@try-works/dsh-model-as-tool 0.1.0 → 0.1.2

package/README.md

@@ -137,6 +137,57 @@ npm i @desert-ant-labs/voz onnxruntime-node   # transcription on Windows/Linux/m
 
 The plugin never bundles or re-hosts model weights.
 
+## What gets downloaded, and when
+
+Three separate things arrive at three separate times. Measured sizes are from a
+Windows x64 install of this package.
+
+**1. The plugin itself — ~58 kB, from npm, at install.** `lib/`, the two catalog
+JSON files, `cordis.patch.yml` and this README. It contains **no model weights
+and no inference runtime**.
+
+**2. The model SDK packages — from npm, at install, only if you asked for them.**
+They are `optionalDependencies`, so a failed or skipped download does not fail the
+install; the capability resolver simply reports the model as unavailable.
+
+| Package | Size on disk | Contains |
+| --- | --- | --- |
+| `@desert-ant-labs/tongue` | 2.1 MB | **The model itself** — `tongue_int8.bin` (2.0 MB) ships inside the tarball |
+| `@desert-ant-labs/voz` | 44.2 MB | The WebAssembly runtime (`VozWeb.wasm`), not the weights |
+| `onnxruntime-node` | 287.1 MB | The prebuilt inference engine for this platform |
+
+**3. The weights — from Hugging Face, on first call, not at install.** Each SDK
+pins one revision and verifies the download, then caches it. Voz fetches about
+**367 MB** on its first transcription:
+
+```
+~/.cache/desert-ant-models/desert-ant-labs/voz      367 MB   (first call)
+```
+
+Tongue never downloads anything: its model is inside the npm package.
+
+Point an SDK at a pre-populated folder to run offline (each adapter accepts a
+`directory`), and set `HF_TOKEN` for a gated repo. Because the licence forbids
+redistribution, the plugin never bundles or mirrors weights — it downloads them
+the way the vendor intends, once, into the vendor's own cache.
+
+### Install cost is real, so it is opt-out
+
+Installing with the optional dependencies present pulls roughly **333 MB** before
+any model runs, and a first Voz call adds **367 MB** more. If that is unwanted,
+install the plugin with them skipped and add only what you use:
+
+```sh
+npm i @try-works/dsh-model-as-tool --omit=optional
+npm i @desert-ant-labs/tongue        # 2 MB, and its model is included
+```
+
+**Watch out for the other model packages.** They ship prebuilt native cores for
+`linux-x64`, `linux-arm64` and `darwin-arm64` inside one tarball — roughly 50 MB
+each — so `@desert-ant-labs/redact` is ~166 MB of which the great majority is
+Linux and macOS binaries that can never load on Windows. Installing one on
+Windows buys ~130 MB that cannot run.
+
 ## Development
 
 ```sh

package/bin/dsh-tool-mode-mcp-stdio.mjs

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * The `dsh-tool-mode-mcp-stdio` executable (MCP-03, P26-08).
+ *
+ * This file owns the one property that cannot be tested from the library: that
+ * STDOUT CARRIES PROTOCOL TRAFFIC AND NOTHING ELSE. Everything written here goes
+ * through two explicitly separate streams, and nothing in this process writes to
+ * stdout except a protocol frame — not a banner, not a version, not a warning.
+ *
+ * The endpoint and token come from the environment, which is how an MCP client
+ * launches a stdio server. A missing token is reported on STDERR and the process
+ * exits non-zero: an unattended launch must fail with guidance rather than hang
+ * waiting for a credential nobody will supply (P26-16).
+ */
+
+import { createStdioBridge } from '../lib/mcp/stdio.js'
+
+const url = process.env.DSH_TOOL_MODE_MCP_URL ?? 'http://127.0.0.1:3765/mcp'
+const token = process.env.DSH_TOOL_MODE_MCP_TOKEN
+
+/** Diagnostics. NEVER stdout. */
+const diagnostic = line => process.stderr.write(`${line}\n`)
+
+if (token === undefined || token.length === 0) {
+  // P26-16: unattended operation must fail with setup guidance, never hang.
+  diagnostic('dsh-tool-mode-mcp-stdio: no credential configured.')
+  diagnostic('  Set DSH_TOOL_MODE_MCP_TOKEN to the token the operator configured for this client,')
+  diagnostic('  and DSH_TOOL_MODE_MCP_URL if the endpoint is not http://127.0.0.1:3765/mcp.')
