@abot-ai/runtime 1.3.1 → 1.5.0

package/plugins/exec/src/index.cjs

@@ -177,6 +177,7 @@ function enforcePluginResultByteBudget(result) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -201,29 +202,8 @@ function failureFromError(error, options) {
   });
 }
 
-// plugins/exec/source/errors.ts
-var ExecPluginError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "ExecPluginError";
-    this.code = code;
-  }
-};
-function execFailureFromError(error, operation) {
-  if (error instanceof ExecPluginError) {
-    return failureResult({
-      errorCode: error.code,
-      message: error.message,
-      output: `${operation} failed: ${error.message}`
-    });
-  }
-  return failureFromError(error, {
-    fallbackCode: `${operation}_failed`,
-    fallbackMessage: `${operation} failed without a safe diagnostic.`,
-    operation
-  });
-}
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
 
 // plugins/exec/source/filesystem-observer.ts
 var import_node_crypto = require("node:crypto");
@@ -495,46 +475,383 @@ function diffExecFilesystemSnapshots(before, after) {
   });
 }
 
+// plugins/exec/source/result-presentation.ts
+function streamDisplay(snapshot) {
+  if (snapshot.text) return snapshot.text;
+  return snapshot.sawOutput ? "(no new output; earlier output was already returned)" : "(empty)";
+}
+function renderedOutput(lines, outputMaxChars) {
+  const bounded = boundText(lines.join("\n"), {
+    maxChars: outputMaxChars,
+    marker: "\n[exec output truncated]"
+  });
+  return Object.freeze({ output: bounded.text, metadata: bounded.metadata });
+}
+function outputBoundsData(snapshot, rendered, maxChars) {
+  return Object.freeze({
+    maxChars,
+    stdout: snapshot.stdout.metadata,
+    stderr: snapshot.stderr.metadata,
+    rendered
+  });
+}
+function runningResult(snapshot, execution) {
+  const nextCursor = snapshot.nextCursor ?? 1;
+  const rendered = renderedOutput(
+    [
+      `Command: ${execution.commandPreview}`,
+      `CWD: ${execution.cwd.logicalPath}`,
+      "Process status: running",
+      `Process ID: ${snapshot.processId}`,
+      `Next cursor: ${nextCursor}`,
+      "STDOUT since the previous observation:",
+      streamDisplay(snapshot.stdout),
+      "STDERR since the previous observation:",
+      streamDisplay(snapshot.stderr),
+      "Continue this exact process with exec_wait; do not run the command again."
+    ],
+    execution.outputMaxChars
+  );
+  return failureResult({
+    errorCode: "exec_process_running",
+    message: "The command is still running. Continue it with exec_wait using the returned process ID and cursor.",
+    output: rendered.output,
+    stdout: snapshot.stdout.text,
+    stderr: snapshot.stderr.text,
+    data: {
+      processId: snapshot.processId,
+      processStatus: "running",
+      nextCursor,
+      outputBounds: outputBoundsData(
+        snapshot,
+        rendered.metadata,
+        execution.outputMaxChars
+      ),
+      observationMeta: {
+        kind: "volatile_external",
+        carryPolicy: "never"
+      }
+    }
+  });
+}
+async function captureFilesystemDelta(execution) {
+  if (!execution.filesystemStateBefore) return null;
+  try {
+    const after = await captureExecFilesystemSnapshot(
+      execution.cwd.absolutePath,
+      execution.cwd.logicalPath
+    );
+    return diffExecFilesystemSnapshots(execution.filesystemStateBefore, after);
+  } catch {
+    return null;
+  }
+}
+function projectExecFilesystemEvidence(delta, logicalRoot) {
+  const effects = delta.actions.map(renderExecFilesystemEffect);
+  const omittedEffectCount = Math.max(
+    0,
+    delta.changedEntryCount - effects.length
+  );
+  const omittedEffectLine = omittedEffectCount > 0 ? `- ${omittedEffectCount} additional changed ${omittedEffectCount === 1 ? "entry" : "entries"} omitted by the ${delta.observation.actionLimit}-effect projection limit.` : void 0;
+  const outputLines = Object.freeze([
+    `Filesystem changes observed: ${delta.changedEntryCount}${delta.observation.complete ? "" : " (bounded observation)"}`,
+    "Filesystem effects observed:",
+    ...effects,
+    ...omittedEffectLine ? [omittedEffectLine] : []
+  ]);
+  return Object.freeze({
+    outputLines,
+    mutationGrounding: [
+      "Observed post-command filesystem effects (settled tool evidence; not command intent, semantic verification, or complete artifact content):",
+      `- observation root: ${logicalRoot}`,
+      `- observation complete: ${delta.observation.complete}`,
+      `- changed entries: ${delta.changedEntryCount}`,
+      `- listed effects: ${effects.length}`,
+      `- effects truncated: ${delta.observation.actionsTruncated}`,
+      "Effects:",
+      ...effects,
+      ...omittedEffectLine ? [omittedEffectLine] : []
+    ].join("\n")
+  });
+}
+function renderExecFilesystemEffect(action) {
+  const target = action.target ? `: ${action.target}` : "";
+  const state = action.details === "exec_filesystem_created" ? "created" : action.details === "exec_filesystem_modified" ? "modified" : action.details === "exec_filesystem_removed" ? "removed" : void 0;
+  return `- ${action.type}${target}${state ? ` (${state})` : ""}`;
+}
+async function finalizeExecResult(params) {
+  const { snapshot, execution } = params;
+  const exitCode = snapshot.exitCode ?? -1;
