Feat v0.8.2 capability negotiation (#69)

Extensions declare environment requirements via capabilities.required and
capabilities.optional in their manifest. The kernel validates at install
time — required capabilities reject with HTTP 422 and rollback, optional
capabilities log a warning. Runtime query via settings.has_capability().
Admin endpoint GET /api/v1/admin/capabilities re-probes live.

Detected capabilities: postgres, pgvector, object_storage, s3, workspace.

18 new tests, all passing with -race.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/sandbox/runner.go

@@ -81,6 +81,7 @@ type Runner struct {
 	objectStore     storage.ObjectStore  // nil = files module unavailable
 	workspaceRoot   string               // empty = workspace module unavailable
 	workspaceQuota  int                  // MB, 0 = unlimited
+	capabilities    map[string]bool      // detected environment capabilities
 }
 
 // NewRunner creates a runner with the given sandbox and dependencies.
@@ -132,6 +133,12 @@ func (r *Runner) SetWorkspaceRoot(root string, quotaMB int) {
 	r.workspaceQuota = quotaMB
 }
 
+// SetCapabilities stores the detected environment capabilities map.
+// Passed to the settings module so extensions can call has_capability().
+func (r *Runner) SetCapabilities(caps map[string]bool) {
+	r.capabilities = caps
+}
+
 // SetAllowPrivateIPs disables the SSRF check that blocks connections to
 // private/loopback IPs. For self-hosted environments where extensions
 // reach internal services. Controlled by EXT_ALLOW_PRIVATE_IPS env var.
@@ -441,7 +448,7 @@ func (r *Runner) buildModulesWithLibCtx(ctx context.Context, packageID string, m
 		userID = rc.UserID
 		teamID = rc.TeamID
 	}
-	modules["settings"] = BuildSettingsModule(ctx, r.stores, packageID, userID, teamID)
+	modules["settings"] = BuildSettingsModule(ctx, r.stores, packageID, userID, teamID, r.capabilities)
 
 	// Always available — read-only check against kernel permission data
 	modules["permissions"] = BuildPermissionsModule(ctx, r.stores)

server/sandbox/settings_module.go

@@ -11,6 +11,7 @@ package sandbox
 // Starlark API:
 //   val = settings.get("key")            # returns string, number, bool, or None
 //   val = settings.get("key", "default") # returns default if key not set
+//   ok  = settings.has_capability("pgvector")  # returns True or False
 
 import (
 	"context"
@@ -24,12 +25,28 @@ import (
 // BuildSettingsModule creates the "settings" Starlark module for a package.
 // It resolves the three-tier cascade (global → team → user) respecting
 // the user_overridable flag from the package manifest.
-func BuildSettingsModule(ctx context.Context, stores store.Stores, packageID, userID, teamID string) *starlarkstruct.Module {
+func BuildSettingsModule(ctx context.Context, stores store.Stores, packageID, userID, teamID string, capabilities map[string]bool) *starlarkstruct.Module {
 	return MakeModule("settings", starlark.StringDict{
-		"get": starlark.NewBuiltin("settings.get", settingsGet(ctx, stores, packageID, userID, teamID)),
+		"get":            starlark.NewBuiltin("settings.get", settingsGet(ctx, stores, packageID, userID, teamID)),
+		"has_capability": starlark.NewBuiltin("settings.has_capability", hasCapability(capabilities)),
 	})
 }
 
+// hasCapability returns a Starlark builtin that checks whether a named
+// environment capability is available.  Read-only, no permission needed.
+func hasCapability(caps map[string]bool) func(*starlark.Thread, *starlark.Builtin, starlark.Tuple, []starlark.Tuple) (starlark.Value, error) {
+	return func(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
+		var name string
+		if err := starlark.UnpackPositionalArgs("settings.has_capability", args, kwargs, 1, &name); err != nil {
+			return nil, err
+		}
+		if caps == nil {
+			return starlark.False, nil
+		}
+		return starlark.Bool(caps[name]), nil
+	}
+}
+
 func settingsGet(ctx context.Context, stores store.Stores, packageID, userID, teamID string) func(*starlark.Thread, *starlark.Builtin, starlark.Tuple, []starlark.Tuple) (starlark.Value, error) {
 	return func(_ *starlark.Thread, _ *starlark.Builtin, args starlark.Tuple, kwargs []starlark.Tuple) (starlark.Value, error) {
 		var key string

server/sandbox/settings_module_test.go

@@ -0,0 +1,75 @@
+package sandbox
+
+import (
+	"context"
+	"testing"
+
+	"go.starlark.net/starlark"
+
+	"armature/store"
+)
+
+func execWithSettings(t *testing.T, caps map[string]bool, script string) (*Result, error) {
+	t.Helper()
+	ctx := context.Background()
+	mod := BuildSettingsModule(ctx, store.Stores{}, "", "", "", caps)
+	sb := New(DefaultConfig())
+	return sb.Exec(ctx, "test.star", script, map[string]starlark.Value{
+		"settings": mod,
+	})
+}
+
+func TestHasCapability_True(t *testing.T) {
+	caps := map[string]bool{"postgres": true, "pgvector": true}
+	result, err := execWithSettings(t, caps, `
+result = settings.has_capability("pgvector")
+`)
+	if err != nil {
+		t.Fatalf("exec error: %v", err)
+	}
+	v := result.Globals["result"]
+	if v != starlark.True {
+		t.Errorf("has_capability('pgvector') = %v, want True", v)
+	}
+}
+
+func TestHasCapability_False(t *testing.T) {
+	caps := map[string]bool{"postgres": true, "pgvector": false}
+	result, err := execWithSettings(t, caps, `
+result = settings.has_capability("pgvector")
+`)
+	if err != nil {
+		t.Fatalf("exec error: %v", err)
+	}
+	v := result.Globals["result"]
+	if v != starlark.False {
+		t.Errorf("has_capability('pgvector') = %v, want False", v)
+	}
+}
+
+func TestHasCapability_UnknownCap(t *testing.T) {
+	caps := map[string]bool{"postgres": true}
+	result, err := execWithSettings(t, caps, `
+result = settings.has_capability("gpu")
+`)
+	if err != nil {
+		t.Fatalf("exec error: %v", err)
+	}
+	v := result.Globals["result"]
+	if v != starlark.False {
+		t.Errorf("has_capability('gpu') = %v, want False", v)
+	}
+}
+
+func TestHasCapability_NilCaps(t *testing.T) {
+	result, err := execWithSettings(t, nil, `
+result = settings.has_capability("postgres")
+`)
+	if err != nil {
+		t.Fatalf("exec error: %v", err)
+	}
+	v := result.Globals["result"]
+	if v != starlark.False {
+		t.Errorf("has_capability with nil caps = %v, want False", v)
+	}
+}