@abot-ai/runtime 1.3.1 → 1.4.0

package/dist/plugins/system/source/companion/process-owner-identity.js

@@ -0,0 +1,144 @@
+import { execFile } from "node:child_process";
+import { readFile } from "node:fs/promises";
+import { promisify } from "node:util";
+const executeFile = promisify(execFile);
+const WINDOWS_OWNER_SCRIPT = `
+$ErrorActionPreference = 'Stop'
+$targetPid = [int]$env:ABOT_HOST_OWNER_PID
+$target = Get-Process -Id $targetPid -ErrorAction Stop
+$started = $target.StartTime.ToUniversalTime().Ticks
+$booted = (Get-CimInstance Win32_OperatingSystem -ErrorAction Stop).LastBootUpTime.ToUniversalTime().Ticks
+[Console]::Out.Write([string]$booted + '|' + [string]$started)
+`;
+function isProcessId(pid) {
+    if (!Number.isSafeInteger(pid))
+        return false;
+    return pid > 0;
+}
+function isUuid(value) {
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu.test(value);
+}
+function observePidLiveness(pid) {
+    if (!isProcessId(pid))
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        if (!error || typeof error !== "object" || !("code" in error))
+            return true;
+        return error.code !== "ESRCH";
+    }
+}
+async function linuxIdentity(pid, dependencies) {
+    const [bootText, processText] = await Promise.all([
+        dependencies.readText("/proc/sys/kernel/random/boot_id"),
+        dependencies.readText(`/proc/${pid}/stat`),
+    ]);
+    const boot = bootText.trim();
+    if (!isUuid(boot))
+        return undefined;
+    if (!processText.startsWith(`${pid} (`))
+        return undefined;
+    const commandEnd = processText.lastIndexOf(") ");
+    if (commandEnd < 0)
+        return undefined;
+    // After the final command-name parenthesis, index zero is stat field 3.
+    const startTicks = processText
+        .slice(commandEnd + 2)
+        .trim()
+        .split(/\s+/u)[19];
+    if (!startTicks || !/^\d+$/u.test(startTicks))
+        return undefined;
+    return `linux:${boot.toLowerCase()}:${startTicks}`;
+}
+function commandOptions(pid) {
+    return {
+        env: {
+            ...process.env,
+            ABOT_HOST_OWNER_PID: String(pid),
+            LC_ALL: "C",
+            TZ: "UTC",
+        },
+        windowsHide: true,
+        timeout: 5_000,
+        maxBuffer: 4_096,
+    };
+}
+async function windowsIdentity(pid, dependencies) {
+    const text = await dependencies.execute("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-EncodedCommand",
+        Buffer.from(WINDOWS_OWNER_SCRIPT, "utf16le").toString("base64"),
+    ], commandOptions(pid));
+    const value = text.trim();
+    if (!/^\d{10,20}\|\d{10,20}$/u.test(value))
+        return undefined;
+    return `windows:${value}`;
+}
+async function macIdentity(pid, dependencies) {
+    const [bootText, startedText] = await Promise.all([
+        dependencies.execute("/usr/sbin/sysctl", ["-n", "kern.bootsessionuuid"], commandOptions(pid)),
+        dependencies.execute("/bin/ps", ["-p", String(pid), "-o", "lstart="], commandOptions(pid)),
+    ]);
+    const boot = bootText.trim();
+    const started = startedText.trim().replace(/\s+/gu, " ");
+    if (!isUuid(boot))
+        return undefined;
+    if (!/^[A-Za-z]{3} [A-Za-z]{3} \d{1,2} \d{2}:\d{2}:\d{2} \d{4}$/u.test(started))
+        return undefined;
+    return `macos:${boot.toLowerCase()}:${started}`;
+}
+export function createProcessOwnerIdentityProbe(dependencies) {
+    async function readProcessOwnerIdentity(pid) {
+        if (!isProcessId(pid))
+            return undefined;
+        try {
+            if (dependencies.platform === "linux")
+                return await linuxIdentity(pid, dependencies);
+            if (dependencies.platform === "win32")
+                return await windowsIdentity(pid, dependencies);
+            if (dependencies.platform === "darwin")
+                return await macIdentity(pid, dependencies);
+            return undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    async function isProcessOwnerAlive(pid, ownerIdentity) {
+        if (!isProcessId(pid))
+            return false;
+        if (!dependencies.processIsAlive(pid))
+            return false;
+        if (!ownerIdentity)
+            return true;
+        const observed = await readProcessOwnerIdentity(pid);
+        if (!observed)
+            return true;
+        return ownerIdentity === observed;
+    }
+    async function requireCurrentProcessOwnerIdentity() {
+        const identity = await readProcessOwnerIdentity(dependencies.currentPid);
+        if (!identity)
+            throw new Error("The host companion could not establish this process's OS identity; its ownership lock was not acquired.");
+        return identity;
+    }
+    return {
+        readProcessOwnerIdentity,
+        isProcessOwnerAlive,
+        requireCurrentProcessOwnerIdentity,
+    };
+}
+const nativeProbe = createProcessOwnerIdentityProbe({
+    platform: process.platform,
+    currentPid: process.pid,
+    readText: (path) => readFile(path, "utf8"),
+    execute: async (file, args, options) => (await executeFile(file, [...args], options)).stdout,
+    processIsAlive: observePidLiveness,
+});
+export const readProcessOwnerIdentity = nativeProbe.readProcessOwnerIdentity;
+export const isProcessOwnerAlive = nativeProbe.isProcessOwnerAlive;
+export const requireCurrentProcessOwnerIdentity = nativeProbe.requireCurrentProcessOwnerIdentity;