+  process.exit(2)
+}
+
+const bridge = createStdioBridge(
+  {
+    url,
+    token,
+    fetch: async (target, init) => {
+      const response = await fetch(target, {
+        method: init.method,
+        headers: init.headers,
+        body: init.body,
+        signal: init.signal,
+      })
+      const headers = {}
+      response.headers.forEach((value, key) => { headers[key] = value })
+      return { status: response.status, headers, body: await response.text() }
+    },
+  },
+  {
+    // The ONLY writer to stdout in this process.
+    protocol: line => process.stdout.write(`${line}\n`),
+    diagnostic,
+  },
+)
+
+// Newline-delimited input. Chunk boundaries are not frame boundaries, so a partial
+// line is buffered until its newline arrives.
+let buffer = ''
+process.stdin.setEncoding('utf8')
+process.stdin.on('data', chunk => {
+  buffer += chunk
+  let index = buffer.indexOf('\n')
+  while (index !== -1) {
+    const line = buffer.slice(0, index)
+    buffer = buffer.slice(index + 1)
+    void bridge.handleLine(line).then(output => {
+      if (output !== undefined) process.stdout.write(`${output}\n`)
+    }).catch(error => {
+      // A bridge fault is a diagnostic; the protocol channel stays clean.
+      diagnostic(`bridge error: ${error instanceof Error ? error.message : String(error)}`)
+    })
+    index = buffer.indexOf('\n')
+  }
+})
+
+process.stdin.on('end', () => {
+  // P26-08: EOF shuts down BRIDGE-OWNED requests without killing the shared host.
+  bridge.close()
+  diagnostic('stdin closed; bridge-owned requests aborted')
+  process.exit(0)
+})

package/catalog/desert-ant-models.json

@@ -4,6 +4,7 @@
     "name": "Align",
     "summary": "Word-timestamp refinement for any transcript, on device, from 0.7MB.",
     "capability": "audio.word-alignment",
+    "contract": null,
     "input": "audio",
     "output": "{ words: [{ text, start, end }] } aligned against the audio",
     "languages": null,
@@ -39,6 +40,7 @@
     "name": "Clear",
     "summary": "On-device speech enhancement: denoise, dereverb and loudness-normalize to 48 kHz.",
     "capability": "audio.speech-enhancement",
+    "contract": null,
     "input": "audio",
     "output": "A cleaned audio file path plus processing metadata",
     "languages": null,
@@ -74,6 +76,7 @@
     "name": "Clips",
     "summary": "Clip selection that turns a long recording into ranked shorts and highlights from a transcript.",
     "capability": "video.clip-selection",
+    "contract": null,
     "input": "video",
     "output": "{ clips: [{ index, start, end, title, file }] } ranked by interest",
     "languages": null,
@@ -109,6 +112,7 @@
     "name": "Ear",
     "summary": "On-device spoken language identification across 102 languages from a short audio stretch.",
     "capability": "audio.spoken-language-identification",
+    "contract": null,
     "input": "audio",
     "output": "{ language, confidence, candidates: [{ language, probability }] }",
     "languages": 102,
@@ -143,6 +147,7 @@
     "name": "Emo",
     "summary": "Type a task or message and get the emoji that fit, in 22 languages, on the device.",
     "capability": "text.emoji-suggestion",
+    "contract": null,
     "input": "text",
     "output": "[{ emoji, confidence }] ranked suggestions",
     "languages": 22,
@@ -163,7 +168,10 @@
       "description": "Suggest emoji that fit a piece of text, in 22 languages, running entirely on device.",
       "params": {
         "text": "The text to suggest emoji for.",
-        "limit": { "description": "Maximum number of suggestions to return (default 5).", "type": "integer" }
+        "limit": {
+          "description": "Maximum number of suggestions to return (default 5).",
+          "type": "integer"
+        }
       },
       "returns": "Ranked emoji suggestions with confidence scores."
