@abot-ai/runtime 1.3.1 → 1.4.0

package/dist/src/runtime/adapters/long-term-memory/file-lock/acquisition.js

@@ -12,7 +12,7 @@ export async function acquireFileLock(lockPath, options) {
     for (;;) {
         const token = randomUUID();
         try {
-            await installLockDirectory(lockPath, token);
+            await installLockDirectory(lockPath, token, options.ownerIdentity);
             return createRelease(lockPath, token, options.releaseMode);
         }
         catch (error) {
@@ -51,9 +51,8 @@ async function removeAbandonedLock(lockPath, processIsAlive) {
         return true;
     if (snapshot.kind === "legacy_file" || !snapshot.reclaimable)
         return false;
-    if (snapshot.ownerPid !== undefined && processIsAlive(snapshot.ownerPid)) {
+    if (await hasLiveObservedOwner(snapshot, processIsAlive))
         return false;
-    }
     if (snapshot.record && snapshot.ownerFileName) {
         return removeObservedOwner(lockPath, snapshot.ownerFileName);
     }
@@ -65,6 +64,11 @@ async function removeAbandonedLock(lockPath, processIsAlive) {
     }
     return removeEmptyLockTree(lockPath, snapshot.hasLeaseDirectory);
 }
+async function hasLiveObservedOwner(snapshot, processIsAlive) {
+    if (snapshot.ownerPid === undefined)
+        return false;
+    return processIsAlive(snapshot.ownerPid, snapshot.record?.ownerIdentity);
+}
 function defaultProcessIsAlive(pid) {
     try {
         process.kill(pid, 0);

package/dist/src/runtime/adapters/long-term-memory/file-lock/contracts.d.ts

@@ -7,7 +7,9 @@ export declare const OWNER_FILE_PATTERN: RegExp;
 export type FileLockOptions = Readonly<{
     waitMs?: number;
     retryDelayMs?: number;
-    processIsAlive?: (pid: number) => boolean;
+    /** Optional process incarnation; interpreted only by the caller's liveness probe. */
+    ownerIdentity?: string;
+    processIsAlive?: (pid: number, ownerIdentity?: string) => boolean | Promise<boolean>;
     /** Long-lived host leases must finish physical cleanup before process.exit. */
     releaseMode?: "asynchronous" | "synchronous";
 }>;
@@ -15,6 +17,7 @@ export type LockRecord = Readonly<{
     pid: number;
     token: string;
     createdAt: string;
+    ownerIdentity?: string;
 }>;
 export type DirectoryLockSnapshot = Readonly<{
     kind: "directory";

package/dist/src/runtime/adapters/long-term-memory/file-lock/install.d.ts

@@ -1 +1 @@
-export declare function installLockDirectory(lockPath: string, token: string): Promise<void>;
+export declare function installLockDirectory(lockPath: string, token: string, ownerIdentity?: string): Promise<void>;

package/dist/src/runtime/adapters/long-term-memory/file-lock/install.js

@@ -2,7 +2,10 @@ import { mkdir, open, rename } from "node:fs/promises";
 import { join } from "node:path";
 import { removeDirectoryIfEmpty, removeStagingLock } from "./cleanup.js";
 import { LEASE_DIRECTORY_NAME, ownerFileName } from "./contracts.js";
-export async function installLockDirectory(lockPath, token) {
+import { hasValidOptionalLockOwnerIdentity } from "./owner-identity.js";
+export async function installLockDirectory(lockPath, token, ownerIdentity) {
+    if (!hasValidOptionalLockOwnerIdentity(ownerIdentity))
+        throw new Error("file_lock_owner_identity_invalid");
     const stagingPath = `${lockPath}.${process.pid}.${token}.pending`;
     const stagingOwnerPath = join(stagingPath, ownerFileName(token));
     let handle;
@@ -15,6 +18,7 @@ export async function installLockDirectory(lockPath, token) {
             pid: process.pid,
             token,
             createdAt: new Date().toISOString(),
+            ...(ownerIdentity === undefined ? {} : { ownerIdentity }),
         }), "utf8");
         await handle.sync();
         await handle.close();

package/dist/src/runtime/adapters/long-term-memory/file-lock/owner-identity.d.ts

@@ -0,0 +1,3 @@
+/** Opaque caller-owned incarnation metadata; the lock does not interpret it. */
+export declare function isLockOwnerIdentity(value: unknown): value is string;
+export declare function hasValidOptionalLockOwnerIdentity(value: unknown): value is string | undefined;

