[ezynda3]

Description

Work in progress toward #253 and the approved extension-provider specification. Not ready to merge.

• Found a non-IPC path through the interpreter blocker: retain a licensed local copy of the v0.16.1 interpreter with one runtime-state patch. _select now copies its compiled case template per invocation. The upstream release and current master both share mutable case data. Regression tests exercise actual concurrent interpreted callbacks and cancellation, not compiled fakes.
• Add concrete provider DTOs/constants, public aliases and interpreter symbols; freeze and validate registered metadata; preserve bulk-load diagnostics and a strict reload candidate path.
• Add a compiled synchronous stream adapter with protocol validation, deferred executable tool calls/finish, retry suppression after exposure, serialized runtime calls and bounded cooperative close.
• Wire instance factories/catalog metadata, offline startup, completions, child factory inheritance, opt-in models --extensions, and host-owned picker entries.
• Add additive extension-origin history/replay metadata and deterministic greeting/tool fixtures. Kit remains the sole tool executor.

Validation

Observed locally during this work:

• go test -race ./... passed on the current branch; focused race suites and the interpreter concurrency probe passed repeatedly throughout.
• go vet ./... passed.
• go build -o output/kit ./cmd/kit passed.
• Offline CLI fixture returned exactly Hello from a fake provider.
• Kit tool round-trip test returned 5 and asserted one host tool execution.
• Interpreter concurrency/cancellation probe passed 20 repetitions with the local patch and failed under the race detector without it.
• Local golangci-lint reports two existing errcheck findings in unchanged internal/app/mcp_ready_test.go and internal/auth/callback_server_test.go. New Kit-owned code findings were fixed. Copied interpreter source is excluded from style lint to keep the upstream diff narrow.

Remaining work / compatibility

The approved acceptance matrix is not complete. Subsequent fixes add publication snapshots, same-source child inheritance, retained generation cleanup, reentrant stream close/reload rejection, replay part/message persistence, host-result origin, capability flags, instance thinking controls, unknown-price display, and retry/usage regression tests. Remaining release blockers include bounded handling and ownership of noncooperative auth/Create callbacks; cancellation of all generations before waiting on any one; shutdown called from auth/Create/Close callbacks; complete auth refresh and live picker refresh; full schema validation and malformed event-payload validation; missing-extension resume diagnostics; complete save/reopen/branch and code-mode/denial/concurrent reload acceptance coverage. Passing existing tests does not establish these guarantees.

The local interpreter copy is intentionally large but has a narrow documented patch; generated stdlib tables remain pinned upstream. This avoids sockets, worker processes, repeated Init side effects and per-extension serialization. Review this maintenance tradeoff before release.

UI evidence

The picker now accepts host-owned instance metadata. No visual verification or screenshots have been performed; terminal interaction and auth availability need manual verification after integration is complete.

Latest evidence

Current head 63516b6f7fb49332631effd2e06792c6800e2b4f: GitHub lint, test, and staticcheck-advisory all succeeded. CodeRabbit skipped the draft; its success status is not a completed code review. No inline or summary reviews have been posted. Local full race tests, vet, and build pass; the documented offline CLI greeting and extension catalog command work. The PR remains draft/WIP because the full approved specification is not complete.

Further work now tracks and cancels Create/auth generation leases, cancels all owners before draining, rejects runtime Close reentry, validates tool schemas without network loaders, validates assembled arguments against schemas, and rejects mismatched event fields. Release acceptance remains incomplete: noncooperative authentication deadline behavior, live auth/picker refresh, missing-extension resume diagnostics, complete concurrent reload and branch/code-mode/denial coverage, and session-resource lifetime after timed-out shutdown still require work.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[mark-iii-labs-huly]

Connected to Huly®: KIT-255