@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/harness/boot.js

@@ -11,6 +11,7 @@ import { BACKGROUND_CONTEXT } from "@earendil-works/chord/context";
 import { join } from "node:path";
 import { Harness, } from "@earendil-works/pi-durable";
 import { openNodeSqliteStorage } from "@earendil-works/pi-durable/storage/sqlite/node";
+import { effectiveMethods } from "../config.js";
 import { wireActivity } from "./activity.js";
 import { createScheduleTask } from "../jobs/task.js";
 import { createJobsService, jobWireOf } from "../jobs/index.js";
@@ -29,6 +30,7 @@ import { modelGuidanceExtension } from "./sections/model-guidance.js";
 import { createSkillsExtension } from "../skills/index.js";
 import { SLASH_COMMANDS } from "../server/commands.js";
 import { packagePromptRootsOf } from "../commands/templates.js";
+import { blocksToolsExtension } from "./blocks/tools.js";
 import { codingToolsExtension, searchToolsExtension } from "./tools.js";
 import { collectProviders, createProviderMergeSink, } from "./providers/index.js";
 import { EventHub } from "../server/events/hub.js";
@@ -36,10 +38,24 @@ import { providerAuthStatus } from "../server/helpers.js";
 import { bootRefresh, DEFAULT_REFRESH_TIMEOUT_MS, refreshProvider, } from "./providers/refresh.js";
 import { startProviderRefresh } from "./providers/scheduler.js";
 import { fileModelsStore } from "./providers/models-store.js";
-import { packagesDirOf } from "./packages.js";
+import { packagesDirOf, selfPackageRoot } from "./packages.js";
+import { resolveHelper } from "../sandbox/helper.js";
+import { launchInJail } from "../sandbox/launch.js";
+import { buildUserPolicy, defaultModuleTrees } from "../sandbox/policy.js";
+import { lookupOsAccount } from "../sandbox/os-account.js";
+import { agentEnv } from "./agent-env.js";
+import { UserServices } from "./user-services.js";
+import { resolveWorkerEntry, sandboxLauncher, WorkerPool } from "../sandbox/pool.js";
+import { IsolationState } from "../sandbox/isolation.js";
+import { probeOsUsers } from "../sandbox/availability.js";
+import { createAdmissionGuard } from "./identity/users.js";
+import { SessionMetaDoc } from "../server/session-meta.js";
+import { probeIsolation, runHelperProbe, selfTestHelper, } from "../sandbox/availability.js";
 import { resolveBuiltins, } from "./builtins.js";
 import { createRegistry } from "./registry.js";
+import { isUserEntryName, rewriteSelection, sweepUserSelections, UserToolRegistry, } from "./user-tools.js";
 import { defaultSettingsDir, SettingsStore } from "./settings.js";
+import { resolveRefreshMinutes, snapshotRestartKeys, } from "../settings/pending.js";
 import { ensureStoreRoots, resolveStoreRoots, sharedExtensionStores, } from "./stores.js";
 import { createWorkspaceService, defaultWorkspacePrefs, toHarnessEnv, } from "./workspace.js";
 /** The idle sweep cadence (spec §2: ONE host-owned 1s interval). */
@@ -93,6 +109,35 @@ export async function openHarness(config, options = {}) {
     // store-root resolution immediately below, and the provider
     // collector further down (`providerEnv`).
