@abot-ai/runtime 1.4.0 → 1.5.0

package/dist/src/model-gateway/providers/ollama/adapter.js

@@ -1,4 +1,5 @@
 import { fetchProviderWithTrace } from "../../model-io-trace.js";
+import { toolMediaSafeError, toolMediaSafeMessage } from "../../observability/tool-media-privacy.js";
 import { buildOllamaPayload, buildOllamaRawPayload, } from "./payload.js";
 import { emitOllamaRequestProjection, emitOllamaSchemaDiagnostics, emitOllamaTiming, resolveOllamaBaseUrl, } from "./request-diagnostics.js";
 import { createOllamaStreamDiagnostics, isAbortFailure, } from "./stream-diagnostics.js";
@@ -56,7 +57,7 @@ export function createOllamaProviderAdapter(options) {
                 return {
                     kind: "error",
                     statusCode: response.status || 502,
-                    message: message || "ollama error",
+                    message: toolMediaSafeMessage(message || "ollama error", params.requestBody),
                 };
             }
             const streamDiagnostics = createOllamaStreamDiagnostics({
@@ -79,8 +80,8 @@ export function createOllamaProviderAdapter(options) {
                         }
                         catch (error) {
                             outcome = resolveFailureOutcome(error);
-                            failure = error;
-                            throw error;
+                            failure = toolMediaSafeError(error, params.requestBody);
+                            throw failure;
                         }
                         finally {
                             streamDiagnostics.terminate(outcome, failure);
@@ -107,8 +108,8 @@ export function createOllamaProviderAdapter(options) {
             }
             catch (error) {
                 outcome = resolveFailureOutcome(error);
-                failure = error;
-                throw error;
+                failure = toolMediaSafeError(error, params.requestBody);
+                throw failure;
             }
             finally {
                 streamDiagnostics.terminate(outcome, failure);

package/dist/src/model-gateway/providers/ollama/message-projection.js

@@ -53,10 +53,12 @@ export function toOllamaMessage(message) {
         };
     }
     if (isToolResultMessage(message)) {
+        const images = message.attachments?.map(readImageData).filter((data) => Boolean(data));
         return {
             role: "tool",
             tool_name: message.toolName,
             content: message.content,
+            ...(images?.length ? { images } : {}),
         };
     }
     const textMessage = readTextMessageWithAttachments(message);

package/dist/src/model-gateway/providers/openai/adapter.js

@@ -1,4 +1,5 @@
 import { fetchProviderWithTrace } from "../../model-io-trace.js";
+import { toolMediaSafeError, toolMediaSafeEvent, toolMediaSafeMessage } from "../../observability/tool-media-privacy.js";
 import { emitOpenAIMessageOutputDiagnostic, emitOpenAISchemaDiagnostics, emitOpenAIStreamTermination, hasStructuredTextFormat, resolveOpenAIStreamFailureOutcome, } from "./diagnostics.js";
 import { countOpenAIInputTokens } from "./input-token-count.js";
 import { buildOpenAIResponsesPayload, collectOpenAIResponsesStream, forwardOpenAIResponsesStream, resolveOpenAIProviderSettings, } from "./protocol.js";
@@ -6,7 +7,7 @@ import { embedWithOpenAI } from "./embeddings.js";
 export function createOpenAIProviderAdapter() {
     return Object.freeze({
         type: "openai",
-        supportsImageInput: false,
+        supportsImageInput: true,
         embed: embedWithOpenAI,
         countInputTokens: countOpenAIInputTokens,
         async invoke(params) {
@@ -50,7 +51,7 @@ export function createOpenAIProviderAdapter() {
                 return {
                     kind: "error",
                     statusCode: response.status || 502,
-                    message: message || "openai error",
+                    message: toolMediaSafeMessage(message || "openai error", params.requestBody),
                 };
             }
             const streamStartedAt = Date.now();
@@ -62,12 +63,14 @@ export function createOpenAIProviderAdapter() {
                         let outcome = "completed";
                         let failure;
                         try {
-                            await forwardOpenAIResponsesStream(body, writer, streamOptions);
+                            await forwardOpenAIResponsesStream(body, {
+                                emit: (event) => writer.emit(toolMediaSafeEvent(event, params.requestBody)),
+                            }, streamOptions);
                         }
                         catch (error) {
                             outcome = resolveOpenAIStreamFailureOutcome(error);
-                            failure = error;
-                            throw error;
+                            failure = toolMediaSafeError(error, params.requestBody);
+                            throw failure;
                         }
                         finally {
                             emitOpenAIStreamTermination({
@@ -99,8 +102,8 @@ export function createOpenAIProviderAdapter() {
             }
             catch (error) {
                 outcome = resolveOpenAIStreamFailureOutcome(error);
-                failure = error;
-                throw error;
+                failure = toolMediaSafeError(error, params.requestBody);
+                throw failure;
             }
             finally {
                 emitOpenAIStreamTermination({

