find its way back
-/// to rebon without the call context being threaded through dsh code that has
-/// no parameter for it.
-export function withCall(ctx, fn) {
-  return calls.run(ctx, fn);
-}
-
-/// The call this code is running inside.
-export function currentCall() {
-  return calls.getStore();
-}
-
-/// The call this code is running inside, or a refusal that says why not.
-///
-/// The refusal is worth its own code: "cannot read properties of undefined" at
-/// the bottom of a dsh stack says nothing, whereas this names the actual rule —
-/// rebon is reachable from inside a call, and a disposer or a module top level
-/// is not inside one.
-function require(what, via) {
-  const ctx = calls.getStore();
-  if (ctx !== undefined) return ctx;
-  // Nothing is being answered, so this is a plugin acting on its own schedule.
-  // `via` is the Cordis context of the plugin whose code is running, and the
-  // session it is attached to is the honest identity for what it does — the
-  // work is still that plugin's, in that session. Without a session there is
-  // no identity to use, and inventing one would make the ledger a guess.
-  const session = sessionOf(via);
-  if (session !== undefined) return session;
-  throw new Error(
-    `[NO_CALL_CONTEXT] ${what} is not reachable from here: no call rebon made is in flight, `
-      + 'and this plugin is not attached to a session. Teardown paths must rely on unload draining instead',
-  );
-}
-
-/// Calls a kernel seat: the composition's `credentials`, `settings`, `web` and
-/// the rest of what rebon installs a plugin to use.
-///
-/// A request, therefore answerable, therefore **not** usable from a cordis
-/// disposer: `dispose()` is synchronous and a cross-process call cannot be.
-/// Nothing in the composition needs it to be — the calls that used to happen
-/// on the way out were unregistrations, and those are the protocol's job now.
-export function seat(name, method, params = null, options = {}) {
-  const { via, ...call } = options;
-  return require(`seat ${JSON.stringify(name)}`, via).seat(name, method, params, call);
-}
-
-/// Invokes one rebon core tool on the session this call belongs to.
-///
-/// Three gates stand in front of it and only the first is here: the plugin's
-/// manifest must declare the tool, rebon's build must expose it, and the
-/// embedder's broker decides whether this run is permitted.
-export function invokeTool(tool, input = null, options = {}) {
-  const { via, ...call } = options;
-  return require(`tool ${JSON.stringify(tool)}`, via).invoke(tool, input, call);
-}
-
-/// Publishes one event onto rebon's event plane.
-///
-/// Not the same thing as `emit` below, and the difference is the audience: a
-/// chunk is a piece of the answer the caller of *this* call is reading, an
-/// event is a fact anyone listening may act on. The composition's runtime
-/// events — a dsh tool body appending to the session log — are the second kind.
-///
-/// Declared as `publishedTopics` in the manifest, separately from what the
-/// composition listens to.
-export function publish(topic, event = null, options = {}) {
-  const { via, ...call } = options;
-  return require(`topic ${JSON.stringify(topic)}`, via).publish(topic, event, call);
-}
-
-/// Emits one piece of a streamed answer on the call this code is serving.
-///
-/// This is the transport `op_llm_emit` and `op_tool_serve_emit` used to be,
-/// with the pumps gone: a chunk belongs to a call, and the call is the one the
-/// handler was entered with rather than an id looked up in a table.
-export function emit(piece) {
-  return require('emit').emit(piece);
-}
-
-/// The workspace root of the session this call belongs to, or undefined
-/// outside a call.
-export function workspaceRoot() {
-  return calls.getStore()?.workspaceRoot;
-}
-
-/// The abort signal rebon raises when it asks this call to stop.
-export function callSignal() {
-  return calls.getStore()?.signal;
-}
-
-/// Diagnostics.
-///
-/// Best-effort on purpose, and never a reason for a call to fail: a log line
-/// that cannot be delivered is not worth failing the work that produced it.
