@abot-ai/runtime 1.3.1 → 1.5.0

package/plugins/capability-brief/src/index.cjs

@@ -107,6 +107,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -120,6 +121,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -133,6 +135,9 @@ function failureResult(input) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // src/plugin-sdk/tool-availability-brief.ts
 var TOOL_COUNT_MAX = 64;
 var OUTPUT_CHARACTER_MAX = 16e3;

package/plugins/code-outline/src/index.cjs

@@ -271,6 +271,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -284,6 +285,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -308,6 +310,9 @@ function failureFromError(error, options) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // plugins/code-outline/source/parser.ts
 var import_parser = require("@babel/parser");
 var IMPORT_LIMIT = 40;

package/plugins/document-reader/plugin.json

@@ -10,7 +10,7 @@
       "catalogGroups": ["read"],
       "capabilities": {
         "document_reader": {
-          "description": "Extract bounded text from an attached or configured-root PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown, JSON, or RTF document. Use source for an attachment id/name or configured-root path. Use source_mode=working_path with path for a runtime/session artifact beneath the current execution working directory. Document bytes remain outside model context, and results expose only attachment identities or logical runtime paths.",
+          "description": "Extract bounded text only from PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (.md), JSON, or RTF documents. Local paths require one of those extensions. Source-code paths such as .js and .ts are unsupported; use read_one_file for source code and other text files when that operation is available. Use source for an attachment id/name or configured-root path. Use source_mode=working_path with path for a runtime/session artifact beneath the current execution working directory. Document bytes remain outside model context, and results expose only attachment identities or logical runtime paths.",
           "routingCapability": "filesystem_inspection",
           "developmentRoles": ["inspect", "verify"],
           "eventPresentation": {
@@ -41,7 +41,7 @@
           "skills": ["document_reader_skill"],
           "operations": {
             "read_document": {
-              "summary": "Read one bounded character window from a supported attachment or logical runtime path, with explicit input, extraction, archive, window, and output bounds.",
+              "summary": "Read one bounded character window from PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (.md), JSON, or RTF documents only. Local .js, .ts, and other unsupported extensions cannot be read here; use read_one_file for source code and other text files when available. Input, extraction, archive, window, and output bounds are explicit.",
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/document-reader/skills/document_reader_skill/SKILL.md

@@ -4,6 +4,13 @@ Use `document_reader` for an uploaded document before answering questions that
 depend on its contents. Also use it for supported local documents that ordinary
 source-code views do not represent well.
 
+Supported formats are PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown, JSON, and RTF.
+Local paths must end in `.pdf`, `.docx`, `.xlsx`, `.pptx`, `.txt`, `.csv`, `.md`,
+`.json`, or `.rtf`. Attachments can also be identified by a supported MIME type.
+Do not select this tool for source-code paths such as `.js` or `.ts`. Use
+`read_one_file` for source code and other text files when that operation is
+available. An unsupported extension is not fixed by changing `source_mode`.
+
 When invoking `read_document` for an attachment, omit `source_mode` or set it to
 `source`, and pass the exact attachment id or name in `source`. The same source
 lane preserves legacy allowed paths beneath configured agent roots. When

package/plugins/document-reader/source/handler.ts

@@ -148,12 +148,14 @@ function renderWindow(
   endChar: number,
   totalCharacters: number,
 ): string {
-  const truncated = endChar < totalCharacters;
+  const hasRemainingText = endChar < totalCharacters;
+  const hasCompleteTextCoverage = startChar === 0 && !hasRemainingText;
   return [
+    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${hasCompleteTextCoverage ? " (complete)" : " (partial)"}`,
+    `Returned characters: ${endChar - startChar}; omitted before window: ${startChar}; remaining after window: ${totalCharacters - endChar}.`,
+    ...(hasRemainingText ? [`Next start_char: ${endChar}`] : []),
     ...identityLines(document),
     `MIME: ${document.mimeType}`,
-    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${truncated ? " (partial)" : " (complete)"}`,
-    ...(truncated ? [`Next start_char: ${endChar}`] : []),
     "Content:",
     sanitizeJsonText(text.slice(startChar, endChar)) || "[no extractable text]",
   ].join("\n");