package/dist/src/model-gateway/providers/openai/image-content.d.ts

@@ -0,0 +1,8 @@
+import type { ModelGatewayAttachment } from "../../types.js";
+/** Responses supports text/image content in messages and function outputs. */
+export declare function openAIImageContents(attachments: readonly ModelGatewayAttachment[] | undefined): {
+    type: "input_image";
+    image_url: string;
+    detail: "auto";
+}[];
+export declare function projectOpenAIImageMessage(value: unknown): unknown;

package/dist/src/model-gateway/providers/openai/image-content.js

@@ -0,0 +1,28 @@
+/** Responses supports text/image content in messages and function outputs. */
+export function openAIImageContents(attachments) {
+    return (attachments ?? []).map((attachment) => {
+        if (attachment.kind !== "image" || !attachment.data)
+            throw new Error("model_gateway_image_data_unavailable");
+        return {
+            type: "input_image",
+            image_url: `data:${attachment.mimeType};base64,${attachment.data}`,
+            detail: "auto",
+        };
+    });
+}
+export function projectOpenAIImageMessage(value) {
+    if (!value || typeof value !== "object")
+        return value;
+    const message = value;
+    if (!message.attachments?.length)
+        return value;
+    if (typeof message.role !== "string" || typeof message.content !== "string")
+        throw new Error("model_gateway_image_message_invalid");
+    return {
+        role: message.role,
+        content: [
+            { type: "input_text", text: message.content },
+            ...openAIImageContents(message.attachments),
+        ],
+    };
+}

package/dist/src/model-gateway/providers/openai/input-token-count.js

@@ -1,6 +1,7 @@
 import { createProviderEnvelopeFingerprint } from "../envelope-budget.js";
 import { buildOpenAIInputTokenCountPayload } from "./payload.js";
 import { resolveOpenAIProviderSettings } from "./settings.js";
+import { toolMediaSafeError, toolMediaSafeMessage } from "../../observability/tool-media-privacy.js";
 function readInputTokenCount(body) {
     const isRecord = body !== null && typeof body === "object" && !Array.isArray(body);
     if (!isRecord) {
@@ -29,13 +30,13 @@ export async function countOpenAIInputTokens(params) {
             Authorization: `Bearer ${settings.apiKey}`,
         },
         body: JSON.stringify(payload),
-    });
+    }).catch((error) => { throw toolMediaSafeError(error, params.requestBody); });
     if (!response.ok) {
         const message = await response.text().catch(() => "");
         return {
             kind: "error",
             statusCode: response.status || 502,
-            message: message || "openai input token count error",
+            message: toolMediaSafeMessage(message || "openai input token count error", params.requestBody),
         };
     }
     const body = await response.json().catch(() => undefined);

package/dist/src/model-gateway/providers/openai/payload.js

@@ -1,4 +1,5 @@
 import { resolveModelStepOutputTokenLimit } from "../../../shared/model-step-registry.js";
+import { openAIImageContents, projectOpenAIImageMessage } from "./image-content.js";
 import { isAssistantToolCallMessage, isToolResultMessage, validateModelGatewayMessages, } from "../../protocol/message-contract.js";
 import { resolveModelInvocation } from "../../policy/invocation-policy.js";
 import { projectOpenAIResponsesFormat, resolveModelGatewayFormat, } from "../../structured-output/projection.js";
@@ -48,11 +49,13 @@ function projectOpenAIInputItems(input) {
                 {
                     type: "function_call_output",
                     call_id: item.toolCallId,
-                    output: item.content,
+                    output: item.attachments?.length
+                        ? [{ type: "input_text", text: item.content }, ...openAIImageContents(item.attachments)]
+                        : item.content,
                 },
             ];
         }
-        return [item];
+        return [projectOpenAIImageMessage(item)];
     });
 }
 function resolveInputWithProviderInstructions(requestBody, providerInstructions) {