package/dist/src/runtime/adapters/long-term-memory/file-lock/owner-identity.js

@@ -0,0 +1,15 @@
+/** Opaque caller-owned incarnation metadata; the lock does not interpret it. */
+export function isLockOwnerIdentity(value) {
+    if (typeof value !== "string")
+        return false;
+    if (value.length === 0)
+        return false;
+    if (Buffer.byteLength(value, "utf8") > 256)
+        return false;
+    return !/[\x00-\x1f\x7f]/u.test(value);
+}
+export function hasValidOptionalLockOwnerIdentity(value) {
+    if (value === undefined)
+        return true;
+    return isLockOwnerIdentity(value);
+}

package/dist/src/runtime/adapters/long-term-memory/file-lock/owner-record.js

@@ -2,6 +2,7 @@ import { constants } from "node:fs";
 import { open } from "node:fs/promises";
 import { join } from "node:path";
 import { directorySnapshot, fileSystemErrorCode, LEASE_DIRECTORY_NAME, MAX_LOCK_RECORD_BYTES, } from "./contracts.js";
+import { isLockOwnerIdentity } from "./owner-identity.js";
 export async function readOwnerRecord(lockPath, entryName, expectedToken, directoryModifiedAtMs) {
     let handle;
     try {
@@ -109,6 +110,7 @@ function parseLockRecord(raw, expectedToken) {
             pid: ownerPid,
             token: expectedToken,
             createdAt: candidate.createdAt,
+            ...(isLockOwnerIdentity(candidate.ownerIdentity) ? { ownerIdentity: candidate.ownerIdentity } : {}),
         }),
     });
 }

package/dist/src/runtime/adapters/long-term-memory/onboarding-config-repository.js

@@ -1,60 +1,34 @@
-import { randomUUID } from "node:crypto";
-import { chmod, copyFile, mkdir, rename, rm, stat, writeFile, } from "node:fs/promises";
-import { dirname } from "node:path";
-import { isDeepStrictEqual } from "node:util";
 import { inspectRuntimeConfigFileWithMeta } from "../../config/loader.js";
-import { withFileLock } from "./file-lock.js";
+import { ConfigFileConflictError, withConfigFileTransaction, } from "../config-file-transaction.js";
 export function createFileLongTermMemoryOnboardingConfigRepository(params) {
     const source = () => inspectRuntimeConfigFileWithMeta(params.rootDir, params.configPath);
     return Object.freeze({
         async read() {
             const current = source();
-            if (!current.exists) {
+            if (!current.exists)
                 throw new Error(`runtime_config_not_found:${current.path}`);
-            }
             return Object.freeze({ config: current.config, path: current.path });
         },
         async write(config, expectedConfig) {
             const current = source();
-            if (!current.exists) {
+            if (!current.exists)
                 throw new Error(`runtime_config_not_found:${current.path}`);
+            try {
+                return await withConfigFileTransaction(current.path, async (transaction) => {
+                    if (!transaction.snapshot.exists)
+                        throw new Error(`runtime_config_not_found:${current.path}`);
+                    const result = await transaction.write(config, { expectedConfig });
+                    return Object.freeze({
+                        configPath: transaction.path,
+                        backupPath: result.backupPath,
+                    });
+                });
             }
-            return withFileLock(`${current.path}.memory-onboarding.lock`, async () => {
-                const lockedCurrent = source();
-                if (!lockedCurrent.exists) {
-                    throw new Error(`runtime_config_not_found:${lockedCurrent.path}`);
-                }
-                const hasConflictingConfig = expectedConfig !== undefined &&
-                    !isDeepStrictEqual(lockedCurrent.config, expectedConfig);
-                if (hasConflictingConfig) {
+            catch (error) {
+                if (error instanceof ConfigFileConflictError)
                     throw new Error("long_term_memory_config_changed");
-                }
-                return writeConfigSnapshot(lockedCurrent.path, config);
-            });
+                throw error;
+            }
         },
     });
 }
-async function writeConfigSnapshot(configPath, config) {
-    await mkdir(dirname(configPath), { recursive: true });
-    const backupPath = createBackupPath(configPath);
-    const temporaryPath = `${configPath}.${process.pid}.${randomUUID()}.tmp`;
-    const sourcePermissions = (await stat(configPath)).mode & 0o777;
-    await copyFile(configPath, backupPath);
-    try {
-        await writeFile(temporaryPath, `${JSON.stringify(config, null, 2)}\n`, {
-            encoding: "utf8",
-            mode: sourcePermissions,
-        });
-        await chmod(temporaryPath, sourcePermissions);
-        await rename(temporaryPath, configPath);
-    }
-    catch (error) {
-        await rm(temporaryPath, { force: true }).catch(() => undefined);
-        throw error;
-    }
-    return Object.freeze({ configPath, backupPath });
-}
-function createBackupPath(configPath) {
-    const timestamp = new Date().toISOString().replace(/[:.]/gu, "-");
-    return `${configPath}.${timestamp}.bak`;
-}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/catalog/registrations.js