     const env = options.env ?? process.env;
+    const coreRoot = selfPackageRoot();
+    const isolation = await (options.isolationProbe ?? probeIsolation)({
+        platform: process.platform,
+        helper: coreRoot === undefined ? undefined : resolveHelper(env, coreRoot),
+        runProbe: runHelperProbe,
+        selfTest: selfTestHelper,
+    });
+    console.log(`sandbox isolation: ${isolation.available ? `available (Landlock ABI ${isolation.abi})` : `unavailable (${isolation.reason ?? "unknown reason"})`}`);
+    if (coreRoot === undefined)
+        throw new Error("sandbox worker entry requires the sigrun package root");
+    const workerEntry = resolveWorkerEntry(coreRoot);
+    const helper = isolation.helper;
+    const osUsers = !config.isolation.osUsers
+        ? { available: false, status: "off" }
+        : options.osUsersProbe !== undefined
+            ? await options.osUsersProbe(helper ?? "")
+            : helper === undefined || !isolation.available
+                ? { available: false, status: "osUsers requires CAP_SETUID" }
+                : await probeOsUsers(helper);
+    const sandboxPool = new WorkerPool({
+        launcher: options.sandboxLauncher ?? ((policy) => {
+            if (helper === undefined)
+                throw new Error("sandbox helper not found");
+            return sandboxLauncher(helper, workerEntry)(policy);
+        }),
+        idleMinutes: () => settingsStore?.read().server?.isolation?.workerIdleMinutes ?? config.isolation.workerIdleMinutes,
+        log: (line) => console.warn(line),
+        workerEntry,
+    });
     // Store-root lifecycle (spec §6): every durable root except cache
     // exists before anything touches disk — storage, the registry's
     // first install, extension packages — so a fresh deploy (or a PVC
@@ -124,6 +169,39 @@ export async function openHarness(config, options = {}) {
     // I/O here (each file materializes on its first write), so this is
     // pure construction over paths boot already owns.
     const identity = options.identity ?? openIdentityStores(roots);
+    // The caller-supplied host wins (serving spec §1: `serve()` resolves
+    // the ONE effective host — options.host → SIGRUN_LISTEN_HOST →
+    // DEFAULT_LISTEN_HOST — and passes it here). The env read below is
+    // NOT a second source on the serve path (the option is always set
+    // there); it remains for direct `openHarness` callers that never
+    // bind a listener (tests) and must derive the same auth posture.
+    const listenHost = options.listenHost ?? env.SIGRUN_LISTEN_HOST ?? "0.0.0.0";
+    const methods = effectiveMethods(config.auth, listenHost);
+    const isolationState = new IsolationState({
+        mode: config.isolation.mode,
+        availability: isolation,
+        userCount: () => identity.users.list().length,
+        log: (line) => console.warn(line),
+    });
+    // These refusals happen during openHarness, before createServer/listen.
+    if (identity.users.list().length >= 2 && methods.length === 0) {
+        throw new Error("multi-user requires authentication: configure SIGRUN_AUTH=token or SIGRUN_AUTH=proxy, or remove users until only one remains");
+    }
+    if ((isolationState.active() || config.isolation.mode === "always") &&
+        methods.includes("proxy") &&
+        config.auth.proxy.secretHeader === undefined) {
+        throw new Error("isolation with proxy authentication requires server.auth.proxy.secretHeader; configure a shared-secret header or disable isolation");
+    }
+    identity.users.configureAdmission({
+        firstWorkspace: config.workspace.path,
+        admit: createAdmissionGuard({
+            isolation,
+            mode: config.isolation.mode,
+            methods,
+            proxySecretHeader: config.auth.proxy.secretHeader,
+        }),
+    });
+    isolationState.active();
     // The unclaimed onboarding posture (W1 Task 4, spec §5.8): every
     // unclaimed boot (re)ensures the setup code under the pod-local cache
     // root and logs it ONCE — the retrieval flow is `kubectl logs … | grep
@@ -140,8 +218,63 @@ export async function openHarness(config, options = {}) {
         const code = await ensureSetupCode(identity.cacheDir, env);
         console.log(`sigrun setup code: ${code}`);
     }
+    const managedPaths = {
+        roots,
+        storagePath: config.storagePath,
+        coreRoot,
+        userAreas: (user) => join(roots.dataDir, "users", user),
+    };
+    const userServices = new UserServices({
+        launch: (policy, command, args, serviceEnv) => {
+            if (helper === undefined)
+                throw new Error("sandbox helper not found");
+            return launchInJail(helper, policy, command, args, serviceEnv);
+        },
+        policyFor: (user) => {
+            const record = identity.users.get(user);