-/// Inside a call it goes to the kernel's `logger` seat, so the line is
-/// attributed to a scope; outside one it goes to stderr, which the supervisor
-/// already collects as the host's diagnostic tail. stdout is never touched —
-/// that is the protocol's channel.
-/// A token bucket per level, so one plugin in a logging loop cannot fill the
-/// worker's log.
-///
-/// Here rather than on rebon's side because the cheapest byte is the one that
-/// never crosses the process boundary, and because this side already knows how
-/// many it dropped. Drops are reported, at most once a second: replacing a
-/// blind spot with a quieter blind spot is not an improvement, and a reader who
-/// sees a gap deserves to know it is a gap.
-const RATE = { perSecond: 20, burst: 100 };
-const buckets = new Map();
-
-function admit(level) {
-  const now = Date.now();
-  let bucket = buckets.get(level);
-  if (bucket === undefined) {
-    bucket = { tokens: RATE.burst, last: now, dropped: 0, reportedAt: 0 };
-    buckets.set(level, bucket);
-  }
-  bucket.tokens = Math.min(
-    RATE.burst,
-    bucket.tokens + ((now - bucket.last) / 1000) * RATE.perSecond,
-  );
-  bucket.last = now;
-  if (bucket.tokens >= 1) {
-    bucket.tokens -= 1;
-    return { allowed: true, dropped: 0 };
-  }
-  bucket.dropped += 1;
-  if (now - bucket.reportedAt >= 1000) {
-    bucket.reportedAt = now;
-    const dropped = bucket.dropped;
-    bucket.dropped = 0;
-    return { allowed: false, dropped };
-  }
-  return { allowed: false, dropped: 0 };
-}
-
-const LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
-export const logger = Object.freeze(Object.fromEntries(LEVELS.map((level) => [
-  level,
-  (message, options = {}) => {
-    const line = String(message);
-    // Inside a call, that call is who is speaking. Outside one — a timer, an
-    // agent loop driving its own turn — `via` names the plugin, and the
-    // session it is attached to is the handle that can still reach the seat.
-    //
-    // This is the same ladder `require()` climbs, with one difference that
-    // matters: it does not throw. A log line is not worth failing a plugin
-    // over, and a refusal here would be the very silence this is fixing.
-    // T19/T19b lost three rounds to lines that went to stderr and were only
-    // ever read when the host died.
-    const ctx = calls.getStore() ?? sessionOf(options.via);
-    if (ctx === undefined) {
-      process.stderr.write(`[compose:${level}] ${line}\n`);
-      return;
-    }
-    const { allowed, dropped } = admit(level);
-    if (dropped > 0) {
-      void ctx
-        .seat('logger', 'warn', { message: `${dropped} ${level} line(s) dropped: too many, too fast` })
-        .catch(() => {});
-    }
-    if (!allowed) return;
-    void ctx.seat('logger', level, { message: line }).catch(() => {
-      process.stderr.write(`[compose:${level}] ${line}\n`);
-    });
-  },
-])));
+// The composition's doorway to rebon, on the plugin plane.
+//
+// The plane is across a process boundary, so there are no synchronous ops
+// into an in-process kernel here. Three consequences follow, and they are the
+// protocol's rather than this module's:
+//
+//   * **Everything is async.** `callService` returned a value from an op; a
+//     `seat/call` is a request that has to be answered. The one place this
+//     bites is a cordis disposer, which is synchronous and cannot await — see
+//     the note on `seat()` below.
+//   * **There is no ambient kernel.** A call is only meaningful inside the
+//     scope incarnation it was made for, so the doorway exists only inside a
+//     handler. `AsyncLocalStorage` is what carries the handler's context down
+//     to code that has no way to be handed it — a dsh credential provider is
+//     called by an adapter that knows nothing about rebon.
+//   * **Registration is not a call.** What a composition provides is
+//     reported once, in the `plugin/load` ready report, and revoked by
+//     `plugin/unload` draining. It has to be that shape: a compensating
+//     `unregister` would have to run from a cordis disposer, and a disposer
+//     cannot await the answer.