+  const cancellationIsSuccess = params.cancellationIsSuccess === true && snapshot.terminationReason === "cancelled";
+  const filesystemDelta = await captureFilesystemDelta(execution);
+  const observedStateChange = filesystemDelta?.observedStateChange === true;
+  const filesystemEvidence = observedStateChange && filesystemDelta ? projectExecFilesystemEvidence(
+    filesystemDelta,
+    execution.cwd.logicalPath
+  ) : null;
+  const commandHasData = snapshot.stdout.sawOutput || snapshot.stderr.sawOutput;
+  const ok = exitCode === 0 || cancellationIsSuccess;
+  const inconclusiveSuccess = exitCode === 0 && !commandHasData && !observedStateChange;
+  const producedNewInformation = observedStateChange || cancellationIsSuccess || ok && commandHasData;
+  const actions = filesystemDelta?.actions ?? [];
+  const resultSummary = cancellationIsSuccess ? "Result summary: the running command was cancelled." : inconclusiveSuccess ? "Result summary: the command completed without observable output or filesystem change. Inspect a concrete target or use a dedicated creation capability." : "";
+  const rendered = renderedOutput(
+    [
+      `Command: ${execution.commandPreview}`,
+      `CWD: ${execution.cwd.logicalPath}`,
+      `Process ID: ${snapshot.processId}`,
+      `Process status: ${snapshot.terminationReason ?? "completed"}`,
+      `Exit code: ${exitCode}`,
+      ...filesystemEvidence ? filesystemEvidence.outputLines : [],
+      "STDOUT:",
+      streamDisplay(snapshot.stdout),
+      "STDERR:",
+      streamDisplay(snapshot.stderr),
+      ...resultSummary ? [resultSummary] : []
+    ],
+    execution.outputMaxChars
+  );
+  const processStatus = snapshot.terminationReason ?? "completed";
+  const data = {
+    ...commandHasData ? { hasData: true } : {},
+    ...observedStateChange ? { mutationEvidence: true } : {},
+    ...filesystemEvidence ? { mutationGrounding: filesystemEvidence.mutationGrounding } : {},
+    processId: snapshot.processId,
+    processStatus,
+    outputBounds: outputBoundsData(
+      snapshot,
+      rendered.metadata,
+      execution.outputMaxChars
+    ),
+    ...filesystemDelta ? { filesystemObservation: filesystemDelta.observation } : { filesystemObservation: { available: false } },
+    observationMeta: {
+      kind: "volatile_external",
+      carryPolicy: "never"
+    }
+  };
+  const common = {
+    output: rendered.output,
+    progress: observedStateChange || cancellationIsSuccess,
+    producedNewInformation,
+    actions: [...actions],
+    exitCode,
+    stdout: snapshot.stdout.text,
+    stderr: snapshot.stderr.text,
+    data
+  };
+  if (ok && (!inconclusiveSuccess || cancellationIsSuccess)) {
+    return enforcePluginResultByteBudget({ ok: true, ...common });
+  }
+  const errorCode = inconclusiveSuccess ? "no_observable_result" : snapshot.terminationReason === "aborted" ? "exec_aborted" : snapshot.terminationReason === "spawn_failed" ? "exec_spawn_failed" : snapshot.terminationReason === "idle_timeout" ? "exec_idle_timeout" : snapshot.terminationReason === "hard_timeout" ? "exec_hard_timeout" : "non_zero_exit";
+  const error = inconclusiveSuccess ? resultSummary : errorCode === "exec_aborted" ? "The exec request was aborted." : errorCode === "exec_spawn_failed" ? "The runtime could not start the configured non-interactive shell." : errorCode === "exec_idle_timeout" ? `The command produced no output for ${execution.idleTimeoutMs}ms.` : errorCode === "exec_hard_timeout" ? `The command exceeded the ${execution.hardTimeoutMs}ms hard timeout.` : `The command exited with code ${exitCode}.`;
+  return enforcePluginResultByteBudget({
+    ok: false,
+    ...common,
+    error,
+    errorCode
+  });
+}
+
+// plugins/exec/source/errors.ts
+var ExecPluginError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ExecPluginError";
+    this.code = code;
+  }
+};
+function execFailureFromError(error, operation) {
+  if (error instanceof ExecPluginError) {
+    return failureResult({
+      errorCode: error.code,
+      message: error.message,
+      output: `${operation} failed: ${error.message}`
+    });
+  }
+  return failureFromError(error, {
+    fallbackCode: `${operation}_failed`,
+    fallbackMessage: `${operation} failed without a safe diagnostic.`,
+    operation
+  });
+}
+
+// plugins/exec/source/request-resources.ts
+var ExecRequestResources = class {
+  constructor(manager, pending, preparation) {
+    this.manager = manager;
+    this.pending = pending;
+    const state = preparation?.requestState;
+    if (!state) return;
+    const saved = state.read("exec.terminal.v1");
+    if (saved !== void 0) this.restore(saved);
+    state.register("exec.terminal.v1", {
+      snapshot: () => this.snapshot(),
+      dispose: () => this.dispose()
+    });
+  }
+  manager;
+  pending;
+  owned = /* @__PURE__ */ new Map();
+  restored = /* @__PURE__ */ new Map();
+  started(processId, scope, settled, context) {
+    this.owned.set(processId, scope);
+    context?.requestWork?.trackUntil(settled);
+  }
+  forget(processId) {
+    this.owned.delete(processId);
+    this.restored.delete(processId);
+  }
+  terminal(processId, scope, cursor) {
+    const entry = this.restored.get(processId);
+    if (!entry) return void 0;
+    if (entry.scope !== scope)
+      throw new ExecPluginError(
+        "unknown_exec_process",
+        "The exec process belongs to a different session."