package/plugins/document-reader/src/index.cjs

@@ -268,6 +268,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -281,6 +282,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -305,6 +307,9 @@ function failureFromError(error, options) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // plugins/document-reader/source/constants.ts
 var MAX_DOCUMENT_BYTES = 10 * 1024 * 1024;
 var DEFAULT_MAX_CHARS = 2e4;
@@ -1319,12 +1324,14 @@ function actionTarget(document) {
   );
 }
 function renderWindow(document, text, startChar, endChar, totalCharacters) {
-  const truncated = endChar < totalCharacters;
+  const hasRemainingText = endChar < totalCharacters;
+  const hasCompleteTextCoverage = startChar === 0 && !hasRemainingText;
   return [
+    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${hasCompleteTextCoverage ? " (complete)" : " (partial)"}`,
+    `Returned characters: ${endChar - startChar}; omitted before window: ${startChar}; remaining after window: ${totalCharacters - endChar}.`,
+    ...hasRemainingText ? [`Next start_char: ${endChar}`] : [],
     ...identityLines(document),
     `MIME: ${document.mimeType}`,
-    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${truncated ? " (partial)" : " (complete)"}`,
-    ...truncated ? [`Next start_char: ${endChar}`] : [],
     "Content:",
     sanitizeJsonText(text.slice(startChar, endChar)) || "[no extractable text]"
   ].join("\n");

package/plugins/exec/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "exec",
   "version": "1.0.0",
-  "description": "Execute, observe, and cancel bounded non-interactive /bin/bash processes on Linux and macOS.",
+  "description": "Execute, observe, and cancel trusted non-interactive /bin/bash processes on Linux and macOS with per-action approval in Ask/Full.",
   "extensions": {
     "ai.abot.runtime": {
       "version": 1,
@@ -19,19 +19,29 @@
       "capabilities": {
         "exec": {
           "catalogGroups": ["read", "write", "exec"],
-          "description": "Execute one bounded non-interactive /bin/bash command on Linux or macOS. The explicit cwd must resolve inside agent work or the configured workspace; `.` means the agent-work root and `workspace/...` selects the workspace. The shell itself runs with the runtime process permissions and is not an operating-system sandbox. A command still running after the foreground window yields a process ID and cursor that exec_wait can resume without restarting it. Prefer dedicated inspection and file-mutation capabilities when they can express the task.",
+          "description": "Execute one trusted non-interactive /bin/bash command on Linux or macOS. Use an explicit existing directory: `.` and relative paths start at the agent-work root, `workspace/...` selects the workspace, and absolute host paths are accepted. Commands run with the runtime OS user permissions without parsing their contents for path or sensitivity restrictions. Ask/Full require approval of the exact action; FULL+ executes without that prompt. A command still running after the foreground window yields a process ID and cursor that exec_wait can resume without restarting it.",
           "routingCapability": "filesystem_inspection",
-          "developmentRoles": ["inspect", "establish", "verify", "auxiliary"],
+          "developmentRoles": ["inspect", "establish", "mutate", "verify", "auxiliary"],
           "eventPresentation": {
             "metadata": {
-              "command": { "param": "command", "kind": "string" },
-              "cwd": { "param": "cwd", "kind": "string" }
+              "command": {
+                "param": "command",
+                "kind": "string",
+                "maxLength": 4096,
+                "preserveWhitespace": true
+              },
+              "cwd": {
+                "param": "cwd",
+                "kind": "string",
+                "maxLength": 4096,
+                "preserveWhitespace": true
+              }
             }
           },
           "skills": ["exec_skill"],
           "operations": {
             "execute_command": {
-              "summary": "Execute one bounded non-interactive /bin/bash command on Linux or macOS in an explicit existing agent-work or workspace directory. The cwd boundary is not an OS sandbox. Full-access availability does not authorize servers, GUI automation, installs, service changes, background work, or other sensitive effects.",
+              "summary": "Execute one trusted non-interactive /bin/bash command in an explicit existing directory. This sensitive operation requires exact-action approval in Ask/Full and runs automatically in FULL+. The OS user permissions still apply; the selected folder is not a sandbox.",
               "input": {
                 "type": "object",
                 "additionalProperties": false,
@@ -46,7 +56,7 @@
                 "required": ["command", "cwd"]
               },
               "effect": "mixed",
-              "approval": "request_policy"
+              "approval": "always"
             }
           }
         },
@@ -55,6 +65,12 @@
           "description": "Continue observing the exact running shell process returned by exec. Use only the process ID and next cursor from the latest exec or exec_wait result. This does not start the command again.",
           "routingCapability": "filesystem_inspection",
           "developmentRoles": ["inspect", "verify", "auxiliary"],
+          "eventPresentation": {
+            "metadata": {
+              "processId": { "param": "process_id", "kind": "string" },
+              "cursor": { "param": "cursor", "kind": "number" }
+            }
+          },
           "skills": ["exec_process_skill"],
           "operations": {
             "wait_for_process": {
@@ -77,7 +93,7 @@
                 "required": ["process_id", "cursor"]
               },
               "effect": "read_only",
-              "approval": "request_policy"
+              "approval": "always"
             }
           }
         },
@@ -86,6 +102,11 @@
           "description": "Cancel one running shell process previously returned by exec. Use only when the current task no longer needs that process or the user asks to stop it.",
           "routingCapability": "filesystem_inspection",
           "developmentRoles": ["auxiliary"],
+          "eventPresentation": {
+            "metadata": {
+              "processId": { "param": "process_id", "kind": "string" }
+            }
+          },
           "skills": ["exec_process_skill"],
           "operations": {
             "cancel_process": {
@@ -103,7 +124,7 @@
                 "required": ["process_id"]
               },
               "effect": "mixed",
-              "approval": "request_policy"
+              "approval": "always"
             }
           }
         }