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { sessionOf } from './registry.mjs';
+
+const calls = new AsyncLocalStorage();
+
+/// Runs `fn` with `ctx` as the call everything underneath reaches through.
+///
+/// Every handler the composition serves — service, tool, llm adapter, event
+/// delivery — is wrapped in this, so anything it calls can find its way back
+/// to rebon without the call context being threaded through dsh code that has
+/// no parameter for it.
+export function withCall(ctx, fn) {
+  return calls.run(ctx, fn);
+}
+
+/// The call this code is running inside.
+export function currentCall() {
+  return calls.getStore();
+}
+
+/// The call this code is running inside, or a refusal that says why not.
+///
+/// The refusal is worth its own code: "cannot read properties of undefined" at
+/// the bottom of a dsh stack says nothing, whereas this names the actual rule —
+/// rebon is reachable from inside a call, and a disposer or a module top level
+/// is not inside one.
+function require(what, via) {
+  const ctx = calls.getStore();
+  if (ctx !== undefined) return ctx;
+  // Nothing is being answered, so this is a plugin acting on its own schedule.
+  // `via` is the Cordis context of the plugin whose code is running, and the
+  // session it is attached to is the honest identity for what it does — the
+  // work is still that plugin's, in that session. Without a session there is
+  // no identity to use, and inventing one would make the ledger a guess.
+  const session = sessionOf(via);
+  if (session !== undefined) return session;
+  throw new Error(
+    `[NO_CALL_CONTEXT] ${what} is not reachable from here: no call rebon made is in flight, `
+      + 'and this plugin is not attached to a session. Teardown paths must rely on unload draining instead',
+  );
+}
+
+/// Calls a kernel seat: the composition's `credentials`, `settings`, `web` and
+/// the rest of what rebon installs a plugin to use.
+///
+/// A request, therefore answerable, therefore **not** usable from a cordis
+/// disposer: `dispose()` is synchronous and a cross-process call cannot be.
+/// Nothing in the composition needs it to be — the calls that used to happen
+/// on the way out were unregistrations, and those are the protocol's job now.
+export function seat(name, method, params = null, options = {}) {
+  const { via, ...call } = options;
+  return require(`seat ${JSON.stringify(name)}`, via).seat(name, method, params, call);
+}
+
+/// Invokes one rebon core tool on the session this call belongs to.
+///
+/// Three gates stand in front of it and only the first is here: the plugin's
+/// manifest must declare the tool, rebon's build must expose it, and the
+/// embedder's broker decides whether this run is permitted.
+export function invokeTool(tool, input = null, options = {}) {
+  const { via, ...call } = options;
+  return require(`tool ${JSON.stringify(tool)}`, via).invoke(tool, input, call);
+}
+
+/// Publishes one event onto rebon's event plane.
+///
+/// Not the same thing as `emit` below, and the difference is the audience: a
+/// chunk is a piece of the answer the caller of *this* call is reading, an
+/// event is a fact anyone listening may act on. The composition's runtime
+/// events — a dsh tool body appending to the session log — are the second kind.
+///
+/// Declared as `publishedTopics` in the manifest, separately from what the
+/// composition listens to.
+export function publish(topic, event = null, options = {}) {
+  const { via, ...call } = options;
+  return require(`topic ${JSON.stringify(topic)}`, via).publish(topic, event, call);
+}
+
+/// Emits one piece of a streamed answer on the call this code is serving.
+///
+/// This is the transport `op_llm_emit` and `op_tool_serve_emit` used to be,
+/// with the pumps gone: a chunk belongs to a call, and the call is the one the
+/// handler was entered with rather than an id looked up in a table.
+export function emit(piece) {
+  return require('emit').emit(piece);
+}
+
+/// The workspace root of the session this call belongs to, or undefined
+/// outside a call.