+      );
+    if (cursor !== void 0 && cursor !== entry.cursor)
+      throw new ExecPluginError(
+        "stale_exec_process_cursor",
+        "The saved exec cursor is stale."
+      );
+    this.restored.delete(processId);
+    return structuredClone(entry.snapshot);
+  }
+  snapshot() {
+    const executions = [...this.restored.values()];
+    for (const [processId, scope] of this.owned) {
+      const execution = this.pending.get(processId);
+      if (!execution) continue;
+      const terminal = this.manager.snapshotSettled(processId, scope);
+      const before = execution.filesystemStateBefore;
+      executions.push({
+        processId,
+        scope,
+        ...terminal,
+        execution: {
+          ...execution,
+          filesystemStateBefore: before ? { ...before, entries: [...before.entries] } : null
+        }
+      });
+    }
+    return { kind: "exec_terminal_state_v1", executions };
+  }
+  restore(value) {
+    if (!isRecord(value) || value.kind !== "exec_terminal_state_v1" || !Array.isArray(value.executions))
+      throw invalid();
+    for (const entry of value.executions) {
+      if (!isSavedExecution(entry) || this.restored.has(entry.processId))
+        throw invalid();
+      const before = entry.execution.filesystemStateBefore;
+      this.restored.set(entry.processId, structuredClone(entry));
+      this.pending.set(entry.processId, {
+        ...structuredClone(entry.execution),
+        filesystemStateBefore: before ? { ...before, entries: new Map(before.entries) } : null
+      });
+    }
+  }
+  async dispose() {
+    for (const [processId, scope] of this.owned) {
+      try {
+        await this.manager.cancel({ processId, scope });
+      } catch {
+      }
+      try {
+        await this.manager.release(processId, scope);
+      } catch {
+      }
+      this.pending.delete(processId);
+    }
+    for (const id of this.restored.keys()) this.pending.delete(id);
+    this.owned.clear();
+    this.restored.clear();
+  }
+};
+function isSavedExecution(value) {
+  if (!isRecord(value) || typeof value.processId !== "string" || typeof value.scope !== "string" || !Number.isSafeInteger(value.cursor) || value.cursor < 1 || !isRecord(value.snapshot) || value.snapshot.processId !== value.processId || value.snapshot.status !== "settled" || !isStream(value.snapshot.stdout) || !isStream(value.snapshot.stderr) || !Number.isFinite(value.snapshot.elapsedMs) || !isRecord(value.execution) || typeof value.execution.commandPreview !== "string" || !isRecord(value.execution.cwd) || typeof value.execution.cwd.absolutePath !== "string" || typeof value.execution.cwd.logicalPath !== "string")
+    return false;
+  if (![
+    value.execution.hardTimeoutMs,
+    value.execution.idleTimeoutMs,
+    value.execution.outputMaxChars
+  ].every(Number.isFinite))
+    return false;
+  const before = value.execution.filesystemStateBefore;
+  return before === null || isRecord(before) && typeof before.absoluteRoot === "string" && typeof before.logicalRoot === "string" && typeof before.rootExists === "boolean" && typeof before.complete === "boolean" && Array.isArray(before.entries) && before.entries.every(
+    (entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && isRecord(entry[1]) && typeof entry[1].kind === "string" && [entry[1].mode, entry[1].size, entry[1].mtimeMs].every(
+      Number.isFinite
+    )
+  );
+}
+function isStream(value) {
+  return isRecord(value) && typeof value.text === "string" && typeof value.sawOutput === "boolean" && isRecord(value.metadata) && typeof value.metadata.truncated === "boolean" && [
+    value.metadata.originalChars,
+    value.metadata.returnedChars,
+    value.metadata.omittedChars
+  ].every(Number.isFinite);
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function invalid() {
+  return new Error("exec_terminal_snapshot_invalid");
+}
+
 // plugins/exec/source/paths.ts
 var import_promises2 = require("node:fs/promises");
 var import_node_path2 = require("node:path");
-var EXEC_ALLOWED_LOCATIONS = Object.freeze([
-  "agent_work",
-  "workspace"
-]);
-function resolverContext(pluginContext, executionContext) {
-  return {
-    runtimePathResolver: executionContext?.runtimePathResolver ?? pluginContext.runtimePathResolver
-  };
-}
-function resolveExecPath(pluginContext, executionContext, rawPath) {
-  return resolvePluginPath(
-    resolverContext(pluginContext, executionContext),
-    rawPath,
+function resolveContextualDirectory(pluginContext, executionContext, requestedPath) {
+  if ((0, import_node_path2.isAbsolute)(requestedPath)) return { absolutePath: requestedPath };
+  const isWorkspaceAlias = requestedPath === "workspace" || requestedPath.startsWith("workspace/");
+  const base = resolvePluginPath(
     {
-      requirePath: true,
-      allowedLocations: EXEC_ALLOWED_LOCATIONS
-    }
+      runtimePathResolver: executionContext?.runtimePathResolver ?? pluginContext.runtimePathResolver
+    },
+    isWorkspaceAlias ? "workspace" : ".",
+    { allowedLocations: [isWorkspaceAlias ? "workspace" : "agent_work"] }
   );
+  const relativePath = isWorkspaceAlias ? requestedPath.slice("workspace".length + 1) || "." : requestedPath;
