@abot-ai/runtime 1.4.0 → 1.5.0

package/docs/plugins.md

@@ -13,7 +13,7 @@ the same physical directory, the catalog is discovered only once.
 
 ## Manage Plugins In The Web UI
 
-Open **Configuration → Plugins** to see installed manifests, capability counts,
+Open **Plugins** to see installed manifests, capability counts,
 and enabled, partially enabled or disabled selections. Switches save the selected
 plugin's configuration while preserving capability-specific allow/deny rules.
 Choose **Manage tools** on a plugin to manage its declared tools inside the same card.
@@ -448,3 +448,13 @@ counts imply full-file coverage.
    restrictive allow-list.
 
 No concrete tool or skill mapping should be added anywhere under `src/runtime`.
+
+### Shared Computer access
+
+Plugins that need host facilities can import the opt-in
+`@abot-ai/runtime/plugin-sdk/computer-access` facade. It exposes native target and
+computer backend contracts and the existing bound Companion client. The Runtime
+owns installation, pairing and connection lifecycle; plugins must not install
+another companion or import another plugin's implementation. Tool permissions,
+request disposal, target binding and exact-action approval remain the plugin's
+existing execution contract. Disabling SYSTEM does not disable ABot Spark.

package/docs/projects-and-full-plus.md

@@ -113,7 +113,7 @@ action may start; it does not lower that process's OS permissions.
 
 ## Connecting a Docker Runtime to its computer
 
-A Docker Runtime can use applications and commands on its Windows or macOS host
+A Docker Runtime can use applications and commands on its Windows, macOS or Linux host
 through the optional native host companion. The companion runs as the signed-in
 desktop user and connects outbound to the Runtime's published loopback Web UI
 address. It does not require a Docker socket, a privileged container, a Windows
@@ -126,12 +126,14 @@ Linux target; discovery identifies Docker separately from WSL.
    loopback port mapping (for example, `-p 127.0.0.1:5184:5184
    -e ABOT_WEB_TRUST_LOOPBACK_PUBLISH=1`). Open the Web UI using its configured
    hostname and port.
-2. In the initial **Computer** step or **Config → Connected computer**, download
-   the setup script for the computer running Docker. Open the Windows script, or
-   extract the Mac ZIP and open its executable command file, on that computer.
-3. The script installs a private, checksum-verified Node runtime and the exact
-   companion build supplied by this ABot installation. It pairs automatically
-   using a single-use grant valid for 15 minutes, without a copied code or command.
+2. In the initial **Computer** step or **Home → Computer access**, choose
+   the computer running Docker. On a Mac, choose **Connect a Mac**, install the
+   same ABot version's CLI locally, run the displayed command in Terminal and
+   enter its separate one-time code. That code is valid for five minutes.
+3. On Windows or Linux, download and run the setup script. Windows setup installs
+   a private, checksum-verified Node runtime; Linux uses an existing Node runtime.
+   The script installs the exact companion build supplied by ABot and pairs
+   automatically using a single-use grant valid for 15 minutes.
 4. The companion saves a private credential and starts now and at future user
    logins. The Web UI polls actual connection readiness. Downloading the script
    alone is not a successful connection; wait for **Ready**.
@@ -154,15 +156,11 @@ Web UI origin. They do not disable TLS validation for unsupported HTTPS setups.
 
 One computer connection is shared by all Runtime environments belonging to the
 same ABot installation. The native user can pair with one installation at a time;
-disconnect before connecting another. Existing native macOS operation and Windows
-operation through functioning WSL interop do not require this companion. The
-setup screen checks those direct paths first. If WSL Windows execution is
-unavailable, it offers a Windows interop repair script instead. The script
-preserves unrelated `wsl.conf` settings, including `appendWindowsPath`, then
-automatically restarts only the selected distribution without a typed confirmation.
-Finish active work before opening the file: the restart interrupts all services
-in that distribution. If the configuration update fails, no restart occurs.
-The script and GUI verify actual Windows execution after the restart.
+disconnect before connecting another. Native commands and functioning WSL interop
+remain available without the companion. Computer access setup installs the shared
+companion for desktop tools and ABot Spark on every supported host, including WSL;
+it does not change interop settings or restart WSL. ABot Spark links to this same
+setup screen. Enabling or disabling collection does not pair or unpair a computer.
 
