@abot-ai/runtime 1.4.0 → 1.6.0

package/plugins/exec/src/index.cjs

@@ -138,8 +138,28 @@ function defineRuntimePlugin(definition) {
   return definition;
 }
 
+// src/capabilities/tool-context-text.ts
+function hasValidToolContextText(carrier) {
+  const fields = carrier.contextTextFields;
+  if (fields === void 0) return true;
+  if (!Array.isArray(fields) || fields.length === 0 || fields.length > 3)
+    return false;
+  if (new Set(fields).size !== fields.length) return false;
+  for (const field of fields) {
+    if (!isContextTextField(field)) return false;
+    if (typeof carrier[field] !== "string") return false;
+  }
+  return true;
+}
+function isContextTextField(value) {
+  return value === "output" || value === "stdout" || value === "stderr";
+}
+
+// src/capabilities/result-budget.ts
+var CAPABILITY_RESULT_ENVELOPE_MAX_BYTES = 256 * 1024;
+
 // src/plugin-sdk/results.ts
-var PLUGIN_RESULT_SERIALIZED_MAX_BYTES = 128 * 1024;
+var PLUGIN_RESULT_SERIALIZED_MAX_BYTES = CAPABILITY_RESULT_ENVELOPE_MAX_BYTES;
 function resultBoundsFailure(code, message) {
   return {
     ok: false,
@@ -149,9 +169,27 @@ function resultBoundsFailure(code, message) {
     errorCode: code
   };
 }
-function enforcePluginResultByteBudget(result) {
-  let serialized;
+function enforcePluginResultByteBudget(result, resultBudget) {
+  let requiresContextTextHost = false;
+  let serializedBytes;
+  let envelopeBytes;
+  let maxBytes = PLUGIN_RESULT_SERIALIZED_MAX_BYTES;
+  let fitsDeclaredBudget = true;
   try {
+    if (!hasValidToolContextText(result)) {
+      return resultBoundsFailure(
+        "plugin_context_text_invalid",
+        "The plugin declared invalid context text fields."
+      );
+    }
+    requiresContextTextHost = result.contextTextFields !== void 0;
+    const lacksContextTextHost = requiresContextTextHost && resultBudget?.acceptsContextText !== true;
+    if (lacksContextTextHost) {
+      return resultBoundsFailure(
+        "plugin_context_text_unavailable",
+        "The host does not support context-managed tool text."
+      );
+    }
     const candidate = JSON.stringify(result);
     if (candidate === void 0) {
       return resultBoundsFailure(
@@ -159,35 +197,43 @@ function enforcePluginResultByteBudget(result) {
         "The plugin produced a result that is not JSON-safe."
       );
     }
-    serialized = candidate;
+    const assessment = resultBudget?.assess(result);
+    serializedBytes = assessment?.serializedBytes ?? Buffer.byteLength(candidate, "utf8");
+    envelopeBytes = assessment?.envelopeBytes ?? serializedBytes;
+    maxBytes = Math.min(assessment?.maxBytes ?? maxBytes, maxBytes);
+    fitsDeclaredBudget = assessment?.fits ?? true;
   } catch {
     return resultBoundsFailure(
       "plugin_result_not_json_safe",
       "The plugin produced a result that is not JSON-safe."