+            if (record === undefined)
+                return { reason: `unknown user "${user}"` };
+            let osAccount;
+            if (record.osUser !== undefined) {
+                if (!osUsers.available)
+                    return { reason: "osUser requires CAP_SETUID" };
+                try {
+                    osAccount = lookupOsAccount(record.osUser);
+                }
+                catch {
+                    return { reason: `OS account not found: ${record.osUser}` };
+                }
+                if (osAccount === undefined)
+                    return { reason: `OS account not found: ${record.osUser}` };
+            }
+            const built = buildUserPolicy(record, {
+                managed: managedPaths,
+                nodeBinDir: process.execPath,
+                moduleTrees: defaultModuleTrees(coreRoot),
+                ...(osAccount === undefined ? {} : { osAccount }),
+            });
+            if (!built.ok)
+                return { reason: built.reason };
+            if (!isolationState.active()) {
+                const serviceEnv = agentEnv(env);
+                delete serviceEnv.SSH_AUTH_SOCK;
+                serviceEnv.HOME = built.policy.home;
+                serviceEnv.TMPDIR = built.policy.tmp;
+                serviceEnv.USER = user;
+                return { ...built.policy, env: serviceEnv };
+            }
+            return built.policy;
+        },
+        isolationActive: () => isolationState.active(),
+        now: () => Date.now(),
+        managed: managedPaths,
+    });
     const storage = await openNodeSqliteStorage(config.storagePath);
     const registry = createRegistry();
+    // Late-filled by the loader: factories publish through the same registry
+    // instance, and selection rewrites read the declared set LIVE.
+    const perUserSlugs = [];
+    const userTools = new UserToolRegistry(registry, () => perUserSlugs);
     // The skills convention's package roots (W5 Task 4, spec §9.4): a LATE
     // array — the extension packages that contribute skill dirs load BELOW
     // (after this install), and the section renders per REQUEST, so the
@@ -203,6 +336,10 @@ export async function openHarness(config, options = {}) {
     registry.install(createSkillsExtension(skillsOptions));
     registry.install(codingToolsExtension);
     registry.install(searchToolsExtension);
+    // The chat-blocks tools (UI-blocks U5 Task 1, spec §8.1): every agent
+    // can show and update interactive block surfaces in chat — the same
+    // core-owned slot as the coding/search tools, never quarantined.
+    registry.install(blocksToolsExtension);
     // Extension packages load before `Harness.open` reads the registry
     // (spec §3 boot order). Failures quarantine and boot continues. §3
     // factory-result producers are retained alongside the outcomes (Task 9e).
@@ -210,17 +347,31 @@ export async function openHarness(config, options = {}) {
     // loader resolves against FIRST (the settings file's `packages`
     // declarations install here — see src/harness/packages.ts).
     const packagesDir = options.packagesDir ?? packagesDirOf(options.settingsDir ?? defaultSettingsDir());
-    // Built-in extensions (Task 2, pi parity): codemode, MCP and tool
-    // search ship with core. Resolution needs the settings FILE (the
+    // Built-in extensions ship with core. Resolution needs the settings FILE (the
     // `builtinExtensions` toggles live there), so the store is constructed
     // HERE — before the loader — and the one instance threads on to the
     // rest of boot (its `harnessSettings()` call below stays the single
-    // construction).
-    const settingsStore = new SettingsStore({ dir: options.settingsDir });
+    // construction). The onWrite observer (U4 §13.2) fires `settingsStore`
+    // writes' change events through a boot-owned sink assigned below (the
+    // hub does not exist yet here — a late-bound closure keeps the store
+    // constructor pure while every committed write still publishes).
+    const settingsChangedSinks = [];
+    const settingsStore = new SettingsStore({
+        dir: options.settingsDir,
+        onWrite: (keys) => {
+            for (const sink of settingsChangedSinks)
+                sink("server", keys);
+        },
+    });
     // Eager validation (the fail-loud boot posture, matching the
     // `harnessSettings()` contract below): a malformed settings file
     // throws HERE even when the caller seam overrides every field.
     const bootSettings = settingsStore.read();
+    // The pending-restart boot snapshot (U4 §13.2): taken ONCE, after the
+    // settings load validates and before anything else reads it — the
+    // diff base `GET /v1/settings`'s `pendingRestart` reports. Pre-listen
+    // by construction: openHarness returns before serve listens.