+  return { absolutePath: `${base.absolutePath}${import_node_path2.sep}${relativePath}`, base };
+}
+function isOutsideExecContextBase(relativePath) {
+  if (relativePath === "..") return true;
+  if (relativePath.startsWith(`..${import_node_path2.sep}`)) return true;
+  return (0, import_node_path2.isAbsolute)(relativePath);
+}
+function logicalDirectory(absolutePath, base) {
+  if (!base) return absolutePath;
+  const fromBase = (0, import_node_path2.relative)(base.absolutePath, absolutePath);
+  if (isOutsideExecContextBase(fromBase)) return absolutePath;
+  return import_node_path2.posix.join(base.logicalPath, fromBase.split(import_node_path2.sep).join("/") || ".");
 }
 async function resolveExecWorkingDirectory(pluginContext, executionContext, rawPath) {
   const requestedPath = readRequiredString(rawPath, {
     name: "cwd",
+    trim: false,
     maxLength: 4096
   });
-  const target = resolveExecPath(
+  if (requestedPath.includes("\0")) {
+    throw new ExecPluginError(
+      "exec_cwd_invalid",
+      "The selected cwd contains NUL characters."
+    );
+  }
+  const target = resolveContextualDirectory(
     pluginContext,
     executionContext,
     requestedPath
   );
+  let absolutePath;
   let info;
   try {
-    info = await (0, import_promises2.stat)(target.absolutePath);
+    absolutePath = await (0, import_promises2.realpath)(target.absolutePath);
+    info = await (0, import_promises2.stat)(absolutePath);
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === "ENOENT") {
       throw new ExecPluginError(
         "exec_cwd_not_found",
-        "The selected cwd does not exist. Select an existing agent-work or workspace directory."
+        "The selected cwd does not exist. Select an existing directory."
       );
     }
     throw new ExecPluginError(
@@ -548,12 +865,10 @@ async function resolveExecWorkingDirectory(pluginContext, executionContext, rawP
       "The selected cwd is not a directory."
     );
   }
-  return target;
-}
-function resolveExecScopedPath(pluginContext, executionContext, rawPath, cwd) {
-  const normalized = rawPath.replaceAll("\\", "/");
-  const requested = (0, import_node_path2.isAbsolute)(rawPath) || normalized === "workspace" || normalized.startsWith("workspace/") ? rawPath : import_node_path2.posix.join(cwd.logicalPath, normalized || ".");
-  return resolveExecPath(pluginContext, executionContext, requested);
+  return Object.freeze({
+    absolutePath,
+    logicalPath: logicalDirectory(absolutePath, target.base)
+  });
 }
 
 // plugins/exec/source/process-manager.ts
@@ -561,33 +876,7 @@ var import_node_child_process = require("node:child_process");
 var import_node_crypto2 = require("node:crypto");
 var import_node_string_decoder = require("node:string_decoder");
 
-// plugins/exec/source/shell-platform.ts
-var import_node_fs2 = require("node:fs");
-var import_promises3 = require("node:fs/promises");
-var EXEC_SHELL = "/bin/bash";
-function isSupportedExecPlatform(platform) {
-  return platform === "linux" || platform === "darwin";
-}
-async function assertSupportedShell(platform = process.platform) {
-  if (!isSupportedExecPlatform(platform)) {
-    throw new ExecPluginError(
-      "exec_platform_unsupported",
-      "The exec plugin requires Linux or macOS and executable /bin/bash."
-    );
-  }
-  try {
-    await (0, import_promises3.access)(EXEC_SHELL, import_node_fs2.constants.X_OK);
-  } catch {
-    throw new ExecPluginError(
-      "exec_shell_unavailable",
-      "The exec plugin cannot start because executable /bin/bash is unavailable."
-    );
-  }
-}
-
-// plugins/exec/source/process-manager.ts
-var COMPLETED_PROCESS_RETENTION_MS = 5 * 6e4;
-var MAX_ACTIVE_PROCESSES_PER_SCOPE = 4;
+// plugins/exec/source/process-output-buffer.ts
 var CappedTextBuffer = class {
   constructor(maxChars) {
     this.maxChars = maxChars;
@@ -606,13 +895,10 @@ var CappedTextBuffer = class {
     this.text += safeChunk.slice(0, available);
     this.omittedChars += Math.max(safeChunk.length - available, 0);
   }
-  consume() {
+  peek() {
     const text = this.text;
     const originalChars = this.originalChars;
     const omittedChars = this.omittedChars;
-    this.text = "";
-    this.originalChars = 0;
-    this.omittedChars = 0;
     return Object.freeze({
       text,
       sawOutput: this.sawOutput,
@@ -624,7 +910,42 @@ var CappedTextBuffer = class {
       })
     });
   }
+  consume() {
+    const result = this.peek();
+    this.text = "";
+    this.originalChars = 0;
+    this.omittedChars = 0;
+    return result;
+  }
 };
+
+// plugins/exec/source/shell-platform.ts
+var import_node_fs2 = require("node:fs");
+var import_promises3 = require("node:fs/promises");
+var EXEC_SHELL = "/bin/bash";
+function isSupportedExecPlatform(platform) {
+  return platform === "linux" || platform === "darwin";
+}
+async function assertSupportedShell(platform = process.platform) {
+  if (!isSupportedExecPlatform(platform)) {
+    throw new ExecPluginError(
+      "exec_platform_unsupported",
+      "The exec plugin requires Linux or macOS and executable /bin/bash."