+export function workspaceRoot() {
+  return calls.getStore()?.workspaceRoot;
+}
+
+/// The abort signal rebon raises when it asks this call to stop.
+export function callSignal() {
+  return calls.getStore()?.signal;
+}
+
+/// Diagnostics.
+///
+/// Best-effort on purpose, and never a reason for a call to fail: a log line
+/// that cannot be delivered is not worth failing the work that produced it.
+/// Inside a call it goes to the kernel's `logger` seat, so the line is
+/// attributed to a scope; outside one it goes to stderr, which the supervisor
+/// already collects as the host's diagnostic tail. stdout is never touched —
+/// that is the protocol's channel.
+/// A token bucket per level, so one plugin in a logging loop cannot fill the
+/// worker's log.
+///
+/// Here rather than on rebon's side because the cheapest byte is the one that
+/// never crosses the process boundary, and because this side already knows how
+/// many it dropped. Drops are reported, at most once a second: replacing a
+/// blind spot with a quieter blind spot is not an improvement, and a reader who
+/// sees a gap deserves to know it is a gap.
+const RATE = { perSecond: 20, burst: 100 };
+const buckets = new Map();
+
+function admit(level) {
+  const now = Date.now();
+  let bucket = buckets.get(level);
+  if (bucket === undefined) {
+    bucket = { tokens: RATE.burst, last: now, dropped: 0, reportedAt: 0 };
+    buckets.set(level, bucket);
+  }
+  bucket.tokens = Math.min(
+    RATE.burst,
+    bucket.tokens + ((now - bucket.last) / 1000) * RATE.perSecond,
+  );
+  bucket.last = now;
+  if (bucket.tokens >= 1) {
+    bucket.tokens -= 1;
+    return { allowed: true, dropped: 0 };
+  }
+  bucket.dropped += 1;
+  if (now - bucket.reportedAt >= 1000) {
+    bucket.reportedAt = now;
+    const dropped = bucket.dropped;
+    bucket.dropped = 0;
+    return { allowed: false, dropped };
+  }
+  return { allowed: false, dropped: 0 };
+}
+
+const LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
+export const logger = Object.freeze(Object.fromEntries(LEVELS.map((level) => [
+  level,
+  (message, options = {}) => {
+    const line = String(message);
+    // Inside a call, that call is who is speaking. Outside one — a timer, an
+    // agent loop driving its own turn — `via` names the plugin, and the
+    // session it is attached to is the handle that can still reach the seat.
+    //
+    // This is the same ladder `require()` climbs, with one difference that
+    // matters: it does not throw. A log line is not worth failing a plugin over,
+    // and a line that goes to stderr is only ever read when the host dies — the
+    // very silence this is fixing.
+    const ctx = calls.getStore() ?? sessionOf(options.via);
+    if (ctx === undefined) {
+      process.stderr.write(`[compose:${level}] ${line}\n`);
+      return;
+    }
+    const { allowed, dropped } = admit(level);
+    if (dropped > 0) {
+      void ctx
+        .seat('logger', 'warn', { message: `${dropped} ${level} line(s) dropped: too many, too fast` })
+        .catch(() => {});
+    }
+    if (!allowed) return;
+    void ctx.seat('logger', level, { message: line }).catch(() => {
+      process.stderr.write(`[compose:${level}] ${line}\n`);
+    });
+  },
+])));

package/payload/compose-runtime/src/credentials-runtime.mjs

@@ -1,50 +1,50 @@
-// The composition's `ctx.credentials` seat, on the plugin plane.
-//
-// dsh configuration carries credential *references* (environment-variable
-// names); the provider owns the values. This resolves a reference through
-// rebon's `credentials` seat, whose `resolveEnv` runs the fail-closed
-// authorize waterfall before touching the environment — so an unauthorized or
-// unset reference is simply "absent", and the consumer's own missing-credential
-// diagnosis fires (dsh-llm's `MISSING_CREDENTIAL`) instead of this seat
-// inventing one.
