@abot-ai/runtime 1.2.0 → 1.3.1

package/plugins/json-inspector/plugin.json

@@ -17,6 +17,18 @@
         "inspect_json": {
           "description": "Validate one JSON file and return a bounded structural summary. Relative paths resolve inside the configured agent work directory; `workspace/...` targets configured workspace sources.",
           "routingCapability": "semantic_lookup",
+          "eventPresentation": {
+            "metadata": {
+              "displayTarget": { "param": "path", "kind": "string" },
+              "maxDepth": { "param": "maxDepth", "kind": "number" }
+            },
+            "resultMetadata": {
+              "outputPreview": { "path": "output", "kind": "preview" },
+              "maxDepth": { "path": "data.maxDepth", "kind": "number" },
+              "syntaxValid": { "path": "data.syntaxValid", "kind": "boolean" },
+              "outputTruncated": { "path": "data.truncation.output.truncated", "kind": "boolean" }
+            }
+          },
           "runtimePathBindings": [
             { "operationId": "inspect_json", "param": "path", "base": "worker_working_directory" }
           ],

package/plugins/local-search/plugin.json

@@ -13,6 +13,18 @@
           "description": "Search filenames and/or textual file contents beneath the configured agent work directory or explicit workspace sources. The result is bounded and read-only; it never searches outside configured agent data roots.",
           "routingCapability": "filesystem_inspection",
           "developmentRoles": ["inspect"],
+          "eventPresentation": {
+            "metadata": {
+              "query": { "param": "query", "kind": "string" },
+              "searchRoot": { "param": "path", "kind": "string" },
+              "searchMode": { "param": "mode", "kind": "string" }
+            },
+            "resultMetadata": {
+              "outputPreview": { "path": "output", "kind": "preview" },
+              "returnedItemCount": { "path": "data.itemCount", "kind": "number" },
+              "sourceTruncated": { "path": "data.truncation.truncated", "kind": "boolean" }
+            }
+          },
           "runtimePathBindings": [
             {
               "operationId": "search_local_files",

package/plugins/local-search/source/index.ts

@@ -98,6 +98,7 @@ export default defineRuntimePlugin((context) => ({
                 root.commandDirectory,
                 maxResults,
                 executionContext?.abortSignal,
+                root.directoryAuthority,
               );
           sourceTruncated ||= names.truncated;
           for (const rawPath of names.items) {
@@ -132,6 +133,7 @@ export default defineRuntimePlugin((context) => ({
             remaining,
             executionContext?.abortSignal,
             root.stdinFd,
+            root.directoryAuthority,
           );
           sourceTruncated ||= content.truncated;
           for (const match of content.items) {

package/plugins/local-search/source/paths.ts

@@ -9,6 +9,7 @@ import type {
 import { resolvePluginPath } from "../../../src/plugin-sdk/index.js";
 
 import { LocalSearchError } from "./errors.js";
+import type { SearchDirectoryAuthority } from "./ripgrep-process.js";
 
 export type SearchRoot = Readonly<{
   target: ResolvedRuntimeToolPath;
@@ -16,6 +17,7 @@ export type SearchRoot = Readonly<{
   commandDirectory: string;
   commandTarget: string;
   stdinFd?: number;
+  directoryAuthority?: SearchDirectoryAuthority;
   close(): Promise<void>;
 }>;
 
@@ -54,11 +56,14 @@ function authorityUnavailable(): LocalSearchError {
 async function openSearchAuthority(
   target: ResolvedRuntimeToolPath,
 ): Promise<SearchRoot> {
-  if (
-    process.platform !== "linux" ||
-    !Number.isInteger(constants.O_NOFOLLOW) ||
-    !Number.isInteger(constants.O_NONBLOCK)
-  ) {
+  const supportsSearchAuthority = ["linux", "darwin"].includes(
+    process.platform,
+  );
+  if (!supportsSearchAuthority) throw authorityUnavailable();
+  const supportsAuthorityOpenFlags =
+    Number.isInteger(constants.O_NOFOLLOW) &&
+    Number.isInteger(constants.O_NONBLOCK);
+  if (!supportsAuthorityOpenFlags) {
     throw authorityUnavailable();
   }
 