package/dist/plugins/system/source/companion/protocol.d.ts

@@ -0,0 +1,57 @@
+import type { ToolImplementationOutput } from "../../../../src/plugin-sdk/index.js";
+export declare const HOST_PROTOCOL_VERSION = 1;
+export declare const HOST_SOCKET_PATH = "/system-host/connect";
+export declare const HOST_WIRE_MAX_BYTES: number;
+export declare const HOST_OPERATIONS: readonly ["system_targets", "system_command", "system_applications", "system_launch"];
+export type HostOperation = (typeof HOST_OPERATIONS)[number];
+export type HostIdentity = Readonly<{
+    name: string;
+    os: "windows" | "macos" | "linux";
+    user: string;
+    homeDir: string;
+}>;
+export type HostStatus = Readonly<{
+    paired: boolean;
+    hostId?: string;
+    identity?: HostIdentity;
+} & ({
+    connected: true;
+    connectionId: string;
+} | {
+    connected: false;
+    connectionId?: never;
+})>;
+export type HostAgentHello = Readonly<{
+    type: "hello";
+    version: 1;
+    identity: HostIdentity;
+    hostId?: string;
+}>;
+export type HostAgentMessage = HostAgentHello | Readonly<{
+    type: "result";
+    id: string;
+    result: ToolImplementationOutput;
+}>;
+export type HostServerMessage = Readonly<{
+    type: "paired";
+    hostId: string;
+    credential: string;
+}> | Readonly<{
+    type: "ready";
+    hostId: string;
+}> | Readonly<{
+    type: "execute";
+    id: string;
+    hostId: string;
+    operation: HostOperation;
+    params: Record<string, unknown>;
+}> | Readonly<{
+    type: "cancel";
+    id: string;
+}>;
+export declare function isHostOperation(value: unknown): value is HostOperation;
+export declare function isHostRecord(value: unknown): value is Record<string, unknown>;
+export declare function isHostIdentifier(value: unknown): value is string;
+export declare function isHostIdentity(value: unknown): value is HostIdentity;
+export declare function hasMatchingHostIdentity(a: HostIdentity, b: HostIdentity): boolean;
+export declare function isHostToolResult(value: unknown): value is ToolImplementationOutput;