     );
   }
-  if (Buffer.byteLength(serialized, "utf8") > PLUGIN_RESULT_SERIALIZED_MAX_BYTES) {
-    return resultBoundsFailure(
-      "plugin_result_too_large",
-      `The plugin result exceeds the ${PLUGIN_RESULT_SERIALIZED_MAX_BYTES}-byte safety limit.`
-    );
+  const hasResultDeliveryHeadroom = fitsDeclaredBudget && envelopeBytes <= maxBytes;
+  if (!hasResultDeliveryHeadroom) {
+    const message = requiresContextTextHost ? `The plugin result envelope is ${envelopeBytes} bytes (${serializedBytes} total bytes) and exceeds the ${maxBytes}-byte delivery limit.` : `The plugin result is ${serializedBytes} bytes and exceeds the ${maxBytes}-byte delivery limit.`;
+    return resultBoundsFailure("plugin_result_too_large", message);
   }
   return result;
 }
-function failureResult(input) {
-  return enforcePluginResultByteBudget({
-    ok: false,
-    output: input.output ?? input.message,
-    producedNewInformation: false,
-    ...input.progress !== void 0 ? { progress: input.progress } : {},
-    ...input.actions !== void 0 ? { actions: input.actions } : {},
-    ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
-    ...input.stdout !== void 0 ? { stdout: input.stdout } : {},
-    ...input.stderr !== void 0 ? { stderr: input.stderr } : {},
-    ...input.data !== void 0 ? { data: input.data } : {},
-    error: input.message,
-    errorCode: input.errorCode
-  });
+function failureResult(input, resultBudget) {
+  return enforcePluginResultByteBudget(
+    {
+      ok: false,
+      ...input.interruption ? { interruption: input.interruption } : {},
+      ...input.media !== void 0 ? { media: input.media } : {},
+      output: input.output ?? input.message,
+      producedNewInformation: false,
+      ...input.progress !== void 0 ? { progress: input.progress } : {},
+      ...input.actions !== void 0 ? { actions: input.actions } : {},
+      ...input.exitCode !== void 0 ? { exitCode: input.exitCode } : {},
+      ...input.stdout !== void 0 ? { stdout: input.stdout } : {},
+      ...input.stderr !== void 0 ? { stderr: input.stderr } : {},
+      ...input.data !== void 0 ? { data: input.data } : {},
+      error: input.message,
+      errorCode: input.errorCode
+    },
+    resultBudget
+  );
 }
 function failureFromError(error, options) {
   const pathCode = runtimeToolPathErrorCode(error);
@@ -201,29 +247,23 @@ function failureFromError(error, options) {
   });
 }
 
-// plugins/exec/source/errors.ts
-var ExecPluginError = class extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "ExecPluginError";
-    this.code = code;
-  }
-};
-function execFailureFromError(error, operation) {
-  if (error instanceof ExecPluginError) {
-    return failureResult({
-      errorCode: error.code,
-      message: error.message,
-      output: `${operation} failed: ${error.message}`
-    });
-  }
-  return failureFromError(error, {
-    fallbackCode: `${operation}_failed`,
-    fallbackMessage: `${operation} failed without a safe diagnostic.`,
-    operation
-  });
+// src/plugin-sdk/context-text-result.ts
+function deliverPluginTextResult(result, fields, budget) {
+  const assessed = enforcePluginResultByteBudget(result, budget);
+  if (!canHandOffContextText(result, assessed, budget)) return assessed;
+  return enforcePluginResultByteBudget(
+    { ...result, contextTextFields: Object.freeze([...fields]) },
+    budget
+  );
 }
+function canHandOffContextText(original, assessed, budget) {
+  if (budget?.acceptsContextText !== true) return false;
+  if (assessed === original) return false;
+  return assessed.errorCode === "plugin_result_too_large";
+}
+
+// src/capabilities/tool-media.ts
+var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
 
 // plugins/exec/source/filesystem-observer.ts
 var import_node_crypto = require("node:crypto");
@@ -495,11 +535,532 @@ function diffExecFilesystemSnapshots(before, after) {
   });
 }
 
-// plugins/exec/source/paths.ts
+// plugins/exec/source/result-presentation.ts
+var EXEC_CONTEXT_TEXT_FIELDS = Object.freeze(["stdout", "stderr"]);
+function streamReceipt(snapshot, field) {
+  if (snapshot.text) return `See the ${field} field (${snapshot.text.length} characters).`;
+  return snapshot.sawOutput ? "(no new output; earlier output was already returned)" : "(empty)";
+}
+function renderedOutput(lines) {
+  const output = lines.join("\n");
+  return Object.freeze({
+    output,
+    metadata: Object.freeze({
+      truncated: false,
+      originalChars: output.length,
+      returnedChars: output.length,
+      omittedChars: 0
+    })
+  });
+}
+function outputBoundsData(snapshot, rendered) {
+  return Object.freeze({
+    maxChars: null,
+    stdout: snapshot.stdout.metadata,
+    stderr: snapshot.stderr.metadata,
+    rendered
+  });
+}
+function runningResult(snapshot, execution, resultBudget) {
+  const nextCursor = snapshot.nextCursor ?? 1;
+  const rendered = renderedOutput(
+    [
+      `Command: ${execution.commandPreview}`,
+      `CWD: ${execution.cwd.logicalPath}`,
+      "Process status: running",
+      `Process ID: ${snapshot.processId}`,
+      `Next cursor: ${nextCursor}`,
+      "STDOUT since the previous observation:",
+      streamReceipt(snapshot.stdout, "stdout"),
+      "STDERR since the previous observation:",
+      streamReceipt(snapshot.stderr, "stderr"),
+      "Continue this exact process with exec_wait; do not run the command again."