     },
@@ -178,6 +186,7 @@
     "name": "Eye",
     "summary": "On-device frame scoring that tells you which shot to keep, what is in it, and which shots repeat.",
     "capability": "image.frame-scoring",
+    "contract": null,
     "input": "image",
     "output": "[{ frame, score, labels, duplicate_of }]",
     "languages": null,
@@ -197,8 +206,14 @@
       "name": "score_frames",
       "description": "Score a burst or clip of frames to choose the best shot, describe what is in it and detect repeated shots.",
       "params": {
-        "image_paths": { "description": "Absolute paths of the frames to score.", "type": "string[]" },
-        "top": { "description": "How many top frames to return (default 5).", "type": "integer" }
+        "image_paths": {
+          "description": "Absolute paths of the frames to score.",
+          "type": "string[]"
+        },
+        "top": {
+          "description": "How many top frames to return (default 5).",
+          "type": "integer"
+        }
       },
       "returns": "Frames ranked by score, with labels and duplicate grouping."
     },
@@ -213,6 +228,7 @@
     "name": "Face",
     "summary": "On-device face matching that finds the same person across a photo library or through a video.",
     "capability": "image.face-matching",
+    "contract": null,
     "input": "image",
     "output": "[{ path, faces: [{ box, match_id }] }]",
     "languages": null,
@@ -232,7 +248,10 @@
       "name": "match_faces",
       "description": "Match the same person across a set of images or a video, entirely on device, with no image leaving the machine.",
       "params": {
-        "image_paths": { "description": "Absolute paths of the images to match faces across.", "type": "string[]" },
+        "image_paths": {
+          "description": "Absolute paths of the images to match faces across.",
+          "type": "string[]"
+        },
         "video_path": "Optional video to track faces through instead of still images."
       },
       "returns": "Detected face boxes grouped by person identity."
@@ -248,6 +267,7 @@
     "name": "Gist",
     "summary": "On-device topic tagging across a 36-topic taxonomy, in 101 languages, with no server call.",
     "capability": "text.topic-tagging",
+    "contract": null,
     "input": "text",
     "output": "{ topics: [{ topic, score }] }",
     "languages": 101,
@@ -268,7 +288,10 @@
       "description": "Tag a title, post or article with the topics it covers, from a fixed 36-topic taxonomy across 101 languages.",
       "params": {
         "text": "The text to tag.",
-        "limit": { "description": "Maximum number of topics to return (default 5).", "type": "integer" }
+        "limit": {
+          "description": "Maximum number of topics to return (default 5).",
+          "type": "integer"
+        }
       },
       "returns": "Ranked topic labels from the fixed taxonomy with scores."
     },
@@ -283,6 +306,7 @@
     "name": "Moderator",
     "summary": "On-device NSFW detection that flags nudity before upload, trained only on licensed and synthetic data.",
     "capability": "image.nsfw-detection",
+    "contract": null,
     "input": "image",
     "output": "{ nsfw, score, labels: [...] }",
     "languages": null,
@@ -302,7 +326,10 @@
       "name": "detect_nsfw",
       "description": "Check images for nudity or sexual content on device before they are uploaded or shown.",
       "params": {
-        "image_paths": { "description": "Absolute paths of the images to check.", "type": "string[]" }
+        "image_paths": {
+          "description": "Absolute paths of the images to check.",
+          "type": "string[]"
+        }
       },
       "returns": "A per-image NSFW verdict with score and labels."
     },
@@ -317,6 +344,7 @@
     "name": "Redact",
     "summary": "On-device redaction that strips personal data as you type, in 27 languages, with restore support.",
     "capability": "text.pii-redaction",
+    "contract": null,
     "input": "text",
     "output": "{ redactedText, items: [{ label, original, placeholder, confidence }] }",
     "languages": 27,
@@ -337,8 +365,14 @@
       "description": "Replace personal data (names, emails, phone numbers, addresses, card numbers and more) in text with stable placeholders, on device, before the text reaches any remote service.",
       "params": {
         "text": "The text to redact.",
-        "labels": { "description": "Optional list of entity labels to restrict redaction to, for example [\"EMAIL\", \"PHONE\"].", "type": "string[]" },
-        "minimum_confidence": { "description": "Optional confidence floor between 0 and 1 (default 0.6).", "type": "number" }
+        "labels": {
+          "description": "Optional list of entity labels to restrict redaction to, for example [\"EMAIL\", \"PHONE\"].",
+          "type": "string[]"
+        },
+        "minimum_confidence": {
+          "description": "Optional confidence floor between 0 and 1 (default 0.6).",
+          "type": "number"
+        }
       },
       "returns": "The redacted text plus the placeholder map, so originals can be restored after a remote round trip."