@@ -92,7 +97,9 @@ async function openSearchAuthority(
 
     const [pathIdentity, descriptorIdentity] = await Promise.all([
       stat(canonicalTarget, { bigint: true }),
-      stat(`/proc/self/fd/${handle.fd}`, { bigint: true }),
+      process.platform === "linux"
+        ? stat(`/proc/self/fd/${handle.fd}`, { bigint: true })
+        : handle.stat({ bigint: true }),
     ]);
     if (
       !sameIdentity(observed, pathIdentity) ||
@@ -103,14 +110,30 @@ async function openSearchAuthority(
 
     const authority = handle;
     const isFile = observed.isFile();
+    const needsDirectoryBridge = !isFile && process.platform === "darwin";
+    let commandDirectory = "/";
+    if (!isFile) {
+      commandDirectory =
+        process.platform === "linux"
+          ? `/proc/self/fd/${authority.fd}`
+          : canonicalTarget;
+    }
     let closed = false;
     handle = undefined;
     return Object.freeze({
       target,
       isFile,
-      commandDirectory: isFile ? "/" : `/proc/self/fd/${authority.fd}`,
+      commandDirectory,
       commandTarget: isFile ? "-" : ".",
       ...(isFile ? { stdinFd: authority.fd } : {}),
+      ...(needsDirectoryBridge
+        ? {
+            directoryAuthority: {
+              directoryPath: canonicalTarget,
+              directoryFd: authority.fd,
+            },
+          }
+        : {}),
       close: async () => {
         if (closed) return;
         closed = true;

package/plugins/local-search/source/ripgrep-process.ts

@@ -0,0 +1,69 @@
+import { spawn, type ChildProcessByStdio } from "node:child_process";
+import type { Readable } from "node:stream";
+
+import { rgPath } from "@vscode/ripgrep";
+
+import { spawnDirectoryAuthorityCommand } from "../../../src/shared/directory-authority/index.js";
+
+export type SearchDirectoryAuthority = Readonly<{
+  directoryPath: string;
+  directoryFd: number;
+}>;
+
+function controlledRipgrepEnvironment(): NodeJS.ProcessEnv {
+  const environment = { ...process.env };
+  for (const name of Object.keys(environment)) {
+    if (name.toUpperCase() === "RIPGREP_CONFIG_PATH") {
+      delete environment[name];
+    }
+  }
+  return environment;
+}
+
+function terminateAuthorityGroup(
+  child: ChildProcessByStdio<null, Readable, Readable>,
+): void {
+  if (!child.pid) {
+    child.kill("SIGKILL");
+    return;
+  }
+  try {
+    process.kill(-child.pid, "SIGKILL");
+  } catch (error) {
+    const groupAlreadyExited =
+      (error as NodeJS.ErrnoException).code === "ESRCH";
+    if (groupAlreadyExited) return;
+    throw error;
+  }
+}
+
+export function spawnRipgrepProcess(
+  args: readonly string[],
+  cwd: string,
+  stdinFd?: number,
+  directoryAuthority?: SearchDirectoryAuthority,
+) {
+  const commandArgs = ["--no-config", ...args];
+  const env = controlledRipgrepEnvironment();
+  if (directoryAuthority) {
+    const child = spawnDirectoryAuthorityCommand({
+      ...directoryAuthority,
+      command: rgPath,
+      args: commandArgs,
+      env,
+    });
+    return { child, terminate: () => terminateAuthorityGroup(child) };
+  }
+  const child = spawn(rgPath, commandArgs, {
+    cwd,
+    env,
+    stdio: [stdinFd ?? "ignore", "pipe", "pipe"],
+    windowsHide: true,
+  }) as ChildProcessByStdio<null, Readable, Readable>;
+  return {
+    child,
+    terminate: () => {
+      child.kill("SIGKILL");
+    },
+  };
+}

package/plugins/local-search/source/ripgrep.ts

@@ -1,10 +1,10 @@
-import { spawn, type ChildProcessByStdio } from "node:child_process";
-import type { Readable } from "node:stream";
 import { TextDecoder } from "node:util";
 