+    );
+  }
+  try {
+    await (0, import_promises3.access)(EXEC_SHELL, import_node_fs2.constants.X_OK);
+  } catch {
+    throw new ExecPluginError(
+      "exec_shell_unavailable",
+      "The exec plugin cannot start because executable /bin/bash is unavailable."
+    );
+  }
+}
+
+// plugins/exec/source/process-manager.ts
+var COMPLETED_PROCESS_RETENTION_MS = 5 * 6e4;
+var MAX_ACTIVE_PROCESSES_PER_SCOPE = 4;
 function createExecProcessManager() {
   const processes = /* @__PURE__ */ new Map();
   const unknownProcess = () => new ExecPluginError(
@@ -779,6 +1100,7 @@ function createExecProcessManager() {
         ...params.onDisposed ? { onDisposed: params.onDisposed } : {}
       };
       processes.set(managed.processId, managed);
+      params.onStarted?.(managed.processId, managed.settlePromise);
       const observe = (stream, chunk) => {
         if (managed.settled || !chunk) return;
         if (stream === "stdout") managed.stdout.append(chunk);
@@ -858,6 +1180,23 @@ function createExecProcessManager() {
         return consumeSnapshot(managed);
       });
     },
+    snapshotSettled(processId, scope) {
+      const managed = getScopedProcess(processId, scope);
+      if (!managed.settled || managed.waitInFlight || managed.terminalSnapshotClaimed)
+        throw new Error("exec_snapshot_not_quiescent");
+      return Object.freeze({
+        cursor: managed.cursor,
+        snapshot: Object.freeze({
+          processId,
+          status: "settled",
+          ...managed.exitCode === void 0 ? {} : { exitCode: managed.exitCode },
+          stdout: managed.stdout.peek(),
+          stderr: managed.stderr.peek(),
+          ...managed.terminationReason ? { terminationReason: managed.terminationReason } : {},
+          elapsedMs: Date.now() - managed.startedAt
+        })
+      });
+    },
     async release(processId, scope) {
       const managed = processes.get(processId);
       if (!managed) return;
@@ -908,169 +1247,40 @@ function readExecSettings(config) {
 }
 
 // plugins/exec/source/validation.ts
-var INVALID_COMMAND_CHARS = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F\uFFFD]/gu;
-var INTERACTIVE_COMMANDS = /* @__PURE__ */ new Set([
-  "gio",
-  "gnome-open",
-  "htop",
-  "kde-open",
-  "less",
-  "more",
-  "nano",
-  "open",
-  "screen",
-  "ssh",
-  "start",
-  "tmux",
-  "top",
-  "vi",
-  "vim",
-  "watch",
-  "xdg-open"
-]);
-function sanitizeExecCommand(value) {
-  const raw = value.trim();
-  const command = raw.replace(/\r\n?/gu, "\n").replace(INVALID_COMMAND_CHARS, "").trim();
-  return Object.freeze({ command, normalized: command !== raw });
-}
-function isInteractiveCommand(command) {
-  const firstToken = command.split(/\s+/u)[0]?.toLowerCase() ?? "";
-  return INTERACTIVE_COMMANDS.has(firstToken) ? firstToken : void 0;
-}
-function isWhitespace(char) {
-  return char === " " || char === "	" || char === "\r";
-}
-function isShellSeparator(char) {
-  return ["\n", ";", "|", "&", "<", ">"].includes(char);
-}
-function isShellTokenBoundary(char) {
-  return isWhitespace(char) || isShellSeparator(char) || char === "(" || char === ")";
-}
-function readShellTokenSpan(command, start) {
-  let index = start;
-  let token = "";
-  let inSingleQuote = false;
-  let inDoubleQuote = false;
-  let substitutionDepth = 0;
-  while (index < command.length) {
-    const char = command[index] ?? "";
-    if (!inSingleQuote && !inDoubleQuote) {
-      if (substitutionDepth === 0 && isShellTokenBoundary(char)) break;
-      if (char === "$" && command[index + 1] === "(") {
-        token += "$(";
-        substitutionDepth += 1;
-        index += 2;
-        continue;
-      }
-      if (char === ")" && substitutionDepth > 0) {
-        token += char;
-        substitutionDepth -= 1;
-        index += 1;
-        continue;
-      }
-      if (char === "\\") {
-        index += 1;
-        if (index < command.length) {
-          token += command[index];
-          index += 1;
-        }
-        continue;
-      }
-      if (char === "'") {
-        inSingleQuote = true;
-        index += 1;
-        continue;
-      }
-      if (char === '"') {
-        inDoubleQuote = true;
-        index += 1;
-        continue;
-      }
-      token += char;
-      index += 1;
-      continue;
-    }
-    index += 1;
-    if (inSingleQuote) {
-      if (char === "'") inSingleQuote = false;
-      else token += char;
-      continue;
-    }
-    if (char === '"') {
-      inDoubleQuote = false;
-      continue;
-    }
-    if (char === "\\" && index < command.length) {
-      token += command[index];
-      index += 1;
-      continue;
-    }
-    token += char;
-  }
-  return Object.freeze({ token: token.trim(), nextIndex: index });
-}
-function readShellToken(command, start) {
-  let index = start;
-  while (index < command.length && isWhitespace(command[index] ?? "")) {
-    index += 1;
-  }
-  return readShellTokenSpan(command, index);
+function isExecutableCommand(value) {
+  if (value.trim().length === 0) return false;
+  return !value.includes("\0");
 }
-function readHereDocDelimiters(line) {
-  const delimiters = [];
-  const pattern = /<<(-)?\s*(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_./-]+))/gu;
-  for (const match of line.matchAll(pattern)) {
-    const delimiter = match[2] ?? match[3] ?? match[4] ?? "";
-    if (delimiter) {
-      delimiters.push({ delimiter, stripTabs: Boolean(match[1]) });
-    }
+function readExecCommand(value) {
+  const command = readRequiredString(value, {
+    name: "command",
+    trim: false,
+    maxLength: EXEC_COMMAND_MAX_CHARS
+  });
+  if (!isExecutableCommand(command)) {
+    throw new ExecPluginError(
+      "exec_command_invalid",
+      "The command must contain nonempty text without NUL characters."