package/dist/plugins/system/source/companion/protocol.js

@@ -0,0 +1,66 @@
+export const HOST_PROTOCOL_VERSION = 1;
+export const HOST_SOCKET_PATH = "/system-host/connect";
+export const HOST_WIRE_MAX_BYTES = 256 * 1024;
+export const HOST_OPERATIONS = [
+    "system_targets",
+    "system_command",
+    "system_applications",
+    "system_launch",
+];
+export function isHostOperation(value) {
+    return HOST_OPERATIONS.some((operation) => operation === value);
+}
+export function isHostRecord(value) {
+    if (value === null)
+        return false;
+    if (typeof value !== "object")
+        return false;
+    return !Array.isArray(value);
+}
+export function isHostIdentifier(value) {
+    if (typeof value !== "string")
+        return false;
+    return /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/u.test(value);
+}
+function isHostIdentityText(value, maximum) {
+    if (typeof value !== "string")
+        return false;
+    if (value.length === 0)
+        return false;
+    if (value.length > maximum)
+        return false;
+    return !/[\x00-\x1f\x7f]/u.test(value);
+}
+export function isHostIdentity(value) {
+    if (!isHostRecord(value))
+        return false;
+    if (Object.keys(value).some((key) => !["name", "os", "user", "homeDir"].includes(key)))
+        return false;
+    if (!["windows", "macos", "linux"].includes(String(value.os)))
+        return false;
+    if (!isHostIdentityText(value.name, 128))
+        return false;
+    if (!isHostIdentityText(value.user, 128))
+        return false;
+    return isHostIdentityText(value.homeDir, 4096);
+}
+export function hasMatchingHostIdentity(a, b) {
+    if (a.name !== b.name)
+        return false;
+    if (a.os !== b.os)
+        return false;
+    if (a.user !== b.user)
+        return false;
+    return a.homeDir === b.homeDir;
+}
+export function isHostToolResult(value) {
+    if (!isHostRecord(value))
+        return false;
+    if (typeof value.ok !== "boolean")
+        return false;
+    if (typeof value.producedNewInformation !== "boolean")
+        return false;
+    if (value.data !== undefined && !isHostRecord(value.data))
+        return false;
+    return typeof value.output === "string";
+}

package/dist/plugins/system/source/contracts.d.ts

@@ -0,0 +1,38 @@
+export type SystemTargetId = "linux" | "macos" | "windows";
+export type SystemTarget = Readonly<{
+    id: SystemTargetId;
+    transport: "native" | "wsl_interop";
+    shell: string;
+}>;
+export type SystemProcessInput = Readonly<{
+    executable: string;
+    args: readonly string[];
+    cwd?: string;
+    timeoutMs?: number;
+    outputMaxChars?: number;
+    abortSignal?: AbortSignal;
+}>;
+export type SystemSpawnObservation = Readonly<{
+    pid: number;
+    pidNamespace: "runtime_os";
+    executable: string;
+    identitySource: "spawn_arguments";
+}>;
+export type SystemProcessResult = Readonly<{
+    exitCode: number | null;
+    stdout: string;
+    stderr: string;
+    status: "completed" | "timeout" | "aborted" | "spawn_failed";
+    outputTruncated: boolean;
+    spawnedProcess?: SystemSpawnObservation;
+}>;
+export type SystemProcessRunner = (input: SystemProcessInput) => Promise<SystemProcessResult>;
+export type SystemApplication = Readonly<{
+    id: string;
+    name: string;
+    target: SystemTargetId;
+}>;
+export declare class SystemOperationError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}

package/dist/plugins/system/source/contracts.js

@@ -0,0 +1,7 @@
+export class SystemOperationError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}

package/dist/plugins/system/source/elevation.d.ts

@@ -0,0 +1,8 @@
+import { type SystemProcessInput, type SystemProcessRunner, type SystemTarget } from "./contracts.js";
+/** Resolve real native authority. Missing human authorization is an explicit result. */
+export declare function elevatedSystemCommand(input: {
+    target: SystemTarget;
+    command: string;
+    cwd: string;
+    run: SystemProcessRunner;
+}): Promise<SystemProcessInput>;