-import { rgPath } from "@vscode/ripgrep";
-
 import { LocalSearchError } from "./errors.js";
+import {
+  spawnRipgrepProcess,
+  type SearchDirectoryAuthority,
+} from "./ripgrep-process.js";
 
 const SEARCH_TIMEOUT_MS = 10_000;
 const MAX_PATH_RECORD_BYTES = 64 * 1024;
@@ -45,16 +45,6 @@ export function escapeRgGlobLiteral(value: string): string {
     .join("");
 }
 
-function controlledRipgrepEnvironment(): NodeJS.ProcessEnv {
-  const environment = { ...process.env };
-  for (const name of Object.keys(environment)) {
-    if (name.toUpperCase() === "RIPGREP_CONFIG_PATH") {
-      delete environment[name];
-    }
-  }
-  return environment;
-}
-
 function decodeUtf8Record(bytes: Buffer, kind: "path" | "result"): string {
   let value: string;
   try {
@@ -129,6 +119,7 @@ async function runRipgrepBounded<T>(
   parser: RipgrepStreamParser<T>,
   signal?: AbortSignal,
   stdinFd?: number,
+  directoryAuthority?: SearchDirectoryAuthority,
 ): Promise<BoundedRipgrepResult<T>> {
   if (signal?.aborted) {
     throw new LocalSearchError(
@@ -143,12 +134,12 @@ async function runRipgrepBounded<T>(
     let timedOut = false;
     let aborted = false;
     let parserError: unknown;
-    const child = spawn(rgPath, ["--no-config", ...args], {
+    const { child, terminate } = spawnRipgrepProcess(
+      args,
       cwd,
-      env: controlledRipgrepEnvironment(),
-      stdio: [stdinFd ?? "ignore", "pipe", "pipe"],
-      windowsHide: true,
-    }) as ChildProcessByStdio<null, Readable, Readable>;
+      stdinFd,
+      directoryAuthority,
+    );
 
     const cleanup = (): void => {
       clearTimeout(timeout);
@@ -177,17 +168,17 @@ async function runRipgrepBounded<T>(
       stoppedAfterExtraResult = true;
       if (mayStopProcess) {
         child.stdout.pause();
-        child.kill("SIGKILL");
+        terminate();
       }
       return false;
     };
     const abortListener = (): void => {
       aborted = true;
-      child.kill("SIGKILL");
+      terminate();
     };
     const timeout = setTimeout(() => {
       timedOut = true;
-      child.kill("SIGKILL");
+      terminate();
     }, SEARCH_TIMEOUT_MS);
     timeout.unref?.();
 
@@ -198,7 +189,7 @@ async function runRipgrepBounded<T>(
       } catch (error) {
         parserError = error;
         child.stdout.pause();
-        child.kill("SIGKILL");
+        terminate();
       }
     });
     // Always drain stderr so the child cannot block on its diagnostic pipe.
@@ -313,6 +304,7 @@ export function runRipgrepPathSearch(
   cwd: string,
   maxResults: number,
   signal?: AbortSignal,
+  directoryAuthority?: SearchDirectoryAuthority,
 ): Promise<BoundedRipgrepResult<string>> {
   return runRipgrepBounded(
     args,
@@ -324,6 +316,8 @@ export function runRipgrepPathSearch(
       parse: (record) => decodeUtf8Record(record, "path"),
     }),
     signal,
+    undefined,
+    directoryAuthority,
   );
 }
 
@@ -333,6 +327,7 @@ export function runRipgrepContentSearch(
   maxResults: number,
   signal?: AbortSignal,
   stdinFd?: number,
+  directoryAuthority?: SearchDirectoryAuthority,
 ): Promise<BoundedRipgrepResult<ContentMatch>> {
   return runRipgrepBounded(
     args,
@@ -349,5 +344,6 @@ export function runRipgrepContentSearch(
     }),
     signal,
     stdinFd,
+    directoryAuthority,
   );
 }