package/dist/src/model-gateway/types.d.ts

@@ -29,12 +29,16 @@ export type ChatToolResultMessage = Readonly<{
     content: string;
     toolCallId: string;
     toolName: string;
-    attachments?: never;
+    attachments?: ModelGatewayAttachment[];
     toolCalls?: never;
 }>;
 export type ChatMessage = ChatTextMessage | ChatAssistantToolCallMessage | ChatToolResultMessage;
 export type ModelGatewayAttachment = RuntimeAttachmentReference & {
     data?: string;
+    /** Request-local tool evidence; never persist or trace this attachment. */
+    toolEvidence?: Readonly<{
+        executionId: string;
+    }>;
 };
 export type ModelGatewayJsonSchemaFormat = {
     type: "json_schema";

package/dist/src/plugin-sdk/computer-access.d.ts

@@ -0,0 +1,13 @@
+/** Shared computer access. Import this subpath only when your plugin uses the host. */
+export { executeHostOperation, readHostStatus, } from "../computer-access/companion/broker-client.js";
+export { HOST_OPERATIONS, type HostIdentity, type HostOperation, type HostStatus, isHostIdentifier, isHostIdentity, isHostOperation, } from "../computer-access/companion/protocol.js";
+export { computerFields, computerInputError, computerRecord, computerText, readNativeComputerAction, readPhysicalRectangle, } from "../computer-access/computer/action-input.js";
+export { createCompanionComputerBackend } from "../computer-access/computer/companion-backend.js";
+export { withDesktopQueue } from "../computer-access/computer/desktop-action-queue.js";
+export { createNativeComputerBackend } from "../computer-access/computer/native-backend.js";
+export { type NativeComputerAction, type NativeComputerBackend, type NativeComputerObservation, type NativeComputerResult, type PhysicalPoint, type PhysicalRectangle, } from "../computer-access/computer/native-protocol.js";
+export { COMPUTER_CAPABILITY, readNativeComputerResult, } from "../computer-access/computer/native-validation.js";
+export { SystemOperationError, type SystemTarget, type SystemTargetId, } from "../computer-access/contracts.js";
+export { createSystemHandlers } from "../computer-access/handlers.js";
+export { type SystemTargetObservation, observeSystemTargets, } from "../computer-access/target-observation.js";
+export type { ComputerAccessConnection, CompanionTarget, } from "../computer-access/client.js";

package/dist/src/plugin-sdk/computer-access.js

@@ -0,0 +1,11 @@
+/** Shared computer access. Import this subpath only when your plugin uses the host. */
+export { executeHostOperation, readHostStatus, } from "../computer-access/companion/broker-client.js";
+export { HOST_OPERATIONS, isHostIdentifier, isHostIdentity, isHostOperation, } from "../computer-access/companion/protocol.js";
+export { computerFields, computerInputError, computerRecord, computerText, readNativeComputerAction, readPhysicalRectangle, } from "../computer-access/computer/action-input.js";
+export { createCompanionComputerBackend } from "../computer-access/computer/companion-backend.js";
+export { withDesktopQueue } from "../computer-access/computer/desktop-action-queue.js";
+export { createNativeComputerBackend } from "../computer-access/computer/native-backend.js";
+export { COMPUTER_CAPABILITY, readNativeComputerResult, } from "../computer-access/computer/native-validation.js";
+export { SystemOperationError, } from "../computer-access/contracts.js";
+export { createSystemHandlers } from "../computer-access/handlers.js";
+export { observeSystemTargets, } from "../computer-access/target-observation.js";