 Host requests use the existing system plugin and the same exact-action approval
 flow: Ask and Full request approval; FULL+ does not add a separate ABot prompt.
@@ -180,12 +178,12 @@ path. OS authorization still applies, and a launch receipt alone is not proof
 that a visible application window appeared.
 
 When confirmed Docker or WSL readiness requires setup, Chat shows a small,
-dismissible suggestion linking to **Config → Connected computer**. It does not
+dismissible suggestion linking to **Home → Computer access**. It does not
 appear for working native access, unknown status, or an already paired computer.
 It reuses the existing readiness state and refreshes on returning to Chat, without
 adding a polling loop. Dismissal lasts until the page is reloaded.
 
-Use **Disconnect computer** in the Web UI to revoke the Runtime's pairing and
+Use **Unpair computer** in the Web UI to revoke the Runtime's pairing and
 pending invitations. The connected companion removes its credential after
 revocation. Downloaded setup files contain an expiring invitation, so keep them
 private and delete them after use. Browser storage retains neither the invitation
@@ -193,10 +191,11 @@ nor the persistent credential.
 
 Advanced installations using the ABot CLI can still use `abot host status`,
 `abot host disconnect` and `abot host uninstall`. The downloaded installer does
-not add a global `abot` command. Its private Node binary and immutable companion
-bundle live under `%LOCALAPPDATA%\ABot\HostCompanion` on Windows or
-`~/Library/Application Support/ABot/HostCompanion` on Mac; the same CLI operations
-can be invoked there as `<node> <companion-bundle> host uninstall`. This removes
+not add a global `abot` command. On Windows, its private Node binary and immutable
+companion bundle live under `%LOCALAPPDATA%\ABot\HostCompanion`. On Mac, the Node
+executable is `~/.abot/host-companion/runtime/node` and the bundle lives under
+`~/Library/Application Support/ABot/HostCompanion`. The same CLI operations can
+be invoked as `<node> <companion-bundle> host uninstall`. This removes
 the local credential and login registration; use the Web UI to clear Runtime-side
 pairing as well. Reconnecting never silently replaces another installation's
 saved native connection.

package/package.json

@@ -42,6 +42,10 @@
       "import": "./dist/src/plugin-sdk/index.js",
       "types": "./dist/src/plugin-sdk/index.d.ts"
     },
+    "./plugin-sdk/computer-access": {
+      "import": "./dist/src/plugin-sdk/computer-access.js",
+      "types": "./dist/src/plugin-sdk/computer-access.d.ts"
+    },
     "./runtime": {
       "import": "./dist/src/runtime/index.js",
       "types": "./dist/src/runtime/index.d.ts"
@@ -81,7 +85,7 @@
     "dist/src/plugin-contract/",
     "dist/src/plugin-sdk/",
     "dist/src/web-ui/",
-    "dist/plugins/system/",
+    "dist/src/computer-access/",
     "runtime.config.schema.json",
     "src/runtime/README.md",
     "src/runtime/scheduler/README.md",
@@ -177,5 +181,5 @@
   },
   "type": "module",
   "types": "./dist/src/runtime/index.d.ts",
-  "version": "1.4.0"
+  "version": "1.5.0"
 }

package/plugins/capability-brief/src/index.cjs

@@ -107,6 +107,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -120,6 +121,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -133,6 +135,9 @@ function failureResult(input) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // src/plugin-sdk/tool-availability-brief.ts
 var TOOL_COUNT_MAX = 64;
 var OUTPUT_CHARACTER_MAX = 16e3;

package/plugins/code-outline/src/index.cjs

@@ -271,6 +271,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -284,6 +285,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -308,6 +310,9 @@ function failureFromError(error, options) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // plugins/code-outline/source/parser.ts
 var import_parser = require("@babel/parser");
 var IMPORT_LIMIT = 40;