package/dist/plugins/system/source/elevation.js

@@ -0,0 +1,57 @@
+import { SystemOperationError, } from "./contracts.js";
+import { powershellArguments, shellLiteral, windowsSystemCommandScript, } from "./targets.js";
+const WINDOWS_ADMIN_PROBE = "([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)";
+/** Resolve real native authority. Missing human authorization is an explicit result. */
+export async function elevatedSystemCommand(input) {
+    const { target, command, cwd, run } = input;
+    if (target.id === "windows")
+        return windowsElevatedCommand(target, command, cwd, run);
+    if (process.getuid?.() === 0)
+        return { executable: target.shell, args: ["-lc", command], cwd };
+    if (target.id === "macos") {
+        const script = `cd ${shellLiteral(cwd)} && ${shellLiteral(target.shell)} -lc ${shellLiteral(command)}`;
+        const appleScriptString = JSON.stringify(script);
+        return {
+            executable: "/usr/bin/osascript",
+            args: [
+                "-e",
+                `do shell script ${appleScriptString} with administrator privileges`,
+            ],
+        };
+    }
+    const probe = await run({
+        executable: "/usr/bin/sudo",
+        args: ["-n", "--", "/usr/bin/true"],
+        timeoutMs: 5_000,
+    });
+    if (!hasSuccessfulPrivilegeProbe(probe))
+        throw new SystemOperationError("system_authorization_required", "Linux sudo authorization requires a human or a configured native privilege policy. Authenticate in a native terminal or supply an authorized host; ABot does not request, invent or bypass passwords.");
+    return {
+        executable: "/usr/bin/sudo",
+        args: ["-n", "--", target.shell, "-lc", command],
+        cwd,
+    };
+}
+function hasSuccessfulPrivilegeProbe(probe) {
+    if (probe.status !== "completed")
+        return false;
+    return probe.exitCode === 0;
+}
+function hasWindowsAdministratorAuthority(probe) {
+    if (!hasSuccessfulPrivilegeProbe(probe))
+        return false;
+    return probe.stdout.trim() === "True";
+}
+async function windowsElevatedCommand(target, command, cwd, run) {
+    const probe = await run({
+        executable: target.shell,
+        args: powershellArguments(WINDOWS_ADMIN_PROBE),
+        timeoutMs: 5_000,
+    });
+    if (!hasWindowsAdministratorAuthority(probe))
+        throw new SystemOperationError("system_authorization_required", "Windows Administrator authority is required. Approve UAC in a native Windows elevated host, then retry; this noninteractive transport cannot answer UAC or provide credentials.");
+    return {
+        executable: target.shell,
+        args: powershellArguments(windowsSystemCommandScript(command, cwd)),
+    };
+}

package/dist/plugins/system/source/handlers.d.ts

@@ -0,0 +1,3 @@
+import { type ToolImplementation } from "../../../src/plugin-sdk/index.js";
+import { type SystemProcessRunner, type SystemTarget, type SystemTargetId } from "./contracts.js";
+export declare function createSystemHandlers(run?: SystemProcessRunner, resolveTarget?: (id: SystemTargetId) => Promise<SystemTarget>): Record<string, ToolImplementation>;