package/plugins/exec/skills/exec_process_skill/SKILL.md

@@ -5,3 +5,4 @@
 - Use `exec_cancel` only when the current task no longer needs the active process or the user asks to stop it.
 - Process IDs belong to one loaded plugin instance and session; never reuse one across runtimes or sessions.
 - Do not cancel a process whose result is still required, and do not retry a stale cursor unchanged.
+- These are sensitive actions like command execution: Ask/Full request approval through the runtime; FULL+ proceeds without an extra prompt. Approval never permits a different process or a replay of the original command.

package/plugins/exec/skills/exec_skill/SKILL.md

@@ -1,12 +1,11 @@
 # Exec Skill
 
-- Use `exec` for narrow shell-native discovery or verification when a dedicated tool is insufficient.
-- `exec` is available on Linux and macOS with executable `/bin/bash`; it does not select a Windows shell or another fallback shell. Commands must use the utilities and options available on the host.
-- Resolve `.` and ordinary relative `cwd` values from the configured agent work directory. They are never rewritten to the active Worker working directory. Use `workspace/...` only when the configured workspace is explicitly intended.
-- Always provide an explicit existing `cwd`. For an existing project, use its project path. To create a new project, use an existing parent `cwd` (normally `.`) and create the project path in the command.
-- The cwd is restricted to configured roots, but the shell runs with the runtime process permissions and is not an operating-system sandbox.
-- Keep commands deterministic, non-interactive, and scoped to the selected configured root.
-- Availability under full-access mode is not user authorization for sensitive effects. Starting a listener or server, launching a browser or GUI automation, installing software, changing services, or creating long-running background work requires explicit authorization in the current user request.
-- For multi-line input, use a single-quoted here-document instead of fragile quoted one-line payloads.
-- Prefer an active file creation or editing capability over shell redirection when it can express the requested change.
-- If a process remains active, continue the same process with `exec_wait`; do not launch it again.
+- Use `exec` for shell work needed by the user's task. Prefer dedicated capabilities when they express that work directly.
+- `exec` uses non-interactive `/bin/bash` on Linux and macOS; it does not select a Windows shell. Use commands available on that target OS.
+- Supply an explicit existing `cwd`. `.` and relative paths start from the configured agent-work directory, not an implicit Worker directory. `workspace/...` selects the configured workspace; absolute host directories are accepted.
+- To create a project, select an existing parent `cwd` and create its directory in the command. A selected project provides working context, not a filesystem sandbox.
+- The whole exec family is sensitive: Ask and Full request approval of each exact action through the normal tool flow; FULL+ executes without an additional ABot prompt. Submit the needed operation instead of declaring it unavailable solely because of the selected mode.
+- Commands run as the runtime OS user. The plugin does not parse command contents to infer sensitivity or restrict referenced paths. OS permissions still apply; FULL+ does not grant root or Administrator rights.
+- Execution has no interactive terminal and retains time, output and process limits. Use non-interactive forms; a terminal prompt cannot be answered through this tool.
+- For multi-line input, use a single-quoted here-document when it preserves the intended shell input.
+- If a process remains active, continue that exact process with `exec_wait`; do not launch the command again.