@@ -28,12 +28,16 @@ function captureAdapter(toolName, adapter) {
         return undefined;
     const normalizeCall = adapter.normalizeCall;
     const validateCall = adapter.validateCall;
-    if ((normalizeCall !== undefined && typeof normalizeCall !== "function") ||
-        (validateCall !== undefined && typeof validateCall !== "function")) {
+    const executionBinding = adapter.executionBinding;
+    if (!hasOnlyAdapterFunctions([normalizeCall, validateCall, executionBinding])) {
         throw new TypeError(`Invalid ordinary invocation adapter registration: ${toolName}`);
     }
     return Object.freeze({
         ...(normalizeCall ? { normalizeCall } : {}),
         ...(validateCall ? { validateCall } : {}),
+        ...(executionBinding ? { executionBinding } : {}),
     });
 }
+function hasOnlyAdapterFunctions(values) {
+    return values.every((value) => value === undefined || typeof value === "function");
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/approval.js

@@ -1,7 +1,13 @@
+import { requiresToolActionApproval } from "../../../../capabilities/tool-permission-mode.js";
 import { buildToolExecutorEventMetadata, } from "../shared/event-metadata.js";
 import { rejectNormalInvocation } from "../shared/rejection.js";
+function recommendsFullPlusForForcedAction(mode, force) {
+    if (mode !== "full_access")
+        return false;
+    return force;
+}
 export async function requestNormalInvocationApproval(params) {
-    if (!params.force && params.toolPermissionMode !== "ask") {
+    if (!requiresToolActionApproval(params.toolPermissionMode, params.force)) {
         return Object.freeze({ ok: true });
     }
     const approvalId = params.nextApprovalId();
@@ -10,6 +16,9 @@ export async function requestNormalInvocationApproval(params) {
         ...(params.executionId ? { executionId: params.executionId } : {}),
         approvalId,
         tool: params.call.tool,
+        ...(recommendsFullPlusForForcedAction(params.toolPermissionMode, params.force)
+            ? { recommendedToolPermissionMode: "full_plus" }
+            : {}),
         ...(params.eventMeta ? { meta: params.eventMeta } : {}),
     });
     if (!params.toolApprovalController) {

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/execution-binding.d.ts

@@ -0,0 +1,11 @@
+import type { ToolCall, ToolCallAdapter } from "../../../../capabilities/tool-types.js";
+import { rejectNormalInvocation } from "../shared/rejection.js";
+/** Private execution identity and human disclosure never enter model controls. */
+export declare function captureExecutionBinding(adapter: ToolCallAdapter | undefined, call: ToolCall): Readonly<{
+    ok: true;
+    identity?: string;
+    metadata?: Readonly<Record<string, unknown>>;
+}> | Readonly<{
+    ok: false;
+    rejection: ReturnType<typeof rejectNormalInvocation>;
+}>;

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/execution-binding.js

@@ -0,0 +1,37 @@
+import { rejectNormalInvocation } from "../shared/rejection.js";
+/** Private execution identity and human disclosure never enter model controls. */
+export function captureExecutionBinding(adapter, call) {
+    if (!adapter?.executionBinding)
+        return { ok: true };
+    try {
+        const binding = adapter.executionBinding(call);
+        if (!hasBoundExecutionIdentity(binding)) {
+            return rejectExecutionBinding();
+        }
+        return Object.freeze({
+            ok: true,
+            identity: binding.identity,
+            ...(binding.metadata
+                ? { metadata: Object.freeze(structuredClone(binding.metadata)) }
+                : {}),
+        });
+    }
+    catch {
+        return rejectExecutionBinding();
+    }
+}
+function hasBoundExecutionIdentity(binding) {
+    if (!binding || typeof binding !== "object")
+        return false;
+    if (!("identity" in binding))
+        return false;
+    if (typeof binding.identity !== "string")
+        return false;
+    return binding.identity.trim().length > 0;
+}
+function rejectExecutionBinding() {
+    return {
+        ok: false,
+        rejection: rejectNormalInvocation("normal_invocation_execution_binding_unavailable", "The registered action could not bind its execution destination for this request."),
+    };
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/file-output-presentation.d.ts