package/dist/plugins/system/source/handlers.js

@@ -0,0 +1,90 @@
+import { failureFromError, failureResult, readBoundedInteger, readOptionalString, successResult, } from "../../../src/plugin-sdk/index.js";
+import { readSystemApplications } from "./application-catalog.js";
+import { systemApplicationObservation } from "./application-observation.js";
+import { observeSystemTargets } from "./target-observation.js";
+import { launchSystemApplication } from "./application-launch.js";
+import { executeSystemCommand } from "./commands.js";
+import { SystemOperationError, } from "./contracts.js";
+import { runSystemProcess } from "./process-runner.js";
+import { systemProcessResult } from "./process-result.js";
+import { readSystemTargetId, resolveSystemTarget } from "./targets.js";
+function withSystemOperationErrors(operation) {
+    return async (params, context) => {
+        try {
+            return await operation(params, context);
+        }
+        catch (error) {
+            if (error instanceof SystemOperationError)
+                return failureResult({
+                    errorCode: error.code,
+                    message: error.message,
+                    data: {
+                        humanActionRequired: error.code === "system_authorization_required",
+                    },
+                });
+            return failureFromError(error, {
+                fallbackCode: "system_operation_failed",
+                fallbackMessage: "The native system operation failed.",
+                operation: "system",
+            });
+        }
+    };
+}
+export function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => resolveSystemTarget(id, run)) {
+    const targets = async () => {
+        const observation = await observeSystemTargets(run);
+        return successResult({
+            output: JSON.stringify(observation),
+            data: {
+                ...observation,
+                observationMeta: { kind: "volatile_external", carryPolicy: "never" },
+            },
+        });
+    };
+    const command = async (params, context) => {
+        const target = await resolveTarget(readSystemTargetId(params.target));
+        const result = await executeSystemCommand({
+            target,
+            params,
+            run,
+            ...(context?.abortSignal ? { abortSignal: context.abortSignal } : {}),
+        });
+        return systemProcessResult(target, result, "command_process_completion");
+    };
+    const applications = async (params) => {
+        const target = await resolveTarget(readSystemTargetId(params.target));
+        const query = (readOptionalString(params.query) ?? "").toLowerCase();
+        const limit = params.limit === undefined
+            ? 50
+            : readBoundedInteger(params.limit, {
+                name: "limit",
+                minimum: 1,
+                maximum: 100,
+            });
+        const catalog = await readSystemApplications(target, run);
+        const { output, data } = systemApplicationObservation(target, catalog, query, limit);
+        return successResult({
+            output,
+            data: {
+                ...data,
+                observationMeta: { kind: "volatile_external", carryPolicy: "never" },
+            },
+        });
+    };
+    const launch = async (params, context) => {
+        const target = await resolveTarget(readSystemTargetId(params.target));
+        const result = await launchSystemApplication({
+            target,
+            params,
+            run,
+            ...(context?.abortSignal ? { abortSignal: context.abortSignal } : {}),
+        });
+        return systemProcessResult(target, result.process, "launch_request_dispatch", result.application);
+    };
+    return {
+        system_targets: withSystemOperationErrors(targets),
+        system_command: withSystemOperationErrors(command),
+        system_applications: withSystemOperationErrors(applications),
+        system_launch: withSystemOperationErrors(launch),
+    };
+}

package/dist/plugins/system/source/host-evidence.d.ts

@@ -0,0 +1,4 @@
+import { type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import { type HostIdentity } from "./companion/protocol.js";
+/** Preserve execution provenance without publishing private connection identity. */
+export declare function attachHostEvidence(result: ToolImplementationOutput, _hostId: string, identity: HostIdentity): ToolImplementationOutput;

package/dist/plugins/system/source/host-evidence.js

@@ -0,0 +1,52 @@
+import { enforcePluginResultByteBudget, } from "../../../src/plugin-sdk/index.js";
+import { isHostRecord } from "./companion/protocol.js";
+/** Preserve execution provenance without publishing private connection identity. */
+export function attachHostEvidence(result, _hostId, identity) {
+    const data = modelSafeHostResultData(result.data ?? {});
+    const output = describeCompanionProcessNamespace(result.output, data.spawnedProcess);
+    return enforcePluginResultByteBudget({
+        ...result,
+        output: [
+            `Execution transport: host_companion; OS target: ${identity.os}.`,
+            "This is settled evidence from the selected host, not the runtime/container. A connection or dispatched process does not prove an application window or requested system effect.",
+            output,
+        ].join("\n"),
+        data: {
+            ...data,
+            ...(typeof data.transport === "string"
+                ? { nativeTransport: data.transport }
+                : {}),
+            transport: "host_companion",
+            ...(isHostRecord(data.spawnedProcess)
+                ? {
+                    spawnedProcess: {
+                        ...data.spawnedProcess,
+                        pidNamespace: "companion_os",
+                    },
+                }
+                : {}),
+        },
+    });
+}
+function modelSafeHostResultData(data) {
+    const privateFields = new Set([
+        "hostId",
+        "host_id",
+        "connectionId",
+        "hostIdentity",
+        "companion",
+        "targetSelection",
+    ]);
+    return Object.fromEntries(Object.entries(data).filter(([key]) => !privateFields.has(key)));
+}
+function describeCompanionProcessNamespace(output, spawnedProcess) {
+    if (!isHostRecord(spawnedProcess))
+        return output;
+    const excerptBoundary = output.indexOf("\nSTDOUT excerpt:");
+    if (excerptBoundary < 0)
+        return output;
+    const header = output.slice(0, excerptBoundary);
+    const streams = output.slice(excerptBoundary);
+    return (header.replace(" in runtime OS namespace.", " in companion OS namespace.") +
+        streams);
+}