+    );
   }
-  return delimiters;
-}
-function stripHereDocBodies(command) {
-  const pending = [];
-  return command.split("\n").map((line) => {
-    const active = pending[0];
-    if (active) {
-      const comparable = active.stripTabs ? line.replace(/^\t+/u, "") : line;
-      if (comparable === active.delimiter) {
-        pending.shift();
-        return line;
-      }
-      return "";
-    }
-    pending.push(...readHereDocDelimiters(line));
-    return line;
-  }).join("\n");
+  return command;
 }
-function scopedPathTokens(command) {
-  const tokens = [];
-  let index = 0;
-  while (index < command.length) {
-    while (index < command.length && isShellTokenBoundary(command[index] ?? "")) {
-      index += 1;
-    }
-    if (index >= command.length) break;
-    const span = readShellToken(command, index);
-    index = Math.max(span.nextIndex, index + 1);
-    const token = span.token;
-    if (token === "." || token === ".." || token.startsWith("./") || token.startsWith("../") || token === "workspace" || token.startsWith("workspace/") || token.startsWith("workspace\\") || token.startsWith("/")) {
-      tokens.push(token);
-    }
-  }
-  return Object.freeze(tokens);
+function isInvalidExecParameter(name, value) {
+  if (typeof value !== "string") return true;
+  if (value.length === 0) return true;
+  if (name === "command") return !isExecutableCommand(value);
+  return value.includes("\0");
 }
 function createExecAdapter() {
   return {
     validateCall(input) {
-      const invalid = ["command", "cwd"].filter((name) => {
-        const value = input.params[name];
-        return typeof value !== "string" || value.trim().length === 0;
-      });
-      if (invalid.length === 0) return null;
+      const invalid2 = ["command", "cwd"].filter(
+        (name) => isInvalidExecParameter(name, input.params[name])
+      );
+      if (invalid2.length === 0) return null;
       return {
-        error: `invalid params for exec: invalid ${invalid.join(", ")}`,
-        repairHint: "Provide one non-interactive command and one explicit existing agent-work or workspace cwd."
+        error: `invalid params for exec: invalid ${invalid2.join(", ")}`,
+        repairHint: "Provide one command without NUL characters and one explicit existing cwd."
       };
     }
   };
@@ -1082,224 +1292,31 @@ function processScope(context) {
   const sessionId = context?.sharedState?.currentSessionId?.trim();
   return sessionId || "anonymous";
 }
-function streamDisplay(snapshot) {
-  if (snapshot.text) return snapshot.text;
-  return snapshot.sawOutput ? "(no new output; earlier output was already returned)" : "(empty)";
-}
-function renderedOutput(lines, outputMaxChars) {
-  const bounded = boundText(lines.join("\n"), {
-    maxChars: outputMaxChars,
-    marker: "\n[exec output truncated]"
-  });
-  return Object.freeze({ output: bounded.text, metadata: bounded.metadata });
-}
-function outputBoundsData(snapshot, rendered, maxChars) {
-  return Object.freeze({
-    maxChars,
-    stdout: snapshot.stdout.metadata,
-    stderr: snapshot.stderr.metadata,
-    rendered
-  });
-}
-function runningResult(snapshot, execution) {
-  const nextCursor = snapshot.nextCursor ?? 1;
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      ...execution.commandWasNormalized ? ["Command normalization: invalid control characters were removed."] : [],
-      `CWD: ${execution.cwd.logicalPath}`,
-      "Process status: running",
-      `Process ID: ${snapshot.processId}`,
-      `Next cursor: ${nextCursor}`,
-      "STDOUT since the previous observation:",
-      streamDisplay(snapshot.stdout),
-      "STDERR since the previous observation:",
-      streamDisplay(snapshot.stderr),
-      "Continue this exact process with exec_wait; do not run the command again."