     },
@@ -353,6 +387,7 @@
     "name": "Schemer",
     "summary": "Extract typed fields from any text against your own schema, on device, with empty fields left empty.",
     "capability": "text.structured-extraction",
+    "contract": null,
     "input": "text",
     "output": "An object matching the caller-supplied schema",
     "languages": null,
@@ -388,6 +423,7 @@
     "name": "Shapes",
     "summary": "On-device shape recognition that turns one hand-drawn stroke into a rectangle, ellipse, triangle, star or line in under 10ms.",
     "capability": "stroke.shape-recognition",
+    "contract": null,
     "input": "stroke",
     "output": "{ shape, confidence, candidates: [...] }",
     "languages": null,
@@ -423,6 +459,7 @@
     "name": "Title",
     "summary": "On-device titles and descriptions: a short factual title and a one- or two-sentence description for any passage.",
     "capability": "text.title-generation",
+    "contract": null,
     "input": "text",
     "output": "{ title, description, isEmpty }",
     "languages": null,
@@ -443,7 +480,10 @@
       "description": "Write a short factual title and a one- or two-sentence description for a passage of text: a landing-page section, a documentation page or an article.",
       "params": {
         "text": "The passage to title.",
-        "max_tokens": { "description": "Optional generation cap in tokens (default 96).", "type": "integer" }
+        "max_tokens": {
+          "description": "Optional generation cap in tokens (default 96).",
+          "type": "integer"
+        }
       },
       "returns": "A title and a description, or an empty card when the model returned neither."
     },
@@ -458,6 +498,7 @@
     "name": "Tongue",
     "summary": "On-device language identification for short text across 84 languages, from just a few words.",
     "capability": "text.language-identification",
+    "contract": "text.language_detect",
     "input": "text",
     "output": "{ language, reliability, candidates: [{ language, probability }], isTooCloseToCall }",
     "languages": 84,
@@ -478,7 +519,10 @@
       "description": "Identify the language of a short piece of text across 84 languages, on device, in microseconds. Works from as little as three words.",
       "params": {
         "text": "The text whose language to identify.",
-        "top": { "description": "How many runner-up language candidates to include (default 3).", "type": "integer" }
+        "top": {
+          "description": "How many runner-up language candidates to include (default 3).",
+          "type": "integer"
+        }
       },
       "returns": "The detected language code, a reliability verdict, and the top scoring candidates with probabilities."
     },
@@ -486,6 +530,10 @@
       "name": "desert-ant-tongue",
       "description": "Detect the language of short text on device with the Desert Ant Tongue model.",
       "whenToUse": "Use before translating, routing to a locale-specific template, or checking that generated copy is in the expected language."
+    },
+    "provider": {
+      "extension": "@try-works/extension-desert-ant-tongue",
+      "modelId": "tongue"
     }
   },
   {
@@ -493,6 +541,7 @@
     "name": "Toxic",
     "summary": "On-device moderation that flags hateful, abusive and threatening text in 23 European languages.",
     "capability": "text.toxicity-detection",
+    "contract": null,
     "input": "text",
     "output": "{ toxic, score, labels: [...] }",
     "languages": 23,
@@ -513,7 +562,10 @@
       "description": "Flag hateful, abusive and threatening text in 23 European languages, on device, before the message is sent.",
       "params": {
         "text": "The text to check.",
-        "minimum_confidence": { "description": "Optional confidence floor between 0 and 1.", "type": "number" }
+        "minimum_confidence": {
+          "description": "Optional confidence floor between 0 and 1.",
+          "type": "number"
+        }
       },
       "returns": "A toxicity verdict with score and the matched labels."
     },
@@ -528,6 +580,7 @@
     "name": "Uhm",
     "summary": "On-device filler detection that marks every um, uh and hmm to within 20ms, an hour of audio in 12s.",
     "capability": "audio.filler-detection",
+    "contract": null,
     "input": "audio",
     "output": "[{ start, end, word }] filler spans to cut",
     "languages": null,
@@ -562,6 +615,7 @@
     "name": "Voz",
     "summary": "Transcribe 10 minutes of audio in 2s on an iPhone, 14x faster than Whisper, with word timestamps.",
     "capability": "audio.speech-recognition",
+    "contract": "stt.transcribe",
     "input": "audio",
     "output": "{ text, words: [{ text, start, end }], realtimeFactor }",
     "languages": 25,
@@ -572,7 +626,9 @@
     "windowsSupport": "onnxruntime-node",
     "npmPackage": "@desert-ant-labs/voz",
     "npmSubpath": null,
-    "requiresRuntime": ["onnxruntime-node"],
+    "requiresRuntime": [
+      "onnxruntime-node"
+    ],
     "cliVerb": "voz",
     "license": "source-available",
     "docsUrl": "https://desertant.com/models/voz/",
@@ -582,7 +638,10 @@
       "description": "Transcribe an audio or video file on device with word-level timestamps across 25 languages. Nothing is uploaded and no API key is needed.",
       "params": {
         "audio_path": "Absolute path to the audio or video file, or a 16 kHz mono WAV.",
-        "include_words": { "description": "Whether to include the per-word timestamps (default true).", "type": "boolean" }
+        "include_words": {
+          "description": "Whether to include the per-word timestamps (default true).",
+          "type": "boolean"
+        }
       },
       "returns": "The transcript text, optional per-word start and end times, and the measured realtime factor."