package/plugins/document-reader/plugin.json

@@ -10,7 +10,7 @@
       "catalogGroups": ["read"],
       "capabilities": {
         "document_reader": {
-          "description": "Extract bounded text from an attached or configured-root PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown, JSON, or RTF document. Use source for an attachment id/name or configured-root path. Use source_mode=working_path with path for a runtime/session artifact beneath the current execution working directory. Document bytes remain outside model context, and results expose only attachment identities or logical runtime paths.",
+          "description": "Extract bounded text only from PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (.md), JSON, or RTF documents. Local paths require one of those extensions. Source-code paths such as .js and .ts are unsupported; use read_one_file for source code and other text files when that operation is available. Use source for an attachment id/name or configured-root path. Use source_mode=working_path with path for a runtime/session artifact beneath the current execution working directory. Document bytes remain outside model context, and results expose only attachment identities or logical runtime paths.",
           "routingCapability": "filesystem_inspection",
           "developmentRoles": ["inspect", "verify"],
           "eventPresentation": {
@@ -41,7 +41,7 @@
           "skills": ["document_reader_skill"],
           "operations": {
             "read_document": {
-              "summary": "Read one bounded character window from a supported attachment or logical runtime path, with explicit input, extraction, archive, window, and output bounds.",
+              "summary": "Read one bounded character window from PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown (.md), JSON, or RTF documents only. Local .js, .ts, and other unsupported extensions cannot be read here; use read_one_file for source code and other text files when available. Input, extraction, archive, window, and output bounds are explicit.",
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/document-reader/skills/document_reader_skill/SKILL.md

@@ -4,6 +4,13 @@ Use `document_reader` for an uploaded document before answering questions that
 depend on its contents. Also use it for supported local documents that ordinary
 source-code views do not represent well.
 
+Supported formats are PDF, DOCX, XLSX, PPTX, TXT, CSV, Markdown, JSON, and RTF.
+Local paths must end in `.pdf`, `.docx`, `.xlsx`, `.pptx`, `.txt`, `.csv`, `.md`,
+`.json`, or `.rtf`. Attachments can also be identified by a supported MIME type.
+Do not select this tool for source-code paths such as `.js` or `.ts`. Use
+`read_one_file` for source code and other text files when that operation is
+available. An unsupported extension is not fixed by changing `source_mode`.
+
 When invoking `read_document` for an attachment, omit `source_mode` or set it to
 `source`, and pass the exact attachment id or name in `source`. The same source
 lane preserves legacy allowed paths beneath configured agent roots. When

package/plugins/document-reader/source/handler.ts

@@ -148,12 +148,14 @@ function renderWindow(
   endChar: number,
   totalCharacters: number,
 ): string {
-  const truncated = endChar < totalCharacters;
+  const hasRemainingText = endChar < totalCharacters;
+  const hasCompleteTextCoverage = startChar === 0 && !hasRemainingText;
   return [
+    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${hasCompleteTextCoverage ? " (complete)" : " (partial)"}`,
+    `Returned characters: ${endChar - startChar}; omitted before window: ${startChar}; remaining after window: ${totalCharacters - endChar}.`,
+    ...(hasRemainingText ? [`Next start_char: ${endChar}`] : []),
     ...identityLines(document),
     `MIME: ${document.mimeType}`,
-    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${truncated ? " (partial)" : " (complete)"}`,
-    ...(truncated ? [`Next start_char: ${endChar}`] : []),
     "Content:",
     sanitizeJsonText(text.slice(startChar, endChar)) || "[no extractable text]",
   ].join("\n");

package/plugins/document-reader/src/index.cjs

@@ -268,6 +268,7 @@ function enforcePluginResultByteBudget(result) {
 function successResult(input) {
   return enforcePluginResultByteBudget({
     ok: true,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output,
     producedNewInformation: input.producedNewInformation ?? true,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -281,6 +282,7 @@ function successResult(input) {
 function failureResult(input) {
   return enforcePluginResultByteBudget({
     ok: false,
+    ...input.media !== void 0 ? { media: input.media } : {},
     output: input.output ?? input.message,
     producedNewInformation: false,
     ...input.progress !== void 0 ? { progress: input.progress } : {},
@@ -305,6 +307,9 @@ function failureFromError(error, options) {
   });
 }
 