package/dist/src/plugin-sdk/index.d.ts

@@ -4,6 +4,8 @@ export * from "./parameters.js";
 export * from "./paths.js";
 export * from "./plugin.js";
 export * from "./results.js";
+export * from "../capabilities/tool-media.js";
 export * from "./tool-availability-brief.js";
 export * from "./tool-availability-overview.js";
 export * from "../plugin-contract/index.js";
+export type { ToolRequestWork, ToolRequestState, ToolRequestPreparationContext, } from "../capabilities/tool-request-resources.js";

package/dist/src/plugin-sdk/index.js

@@ -4,6 +4,7 @@ export * from "./parameters.js";
 export * from "./paths.js";
 export * from "./plugin.js";
 export * from "./results.js";
+export * from "../capabilities/tool-media.js";
 export * from "./tool-availability-brief.js";
 export * from "./tool-availability-overview.js";
 export * from "../plugin-contract/index.js";

package/dist/src/plugin-sdk/results.d.ts

@@ -1,5 +1,5 @@
 import type { ToolImplementationOutput } from "../plugin-contract/entrypoint.js";
-type ResultCommon = Pick<ToolImplementationOutput, "actions" | "data" | "exitCode" | "progress" | "stderr" | "stdout">;
+type ResultCommon = Pick<ToolImplementationOutput, "actions" | "data" | "exitCode" | "progress" | "stderr" | "stdout" | "media">;
 export declare const PLUGIN_RESULT_SERIALIZED_MAX_BYTES: number;
 export declare function enforcePluginResultByteBudget(result: ToolImplementationOutput): ToolImplementationOutput;
 export type SuccessResultInput = ResultCommon & Readonly<{

package/dist/src/plugin-sdk/results.js

@@ -30,6 +30,7 @@ export function enforcePluginResultByteBudget(result) {
 export function successResult(input) {
     return enforcePluginResultByteBudget({
         ok: true,
+        ...(input.media !== undefined ? { media: input.media } : {}),
         output: input.output,
         producedNewInformation: input.producedNewInformation ?? true,
         ...(input.progress !== undefined ? { progress: input.progress } : {}),
@@ -43,6 +44,7 @@ export function successResult(input) {
 export function failureResult(input) {
     return enforcePluginResultByteBudget({
         ok: false,
+        ...(input.media !== undefined ? { media: input.media } : {}),
         output: input.output ?? input.message,
         producedNewInformation: false,
         ...(input.progress !== undefined ? { progress: input.progress } : {}),

package/dist/src/runtime/adapters/co-worker-resources.d.ts

@@ -0,0 +1,13 @@
+import type { RuntimeConfig, ModelGatewayClient, SessionStore } from "../ports.js";
+import type { LongTermMemoryService } from "../long-term-memory/contracts.js";
+import type { LearningBackgroundContext, LearningBackgroundDependencies } from "../passive-learning/background-dependencies.js";
+/** The environment shares one budget; foreground chat keeps its original clients. */
+export declare function createCoWorkerResourceDependencies(options: {
+    config: RuntimeConfig;
+    models: ModelGatewayClient;
+    memory: LongTermMemoryService;
+    directory: string;
+    ownerId: string;
+    context: LearningBackgroundContext;
+    sessions?: SessionStore;
+}): LearningBackgroundDependencies;

