mirror of
https://github.com/langbot-app/LangBot.git
synced 2026-11-01 21:35:25 +08:00
51 lines
3.1 KiB
Markdown
51 lines
3.1 KiB
Markdown
# Shared runtime source candidate (SDK >=0.7.4)
|
|
|
|
This source declares `sharedRuntime: shared-runtime-v1` and `componentModel: stateless-v1`.
|
|
It is source-reviewed for the multi-tenant contract; it is **not certified** and makes no
|
|
claim of live tenant acceptance.
|
|
|
|
## What is per invocation
|
|
|
|
- Every `spec.config` value — `server_url`, `api_token`, `timeout_seconds`,
|
|
`allow_insecure_http`, `scope_mode`, `scope_id`, `allow_default_scope`, `auto_recall`,
|
|
`capture_user_messages`, `max_context_bytes`, `search_limit` — is resolved by
|
|
`PowerContextPlugin.settings()` from `self.get_config()` inside the invocation. No config
|
|
value is copied onto the plugin object or any component object.
|
|
- The bearer token is resolved from that same per-invocation config and from nowhere else. The
|
|
process environment is not consulted: a process-global credential combined with an
|
|
installation-chosen `server_url` would let one installation send the worker's credential to a
|
|
host it controls. A token configured for installation A is never sent to installation B's
|
|
endpoint.
|
|
- `PowerContextSettings.new_client()` builds the transport client for the invocation that is
|
|
about to issue a request. `PowerContextClient` holds no connection: every request opens its
|
|
own `httpx.AsyncClient`, so the client is a thin descriptor carrying this invocation's
|
|
endpoint and bearer token only. The `PromptPreProcessing` bridge resolves settings once per
|
|
turn and reuses that turn's client for resolve/prepare/capture.
|
|
- `initialize()` is not overridden: a shared worker attaches it once with an empty config, so
|
|
there is no process-scope place where tenant config could be captured.
|
|
|
|
## Binding-keyed state
|
|
|
|
- None. This plugin keeps no process-local tenant state, no Host storage rows, and no detached
|
|
tasks, so there is nothing to key by installation binding and nothing for
|
|
`on_installation_revoked()` to release; the `BasePlugin` default no-op is correct.
|
|
- Scope bindings live in the PowerContext Server, keyed by SHA-256 digests of the LangBot
|
|
identity. The worker process caches neither bindings nor resolved scopes.
|
|
|
|
## Known limits
|
|
|
|
- Concurrent invocations of different installations share the plugin and component objects.
|
|
The bridge is re-entrant: it holds no mutable state across `await`, and its per-turn state is
|
|
task-local.
|
|
- Historical context is injected as untrusted data with an explicit boundary; the plugin does
|
|
not authorize or act on it.
|
|
- `api_token` is a Host-stored configuration string scoped to one installation, never a process
|
|
environment variable. Restrict access to plugin configuration and use HTTPS for a remote Server.
|
|
- Remote cleartext HTTP stays rejected unless `allow_insecure_http` is explicitly enabled; that
|
|
is a deployment decision, not a network sandbox.
|
|
- Tests drive the real plugin and component objects through two `InstallationBinding` values
|
|
with a recording HTTP transport and simulated PowerContext replies. They are not paid or live
|
|
PowerContext Server tests.
|
|
- Not certified; independent review, signer approval, and two-Workspace invocation acceptance
|
|
are still required.
|