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
+
 // plugins/document-reader/source/constants.ts
 var MAX_DOCUMENT_BYTES = 10 * 1024 * 1024;
 var DEFAULT_MAX_CHARS = 2e4;
@@ -1319,12 +1324,14 @@ function actionTarget(document) {
   );
 }
 function renderWindow(document, text, startChar, endChar, totalCharacters) {
-  const truncated = endChar < totalCharacters;
+  const hasRemainingText = endChar < totalCharacters;
+  const hasCompleteTextCoverage = startChar === 0 && !hasRemainingText;
   return [
+    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${hasCompleteTextCoverage ? " (complete)" : " (partial)"}`,
+    `Returned characters: ${endChar - startChar}; omitted before window: ${startChar}; remaining after window: ${totalCharacters - endChar}.`,
+    ...hasRemainingText ? [`Next start_char: ${endChar}`] : [],
     ...identityLines(document),
     `MIME: ${document.mimeType}`,
-    `Coverage: characters ${startChar}-${endChar} of ${totalCharacters}${truncated ? " (partial)" : " (complete)"}`,
-    ...truncated ? [`Next start_char: ${endChar}`] : [],
     "Content:",
     sanitizeJsonText(text.slice(startChar, endChar)) || "[no extractable text]"
   ].join("\n");

package/plugins/exec/source/handlers.ts

@@ -1,30 +1,22 @@
+import { runningResult, finalizeExecResult } from "./result-presentation.js";
+import { ExecRequestResources } from "./request-resources.js";
 import {
   boundText,
-  enforcePluginResultByteBudget,
-  failureResult,
   readBoundedInteger,
   readRequiredString,
   type RuntimePluginLoadContext,
+  type ToolRequestPreparationContext,
   type ToolExecutionContext,
   type ToolImplementation,
   type ToolImplementationOutput,
 } from "../../../src/plugin-sdk/index.js";
 
 import { execFailureFromError, ExecPluginError } from "./errors.js";
-import {
-  captureExecFilesystemSnapshot,
-  diffExecFilesystemSnapshots,
-} from "./filesystem-observer.js";
+import { captureExecFilesystemSnapshot } from "./filesystem-observer.js";
 import { resolveExecWorkingDirectory } from "./paths.js";
 import { createExecProcessManager } from "./process-manager.js";
 import type { ExecSettings } from "./settings.js";
-import type {
-  ExecActionSummary,
-  ExecFilesystemDelta,
-  ExecProcessSnapshot,
-  ExecStreamSnapshot,
-  PendingExecExecution,
-} from "./types.js";
+import type { ExecProcessSnapshot, PendingExecExecution } from "./types.js";
 import { readExecCommand } from "./validation.js";
 
 const COMMAND_PREVIEW_MAX_CHARS = 768;
@@ -34,264 +26,6 @@ function processScope(context: ToolExecutionContext | undefined): string {
   return sessionId || "anonymous";
 }
 