-    ],
-    execution.outputMaxChars
-  );
-  return failureResult({
-    errorCode: "exec_process_running",
-    message: "The command is still running. Continue it with exec_wait using the returned process ID and cursor.",
-    output: rendered.output,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data: {
-      processId: snapshot.processId,
-      processStatus: "running",
-      nextCursor,
-      outputBounds: outputBoundsData(
-        snapshot,
-        rendered.metadata,
-        execution.outputMaxChars
-      ),
-      observationMeta: {
-        kind: "volatile_external",
-        carryPolicy: "never"
-      }
-    }
-  });
-}
-async function captureFilesystemDelta(execution) {
-  if (!execution.filesystemStateBefore) return null;
-  try {
-    const after = await captureExecFilesystemSnapshot(
-      execution.cwd.absolutePath,
-      execution.cwd.logicalPath
-    );
-    return diffExecFilesystemSnapshots(execution.filesystemStateBefore, after);
-  } catch {
-    return null;
-  }
-}
-function projectExecFilesystemEvidence(delta, logicalRoot) {
-  const effects = delta.actions.map(renderExecFilesystemEffect);
-  const omittedEffectCount = Math.max(
-    0,
-    delta.changedEntryCount - effects.length
-  );
-  const omittedEffectLine = omittedEffectCount > 0 ? `- ${omittedEffectCount} additional changed ${omittedEffectCount === 1 ? "entry" : "entries"} omitted by the ${delta.observation.actionLimit}-effect projection limit.` : void 0;
-  const outputLines = Object.freeze([
-    `Filesystem changes observed: ${delta.changedEntryCount}${delta.observation.complete ? "" : " (bounded observation)"}`,
-    "Filesystem effects observed:",
-    ...effects,
-    ...omittedEffectLine ? [omittedEffectLine] : []
-  ]);
-  return Object.freeze({
-    outputLines,
-    mutationGrounding: [
-      "Observed post-command filesystem effects (settled tool evidence; not command intent, semantic verification, or complete artifact content):",
-      `- observation root: ${logicalRoot}`,
-      `- observation complete: ${delta.observation.complete}`,
-      `- changed entries: ${delta.changedEntryCount}`,
-      `- listed effects: ${effects.length}`,
-      `- effects truncated: ${delta.observation.actionsTruncated}`,
-      "Effects:",
-      ...effects,
-      ...omittedEffectLine ? [omittedEffectLine] : []
-    ].join("\n")
-  });
-}
-function renderExecFilesystemEffect(action) {
-  const target = action.target ? `: ${action.target}` : "";
-  const state = action.details === "exec_filesystem_created" ? "created" : action.details === "exec_filesystem_modified" ? "modified" : action.details === "exec_filesystem_removed" ? "removed" : void 0;
-  return `- ${action.type}${target}${state ? ` (${state})` : ""}`;
-}
-async function finalizeExecResult(params) {
-  const { snapshot, execution } = params;
-  const exitCode = snapshot.exitCode ?? -1;
-  const cancellationIsSuccess = params.cancellationIsSuccess === true && snapshot.terminationReason === "cancelled";
-  const filesystemDelta = await captureFilesystemDelta(execution);
-  const observedStateChange = filesystemDelta?.observedStateChange === true;
-  const filesystemEvidence = observedStateChange && filesystemDelta ? projectExecFilesystemEvidence(
-    filesystemDelta,
-    execution.cwd.logicalPath
-  ) : null;
-  const commandHasData = snapshot.stdout.sawOutput || snapshot.stderr.sawOutput;
-  const ok = exitCode === 0 || cancellationIsSuccess;
-  const inconclusiveSuccess = exitCode === 0 && !commandHasData && !observedStateChange;
-  const producedNewInformation = observedStateChange || cancellationIsSuccess || ok && commandHasData;
-  const actions = filesystemDelta?.actions ?? [];
-  const resultSummary = cancellationIsSuccess ? "Result summary: the running command was cancelled." : inconclusiveSuccess ? "Result summary: the command completed without observable output or filesystem change. Inspect a concrete target or use a dedicated creation capability." : "";
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      ...execution.commandWasNormalized ? ["Command normalization: invalid control characters were removed."] : [],
-      `CWD: ${execution.cwd.logicalPath}`,
-      `Process ID: ${snapshot.processId}`,
-      `Process status: ${snapshot.terminationReason ?? "completed"}`,
-      `Exit code: ${exitCode}`,
-      ...filesystemEvidence ? filesystemEvidence.outputLines : [],
-      "STDOUT:",
-      streamDisplay(snapshot.stdout),
-      "STDERR:",
-      streamDisplay(snapshot.stderr),
-      ...resultSummary ? [resultSummary] : []
-    ],
-    execution.outputMaxChars
-  );
-  const processStatus = snapshot.terminationReason ?? "completed";
-  const data = {
-    ...commandHasData ? { hasData: true } : {},
-    ...observedStateChange ? { mutationEvidence: true } : {},
-    ...filesystemEvidence ? { mutationGrounding: filesystemEvidence.mutationGrounding } : {},
-    processId: snapshot.processId,
-    processStatus,
-    outputBounds: outputBoundsData(
-      snapshot,
-      rendered.metadata,
-      execution.outputMaxChars
-    ),
-    ...filesystemDelta ? { filesystemObservation: filesystemDelta.observation } : { filesystemObservation: { available: false } },
-    observationMeta: {
-      kind: "volatile_external",
-      carryPolicy: "never"
-    }
-  };
-  const common = {
-    output: rendered.output,
-    progress: observedStateChange || cancellationIsSuccess,
-    producedNewInformation,