-//
-// Ported from `js/compose/credentials-runtime.js`. The one change is that the
-// seat call is now a request across a process boundary, which means it is
-// awaited — and that it can only be made from inside a call rebon is waiting
-// on, or by the plugin being attached to a session. Both hold where a
-// credential is actually wanted: inside a model turn rebon asked for, or inside
-// one an agent loop is running in a session of its own. `bridge.mjs` names the
-// refusal if anything ever tries from a disposer or a module top level.
-import { Service } from 'cordis';
-import { seat } from './bridge.mjs';
-
-export default class RebonCredentials extends Service {
-  constructor(ctx) {
-    super(ctx, 'credentials');
-  }
-
-  /** dsh CredentialProvider.resolve: `{value, source}` or undefined. */
-  async resolve(ref) {
-    try {
-      // `via` is this seat's caller — the plugin whose code wants the
-      // credential. Inside a call that changes nothing; outside one it is what
-      // lets an agent loop's own model turn resolve a key at all, attributed to
-      // the plugin and session it belongs to.
-      const out = await seat('credentials', 'resolveEnv', { ref: String(ref) }, { via: this.ctx });
-      const value = out?.value;
-      if (typeof value === 'string' && value.length > 0) {
-        return { value, source: 'env' };
-      }
-    } catch {
-      // A refusal from the seat (no authorizer, unset variable, bad ref) and
-      // an absent value are the same fact to a consumer: not configured here.
-    }
-    return undefined;
-  }
-
-  /** dsh CredentialProvider.describe: facts only, never the value. */
-  async describe(ref) {
-    const hit = await this.resolve(ref);
-    return { configured: hit !== undefined, ...(hit ? { source: hit.source } : {}), writable: false };
-  }
-}
+// The composition's `ctx.credentials` seat, on the plugin plane.
+//
+// dsh configuration carries credential *references* (environment-variable
+// names); the provider owns the values. This resolves a reference through
+// rebon's `credentials` seat, whose `resolveEnv` runs the fail-closed
+// authorize waterfall before touching the environment — so an unauthorized or
+// unset reference is simply "absent", and the consumer's own missing-credential
+// diagnosis fires (dsh-llm's `MISSING_CREDENTIAL`) instead of this seat
+// inventing one.
+//
+// Ported from `js/compose/credentials-runtime.js`. The one change is that the
+// seat call is now a request across a process boundary, which means it is
+// awaited — and that it can only be made from inside a call rebon is waiting
+// on, or by the plugin being attached to a session. Both hold where a
+// credential is actually wanted: inside a model turn rebon asked for, or inside
+// one an agent loop is running in a session of its own. `bridge.mjs` names the
+// refusal if anything ever tries from a disposer or a module top level.
+import { Service } from 'cordis';
+import { seat } from './bridge.mjs';
+
+export default class RebonCredentials extends Service {
+  constructor(ctx) {
+    super(ctx, 'credentials');
+  }
+
+  /** dsh CredentialProvider.resolve: `{value, source}` or undefined. */
+  async resolve(ref) {
+    try {
+      // `via` is this seat's caller — the plugin whose code wants the
+      // credential. Inside a call that changes nothing; outside one it is what
+      // lets an agent loop's own model turn resolve a key at all, attributed to
+      // the plugin and session it belongs to.
+      const out = await seat('credentials', 'resolveEnv', { ref: String(ref) }, { via: this.ctx });
+      const value = out?.value;
+      if (typeof value === 'string' && value.length > 0) {
+        return { value, source: 'env' };
+      }
+    } catch {
+      // A refusal from the seat (no authorizer, unset variable, bad ref) and
+      // an absent value are the same fact to a consumer: not configured here.
+    }
+    return undefined;
+  }
+
+  /** dsh CredentialProvider.describe: facts only, never the value. */
+  async describe(ref) {
+    const hit = await this.resolve(ref);
+    return { configured: hit !== undefined, ...(hit ? { source: hit.source } : {}), writable: false };
+  }
+}