package/dist/src/runtime/adapters/co-worker-resources.js

@@ -0,0 +1,74 @@
+import { createRuntimePassiveLearningModel } from "../passive-learning/model.js";
+import { CoWorkerResourceBudget } from "../passive-learning/resources/budget.js";
+import { DEFAULT_CO_WORKER_RESOURCE_LIMITS } from "../passive-learning/resources/contracts.js";
+import { createCoWorkerResourceGateway } from "../passive-learning/resources/gateway.js";
+import { createRuntimeProactiveModel } from "../passive-learning/proactive/model.js";
+import { CoWorkerProactiveAgent } from "../passive-learning/proactive/agent.js";
+import { isWithinAnalysisWindow } from "../passive-learning/analysis-schedule.js";
+import { ScheduledLearningReassessment } from "../passive-learning/scheduled-reassessment.js";
+/** The environment shares one budget; foreground chat keeps its original clients. */
+export function createCoWorkerResourceDependencies(options) {
+    const { context } = options;
+    const budget = new CoWorkerResourceBudget({ directory: options.directory, limits: () => {
+            const preferences = context.preferences();
+            return { ...(preferences.resourceLimits ?? DEFAULT_CO_WORKER_RESOURCE_LIMITS), maxConcurrentCalls: preferences.maxConcurrentBatches ?? 1 };
+        } });
+    const original = createRuntimePassiveLearningModel(options);
+    const processingGateway = createCoWorkerResourceGateway({
+        gateway: options.models, budget, activity: "processing", assertActivityAllowed: context.assertProcessingAllowed,
+        supportsParallel: () => original.supportsParallelBatches?.(context.preferences().modelProfileId ?? "") ?? false,
+    });
+    async function assertMemoryAvailable(signal) {
+        signal.throwIfAborted();
+        context.assertProcessingAllowed();
+        const status = await options.memory.status();
+        signal.throwIfAborted();
+        context.assertProcessingAllowed();
+        if (!status.enabled || !status.available)
+            throw new Error("learning_memory_unavailable");
+    }
+    const gateway = {
+        ...processingGateway,
+        async invoke(input) { await assertMemoryAvailable(input.abortSignal); return processingGateway.invoke(input); },
+        async invokeRaw(input) { await assertMemoryAvailable(input.abortSignal); return processingGateway.invokeRaw(input); },
+        ...(processingGateway.embed ? { embed: async (input) => {
+                await assertMemoryAvailable(input.abortSignal);
+                return processingGateway.embed(input);
+            } } : {}),
+    };
+    const beforeEmbedding = async ({ signal, characters }) => {
+        await assertMemoryAvailable(signal);
+        return budget.reserve({ kind: "embedding", activity: "processing", signal, embeddingCharacters: characters,
+            supportsParallel: false, assertActivityAllowed: context.assertProcessingAllowed });
+    };
+    const learning = options.memory.learning;
+    const memory = {
+        ...options.memory,
+        ...(learning ? { learning: {
+                ...learning,
+                prepare: (input) => learning.prepare({ ...input, beforeEmbedding }),
+                apply: (input) => learning.apply({ ...input, beforeEmbedding }),
+            } } : {}),
+    };
+    const proactiveGateway = createCoWorkerResourceGateway({
+        gateway: options.models, budget, activity: "proactive",
+        assertActivityAllowed: () => {
+            if (!context.isStarted() || context.isInteractiveBusy() || !context.preferences().proactiveEnabled)
+                throw new Error("proactive_disabled");
+            if (!isWithinAnalysisWindow(Date.now(), context.preferences().proactiveWindow))
+                throw new Error("proactive_outside_window");
+        },
+        supportsParallel: () => original.supportsParallelBatches?.(context.preferences().proactiveModelProfileId ?? context.preferences().modelProfileId ?? "") ?? false,
+    });
+    const proactive = learning && options.sessions ? new CoWorkerProactiveAgent({ directory: options.directory,
+        context, memory: learning, sessions: options.sessions, budget,
+        model: createRuntimeProactiveModel({ config: options.config, models: proactiveGateway }) }) : undefined;
+    const model = createRuntimePassiveLearningModel({ ...options, models: gateway });
+    const reassessment = memory.learning ? new ScheduledLearningReassessment({ directory: options.directory,
+        environmentId: options.ownerId, context, memory: memory.learning, model,
+        resourceUsage: () => budget.status(), changed: () => { proactive?.knowledgeChanged(); context.changed(); } }) : undefined;
+    return { model, memory,
+        ...(proactive ? { proactive } : {}),
+        ...(reassessment ? { reassessment } : {}),
+        resourceUsage: () => budget.status() };
+}

package/dist/src/runtime/adapters/config-file-transaction.js

@@ -62,9 +62,16 @@ function parseSnapshotConfig(raw, options) {
         };
     }
 }
+async function requireRegularConfigFile(path) {
+    if ((await stat(path)).isFile())
+        return;
+    throw new Error("Configuration path must be a regular file.");
+}
 async function readSnapshot(path, options = {}) {
     let raw;
     try {
+        // Inspect before opening: special entries such as FIFOs can block a read.
+        await requireRegularConfigFile(path);
         raw = await readFile(path);
     }
     catch (error) {

