Module lease 

Task 20 (Commit B) — session-scoped exact extension runtime leases (spec §7.5, mirroring the §7.4 MCP lease discipline).

Deferred manifest-declared extension tools execute ONLY through this manager, strictly AFTER the ExecutionGate has authorized the exact call. One ExtensionRuntimeManager is shared by the ExtensionManager (which owns the retained internal launch records) and the Runtime (which mints per-session capabilities and the durable session-end scope):

• a lease is keyed by (session, plugin) and PINNED to the launch-record fingerprint (manifest + cwd + resolved config) it was acquired under; per-key SINGLE-FLIGHT acquisition (a Starting placeholder holding a watch receiver whose stored state makes wakeups lost-proof) guarantees concurrent first calls never spawn duplicate children, and the manager map lock is NEVER held across process/pipe I/O;
• acquisition re-reads the retained launch record, RE-VALIDATES the manifest (permissions included), starts exactly one child (kill_on_drop), initializes ONCE, and requires the runtime’s registered declarations to match the manifest’s passive declarations EXACTLY (tool names, descriptions, canonical schema digests — and provider declarations when present) BEFORE any call; a mismatch shuts the child down and fails closed;
• every call validates the selected exact tool name and canonical schema digest against the pinned validated listing BEFORE tool.call;
• revocation/termination semantics are exact and honest: revocation marks the lease cancelled under the per-lease call permit; a call that already passed the gate check MAY complete and then shuts the child down; NO call passes after revocation returns. kill_on_drop on the child is the hard backstop once the last Arc drops;
• idle leases are reaped opportunistically with a CONSTANT per-pass scan cap; session end is the drop of the LAST owner of the shared durable ExtensionSessionEndGuard scope. No PID signalling, no long-lived task, no unbounded channel;
• lease failures carry ONLY static text, local identities, and numeric metadata — extension-reported error content is withheld (length only), and no launch-record (secret) config ever appears anywhere.

Structs

ExtensionLeaseCapability

Typed per-session lease capability handed to tool contexts: the exact session identity plus the shared manager. Never widens to a plugin grant — every call re-validates the exact tool and launch record.

ExtensionRuntimeManager

Session-scoped exact extension runtime lease manager. See module docs.

ExtensionSessionEndGuard

Durable last-owner session scope. The Runtime mints ONE of these per tool session (wrapped in an Arc shared by every runtime clone and in-flight stream); streams HOLD it, never construct or drop their own. Leases therefore survive across provider turns, and only the drop of the LAST owner — true session end — terminates the session’s leases.

LazyExtensionHandler

Lazy ExtensionHandler for deferred hook/provider/user capabilities (Task 20 Commit C). Registered/subscribed at load WITHOUT a process; the first AUTHORIZED use (a matching hook event delivered by the permission-checked HookBus subscription, a selected provider complete/stream, or an explicit user sidecar/command/settings action) single-flights through the SAME per-plugin lease manager — starting and exact-validating the child once. Discovery, load, search, and diagnostics never acquire.

Enums

ExtensionLeaseError

Typed lease failures. Static text, local identities, and numeric metadata only — never extension-controlled content, never config.

Constants

DEFAULT_IDLE_MAX

Default idle bound for opportunistic reaping (parity with MCP leases).

MAX_LIVE_LEASES

Hard cap on simultaneously live leases per manager.

REAP_SCAN_MAX

Reap passes scan up to the full capped map so idle entries can never starve behind an active HashMap iteration prefix.