+    const settingsBootSnapshot = snapshotRestartKeys(bootSettings);
     const builtinsEnabled = options.builtins !== false;
     // Skipped entirely (no resolution, no log lines) when the caller
     // turns built-ins off.
@@ -231,7 +382,7 @@ export async function openHarness(config, options = {}) {
         options.extensionSpecifiers ??
         config.extensions).map((specifier) => typeof specifier === "string" ? { entry: specifier } : specifier);
     const builtins = builtinsEnabled
-        ? resolveBuiltins(bootSettings, configuredInputs, options.extraBuiltins ?? [])
+        ? resolveBuiltins(bootSettings, configuredInputs, options.extraBuiltins ?? [], options.builtinResolver)
         : { load: [], skipped: [] };
     // The loader input: built-ins FIRST (pi parity — the replacement rule
     // already removed any built-in a configured entry claims), marked
@@ -274,10 +425,10 @@ export async function openHarness(config, options = {}) {
     // the cache dir materializes lazily on first `paths.cache` access).
     // The boot env feeds the admin surface's env-secret listing (the
     // `SIGRUN_EXT_<SLUG>_` fallbacks — never written down, listed only).
-    const sharedStores = sharedExtensionStores(roots, env);
+    const sharedStores = sharedExtensionStores(roots, env, identity.users);
     const seamHosts = new Map();
     const seamKinds = new Map();
-    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, lifecycleBindings, workerBindings, providerContributors, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, } = await loadExtensions(loaderInputs, registry, {
+    const { outcomes: extensionOutcomes, healthProducers: extensionHealth, runSettledBindings, settingsChangedBindings, lifecycleBindings, workerBindings, userServices: userServiceBindings, providerContributors, loginProviders, webuiBundles: extensionWebuiBundles, skillRoots: extensionSkillRoots, jobBindings, routeBindings, commandBindings, notifierBindings, channelBindings, gatewayEngine, surfaces: surfaceBindings, settingsSections: settingsSectionBindings, perUserSlugs: loadedPerUserSlugs, } = await loadExtensions(loaderInputs, registry, {
         packagesDir,
         hostContextFactory: (extensionName, kinds, priorHost) => {
             // Two-phase, revised for the provisional identity (provider
@@ -294,7 +445,10 @@ export async function openHarness(config, options = {}) {
                 createSeamHost({ name: extensionName }, kinds, {
                     bindHarness,
                     harness: harnessOf,
-                }, sharedStores);
+                }, sharedStores, {
+                    declared: (slug) => perUserSlugs.includes(slug),
+                    set: (slug, user, tools) => userTools.set(slug, user, tools),
+                }, userServices);
             host.rekey({ name: extensionName }, kinds);
             // File under the final name only, and only once the load
             // resolved: the PRE-import call must NOT file (its identity is
@@ -307,7 +461,15 @@ export async function openHarness(config, options = {}) {
             }
             return host;
         },
+        onQuarantine: (slug) => {
+            userTools.removeSlug(slug);
+            return userServices.quarantine(slug);
+        },
     });
+    perUserSlugs.push(...loadedPerUserSlugs);
+    for (const binding of userServiceBindings) {
+        userServices.register(binding.extension, binding.services, binding.packageDir);
+    }
     // The late fill (W5 Task 4): the skills extension installed BEFORE the
     // loader ran, holding an empty package-roots array by reference — the
     // collected roots land HERE, and the section (which renders per request)
@@ -434,6 +596,7 @@ export async function openHarness(config, options = {}) {
         // engine loaded (core ships none — `gatewayEngine` is undefined
         // unless an extension declared one).
         gatewayLoaded: gatewayEngine !== undefined,
+        rewriteUserSelection: (tx, conversationId, from, to) => rewriteSelection(tx, conversationId, from, to, perUserSlugs),
     };
     registry.install({
         name: "sigrun.jobs",
@@ -511,17 +674,39 @@ export async function openHarness(config, options = {}) {
     // when the resolved interval is greater than zero (0 = the designed
     // disable, no timer); the timer is unref()ed inside, and `stop()` rides
     // on the returned handle for the deploy shutdown path.
