feat(extensions): add host-owned external integration policy

Author: limityan

scripts/core-boundaries/rules/feature-rules.mjs

@@ -128,6 +128,12 @@ export const productCoreFeatureAssemblyRules = [
     requiredFeatures: ['product-full'],
     reason: 'CLI must explicitly assemble the full bitfun-core product runtime',
   },
+  {
+    manifestPath: 'src/apps/server/Cargo.toml',
+    dependencyName: 'bitfun-core',
+    requiredFeatures: ['product-full'],
+    reason: 'Server must explicitly assemble the full bitfun-core product runtime',
+  },
   {
     manifestPath: 'src/crates/interfaces/acp/Cargo.toml',
     dependencyName: 'bitfun-core',

scripts/core-boundaries/rules/source/public-api-rules.mjs

@@ -9,6 +9,7 @@ export const publicApiContractSlices = [
   'external-source-tool-contract',
   'external-source-subagent-contract',
   'external-source-mcp-contract',
+  'external-integration-policy-contract',
 ];
 
 const contractSlices = {
@@ -20,6 +21,7 @@ const contractSlices = {
   externalSourceToolContract: 'external-source-tool-contract',
   externalSourceSubagentContract: 'external-source-subagent-contract',
   externalSourceMcpContract: 'external-source-mcp-contract',
+  externalIntegrationPolicyContract: 'external-integration-policy-contract',
 };
 
 function pluginRuntimeEntry(symbol, p0, consumer, verification, contractSlice, wireImpact = true) {
@@ -230,6 +232,55 @@ function externalSourceEntry(symbol, owner, consumer, wireImpact = false) {
   };
 }
 
+function externalIntegrationPolicyEntry(
+  symbol,
+  owner = 'product-domains external integration policy contract owner',
+  consumer = 'bitfun-core product composition and cross-host product surfaces',
+  wireImpact = true,
+) {
+  return {
+    symbol,
+    owner,
+    consumer,
+    verification:
+      'external integration policy contract tests, core policy lifecycle tests, cross-host route tests, and Web policy-control tests',
+    p0: 'host-owned external integration policy and OpenCode-compatible product defaults',
+    contractSlice: contractSlices.externalIntegrationPolicyContract,
+    wireImpact,
+    rationale:
+      'all product surfaces need one ecosystem-neutral, versioned, fail-closed policy contract while concrete ecosystem defaults remain in product assembly',
+    exit:
+      'remove only through a reviewed policy-contract migration with equivalent compatibility, safety-ceiling, and cross-host behavior tests',
+  };
+}
+
+export const externalIntegrationPolicyPublicApiEntries = [
+  'EXTERNAL_INTEGRATION_POLICY_SCHEMA_MAJOR',
+  'ExternalIntegrationMode',
+  'ExternalIntegrationAccess',
+  'ExternalEcosystemPolicy',
+  'ExternalIntegrationPolicySettings',
+  'ExternalIntegrationPolicySettingsView',
+  'ExternalEcosystemPolicyOverride',
+  'ExternalEcosystemPolicyOverrideView',
+  'ExternalIntegrationPolicyOverride',
+  'ExternalIntegrationPolicyOverrideView',
+  'ExternalIntegrationPolicyDocument',
+  'ExternalIntegrationCapabilityDescriptor',
+  'ExternalIntegrationEcosystemDescriptor',
+  'ExternalEcosystemPolicyView',
+  'EffectiveExternalEcosystemPolicy',
+  'EffectiveExternalIntegrationPolicy',
+  'ExternalIntegrationPolicyStatus',
+  'ExternalIntegrationPolicySnapshot',
+  'ExternalIntegrationPolicyScope',
+  'ExternalIntegrationPolicyOperation',
+  'ExternalIntegrationPolicyMutation',
+  'evaluate_external_integration_policy',
+  'external_integration_policy_snapshot',
+  'incompatible_external_integration_policy_snapshot',
+].map((symbol) => externalIntegrationPolicyEntry(symbol));
+
 function externalToolEntry(symbol, owner, consumer, wireImpact = false) {
   return {
     symbol,
@@ -298,6 +349,9 @@ export const externalSourceContractPublicApiEntries = [
   'ExternalSourceContext',
   'ExternalWatchRoot',
   'ExternalSourceProviderError',
+  'ExternalSourceOperationErrorCode',
+  'ExternalSourceOperationError',
+  'ExternalSourceOperationResult',
   'PromptCommandSourceProvider',
   'ExternalSourceLifecycleState',
   'ExternalSourceCatalogEntry',
@@ -306,6 +360,10 @@ export const externalSourceContractPublicApiEntries = [
   'PromptCommandConflict',
   'prompt_command_conflict_key',
   'ExternalSourceCatalogSnapshot',
+  'ExternalPromptCommandDefinitionSummary',
+  'ExternalPromptCommandSummary',
+  'ExternalSourcePublicSnapshot',
+  'ExternalSourceHostCapabilities',
 ].map((symbol) =>
   externalSourceEntry(
     symbol,
@@ -459,6 +517,31 @@ export const externalSourceCoordinatorPublicApiEntries = [
 ];
 