     },
@@ -590,6 +649,10 @@
       "name": "desert-ant-voz",
       "description": "Transcribe audio on device with word timestamps using the Desert Ant Voz model.",
       "whenToUse": "Use to get a transcript or captions from a recording locally, without uploading audio to a hosted API."
+    },
+    "provider": {
+      "extension": "@try-works/extension-desert-ant-voz",
+      "modelId": "voz"
     }
   },
   {
@@ -597,6 +660,7 @@
     "name": "Who",
     "summary": "On-device speaker labeling that turns a recording into per-person turns with face boxes and timestamps.",
     "capability": "audio.speaker-labeling",
+    "contract": null,
     "input": "audio",
     "output": "[{ speaker, start, end, face_box }] turns",
     "languages": null,

package/lib/adapters/index.d.ts

@@ -11,13 +11,20 @@
  */
 import type { ModelCatalogEntry } from '../types.ts';
 import type { AdapterFactory, ModelAdapter } from './types.ts';
+import type { ProviderBridge } from '../provider-bridge.ts';
 import { type TransportOptions } from '../transport.ts';
 /**
- * Every hand-written adapter this plugin ships, in priority order.
+ * Hand-written adapters living inside the host.
  *
- * Each factory returns undefined for the entries it does not serve, so the
- * lookup is a linear scan rather than a switch, and a model with no adapter yet
- * simply has no tool.
+ * EMPTY, and it must stay that way (BASE-09). Every model-specific implementation
+ * is now an independently versioned extension package reached through the public
+ * extension API: Tongue is `@try-works/extension-desert-ant-tongue` and Voz is
+ * `@try-works/extension-desert-ant-voz`. The host holds no adapter for any model,
+ * so a first-party package has no privilege a published one lacks.
+ *
+ * The parameter is kept rather than deleted because a test may still inject
+ * factories, and an empty list DOCUMENTED as needing to stay empty is a stronger
+ * statement than a removed hook.
  */
 export declare const ADAPTER_FACTORIES: readonly AdapterFactory[];
 /**
@@ -37,12 +44,18 @@ export interface TransportSelection extends TransportOptions {
  * A hand-written adapter always wins for the model it serves: an in-process
  * call is faster and needs no external service. Everything else falls to the
  * transport the capability resolver selected.
+ *
+ * The lookup is ASYNC because an extension-backed model is reached by importing
+ * and activating its package, which cannot happen in a synchronous call. The
+ * order is deliberate: a declared extension binding wins, then a hand-written
+ * factory, then a transport.
  * @param entry - the catalog entry.
  * @param options - the resolved route plus transport settings.
  * @param factories - hand-written adapter factories, defaulting to the shipped set.
- * @returns the adapter, or undefined when no factory or transport serves this model.
+ * @param bridge - the extension provider bridge, when extensions are available.
+ * @returns the adapter, or undefined when no extension, factory or transport serves this model.