+    ]
+  );
+  return deliverPluginTextResult({
+    ok: false,
+    producedNewInformation: false,
+    errorCode: "exec_process_running",
+    error: "The command is still running. Continue it with exec_wait using the returned process ID and cursor.",
+    output: rendered.output,
+    stdout: snapshot.stdout.text,
+    stderr: snapshot.stderr.text,
+    data: {
+      processId: snapshot.processId,
+      processStatus: "running",
+      nextCursor,
+      outputBounds: outputBoundsData(snapshot, rendered.metadata),
+      observationMeta: {
+        kind: "volatile_external",
+        carryPolicy: "never"
+      }
+    }
+  }, EXEC_CONTEXT_TEXT_FIELDS, resultBudget);
+}
+async function captureFilesystemDelta(execution) {
+  if (!execution.filesystemStateBefore) return null;
+  try {
+    const after = await captureExecFilesystemSnapshot(
+      execution.cwd.absolutePath,
+      execution.cwd.logicalPath
+    );
+    return diffExecFilesystemSnapshots(execution.filesystemStateBefore, after);
+  } catch {
+    return null;
+  }
+}
+function projectExecFilesystemEvidence(delta, logicalRoot) {
+  const effects = delta.actions.map(renderExecFilesystemEffect);
+  const omittedEffectCount = Math.max(
+    0,
+    delta.changedEntryCount - effects.length
+  );
+  const omittedEffectLine = omittedEffectCount > 0 ? `- ${omittedEffectCount} additional changed ${omittedEffectCount === 1 ? "entry" : "entries"} omitted by the ${delta.observation.actionLimit}-effect projection limit.` : void 0;
+  const outputLines = Object.freeze([
+    `Filesystem changes observed: ${delta.changedEntryCount}${delta.observation.complete ? "" : " (bounded observation)"}`,
+    "Filesystem effects observed:",
+    ...effects,
+    ...omittedEffectLine ? [omittedEffectLine] : []
+  ]);
+  return Object.freeze({
+    outputLines,
+    mutationGrounding: [
+      "Observed post-command filesystem effects (settled tool evidence; not command intent, semantic verification, or complete artifact content):",
+      `- observation root: ${logicalRoot}`,
+      `- observation complete: ${delta.observation.complete}`,
+      `- changed entries: ${delta.changedEntryCount}`,
+      `- listed effects: ${effects.length}`,
+      `- effects truncated: ${delta.observation.actionsTruncated}`,
+      "Effects:",
+      ...effects,
+      ...omittedEffectLine ? [omittedEffectLine] : []
+    ].join("\n")
+  });
+}
+function renderExecFilesystemEffect(action) {
+  const target = action.target ? `: ${action.target}` : "";
+  const state = action.details === "exec_filesystem_created" ? "created" : action.details === "exec_filesystem_modified" ? "modified" : action.details === "exec_filesystem_removed" ? "removed" : void 0;
+  return `- ${action.type}${target}${state ? ` (${state})` : ""}`;
+}
+async function finalizeExecResult(params) {
+  const { snapshot, execution } = params;
+  const exitCode = snapshot.exitCode ?? -1;
+  const cancellationIsSuccess = params.cancellationIsSuccess === true && snapshot.terminationReason === "cancelled";
+  const filesystemDelta = await captureFilesystemDelta(execution);
+  const observedStateChange = filesystemDelta?.observedStateChange === true;
+  const filesystemEvidence = observedStateChange && filesystemDelta ? projectExecFilesystemEvidence(
+    filesystemDelta,
+    execution.cwd.logicalPath