package/dist/src/runtime/adapters/default-session-adapters.d.ts

@@ -1,3 +1,3 @@
 import type { ConversationContextProvider, SessionStore } from "../ports.js";
-export declare const defaultRuntimeSessionStore: Pick<SessionStore, "appendMessage" | "appendContextEntry" | "appendRequestEvent" | "compareAndSwapSessionMemoryCheckpoint" | "getAllSessions" | "getOrCreateSession" | "startRequestStream" | "upsertArtifactPaths" | "updateSessionRuntimeMode" | "updateSessionTitle">;
+export declare const defaultRuntimeSessionStore: Pick<SessionStore, "appendMessage" | "requestLifecycle" | "appendContextEntry" | "appendRequestEvent" | "compareAndSwapSessionMemoryCheckpoint" | "getAllSessions" | "getOrCreateSession" | "startRequestStream" | "upsertArtifactPaths" | "updateSessionRuntimeMode" | "updateSessionTitle">;
 export declare const defaultRuntimeConversationContextProvider: Pick<ConversationContextProvider, "buildContextBuckets">;

package/dist/src/runtime/adapters/file-session-store.js

@@ -2,6 +2,8 @@ import { SessionService } from "../../sessions/session-service.js";
 export function createFileSessionStore(options = {}) {
     const service = new SessionService(options);
     return {
+        requestLifecycle: service.requestLifecycle,
+        createAssistantConversation: service.createAssistantConversation.bind(service),
         getOrCreateSession: service.getOrCreateSession.bind(service),
         getAllSessions: service.getAllSessions.bind(service),
         listSessions: service.listSessions.bind(service),

package/dist/src/runtime/adapters/long-term-memory/file-repository.js

@@ -3,6 +3,7 @@ import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 import { advanceMemorySnapshot, createEmptyMemorySnapshot, parseMemorySnapshot, } from "../../long-term-memory/repository-state.js";
 import { withFileLock } from "./file-lock.js";
+import { preserveMemoryMigrationBackup } from "./migration-backup.js";
 const STORE_FILE_NAME = "memory.json";
 const LOCK_FILE_NAME = "memory.lock";
 const PRIVATE_STORE_FILE_MODE = 0o600;
@@ -16,6 +17,7 @@ export function createFileLongTermMemoryRepository(directory) {
             return withFileLock(lockPath, async () => {
                 const current = await readSnapshot(storePath);
                 const next = advanceMemorySnapshot(current, mutate(current));
+                await preserveMemoryMigrationBackup(storePath, current, next);
                 await writeSnapshot(storePath, next);
                 return next;
             });

package/dist/src/runtime/adapters/long-term-memory/migration-backup.d.ts

@@ -0,0 +1,3 @@
+import type { LongTermMemoryRepositorySnapshot } from "../../long-term-memory/contracts.js";
+/** Preserve one private rollback snapshot before each incompatible replacement. */
+export declare function preserveMemoryMigrationBackup(storePath: string, current: LongTermMemoryRepositorySnapshot, next: LongTermMemoryRepositorySnapshot): Promise<void>;

package/dist/src/runtime/adapters/long-term-memory/migration-backup.js

@@ -0,0 +1,44 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { parseMemorySnapshot } from "../../long-term-memory/repository-state.js";
+/** Preserve one private rollback snapshot before each incompatible replacement. */
+export async function preserveMemoryMigrationBackup(storePath, current, next) {
+    const version = memoryUpgradeVersion(current, next);
+    if (version === undefined)
+        return;
+    const original = await readExistingSnapshot(storePath);
+    if (original === undefined)
+        return;
+    const backupPath = `${storePath}.pre-v${version}.backup`;
+    try {
+        await writeFile(backupPath, original, { encoding: "utf8", flag: "wx", mode: 0o600 });
+    }
+    catch (error) {
+        if (!hasFileErrorCode(error, "EEXIST"))
+            throw error;
+        const existing = parseMemorySnapshot(JSON.parse(await readFile(backupPath, "utf8")));
+        if (existing.schemaVersion >= version)
+            throw new Error("long_term_memory_migration_backup_invalid");
+    }
+}
+function memoryUpgradeVersion(current, next) {
+    if (current.schemaVersion < 5 && next.schemaVersion === 5)
+        return 5;
+    if (current.schemaVersion < 4 && next.schemaVersion === 4)
+        return 4;
+    return undefined;
+}
+async function readExistingSnapshot(storePath) {
+    try {
+        return await readFile(storePath, "utf8");
+    }
+    catch (error) {
+        if (hasFileErrorCode(error, "ENOENT"))
+            return undefined;
+        throw error;
+    }
+}
+function hasFileErrorCode(error, code) {
+    if (!error || typeof error !== "object")
+        return false;
+    return "code" in error && error.code === code;
+}