 export const externalSourceCorePublicApiEntries = [
+  ...[
+    'ExternalIntegrationAccess',
+    'ExternalIntegrationMode',
+    'ExternalIntegrationPolicyMutation',
+    'ExternalIntegrationPolicyOperation',
+    'ExternalIntegrationPolicyScope',
+    'EffectiveExternalIntegrationPolicy',
+    'ExternalIntegrationPolicySnapshot',
+    'ExternalIntegrationPolicyStatus',
+    'EcosystemId',
+    'ExternalIntegrationCapabilityId',
+    'OPENCODE_ECOSYSTEM_ID',
+    'EXTERNAL_CAPABILITY_COMMAND',
+    'EXTERNAL_CAPABILITY_TOOL',
+    'EXTERNAL_CAPABILITY_SUBAGENT',
+    'EXTERNAL_CAPABILITY_MCP',
+    'update_external_integration_policy',
+  ].map((symbol) =>
+    externalIntegrationPolicyEntry(
+      symbol,
+      'bitfun-core external integration policy composition facade',
+      'bitfun-cli, Desktop, Server, Peer Host, and Web API adapters',
+      true,
+    ),
+  ),
   ...[
     'ExpandedPromptCommand',
     'ExternalSourceCatalogEntry',
@@ -467,6 +550,10 @@ export const externalSourceCorePublicApiEntries = [
     'ExternalSourceDiagnostic',
     'ExternalSourceDiagnosticSeverity',
     'ExternalSourceLifecycleState',
+    'ExternalSourceHostCapabilities',
+    'ExternalSourceOperationError',
+    'ExternalSourceOperationErrorCode',
+    'ExternalSourceOperationResult',
     'PromptCommandAvailability',
     'PromptCommandCatalogEntry',
     'PromptCommandDefinition',
@@ -480,6 +567,7 @@ export const externalSourceCorePublicApiEntries = [
     'expand_external_prompt_command',
     'subscribe_external_source_updates',
     'ExternalSourceSubscription',
+    'ExternalSourcePublicSnapshot',
   ].map((symbol) =>
     externalSourceEntry(
       symbol,
@@ -493,6 +581,7 @@ export const externalSourceCorePublicApiEntries = [
     'ExternalToolCapability',
     'ExternalToolCatalogEntry',
     'ExternalToolConflict',
+    'ExternalToolConflictCandidateKind',
     'ExternalToolRuntimeKind',
     'set_external_tool_target_decision',
     'set_external_tool_conflict_choice',
@@ -657,6 +746,12 @@ export const publicApiAllowlistRules = [
       'managed plugin package and trust contracts must stay explicitly budgeted and ecosystem-neutral',
     allowedSymbolEntries: pluginSourceContractPublicApiEntries,
   },
+  {
+    path: 'src/crates/contracts/product-domains/src/external_integration_policy.rs',
+    reason:
+      'external integration policy contracts must stay ecosystem-neutral, versioned, fail-closed, and explicitly consumer-backed',
+    allowedSymbolEntries: externalIntegrationPolicyPublicApiEntries,
+  },
   {
     path: 'src/crates/contracts/product-domains/src/external_sources.rs',
     reason:

scripts/core-boundaries/self-test.mjs

@@ -165,6 +165,7 @@ export function runManifestParserSelfTest({
   for (const manifestPath of [
     'src/apps/desktop/Cargo.toml',
     'src/apps/cli/Cargo.toml',
+    'src/apps/server/Cargo.toml',
     'src/crates/interfaces/acp/Cargo.toml',
   ]) {
     if (!productCoreRulePaths.has(manifestPath)) {
@@ -195,15 +196,21 @@ export function runManifestParserSelfTest({
     },
     {
       manifestPath: 'src/apps/server/Cargo.toml',
-      text: '[dependencies]\naxum = { workspace = true }',
+      text:
+        '[dependencies]\nbitfun-core = { path = "../../crates/assembly/core", default-features = false, features = ["product-full"] }',
     },
     {
       manifestPath: 'src/crates/interfaces/acp/Cargo.toml',
       text: '[dependencies."bitfun-core"]\npath = "../../assembly/core"\ndefault-features = false\nfeatures = ["product-full"]',
     },
   ]);
-  if (discoveredProductCoreManifests.join(',') !== 'src/apps/desktop/Cargo.toml,src/crates/interfaces/acp/Cargo.toml') {
-    throw new Error('product core dependency scanner must discover only manifests that depend on bitfun-core');
+  if (
+    discoveredProductCoreManifests.join(',') !==
+    'src/apps/desktop/Cargo.toml,src/apps/server/Cargo.toml,src/crates/interfaces/acp/Cargo.toml'
+  ) {
+    throw new Error(
+      'product core dependency scanner must discover only manifests that depend on bitfun-core',
+    );
   }
   const ownerFeatureRulePaths = new Set(
     ownerCrateFeatureAssemblyRules.map((rule) => rule.manifestPath),

src/apps/cli/src/main.rs

@@ -28,7 +28,7 @@ mod ui;
 
 use anyhow::{anyhow, Result};
 use bitfun_core::service::remote_connect::DeviceIdentity;
-use clap::{Parser, Subcommand};
+use clap::{Parser, Subcommand, ValueEnum};
 use std::sync::atomic::{AtomicU8, Ordering};
 use std::sync::OnceLock;
 
@@ -400,6 +400,78 @@ enum ConfigAction {
     Edit,
     /// Reset to default configuration
     Reset,
+    /// Inspect or change external AI application compatibility
+    External {
+        #[command(subcommand)]
+        action: ExternalConfigAction,
+    },
+}
+
+#[derive(Subcommand)]
+enum ExternalConfigAction {
+    /// Show effective global and project compatibility settings
+    Status,
+    /// Enable or disable external compatibility
+    SetEnabled {
+        enabled: bool,
+        #[arg(long, value_enum, default_value = "project")]
+        scope: ExternalPolicyScopeArg,
+    },
+    /// Select an external ecosystem compatibility mode
+    SetMode {
+        #[arg(value_enum)]
+        mode: ExternalPolicyModeArg,
+        /// Ecosystem id; optional when exactly one ecosystem is registered
+        #[arg(long)]
+        ecosystem: Option<String>,
+        #[arg(long, value_enum, default_value = "project")]
+        scope: ExternalPolicyScopeArg,
+    },
+    /// Customize one external ecosystem capability
+    SetCapability {
+        #[arg(value_enum)]
+        capability: ExternalCapabilityArg,
+        #[arg(value_enum)]
+        access: ExternalAccessArg,
+        /// Ecosystem id; optional when exactly one ecosystem is registered
+        #[arg(long)]
+        ecosystem: Option<String>,
+        #[arg(long, value_enum, default_value = "project")]
+        scope: ExternalPolicyScopeArg,
+    },
+    /// Remove this project's overrides and inherit global settings
+    ResetProject,
+    /// Back up and reset a policy written by an incompatible BitFun version
+    ResetIncompatible,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum ExternalPolicyScopeArg {
+    Global,
+    Project,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum ExternalPolicyModeArg {
+    Recommended,
+    DiscoverOnly,
+    Off,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum ExternalCapabilityArg {
+    Command,
+    Tool,
+    Agent,
+    Mcp,
+}
+
+#[derive(Clone, Copy, Debug, ValueEnum)]
+enum ExternalAccessArg {
+    Off,
+    Discover,
+    Ask,
+    Auto,
 }
 