-function streamDisplay(snapshot: ExecStreamSnapshot): string {
-  if (snapshot.text) return snapshot.text;
-  return snapshot.sawOutput
-    ? "(no new output; earlier output was already returned)"
-    : "(empty)";
-}
-
-function renderedOutput(
-  lines: readonly string[],
-  outputMaxChars: number,
-): Readonly<{
-  output: string;
-  metadata: ReturnType<typeof boundText>["metadata"];
-}> {
-  const bounded = boundText(lines.join("\n"), {
-    maxChars: outputMaxChars,
-    marker: "\n[exec output truncated]",
-  });
-  return Object.freeze({ output: bounded.text, metadata: bounded.metadata });
-}
-
-function outputBoundsData(
-  snapshot: ExecProcessSnapshot,
-  rendered: ReturnType<typeof renderedOutput>["metadata"],
-  maxChars: number,
-) {
-  return Object.freeze({
-    maxChars,
-    stdout: snapshot.stdout.metadata,
-    stderr: snapshot.stderr.metadata,
-    rendered,
-  });
-}
-
-function runningResult(
-  snapshot: ExecProcessSnapshot,
-  execution: PendingExecExecution,
-): ToolImplementationOutput {
-  const nextCursor = snapshot.nextCursor ?? 1;
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      `CWD: ${execution.cwd.logicalPath}`,
-      "Process status: running",
-      `Process ID: ${snapshot.processId}`,
-      `Next cursor: ${nextCursor}`,
-      "STDOUT since the previous observation:",
-      streamDisplay(snapshot.stdout),
-      "STDERR since the previous observation:",
-      streamDisplay(snapshot.stderr),
-      "Continue this exact process with exec_wait; do not run the command again.",
-    ],
-    execution.outputMaxChars,
-  );
-  return failureResult({
-    errorCode: "exec_process_running",
-    message:
-      "The command is still running. Continue it with exec_wait using the returned process ID and cursor.",
-    output: rendered.output,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data: {
-      processId: snapshot.processId,
-      processStatus: "running",
-      nextCursor,
-      outputBounds: outputBoundsData(
-        snapshot,
-        rendered.metadata,
-        execution.outputMaxChars,
-      ),
-      observationMeta: {
-        kind: "volatile_external",
-        carryPolicy: "never",
-      },
-    },
-  });
-}
-
-async function captureFilesystemDelta(
-  execution: PendingExecExecution,
-): Promise<ExecFilesystemDelta | null> {
-  if (!execution.filesystemStateBefore) return null;
-  try {
-    const after = await captureExecFilesystemSnapshot(
-      execution.cwd.absolutePath,
-      execution.cwd.logicalPath,
-    );
-    return diffExecFilesystemSnapshots(execution.filesystemStateBefore, after);
-  } catch {
-    return null;
-  }
-}
-
-type ExecFilesystemEvidenceProjection = Readonly<{
-  outputLines: readonly string[];
-  mutationGrounding: string;
-}>;
-
-function projectExecFilesystemEvidence(
-  delta: ExecFilesystemDelta,
-  logicalRoot: string,
-): ExecFilesystemEvidenceProjection {
-  const effects = delta.actions.map(renderExecFilesystemEffect);
-  const omittedEffectCount = Math.max(
-    0,
-    delta.changedEntryCount - effects.length,
-  );
-  const omittedEffectLine =
-    omittedEffectCount > 0
-      ? `- ${omittedEffectCount} additional changed ${omittedEffectCount === 1 ? "entry" : "entries"} omitted by the ${delta.observation.actionLimit}-effect projection limit.`
-      : undefined;
-  const outputLines = Object.freeze([
-    `Filesystem changes observed: ${delta.changedEntryCount}${delta.observation.complete ? "" : " (bounded observation)"}`,
-    "Filesystem effects observed:",
-    ...effects,
-    ...(omittedEffectLine ? [omittedEffectLine] : []),
-  ]);
-  return Object.freeze({
-    outputLines,
-    mutationGrounding: [
-      "Observed post-command filesystem effects (settled tool evidence; not command intent, semantic verification, or complete artifact content):",
-      `- observation root: ${logicalRoot}`,
-      `- observation complete: ${delta.observation.complete}`,
-      `- changed entries: ${delta.changedEntryCount}`,
-      `- listed effects: ${effects.length}`,
-      `- effects truncated: ${delta.observation.actionsTruncated}`,
-      "Effects:",
-      ...effects,
-      ...(omittedEffectLine ? [omittedEffectLine] : []),
-    ].join("\n"),
-  });
-}
-
-function renderExecFilesystemEffect(action: ExecActionSummary): string {
-  const target = action.target ? `: ${action.target}` : "";
-  const state =
-    action.details === "exec_filesystem_created"
-      ? "created"
-      : action.details === "exec_filesystem_modified"
-        ? "modified"
-        : action.details === "exec_filesystem_removed"
-          ? "removed"
-          : undefined;
-  return `- ${action.type}${target}${state ? ` (${state})` : ""}`;
-}
-
-async function finalizeExecResult(params: {