package/dist/src/runtime/adapters/passive-learning-runtime.d.ts

@@ -0,0 +1,28 @@
+import type { RuntimeConfig, ModelGatewayClient, SessionStore } from "../ports.js";
+import type { LongTermMemoryService } from "../long-term-memory/contracts.js";
+/** The environment owns learning; the paired desktop owns native collection. */
+export declare function createRuntimePassiveLearning(params: {
+    config: RuntimeConfig;
+    models: ModelGatewayClient;
+    memory: LongTermMemoryService;
+    sessions?: SessionStore;
+}): Readonly<{
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    configure(input: Partial<import("../passive-learning/contracts.js").PassiveLearningPreferences>): Promise<import("../passive-learning/contracts.js").PassiveLearningStatus>;
+    status(): Promise<import("../passive-learning/contracts.js").PassiveLearningStatus>;
+    clearPending(): Promise<import("../passive-learning/contracts.js").PassiveLearningStatus>;
+    restartCollection?(): Promise<import("../passive-learning/contracts.js").PassiveLearningStatus>;
+    batches(input?: Readonly<{
+        limit?: number;
+    }>): Promise<readonly import("../passive-learning/contracts.js").LearningBatchSummary[]>;
+    batch(id: string): Promise<import("../passive-learning/contracts.js").LearningBatch | undefined>;
+    accept(event: import("../../shared/passive-observation.js").HostObservationEvent): void;
+    flush(): Promise<void>;
+    beginInteractive(): () => void;
+    subscribe(listener: (event?: import("../passive-learning/contracts.js").LearningChangedEvent) => void): () => void;
+    dismissProposal?(id: string): Promise<void>;
+    sessionDeleted?(sessionId: string): Promise<void>;
+    notifyKnowledgeChanged?(): void;
+    candidates?(): Promise<readonly Omit<import("../long-term-memory/maturation/contracts.js").LearningCandidateRecord, "embedding">[]>;
+}>;

package/dist/src/runtime/adapters/passive-learning-runtime.js

@@ -0,0 +1,28 @@
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import { connectHostObservations } from "../../computer-access/companion/observation-client.js";
+import { createPassiveLearningService } from "../passive-learning/service.js";
+import { createRuntimePassiveLearningModel } from "../passive-learning/model.js";
+import { createCoWorkerResourceDependencies } from "./co-worker-resources.js";
+/** The environment owns learning; the paired desktop owns native collection. */
+export function createRuntimePassiveLearning(params) {
+    const { config, models, memory } = params;
+    const ownerId = createHash("sha256")
+        .update(config.paths.runtimeDir)
+        .digest("hex");
+    return createPassiveLearningService({
+        ownerId,
+        directory: join(config.paths.runtimeDir, "passive-learning"),
+        memory,
+        model: createRuntimePassiveLearningModel({ config, models }),
+        backgroundDependencies: (context) => createCoWorkerResourceDependencies({
+            config, models, memory, context, ownerId, directory: join(config.paths.runtimeDir, "passive-learning"),
+            sessions: params.sessions,
+        }),
+        connect: (input) => connectHostObservations({
+            ...input,
+            ownerId,
+            rootDir: config.paths.rootDir,
+        }),
+    });
+}