 #[derive(Subcommand)]
@@ -887,7 +959,7 @@ async fn run_cli() -> Result<()> {
         }
 
         Some(Commands::Config { action }) => {
-            root_handlers::handle_config_action(action, &config)?;
+            root_handlers::handle_config_action(action, &config).await?;
         }
 
         Some(Commands::Health) => {
@@ -1143,6 +1215,88 @@ mod plugin_command_tests {
     }
 }
 
+#[cfg(test)]
+mod external_config_command_tests {
+    use super::{
+        Cli, Commands, ConfigAction, ExternalAccessArg, ExternalCapabilityArg,
+        ExternalConfigAction, ExternalPolicyModeArg, ExternalPolicyScopeArg,
+    };
+    use clap::Parser;
+
+    #[test]
+    fn external_config_commands_keep_scope_and_capability_explicit() {
+        let status = Cli::try_parse_from(["bitfun-cli", "config", "external", "status"])
+            .expect("parse external status");
+        assert!(matches!(
+            status.command,
+            Some(Commands::Config {
+                action: ConfigAction::External {
+                    action: ExternalConfigAction::Status
+                }
+            })
+        ));
+
+        let mode = Cli::try_parse_from([
+            "bitfun-cli",
+            "config",
+            "external",
+            "set-mode",
+            "discover-only",
+            "--scope",
+            "global",
+        ])
+        .expect("parse external mode");
+        assert!(matches!(
+            mode.command,
+            Some(Commands::Config {
+                action: ConfigAction::External {
+                    action: ExternalConfigAction::SetMode {
+                        mode: ExternalPolicyModeArg::DiscoverOnly,
+                        ecosystem: None,
+                        scope: ExternalPolicyScopeArg::Global,
+                    }
+                }
+            })
+        ));
+
+        let capability = Cli::try_parse_from([
+            "bitfun-cli",
+            "config",
+            "external",
+            "set-capability",
+            "mcp",
+            "ask",
+            "--ecosystem",
+            "opencode",
+        ])
+        .expect("parse external capability");
+        assert!(matches!(
+            capability.command,
+            Some(Commands::Config {
+                action: ConfigAction::External {
+                    action: ExternalConfigAction::SetCapability {
+                        capability: ExternalCapabilityArg::Mcp,
+                        access: ExternalAccessArg::Ask,
+                        ecosystem: Some(ref ecosystem),
+                        scope: ExternalPolicyScopeArg::Project,
+                    }
+                }
+            }) if ecosystem == "opencode"
+        ));
+
+        let reset = Cli::try_parse_from(["bitfun-cli", "config", "external", "reset-incompatible"])
+            .expect("parse incompatible policy reset");
+        assert!(matches!(
+            reset.command,
+            Some(Commands::Config {
+                action: ConfigAction::External {
+                    action: ExternalConfigAction::ResetIncompatible
+                }
+            })
+        ));
+    }
+}
+
 #[cfg(test)]
 mod bootstrap_profile_tests {
     use super::{exec_requests_json_output, BootstrapProfile, SessionAction};