-    const stopProviderRefresh = config.providers.refreshIntervalMinutes > 0
-        ? startProviderRefresh(models, {
-            intervalMinutes: config.providers.refreshIntervalMinutes,
+    // The interval refresh scheduler (with the U4 §13.1 re-arm): the
+    // cadence is a LIVE setting — a committed write to
+    // `server.providers.refreshIntervalMinutes` re-arms the timer at the
+    // NEW interval (stop + start; `0` disables, no timer). The re-arm
+    // resolves env over the fresh file value exactly like boot does, so
+    // an env-pinned cadence (`SIGRUN_PROVIDER_REFRESH_MINUTES`) stays
+    // authoritative across re-arms.
+    const armProviderRefresh = () => {
+        const minutes = resolveRefreshMinutes(env, settingsStore);
+        if (!(minutes > 0))
+            return () => { };
+        return startProviderRefresh(models, {
+            intervalMinutes: minutes,
             onReadinessChange: observeReadiness,
             snapshotReadiness,
-        }).stop
-        : () => { };
-    // The static workspace service (spec §4.5): every tool call's ExecutionEnv
-    // resolves through it, so a future resolver swap changes this wiring's
-    // inputs and nothing downstream.
-    const workspaceService = createWorkspaceService();
+        }).stop;
+    };
+    let stopProviderRefresh = armProviderRefresh();
+    // SAFETY: `stopProviderRefresh` is `let`-bound for the re-arm swap;
+    // the shutdown handle the deploy path calls stays this function (it
+    // always stops whatever arm is current).
+    const stopCurrentProviderRefresh = () => {
+        stopProviderRefresh();
+    };
+    // Every tool/file/upload/job env resolves through this one decision seam.
+    const workspaceService = createWorkspaceService({
+        isolation: isolationState,
+        osUsers,
+        pool: sandboxPool,
+        directory: identity.users,
+        managed: managedPaths,
+        ownerOf: async (conversationId, read, ctx) => (await read.snapshot(SessionMetaDoc, conversationId, ctx))?.owner,
+    });
     const workspacePrefs = defaultWorkspacePrefs(config.workspace.path);
     const envBuilder = toHarnessEnv(workspaceService, workspacePrefs);
     // The job runtime's env-builder binding resolves here (the placeholder
@@ -572,7 +757,13 @@ export async function openHarness(config, options = {}) {
             get stream() {
                 return callerSettings?.stream ?? fileSettings.stream;
             },
-            extensions: callerSettings?.extensions,
+            get extensions() {
+                // Per-user entries are core-computed from SessionMeta.owner,
+                // never part of a host default — including an operator-supplied
+                // caller list (controller ruling: filter BOTH sources).
+                const selected = callerSettings?.extensions ?? registry.snapshot().installed();
+                return selected.filter((entry) => !isUserEntryName(entry.name));
+            },
             toolExecution: callerSettings?.toolExecution,
             compaction: {
                 ...config.compaction,
@@ -580,6 +771,11 @@ export async function openHarness(config, options = {}) {
             },
         },
     }, BACKGROUND_CONTEXT);
+    // M2 boot sweep: add each conversation owner's declared entries to every
+    // default-edited selection. Exact arrays are never widened. Runs before
+    // resume and is idempotent; late tool installs still resolve by name.
+    const userToolSweep = await sweepUserSelections(harness, storage, perUserSlugs);
+    console.log(`user tools: boot sweep scanned ${userToolSweep.scanned} conversation(s), changed ${userToolSweep.changed}`);
     // The seam hosts' lazy binding resolves here: every seam call issued
     // after boot completes finds the harness immediately; one issued from a
     // post-open async factory path waits on this same promise.