  */
-export declare function createAdapter(entry: ModelCatalogEntry, options?: TransportSelection, factories?: readonly AdapterFactory[]): ModelAdapter | undefined;
+export declare function createAdapter(entry: ModelCatalogEntry, options?: TransportSelection, factories?: readonly AdapterFactory[], bridge?: ProviderBridge): ModelAdapter | undefined;
 export type { AdapterFactory, AdapterInvocation, JsonValue, ModelAdapter } from './types.ts';
 export type { CommandTransport, TransportOptions } from '../transport.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/adapters/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAG9D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAA;AAExB;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAGtD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAmBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE,kBAA4C,EACrD,SAAS,GAAE,SAAS,cAAc,EAAsB,GACvD,YAAY,GAAG,SAAS,CAY1B;AAED,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAA;AAExB;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,cAAc,EAAO,CAAA;AAE9D;;;;;;GAMG;AACH,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAC1D,yCAAyC;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAmBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,iBAAiB,EACxB,OAAO,GAAE,kBAA4C,EACrD,SAAS,GAAE,SAAS,cAAc,EAAsB,EACxD,MAAM,CAAC,EAAE,cAAc,GACtB,YAAY,GAAG,SAAS,CAqB1B;AAED,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAC5F,YAAY,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA"}

package/lib/adapters/index.js

@@ -9,20 +9,21 @@
  *
  * @module @try-works/dsh-model-as-tool/adapters/index
  */
-import { createTongueAdapter } from "./tongue.js";
-import { createVozAdapter } from "./voz.js";
 import { createCliTransport, createRemoteTransport, } from "../transport.js";
 /**
- * Every hand-written adapter this plugin ships, in priority order.
+ * Hand-written adapters living inside the host.
  *
- * Each factory returns undefined for the entries it does not serve, so the
- * lookup is a linear scan rather than a switch, and a model with no adapter yet
- * simply has no tool.
+ * EMPTY, and it must stay that way (BASE-09). Every model-specific implementation
+ * is now an independently versioned extension package reached through the public
+ * extension API: Tongue is `@try-works/extension-desert-ant-tongue` and Voz is
+ * `@try-works/extension-desert-ant-voz`. The host holds no adapter for any model,
+ * so a first-party package has no privilege a published one lacks.
+ *
+ * The parameter is kept rather than deleted because a test may still inject
+ * factories, and an empty list DOCUMENTED as needing to stay empty is a stronger
+ * statement than a removed hook.
  */
-export const ADAPTER_FACTORIES = [
-    createTongueAdapter,
-    createVozAdapter,
-];
+export const ADAPTER_FACTORIES = [];
 /**
  * Wrap a command transport as a model adapter.
  *
@@ -45,23 +46,37 @@ function transportAdapter(entry, transport) {
  * A hand-written adapter always wins for the model it serves: an in-process
  * call is faster and needs no external service. Everything else falls to the
  * transport the capability resolver selected.
+ *
+ * The lookup is ASYNC because an extension-backed model is reached by importing
+ * and activating its package, which cannot happen in a synchronous call. The
+ * order is deliberate: a declared extension binding wins, then a hand-written
+ * factory, then a transport.
  * @param entry - the catalog entry.
  * @param options - the resolved route plus transport settings.
  * @param factories - hand-written adapter factories, defaulting to the shipped set.
- * @returns the adapter, or undefined when no factory or transport serves this model.
+ * @param bridge - the extension provider bridge, when extensions are available.
+ * @returns the adapter, or undefined when no extension, factory or transport serves this model.
  */
-export function createAdapter(entry, options = { route: 'npm-native' }, factories = ADAPTER_FACTORIES) {
+export function createAdapter(entry, options = { route: 'npm-native' }, factories = ADAPTER_FACTORIES, bridge) {
+    // A declared extension binding is the model's own statement of who implements
+    // it, so it is consulted before any host-side knowledge.
+    if (bridge !== undefined && entry.provider !== undefined) {
+        return bridge.adapterFor(entry);
+    }
     for (const factory of factories) {
         const adapter = factory(entry);
         if (adapter !== undefined)
             return adapter;
     }
-    // No hand-written adapter: the model is reachable only through a transport.
+    // No extension and no factory: the model is reachable only through a transport.
     if (options.route === 'cli')
         return transportAdapter(entry, createCliTransport(entry, options));
     if (options.route === 'remote') {
         return transportAdapter(entry, createRemoteTransport(entry, options));
     }
+    // No extension, no factory and no transport serves this model. Returning
+    // undefined is correct: a model with no implementation simply has no tool,
+    // rather than falling back to something that cannot run it.
     return undefined;
 }
 //# sourceMappingURL=index.js.map

package/lib/adapters/tongue.d.ts

@@ -11,13 +11,21 @@
  */
 import type { ModelCatalogEntry } from '../types.ts';
 import { type ModelAdapter } from './types.ts';
+/** The npm package this adapter knows how to call. */
+export declare const TONGUE_PACKAGE = "@desert-ant-labs/tongue";
 /**
  * Build the Tongue adapter.