+  ) : null;
+  const commandHasData = snapshot.stdout.sawOutput || snapshot.stderr.sawOutput;
+  const ok = exitCode === 0 || cancellationIsSuccess;
+  const inconclusiveSuccess = exitCode === 0 && !commandHasData && !observedStateChange;
+  const producedNewInformation = observedStateChange || cancellationIsSuccess || ok && commandHasData;
+  const actions = filesystemDelta?.actions ?? [];
+  const resultSummary = cancellationIsSuccess ? "Result summary: the running command was cancelled." : inconclusiveSuccess ? "Result summary: the command completed without observable output or filesystem change. Inspect a concrete target or use a dedicated creation capability." : "";
+  const rendered = renderedOutput(
+    [
+      `Command: ${execution.commandPreview}`,
+      `CWD: ${execution.cwd.logicalPath}`,
+      `Process ID: ${snapshot.processId}`,
+      `Process status: ${snapshot.terminationReason ?? "completed"}`,
+      `Exit code: ${exitCode}`,
+      ...filesystemEvidence ? filesystemEvidence.outputLines : [],
+      "STDOUT:",
+      streamReceipt(snapshot.stdout, "stdout"),
+      "STDERR:",
+      streamReceipt(snapshot.stderr, "stderr"),
+      ...resultSummary ? [resultSummary] : []
+    ]
+  );
+  const processStatus = snapshot.terminationReason ?? "completed";
+  const data = {
+    ...commandHasData ? { hasData: true } : {},
+    ...observedStateChange ? { mutationEvidence: true } : {},
+    ...filesystemEvidence ? { mutationGrounding: filesystemEvidence.mutationGrounding } : {},
+    processId: snapshot.processId,
+    processStatus,
+    outputBounds: outputBoundsData(snapshot, rendered.metadata),
+    ...filesystemDelta ? { filesystemObservation: filesystemDelta.observation } : { filesystemObservation: { available: false } },
+    observationMeta: {
+      kind: "volatile_external",
+      carryPolicy: "never"
+    }
+  };
+  const common = {
+    output: rendered.output,
+    progress: observedStateChange || cancellationIsSuccess,
+    producedNewInformation,
+    actions: [...actions],
+    exitCode,
+    stdout: snapshot.stdout.text,
+    stderr: snapshot.stderr.text,
+    data
+  };
+  if (ok && (!inconclusiveSuccess || cancellationIsSuccess)) {
+    return deliverPluginTextResult({ ok: true, ...common }, EXEC_CONTEXT_TEXT_FIELDS, params.resultBudget);
+  }
+  const errorCode = inconclusiveSuccess ? "no_observable_result" : snapshot.terminationReason === "aborted" ? "exec_aborted" : snapshot.terminationReason === "spawn_failed" ? "exec_spawn_failed" : snapshot.terminationReason === "idle_timeout" ? "exec_idle_timeout" : snapshot.terminationReason === "hard_timeout" ? "exec_hard_timeout" : "non_zero_exit";
+  const error = inconclusiveSuccess ? resultSummary : errorCode === "exec_aborted" ? "The exec request was aborted." : errorCode === "exec_spawn_failed" ? "The runtime could not start the configured non-interactive shell." : errorCode === "exec_idle_timeout" ? `The command produced no output for ${execution.idleTimeoutMs}ms.` : errorCode === "exec_hard_timeout" ? `The command exceeded the ${execution.hardTimeoutMs}ms hard timeout.` : `The command exited with code ${exitCode}.`;
+  return deliverPluginTextResult({
+    ok: false,
+    ...common,
+    error,
+    errorCode
+  }, EXEC_CONTEXT_TEXT_FIELDS, params.resultBudget);
+}
+
+// plugins/exec/source/retained-output-failure.ts