@@ -0,0 +1,7 @@
+import { type ToolFileOutputReporter } from "../../../../capabilities/file-output-presentation.js";
+import type { ToolEventMetadata, ToolExecutionResult, ToolExecutionSharedState, ToolNormalInvocationEffect } from "../../../../capabilities/tool-types.js";
+/** One invocation-local presentation collector; canonical results are untouched. */
+export declare function createFileOutputPresentation(runtimePaths: ToolExecutionSharedState["runtimePaths"]): Readonly<{
+    report: ToolFileOutputReporter;
+    finish(result: ToolExecutionResult, metadata: ToolEventMetadata | undefined, effect: ToolNormalInvocationEffect): ToolEventMetadata | undefined;
+}>;

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/file-output-presentation.js

@@ -0,0 +1,105 @@
+import { isAbsolute } from "node:path";
+import { isToolFileOutputLocation, parseToolFileOutputRootIdentity, parseToolFileOutputReceipt, } from "../../../../capabilities/file-output-presentation.js";
+import { createRuntimeToolPathResolver } from "../../../capabilities/runtime-target-path.js";
+import { captureFileOutputRootId } from "../../../capabilities/file-output-root-identity.js";
+function matchesReportedFileTarget(target, resolved) {
+    if (target.location !== resolved.location)
+        return false;
+    if (target.rootPath !== resolved.rootPath)
+        return false;
+    if (target.absolutePath !== resolved.absolutePath)
+        return false;
+    if (target.relativePath !== resolved.relativePath)
+        return false;
+    return target.logicalPath === resolved.logicalPath;
+}
+function captureReportedFileOutput(report, resolver) {
+    const rootIdentity = parseToolFileOutputRootIdentity(report.rootIdentity);
+    if (!rootIdentity)
+        return undefined;
+    const target = report.target;
+    if (!isToolFileOutputLocation(target.location))
+        return undefined;
+    if (!isAbsolute(target.absolutePath))
+        return undefined;
+    const resolved = resolver.resolve(target.absolutePath, {
+        requirePath: true,
+        allowedLocations: [target.location],
+    });
+    if (!matchesReportedFileTarget(target, resolved))
+        return undefined;
+    return parseToolFileOutputReceipt({
+        version: 1,
+        location: target.location,
+        rootId: captureFileOutputRootId(target.location, resolved.rootPath, rootIdentity),
+        relativePath: target.relativePath,
+        logicalPath: target.logicalPath,
+        operation: report.operation,
+    });
+}
+function isSameFileOutputReceipt(left, right) {
+    if (left.rootId !== right.rootId)
+        return false;
+    if (left.relativePath !== right.relativePath)
+        return false;
+    return left.operation === right.operation;
+}
+function hasConflictingFileOutputReceipt(previous, next) {
+    if (!previous)
+        return false;
+    return !isSameFileOutputReceipt(previous, next);
+}
+function canPublishFileOutput(result, effect) {
+    if (!result.ok)
+        return false;
+    if (result.data?.mutationEvidence !== true)
+        return false;
+    return effect !== "read_only";
+}
+function omitReservedFileOutput(metadata) {
+    const { fileOutput: _untrustedFileOutput, ...rest } = metadata ?? {};
+    return rest;
+}
+/** One invocation-local presentation collector; canonical results are untouched. */
+export function createFileOutputPresentation(runtimePaths) {
+    const resolver = createRuntimeToolPathResolver(runtimePaths);
+    let receipt;
+    let rejected = false;
+    let finished = false;
+    const report = (input) => {
+        if (finished)
+            return;
+        if (rejected)
+            return;
+        try {
+            const captured = captureReportedFileOutput(input, resolver);
+            if (!captured) {
+                rejected = true;
+                return;
+            }
+            if (hasConflictingFileOutputReceipt(receipt, captured)) {
+                rejected = true;
+                return;
+            }
+            receipt = captured;
+        }
+        catch {
+            rejected = true;
+        }
+    };
+    return Object.freeze({
+        report,
+        finish(result, metadata, effect) {
+            finished = true;
+            const base = omitReservedFileOutput(metadata);
+            const fallback = Object.keys(base).length > 0 ? base : undefined;
+            if (rejected)
+                return fallback;
+            if (!receipt)
+                return fallback;
+            if (!canPublishFileOutput(result, effect))
+                return fallback;
+            return { ...base, fileOutput: receipt };
+        },
+    });
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/run.js