@@ -608,12 +804,35 @@ export async function openHarness(config, options = {}) {
         idleThresholdMs: options.eventBus?.idleThresholdMs ?? memorySeam.idleThresholdMs,
         idleSweepMs: options.eventBus?.idleSweepMs ?? IDLE_SWEEP_MS,
         workerDeadlineMs: options.eventBus?.workerDeadlineMs ?? memorySeam.workerDeadlineMs,
+        shutdownSettleWaitMs: options.eventBus?.shutdownSettleWaitMs,
         // W3 Task 4: the hub's subscription is installed at open —
         // synchronous, no-blocking-work (the SSE route's filtering side
         // lane does its own async work). Exposed so the bus's open() can
         // wire it before any commit lands.
         onHostEvent: (event) => events.publish(event),
     });
+    // The settings-changed publication (U4 §13.2): ONE seam fanning a
+    // committed settings write out to (a) the hub — /v1/events delivers
+    // `settings.changed` to admins — and (b) every extension's
+    // `onSettingsChanged` through the bus's bounded fan-out (rejections
+    // logged, never propagated: §13.2's the-write-still-succeeds rule).
+    // The scheduler re-arm rides the same seam: a write touching
+    // `server.providers.refreshIntervalMinutes` (a LIVE key, §13.1) stops
+    // and re-arms the interval timer at the fresh cadence.
+    const publishSettingsChanged = (scope, keys, user) => {
+        events.publish({ type: "settings.changed", scope, keys: [...keys] });
+        if (keys.includes("server.providers.refreshIntervalMinutes") ||
+            keys.includes("server.providers") ||
+            keys.includes("server")) {
+            stopProviderRefresh();
+            stopProviderRefresh = armProviderRefresh();
+        }
+        if (user !== undefined && typeof scope !== "string") {
+            userServices.settingsChanged(scope.extension, user);
+        }
+        void eventBus.emitSettingsChanged(keys, user);
+    };
+    settingsChangedSinks.push(publishSettingsChanged);
     // Activity stamping (UI refresh A1): every settled run stamps its
     // conversation's `lastActivityAt` (the admission-side stamp lives in the
     // submissions route). Registered directly after the bus opens — host-owned
@@ -628,6 +847,14 @@ export async function openHarness(config, options = {}) {
             runSettled: binding.runSettled,
         });
     }
+    // UI-blocks U4 §13.2: the settings-change hook merges into the same
+    // per-extension registration (the fan-out below invokes it).
+    for (const binding of settingsChangedBindings) {
+        handlersByName.set(binding.extension.name, {
+            ...handlersByName.get(binding.extension.name),
+            onSettingsChanged: binding.onSettingsChanged,
+        });
+    }
     for (const binding of lifecycleBindings) {
         handlersByName.set(binding.extension.name, {
             ...handlersByName.get(binding.extension.name),
@@ -824,8 +1051,16 @@ export async function openHarness(config, options = {}) {
     harness.resume();
     return {
         harness,
+        isolation,
+        isolationState,
+        osUsers,
+        sandboxPool,
+        userServices,
         storage,
         registry,
+        userTools,
+        rewriteUserSelection: (tx, conversationId, from, to) => rewriteSelection(tx, conversationId, from, to, perUserSlugs),
+        userToolSweep,
         models,
         jobs,
         jobRunTotals: () => jobRunTotals,
@@ -835,6 +1070,7 @@ export async function openHarness(config, options = {}) {
         webuiBundleCollisions,
         envBuilder,
         extensionOutcomes,
+        loginProviders,
         builtinSkipped: builtinsEnabled ? builtins.skipped : [],
         providerHealth,
         providerOwnership,
@@ -855,6 +1091,7 @@ export async function openHarness(config, options = {}) {
         extensionRoutes: routeBindings,
         extensionCommands: commandBindings,
         extensionSurfaces: surfaceBindings,
+        extensionSettingsSections: settingsSectionBindings,
         notifierBindings,
         channelBindings,
         gatewayEngine,
@@ -867,6 +1104,8 @@ export async function openHarness(config, options = {}) {
         autoNamer,
         bootRefresh: bootRefreshDone,
         refreshProvider: refreshOneProvider,
-        stopProviderRefresh,
+        stopProviderRefresh: stopCurrentProviderRefresh,
+        settingsBootSnapshot,
+        publishSettingsChanged,
     };
 }

package/dist/harness/builtins.js

@@ -1,11 +1,10 @@
 /**
- * Built-in extensions (Task 2, pi parity): codemode, MCP and tool search
- * ship WITH core — present by default, disableable via settings
- * `builtinExtensions`, replaceable by a same-named configured extension.