+function retainedOutputFailure(snapshot, context) {
+  const expired = hasUnavailableOutput(snapshot);
+  return failureResult(
+    {
+      errorCode: expired ? "exec_output_expired" : snapshot.outputFailure ? "exec_output_storage_failed" : "exec_output_delivery_pending",
+      message: expired ? "The retained output expired or is no longer available. The command was already started; it has not been run again." : snapshot.outputFailure ? "Output storage or delivery failed. The command was already started; do not run it again. Any committed bytes are retained for the configured retention period; complete output delivery is not confirmed." : "The output exceeds the delivery envelope and remains retained. The command was already executed; do not run it again.",
+      data: {
+        processId: snapshot.processId,
+        processStatus: snapshot.status,
+        nextCursor: snapshot.nextCursor,
+        ...snapshot.exitCode !== void 0 ? { exitCode: snapshot.exitCode } : {},
+        ...snapshot.terminationReason ? { terminationReason: snapshot.terminationReason } : {},
+        outputDelivery: expired ? "expired" : "pending",
+        ...snapshot.outputFailure ? { outputStorageFailure: snapshot.outputFailure } : {},
+        retainedCharacters: snapshot.stdout.text.length + snapshot.stderr.text.length
+      }
+    },
+    context?.resultBudget
+  );
+}
+function hasUnavailableOutput(snapshot) {
+  if (snapshot.outputFailure?.code === "exec_output_expired") return true;
+  return snapshot.outputFailure?.code === "exec_output_expired_or_unavailable";
+}
+
+// plugins/exec/source/errors.ts
+var ExecPluginError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ExecPluginError";
+    this.code = code;
+  }
+};
+function execFailureFromError(error, operation) {
+  if (error instanceof ExecPluginError) {
+    return failureResult({
+      errorCode: error.code,
+      message: error.message,
+      output: `${operation} failed: ${error.message}`
+    });
+  }
+  return failureFromError(error, {
+    fallbackCode: `${operation}_failed`,
+    fallbackMessage: `${operation} failed without a safe diagnostic.`,
+    operation
+  });
+}
+
+// plugins/exec/source/terminal-delivery.ts
+var import_node_crypto2 = require("node:crypto");
+var ExecTerminalDelivery = class {
+  claim;
+  accepted = false;
+  get isClaimed() {
+    return this.claim !== void 0;
+  }
+  assertAvailable() {
+    if (this.isClaimed) throw this.unavailable();
+  }
+  reserve(snapshot) {
+    if (snapshot.status !== "settled") return snapshot;
+    this.assertAvailable();
+    this.claim = (0, import_node_crypto2.randomUUID)();
+    return Object.freeze({ ...snapshot, deliveryId: this.claim });
+  }
+  assertOwner(snapshot) {
+    if (snapshot.status !== "settled") return;
+    if (!this.claim || snapshot.deliveryId !== this.claim || this.accepted)
+      throw this.unavailable();
+  }
+  accept(snapshot) {
+    if (snapshot.status !== "settled") return;
+    this.assertOwner(snapshot);
+    this.accepted = true;
+  }
+  reject(snapshot) {
+    if (this.accepted) return;
+    if (snapshot.deliveryId !== this.claim) return;
+    this.claim = void 0;
+  }
+  unavailable() {
+    return new ExecPluginError(
+      "unknown_exec_process",
+      "The terminal exec result is already claimed by another observation."