@@ -1,3 +1,4 @@
+import { permitsRequiredToolMode } from "../../../../capabilities/tool-permission-mode.js";
 import { buildToolCompletedEventActions, buildToolCompletedEventMetadata, buildToolLifecycleEventCopy, } from "../../../../capabilities/tool-event-metadata.js";
 import { requestNormalInvocationApproval } from "./approval.js";
 import { createPreparedInvocationRejectionEmitter } from "./rejection-event.js";
@@ -6,6 +7,8 @@ import { createRegisteredToolActionFingerprint } from "../shared/action-fingerpr
 import { buildToolExecutorEventMetadata, buildToolIntentEventMetadata, } from "../shared/event-metadata.js";
 import { prepareCompleteInvocationInput } from "../payload/input-preparation.js";
 import { rejectNormalInvocation } from "../shared/rejection.js";
+import { createFileOutputPresentation } from "./file-output-presentation.js";
+import { captureExecutionBinding } from "./execution-binding.js";
 export async function executeNormalInvocation(params) {
     const prepared = prepareNormalInvocation(params);
     return prepared.status === "prepared"
@@ -19,6 +22,9 @@ export function prepareNormalInvocation(params) {
     if (!source) {
         return rejectNormalInvocation("normal_invocation_handle_invalid", "The selected ordinary capability is not registered for this request.");
     }
+    if (!permitsRequiredToolMode(executor.toolPermissionMode, source.registration.definition.requiredPermissionMode)) {
+        return rejectNormalInvocation("tool_permission_mode_required", "The source tool requires a different captured request permission mode.");
+    }
     const preparedInput = prepareCompleteInvocationInput(source, params.input);
     if (!preparedInput.ok)
         return preparedInput.rejection;
@@ -38,6 +44,9 @@ export function prepareNormalInvocation(params) {
     const target = resolveExactTargetOperation(params.registrations, normalizedCall.call);
     if (!target.ok)
         return target.rejection;
+    if (!permitsRequiredToolMode(executor.toolPermissionMode, target.binding.registration.definition.requiredPermissionMode)) {
+        return rejectNormalInvocation("tool_permission_mode_required", "The normalized target tool requires a different captured request permission mode.");
+    }
     const targetValidation = validateCompleteCall({
         adapter: target.binding.registration.adapter,
         call: normalizedCall.call,
@@ -50,11 +59,20 @@ export function prepareNormalInvocation(params) {
     if (target.binding.operation.effect !== source.operation.effect) {
         return rejectNormalInvocation("normal_invocation_effect_changed", "A normalized ordinary invocation cannot change its declared execution effect.");
     }
-    const eventMeta = buildToolIntentEventMetadata(normalizedCall.call, params.input.intent, target.binding.registration.definition);
+    const executionBinding = captureExecutionBinding(target.binding.registration.adapter, normalizedCall.call);
+    if (!executionBinding.ok)
+        return executionBinding.rejection;
+    const intentMeta = buildToolIntentEventMetadata(normalizedCall.call, params.input.intent, target.binding.registration.definition);
+    const eventMeta = executionBinding.metadata
+        ? { ...executionBinding.metadata, ...intentMeta }
+        : intentMeta;
     const actionFingerprint = createRegisteredToolActionFingerprint({
         contractVersion: target.binding.registration.contract.version,
         operationId: target.binding.operation.operationId,
         call: normalizedCall.call,
+        ...(executionBinding.identity
+            ? { executionIdentity: executionBinding.identity }
+            : {}),
     });
     return Object.freeze({
         status: "prepared",
@@ -73,6 +91,9 @@ export function prepareNormalInvocation(params) {
             target: target.binding,
             call: normalizedCall.call,
             eventMeta,
+            ...(executionBinding.metadata
+                ? { executionMetadata: executionBinding.metadata }
+                : {}),
             input: params.input,
         }),
     });
@@ -110,22 +131,27 @@ async function executePreparedNormalInvocation(params) {
         ...(params.eventMeta ? { meta: params.eventMeta } : {}),
         ...(startedCopy ?? {}),
     });
+    const fileOutputPresentation = createFileOutputPresentation(params.executor.sharedState?.runtimePaths);
     const result = await params.executor.toolRegistry.execute(params.call, {
         abortSignal: params.executor.abortSignal,
+        reportFileOutput: fileOutputPresentation.report,
         ...(params.executor.sharedState
             ? { sharedState: params.executor.sharedState }
             : {}),
     });
     const completionActions = Object.freeze(buildToolCompletedEventActions(params.call, result, params.target.registration.definition).map((action) => Object.freeze({ ...action })));
-    const completedMeta = buildToolCompletedEventMetadata(params.call, result, params.target.registration.definition);
+    const completedMeta = fileOutputPresentation.finish(result, buildToolCompletedEventMetadata(params.call, result, params.target.registration.definition), params.target.operation.effect);
     const completedCopy = buildToolLifecycleEventCopy(params.target.registration.definition, result.ok ? "completed" : "failed");
+    const completedEventMeta = params.executionMetadata
+        ? { ...completedMeta, ...params.executionMetadata }
+        : completedMeta;
     params.executor.onEvent?.("tool.completed", {
         ...buildToolExecutorEventMetadata(params.executorIdentity),
         ...(params.executionId ? { executionId: params.executionId } : {}),
         tool: params.source.registration.toolName,
         ok: result.ok,
         actions: completionActions,
-        ...(completedMeta ? { meta: completedMeta } : {}),
+        ...(completedEventMeta ? { meta: completedEventMeta } : {}),
         ...(completedCopy ?? {}),
     });
     return Object.freeze({