+ * Built-in extensions: codemode, MCP, tool search and OAuth ship WITH
+ * core — present by default, disableable via settings `builtinExtensions`,
+ * replaceable by a same-named configured extension.
  *
- * pi 1.3.0 ships these three as built-ins; a default sigrun install
- * mirrors that, so a friend installing sigrun gets pi's tool surface
- * without configuring anything.
+ * The first three mirror pi 1.3.0's built-in tool surface; OAuth adds
+ * sigrun's standard OIDC/OAuth2 login providers without extra setup.
  *
  * Resolution root (Ruling 2): built-ins resolve through core's OWN
  * node_modules via `createRequire(import.meta.url)` — they are core
@@ -24,7 +23,7 @@
  * (`readPackageName` for path-shaped entries, `parsePackageSpecifier`
  * otherwise), never by string equality on the raw specifier.
  *
- * Disabled (Ruling 6): `builtinExtensions: {codemode?, mcp?, toolSearch?}`
+ * Disabled (Ruling 6): `builtinExtensions: {codemode?, mcp?, toolSearch?, oauth?}`
  * (each defaulting to `true`, restart-required). A disabled built-in is
  * absent from `/v1/extensions` entirely; one log line records the skip.
  *
@@ -39,7 +38,7 @@ import { basename, dirname, isAbsolute, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { parsePackageSpecifier, readPackageName } from "./packages.js";
 /**
- * The three built-ins, in load order (codemode before tool-search: both
+ * The five built-ins, in load order (codemode before tool-search: both
  * wrap pi-durable's own extensions and neither depends on the other, but
  * the order pins the tool-collision story should names ever overlap).
  * Specifiers are the published package names (Task 3) — npm keys a file:
@@ -51,6 +50,8 @@ export const BUILTIN_EXTENSIONS = [
     { key: "codemode", specifier: "@sigrun/ext-codemode", slug: "codemode" },
     { key: "mcp", specifier: "@sigrun/ext-mcp", slug: "sigrun-mcp" },
     { key: "toolSearch", specifier: "@sigrun/ext-tool-search", slug: "tool-search" },
+    { key: "gateway", specifier: "@sigrun/ext-gateway", slug: "gateway" },
+    { key: "oauth", specifier: "@sigrun/oauth", slug: "oauth" },
 ];
 /** The core-anchored require (built-ins resolve from core's own node_modules). */
 const coreRequire = createRequire(import.meta.url);
@@ -154,7 +155,10 @@ function configuredPackageName(entry) {
  */
 export function resolveBuiltins(settings, configured, 
 /** Test seam: additional built-in specifiers (fixtures), resolved like the real ones. */
-extra = []) {
+extra = [], 
+/** Test seam: replace core resolution to exercise an unresolvable built-in. */
+resolveEntry) {
+    const resolve = resolveEntry ?? ((specifier) => builtinEntry(specifier));
     const toggles = settings.builtinExtensions;
     const load = [];
     const skipped = [];
@@ -179,13 +183,13 @@ extra = []) {
             skipped.push({ key: builtin.key, reason: "replaced", by: replacement });
             continue;
         }
-        load.push(builtinEntry(builtin.specifier));
+        load.push(resolve(builtin.specifier, builtinEntry));
     }
     // The test-seam extra entries (the boot's `extraBuiltins` option):
     // resolved exactly like the real built-ins, appended after them,
     // reported builtin.
     for (const specifier of extra) {
-        load.push(builtinEntry(specifier));
+        load.push(resolve(specifier, builtinEntry));
     }
     return { load, skipped };
 }