-    actions: [...actions],
-    exitCode,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data
-  };
-  if (ok && (!inconclusiveSuccess || cancellationIsSuccess)) {
-    return enforcePluginResultByteBudget({ ok: true, ...common });
-  }
-  const errorCode = inconclusiveSuccess ? "no_observable_result" : snapshot.terminationReason === "aborted" ? "exec_aborted" : snapshot.terminationReason === "spawn_failed" ? "exec_spawn_failed" : snapshot.terminationReason === "idle_timeout" ? "exec_idle_timeout" : snapshot.terminationReason === "hard_timeout" ? "exec_hard_timeout" : "non_zero_exit";
-  const error = inconclusiveSuccess ? resultSummary : errorCode === "exec_aborted" ? "The exec request was aborted." : errorCode === "exec_spawn_failed" ? "The runtime could not start the configured non-interactive shell." : errorCode === "exec_idle_timeout" ? `The command produced no output for ${execution.idleTimeoutMs}ms.` : errorCode === "exec_hard_timeout" ? `The command exceeded the ${execution.hardTimeoutMs}ms hard timeout.` : `The command exited with code ${exitCode}.`;
-  return enforcePluginResultByteBudget({
-    ok: false,
-    ...common,
-    error,
-    errorCode
-  });
-}
-function createExecHandlers(pluginContext, settings) {
+function createExecHandlers(pluginContext, settings, preparation) {
   const processManager = createExecProcessManager();
   const pendingExecutions = /* @__PURE__ */ new Map();
+  const requestResources = new ExecRequestResources(
+    processManager,
+    pendingExecutions,
+    preparation
+  );
   const finalizeAndRelease = async (params) => {
     try {
       return await finalizeExecResult(params);
     } finally {
       pendingExecutions.delete(params.snapshot.processId);
+      requestResources.forget(params.snapshot.processId);
       await processManager.release(params.snapshot.processId, params.scope);
     }
   };
   const exec = async (params, context) => {
     try {
-      const rawCommand = readRequiredString(params.command, {
-        name: "command",
-        trim: false,
-        maxLength: EXEC_COMMAND_MAX_CHARS
-      });
-      const { command, normalized } = sanitizeExecCommand(rawCommand);
-      if (!command) {
-        throw new ExecPluginError(
-          "exec_command_invalid",
-          "The command is empty after invalid control characters are removed."
-        );
-      }
-      const interactive = isInteractiveCommand(command);
-      if (interactive) {
-        throw new ExecPluginError(
-          "exec_interactive_command_blocked",
-          `Interactive command ${interactive} is not supported by the non-interactive exec plugin.`
-        );
-      }
+      const command = readExecCommand(params.command);
       const cwd = await resolveExecWorkingDirectory(
         pluginContext,
         context,
         params.cwd
       );
-      const staticCommand = stripHereDocBodies(command);
-      for (const token of scopedPathTokens(staticCommand)) {
-        resolveExecScopedPath(pluginContext, context, token, cwd);
-      }
       const filesystemStateBefore = await captureExecFilesystemSnapshot(
         cwd.absolutePath,
         cwd.logicalPath
@@ -1310,7 +1327,6 @@ function createExecHandlers(pluginContext, settings) {
       }).text;
       const execution = Object.freeze({
         commandPreview,
-        commandWasNormalized: normalized,
         cwd,
         filesystemStateBefore,
         hardTimeoutMs: settings.hardTimeoutMs,
@@ -1327,7 +1343,11 @@ function createExecHandlers(pluginContext, settings) {
         idleTimeoutMs: execution.idleTimeoutMs,
         hardTimeoutMs: execution.hardTimeoutMs,
         ...context?.abortSignal ? { abortSignal: context.abortSignal } : {},
-        onDisposed: (processId) => pendingExecutions.delete(processId)
+        onDisposed: (processId) => {
+          pendingExecutions.delete(processId);
+          requestResources.forget(processId);
+        },
+        onStarted: (processId, settled) => requestResources.started(processId, scope, settled, context)
       });
       if (snapshot.status === "running") {
         pendingExecutions.set(snapshot.processId, execution);
@@ -1357,7 +1377,7 @@ function createExecHandlers(pluginContext, settings) {
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.wait({
+      const snapshot = requestResources.terminal(processId, scope, cursor) ?? await processManager.wait({
         processId,
         scope,
         cursor,
@@ -1382,7 +1402,7 @@ function createExecHandlers(pluginContext, settings) {
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.cancel({ processId, scope });
+      const snapshot = requestResources.terminal(processId, scope) ?? await processManager.cancel({ processId, scope });
       return finalizeAndRelease({
         snapshot,
         execution,
@@ -1399,6 +1419,18 @@ function createExecHandlers(pluginContext, settings) {
 // plugins/exec/source/index.ts
 var index_default = defineRuntimePlugin((context) => ({
   handlers: createExecHandlers(context, readExecSettings(context.config)),
+  prepareRequest: async (modules, preparation) => {
+    if (!preparation?.requestState) return modules;
+    const handlers = createExecHandlers(
+      context,
+      readExecSettings(context.config),
+      preparation
+    );
+    return modules.map((module2) => ({
+      ...module2,
+      implementation: handlers[module2.definition.name]
+    }));
+  },
   adapters: {
     exec: createExecAdapter()
   }