-  snapshot: ExecProcessSnapshot;
-  execution: PendingExecExecution;
-  cancellationIsSuccess?: boolean;
-}): Promise<ToolImplementationOutput> {
-  const { snapshot, execution } = params;
-  const exitCode = snapshot.exitCode ?? -1;
-  const cancellationIsSuccess =
-    params.cancellationIsSuccess === true &&
-    snapshot.terminationReason === "cancelled";
-  const filesystemDelta = await captureFilesystemDelta(execution);
-  const observedStateChange = filesystemDelta?.observedStateChange === true;
-  const filesystemEvidence =
-    observedStateChange && filesystemDelta
-      ? projectExecFilesystemEvidence(
-          filesystemDelta,
-          execution.cwd.logicalPath,
-        )
-      : null;
-  const commandHasData = snapshot.stdout.sawOutput || snapshot.stderr.sawOutput;
-  const ok = exitCode === 0 || cancellationIsSuccess;
-  const inconclusiveSuccess =
-    exitCode === 0 && !commandHasData && !observedStateChange;
-  const producedNewInformation =
-    observedStateChange || cancellationIsSuccess || (ok && commandHasData);
-  const actions = filesystemDelta?.actions ?? [];
-  const resultSummary = cancellationIsSuccess
-    ? "Result summary: the running command was cancelled."
-    : inconclusiveSuccess
-      ? "Result summary: the command completed without observable output or filesystem change. Inspect a concrete target or use a dedicated creation capability."
-      : "";
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      `CWD: ${execution.cwd.logicalPath}`,
-      `Process ID: ${snapshot.processId}`,
-      `Process status: ${snapshot.terminationReason ?? "completed"}`,
-      `Exit code: ${exitCode}`,
-      ...(filesystemEvidence ? filesystemEvidence.outputLines : []),
-      "STDOUT:",
-      streamDisplay(snapshot.stdout),
-      "STDERR:",
-      streamDisplay(snapshot.stderr),
-      ...(resultSummary ? [resultSummary] : []),
-    ],
-    execution.outputMaxChars,
-  );
-  const processStatus = snapshot.terminationReason ?? "completed";
-  const data = {
-    ...(commandHasData ? { hasData: true } : {}),
-    ...(observedStateChange ? { mutationEvidence: true } : {}),
-    ...(filesystemEvidence
-      ? { mutationGrounding: filesystemEvidence.mutationGrounding }
-      : {}),
-    processId: snapshot.processId,
-    processStatus,
-    outputBounds: outputBoundsData(
-      snapshot,
-      rendered.metadata,
-      execution.outputMaxChars,
-    ),
-    ...(filesystemDelta
-      ? { filesystemObservation: filesystemDelta.observation }
-      : { filesystemObservation: { available: false } }),
-    observationMeta: {
-      kind: "volatile_external" as const,
-      carryPolicy: "never" as const,
-    },
-  };
-  const common = {
-    output: rendered.output,
-    progress: observedStateChange || cancellationIsSuccess,
-    producedNewInformation,
-    actions: [...actions],
-    exitCode,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data,
-  };
-  if (ok && (!inconclusiveSuccess || cancellationIsSuccess)) {
-    return enforcePluginResultByteBudget({ ok: true, ...common });
-  }
-  const errorCode = inconclusiveSuccess
-    ? "no_observable_result"
-    : snapshot.terminationReason === "aborted"
-      ? "exec_aborted"
-      : snapshot.terminationReason === "spawn_failed"
-        ? "exec_spawn_failed"
-        : snapshot.terminationReason === "idle_timeout"
-          ? "exec_idle_timeout"
-          : snapshot.terminationReason === "hard_timeout"
-            ? "exec_hard_timeout"
-            : "non_zero_exit";
-  const error = inconclusiveSuccess
-    ? resultSummary
-    : errorCode === "exec_aborted"
-      ? "The exec request was aborted."
-      : errorCode === "exec_spawn_failed"
-        ? "The runtime could not start the configured non-interactive shell."
-        : errorCode === "exec_idle_timeout"
-          ? `The command produced no output for ${execution.idleTimeoutMs}ms.`
-          : errorCode === "exec_hard_timeout"
-            ? `The command exceeded the ${execution.hardTimeoutMs}ms hard timeout.`
-            : `The command exited with code ${exitCode}.`;
-  return enforcePluginResultByteBudget({
-    ok: false,
-    ...common,
-    error,
-    errorCode,
-  });
-}
-
 type ExecHandlers = Readonly<{
   exec: ToolImplementation;
   exec_wait: ToolImplementation;
@@ -301,9 +35,15 @@ type ExecHandlers = Readonly<{
 export function createExecHandlers(
   pluginContext: RuntimePluginLoadContext,
   settings: ExecSettings,
+  preparation?: ToolRequestPreparationContext,
 ): ExecHandlers {
   const processManager = createExecProcessManager();
   const pendingExecutions = new Map<string, PendingExecExecution>();
+  const requestResources = new ExecRequestResources(
+    processManager,
+    pendingExecutions,
+    preparation,
+  );
 