package/dist/src/runtime/adapters/registered-tool-normal-invocations/shared/action-fingerprint.d.ts

@@ -7,6 +7,7 @@ export declare function createRegisteredToolActionFingerprint(input: {
     contractVersion: number;
     operationId: string;
     call: ToolCall;
+    executionIdentity?: string;
 }): string;
 /**
  * Identifies a fully bounded preparation attempt that could not become a

package/dist/src/runtime/adapters/registered-tool-normal-invocations/shared/action-fingerprint.js

@@ -10,6 +10,7 @@ export function createRegisteredToolActionFingerprint(input) {
         input.operationId,
         input.call.tool,
         canonicalEntries(input.call.params),
+        ...(input.executionIdentity === undefined ? [] : [input.executionIdentity]),
     ]);
     return `sha256:${createHash("sha256").update(canonical).digest("hex")}`;
 }

package/dist/src/runtime/capabilities/configured-tool-registry.js

@@ -1,6 +1,8 @@
+import { bindRequestWorkingDirectory } from "./request-working-directory.js";
 import { createToolRegistry as createToolRegistryInstance } from "../../capabilities/registry.js";
 import { executeToolCall } from "../../capabilities/tool-executor.js";
 import { createRuntimeToolPathResolver } from "./runtime-target-path.js";
+import { prepareRequestToolModules } from "./request-module-preparation.js";
 export function createConfiguredToolRegistry(config, modules) {
     const baseRegistry = createToolRegistryInstance({ modules });
     const getImplementations = () => baseRegistry.getImplementations();
@@ -20,6 +22,11 @@ export function createConfiguredToolRegistry(config, modules) {
         }
         : { ...sharedState };
     return {
+        ...(modules.some((module) => module.prepareRequest)
+            ? {
+                prepareRequest: async () => createConfiguredToolRegistry(config, await prepareRequestToolModules(modules)),
+            }
+            : {}),
         listDefinitions: () => baseRegistry.getDefinitions(),
         listNormalInvocations: () => baseRegistry.getNormalInvocations(),
         getDefinition: (name) => baseRegistry.getByName(name),
@@ -28,7 +35,8 @@ export function createConfiguredToolRegistry(config, modules) {
         getImplementations,
         prepareSharedState,
         execute: (call, options) => {
-            const sharedState = prepareSharedState(options?.sharedState);
+            const configuredState = prepareSharedState(options?.sharedState);
+            const sharedState = bindRequestWorkingDirectory(configuredState, options?.requestWorkingDirectory);
             return executeToolCall(call, {
                 ...options,
                 sharedState,

package/dist/src/runtime/capabilities/file-output-root-identity.d.ts

@@ -0,0 +1,5 @@
+import { type ToolFileOutputLocation, type ToolFileOutputRootIdentity } from "../../capabilities/file-output-presentation.js";
+/** Host presentation capture only. Creates a marker once; never overwrites it. */
+export declare function captureFileOutputRootId(location: ToolFileOutputLocation, canonicalRoot: string, expectedIdentity?: ToolFileOutputRootIdentity): string;
+/** Preview authorization is read-only: missing or invalid markers stay invalid. */
+export declare function readFileOutputRootId(location: ToolFileOutputLocation, canonicalRoot: string): string;