package/dist/plugins/system/source/host-observation.d.ts

@@ -0,0 +1,25 @@
+import type { SystemTargetId } from "./contracts.js";
+export type SystemHostFacts = Readonly<{
+    platform: NodeJS.Platform;
+    kernelRelease: string;
+    containerMarker?: boolean;
+}>;
+export declare function readSystemHostFacts(): SystemHostFacts;
+export declare function isWslHostRuntime(facts: SystemHostFacts): boolean;
+export declare function observeSystemHost(facts?: SystemHostFacts): {
+    readonly runtimeOs: "unsupported" | SystemTargetId;
+    readonly kernelRelease: string;
+    readonly environment: "container";
+    readonly inferredHostOs: "unknown";
+    readonly hostInferenceSource: "container_marker";
+    readonly windowsExecutionRequiresProbe: false;
+    readonly guiSessionStatus: "not_checked";
+} | {
+    readonly runtimeOs: "unsupported" | SystemTargetId;
+    readonly kernelRelease: string;
+    readonly environment: "wsl_guest" | "not_identified_as_wsl";
+    readonly inferredHostOs: "unsupported" | SystemTargetId;
+    readonly hostInferenceSource: "wsl_kernel_signature" | "runtime_platform_only";
+    readonly windowsExecutionRequiresProbe: boolean;
+    readonly guiSessionStatus: "not_checked";
+};

package/dist/plugins/system/source/host-observation.js

@@ -0,0 +1,59 @@
+import { existsSync } from "node:fs";
+import { release } from "node:os";
+export function readSystemHostFacts() {
+    return {
+        platform: process.platform,
+        kernelRelease: release(),
+        containerMarker: hasSystemContainerMarker(),
+    };
+}
+function hasSystemContainerMarker() {
+    if (existsSync("/.dockerenv"))
+        return true;
+    return existsSync("/run/.containerenv");
+}
+function isContainerHostRuntime(facts) {
+    if (facts.platform !== "linux")
+        return false;
+    return facts.containerMarker === true;
+}
+export function isWslHostRuntime(facts) {
+    if (facts.platform !== "linux")
+        return false;
+    if (isContainerHostRuntime(facts))
+        return false;
+    return /microsoft/iu.test(facts.kernelRelease);
+}
+function runtimeOs(platform) {
+    if (platform === "win32")
+        return "windows";
+    if (platform === "darwin")
+        return "macos";
+    if (platform === "linux")
+        return "linux";
+    return "unsupported";
+}
+export function observeSystemHost(facts = readSystemHostFacts()) {
+    const runtime = runtimeOs(facts.platform);
+    if (isContainerHostRuntime(facts))
+        return {
+            runtimeOs: runtime,
+            kernelRelease: facts.kernelRelease,
+            environment: "container",
+            inferredHostOs: "unknown",
+            hostInferenceSource: "container_marker",
+            windowsExecutionRequiresProbe: false,
+            guiSessionStatus: "not_checked",
+        };
+    const wsl = isWslHostRuntime(facts);
+    const inferredHostOs = wsl ? "windows" : runtime;
+    return {
+        runtimeOs: runtime,
+        kernelRelease: facts.kernelRelease,
+        environment: wsl ? "wsl_guest" : "not_identified_as_wsl",
+        inferredHostOs,
+        hostInferenceSource: wsl ? "wsl_kernel_signature" : "runtime_platform_only",
+        windowsExecutionRequiresProbe: inferredHostOs === "windows",
+        guiSessionStatus: "not_checked",
+    };
+}

package/dist/plugins/system/source/process-result.d.ts

@@ -0,0 +1,4 @@
+import { type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import type { SystemApplication, SystemProcessResult, SystemTarget } from "./contracts.js";
+export type SystemEvidenceScope = "command_process_completion" | "launch_request_dispatch";
+export declare function systemProcessResult(target: SystemTarget, result: SystemProcessResult, evidenceScope: SystemEvidenceScope, application?: SystemApplication): ToolImplementationOutput;