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/approval.d.ts

@@ -1,8 +1,11 @@
 import type { ToolCall } from "../../../../capabilities/tool-types.js";
 import { type ToolEventExecutorIdentity } from "../shared/event-metadata.js";
-import type { ToolApprovalController, ToolPermissionMode } from "../../../ports.js";
+import type { ToolApprovalController, ToolApprovalRequest, ToolApprovalDecision, ToolPermissionMode } from "../../../ports.js";
 import type { RegisteredToolNormalInvocationRejection } from "../shared/contracts.js";
 export declare function requestNormalInvocationApproval(params: {
+    preparedRequest?: ToolApprovalRequest;
+    decision?: ToolApprovalDecision;
+    decisionRecorded?: boolean;
     executionId?: string;
     executorIdentity?: ToolEventExecutorIdentity;
     requestId: string;

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/approval.js

@@ -10,7 +10,9 @@ export async function requestNormalInvocationApproval(params) {
     if (!requiresToolActionApproval(params.toolPermissionMode, params.force)) {
         return Object.freeze({ ok: true });
     }
-    const approvalId = params.nextApprovalId();
+    const approvalId = params.preparedRequest?.approvalId ?? params.nextApprovalId();
+    if (params.decision)
+        return applyDecision(params, approvalId, params.decision);
     params.onEvent?.("tool.approval.required", {
         ...buildToolExecutorEventMetadata(params.executorIdentity),
         ...(params.executionId ? { executionId: params.executionId } : {}),
@@ -36,28 +38,35 @@ export async function requestNormalInvocationApproval(params) {
         };
     }
     const decision = await params.toolApprovalController.requestToolApproval({
-        requestId: params.requestId,
-        approvalId,
-        call: params.call,
-        ...(params.eventMeta ? { meta: params.eventMeta } : {}),
+        ...(params.preparedRequest ?? {
+            requestId: params.requestId,
+            approvalId,
+            call: params.call,
+            ...(params.eventMeta ? { meta: params.eventMeta } : {}),
+        }),
     }, { abortSignal: params.abortSignal });
+    return applyDecision(params, approvalId, decision);
+}
+function applyDecision(params, approvalId, decision) {
     if (decision.approved) {
-        params.onEvent?.("tool.approval.granted", {
+        if (!params.decisionRecorded)
+            params.onEvent?.("tool.approval.granted", {
+                ...buildToolExecutorEventMetadata(params.executorIdentity),
+                ...(params.executionId ? { executionId: params.executionId } : {}),
+                approvalId,
+                tool: params.call.tool,
+            });
+        return Object.freeze({ ok: true });
+    }
+    const message = decision.reason?.trim() || "Tool execution was rejected.";
+    if (!params.decisionRecorded)
+        params.onEvent?.("tool.approval.rejected", {
             ...buildToolExecutorEventMetadata(params.executorIdentity),
             ...(params.executionId ? { executionId: params.executionId } : {}),
             approvalId,
             tool: params.call.tool,
+            reason: message,
         });
-        return Object.freeze({ ok: true });
-    }
-    const message = decision.reason?.trim() || "Tool execution was rejected.";
-    params.onEvent?.("tool.approval.rejected", {
-        ...buildToolExecutorEventMetadata(params.executorIdentity),
-        ...(params.executionId ? { executionId: params.executionId } : {}),
-        approvalId,
-        tool: params.call.tool,
-        reason: message,
-    });
     return {
         ok: false,
         rejection: rejectNormalInvocation("tool_approval_rejected", message),

package/dist/src/runtime/adapters/registered-tool-normal-invocations/execution/prepared-execution.d.ts

@@ -0,0 +1,16 @@
+import type { ToolCall } from "../../../../capabilities/tool-types.js";
+import type { ToolApprovalRequest } from "../../../ports.js";
+import type { BoundOperation, RegisteredToolNormalInvocationExecutorParams, RegisteredToolPreparedNormalInvocation } from "../shared/contracts.js";
+export declare function createPreparedNormalInvocation(params: {
+    executor: RegisteredToolNormalInvocationExecutorParams;
+    source: BoundOperation;
+    target: BoundOperation;
+    call: ToolCall;
+    actionFingerprint: string;
+    acceptedControls: Readonly<Record<string, unknown>>;
+    intent?: string;
+    eventMeta?: Record<string, unknown>;
+    executionIdentity?: string;
+    executionMetadata?: Readonly<Record<string, unknown>>;
+    restoredApprovalRequest?: ToolApprovalRequest;
+}): RegisteredToolPreparedNormalInvocation;