  *
- * The model is loaded once and reused, because `Tongue.load()` parses the
- * bundled 2 MB weight file and detection afterwards is synchronous.
+ * The factory is keyed on the PACKAGE, not the catalog id: an adapter's job is to
+ * know how to call one SDK, so any catalog row bound to this package can share it.
+ * Keying on the model id instead would mean a second conforming implementation of
+ * the same contract could never be served — exactly the model-name switch BASE-02
+ * and EXT-01 exist to prevent.
+ *
+ * The model is loaded once and reused, because `Tongue.load()` parses the bundled
+ * 2 MB weight file and detection afterwards is synchronous.
  * @param entry - the catalog entry this adapter serves.
- * @returns the adapter, or undefined if the entry is not Tongue.
+ * @returns the adapter, or undefined if the entry does not use this SDK.
  */
 export declare function createTongueAdapter(entry: ModelCatalogEntry): ModelAdapter | undefined;
 //# sourceMappingURL=tongue.d.ts.map

package/lib/adapters/tongue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tongue.d.ts","sourceRoot":"","sources":["../../src/adapters/tongue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,YAAY,CAAA;AA4BnB;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,GAAG,SAAS,CAwDtF"}
+{"version":3,"file":"tongue.d.ts","sourceRoot":"","sources":["../../src/adapters/tongue.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,EAKL,KAAK,YAAY,EAClB,MAAM,YAAY,CAAA;AAwBnB,sDAAsD;AACtD,eAAO,MAAM,cAAc,4BAA4B,CAAA;AAMvD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,iBAAiB,GAAG,YAAY,GAAG,SAAS,CAwDtF"}

package/lib/adapters/tongue.js

@@ -18,19 +18,27 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
     return path;
 };
 import { optionalInteger, requireString, throwIfAborted, } from "./types.js";
+/** The npm package this adapter knows how to call. */
+export const TONGUE_PACKAGE = '@desert-ant-labs/tongue';
 /** Default number of runner-up candidates reported to the model. */
 const DEFAULT_TOP = 3;
 const MAX_TOP = 20;
 /**
  * Build the Tongue adapter.
  *
- * The model is loaded once and reused, because `Tongue.load()` parses the
- * bundled 2 MB weight file and detection afterwards is synchronous.
+ * The factory is keyed on the PACKAGE, not the catalog id: an adapter's job is to
+ * know how to call one SDK, so any catalog row bound to this package can share it.
+ * Keying on the model id instead would mean a second conforming implementation of
+ * the same contract could never be served — exactly the model-name switch BASE-02
+ * and EXT-01 exist to prevent.
+ *
+ * The model is loaded once and reused, because `Tongue.load()` parses the bundled
+ * 2 MB weight file and detection afterwards is synchronous.
  * @param entry - the catalog entry this adapter serves.
- * @returns the adapter, or undefined if the entry is not Tongue.
+ * @returns the adapter, or undefined if the entry does not use this SDK.
  */
 export function createTongueAdapter(entry) {
-    if (entry.id !== 'tongue')
+    if (entry.npmPackage !== TONGUE_PACKAGE)
         return undefined;
     let loaded;
     const load = async () => {

package/lib/adapters/types.d.ts

@@ -10,6 +10,7 @@
  * @module @try-works/dsh-model-as-tool/adapters/types
  */
 import type { ModelCatalogEntry } from '../types.ts';
+import type { InvocationAuthority } from '../authority.ts';
 /** A lossless JSON value, the only thing a tool body may return. */
 export type JsonValue = null | boolean | number | string | JsonValue[] | {
     [key: string]: JsonValue;
@@ -20,6 +21,16 @@ export interface AdapterInvocation {
     readonly args: Readonly<Record<string, unknown>>;
     /** Caller cancellation, forwarded by the tool body. */
     readonly signal: AbortSignal;
+    /**
+     * Trusted authority for this call (BASE-05).
+     *
+     * An implementation MUST resolve a caller-supplied path through
+     * `authority.resolvePath` rather than opening the argument directly: the
+     * authority is constructed by the host and cannot be supplied or widened by a
+     * request. It is optional only so a test can drive an adapter without a grant;
+     * a host always provides one.
+     */
+    readonly authority?: InvocationAuthority;
 }
 /** One model's invocation strategy. */
 export interface ModelAdapter {