   const finalizeAndRelease = async (params: {
     snapshot: ExecProcessSnapshot;
@@ -315,6 +55,7 @@ export function createExecHandlers(
       return await finalizeExecResult(params);
     } finally {
       pendingExecutions.delete(params.snapshot.processId);
+      requestResources.forget(params.snapshot.processId);
       await processManager.release(params.snapshot.processId, params.scope);
     }
   };
@@ -353,7 +94,12 @@ export function createExecHandlers(
         idleTimeoutMs: execution.idleTimeoutMs,
         hardTimeoutMs: execution.hardTimeoutMs,
         ...(context?.abortSignal ? { abortSignal: context.abortSignal } : {}),
-        onDisposed: (processId) => pendingExecutions.delete(processId),
+        onDisposed: (processId) => {
+          pendingExecutions.delete(processId);
+          requestResources.forget(processId);
+        },
+        onStarted: (processId, settled) =>
+          requestResources.started(processId, scope, settled, context),
       });
       if (snapshot.status === "running") {
         pendingExecutions.set(snapshot.processId, execution);
@@ -384,12 +130,14 @@ export function createExecHandlers(
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.wait({
-        processId,
-        scope,
-        cursor,
-        waitMs: settings.yieldAfterMs,
-      });
+      const snapshot =
+        requestResources.terminal(processId, scope, cursor) ??
+        (await processManager.wait({
+          processId,
+          scope,
+          cursor,
+          waitMs: settings.yieldAfterMs,
+        }));
       return snapshot.status === "running"
         ? runningResult(snapshot, execution)
         : finalizeAndRelease({ snapshot, execution, scope });
@@ -412,7 +160,9 @@ export function createExecHandlers(
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.cancel({ processId, scope });
+      const snapshot =
+        requestResources.terminal(processId, scope) ??
+        (await processManager.cancel({ processId, scope }));
       return finalizeAndRelease({
         snapshot,
         execution,

package/plugins/exec/source/index.ts

@@ -6,6 +6,18 @@ import { createExecAdapter } from "./validation.js";
 
 export default defineRuntimePlugin((context) => ({
   handlers: createExecHandlers(context, readExecSettings(context.config)),
+  prepareRequest: async (modules, preparation) => {
+    if (!preparation?.requestState) return modules;
+    const handlers = createExecHandlers(
+      context,
+      readExecSettings(context.config),
+      preparation,
+    );
+    return modules.map((module) => ({
+      ...module,
+      implementation: handlers[module.definition.name as keyof typeof handlers],
+    }));
+  },
   adapters: {
     exec: createExecAdapter(),
   },