+    );
+  }
+};
+
+// plugins/exec/source/output-files.ts
+var import_node_crypto3 = require("node:crypto");
 var import_promises2 = require("node:fs/promises");
 var import_node_path2 = require("node:path");
+var ID = /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/;
+function outputStorageRoot(stateDir) {
+  if (!stateDir.trim()) throw outputFailure("state_dir_invalid");
+  return (0, import_node_path2.resolve)(stateDir, "output");
+}
+function outputOwnerDirectory(root, ownerId) {
+  if (!ownerId.trim()) throw outputFailure("owner_invalid");
+  return (0, import_node_path2.join)(root, (0, import_node_crypto3.createHash)("sha256").update(ownerId).digest("hex"));
+}
+function outputStreamPath(directory, id) {
+  assertOutputId(id);
+  return (0, import_node_path2.join)(directory, `${id}.bytes`);
+}
+function outputSnapshotPath(directory, id) {
+  assertOutputId(id);
+  return (0, import_node_path2.join)(directory, `${id}.snapshot.json`);
+}
+function assertOutputId(id) {
+  if (typeof id !== "string" || !ID.test(id)) throw outputFailure("id_invalid");
+}
+function outputFailure(code, cause) {
+  const error = new ExecPluginError(
+    `exec_output_${code}`,
+    `Exec output storage failed: ${code}.`
+  );
+  if (cause !== void 0)
+    Object.defineProperty(error, "cause", { value: cause });
+  return error;
+}
+async function writeOutputMetadata(path, value) {
+  const temporary = `${path}.${(0, import_node_crypto3.randomUUID)()}.tmp`;
+  try {
+    const file = await (0, import_promises2.open)(temporary, "wx", 384);
+    try {
+      await file.writeFile(JSON.stringify(value));
+      await file.sync();
+    } finally {
+      await file.close();
+    }
+    await (0, import_promises2.rename)(temporary, path);
+    const directory = await (0, import_promises2.open)((0, import_node_path2.dirname)(path), "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  } catch (error) {
+    await (0, import_promises2.rm)(temporary, { force: true }).catch(() => void 0);
+    throw outputFailure("metadata_write_failed", error);
+  }
+}
+async function prepareOutputOwnerDirectory(directory) {
+  try {
+    await (0, import_promises2.mkdir)(directory, { recursive: true, mode: 448 });
+  } catch (error) {
+    throw outputFailure("write_failed", error);
+  }
+}
+async function readOutputOwner(directory) {
+  let value;
+  try {
+    value = JSON.parse(await (0, import_promises2.readFile)((0, import_node_path2.join)(directory, "owner.json"), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw outputFailure("owner_read_failed", error);
+  }
+  if (!isOutputOwnerRecord(value)) throw outputFailure("owner_invalid");
+  return value;
+}
+function isOutputOwnerRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const owner = value;
+  if (owner.kind !== "exec_output_owner_v1") return false;
+  if (typeof owner.ownerId !== "string" || !owner.ownerId.trim()) return false;
+  return owner.completedAt === null || Number.isSafeInteger(owner.completedAt) && owner.completedAt >= 0;
+}
+async function lookupOutputSnapshot(directory, ownerId, id) {
+  let value;
+  try {
+    value = JSON.parse(
+      await (0, import_promises2.readFile)(outputSnapshotPath(directory, id), "utf8")
+    );
+  } catch (error) {
+    throw outputFailure("snapshot_unavailable", error);
+  }
+  if (!isStoredOutputSnapshot(value, ownerId, id))
+    throw outputFailure("snapshot_binding_invalid");
+  return value;
+}
+function isStoredOutputSnapshot(value, ownerId, id) {
+  if (!value || typeof value !== "object") return false;
+  const snapshot = value;
+  if (snapshot.kind !== "exec_output_snapshot_v1" || snapshot.ownerId !== ownerId)
+    return false;
+  if (typeof snapshot.streamId !== "string" || !ID.test(snapshot.streamId))
+    return false;
+  const body = snapshot.body;
+  if (!body || typeof body !== "object" || body.id !== id) return false;
+  return isExecOutputBody(body);
+}
+function isExecOutputBody(value) {
+  if (!value || typeof value !== "object") return false;
+  const body = value;
+  if (typeof body.id !== "string" || !ID.test(body.id)) return false;
+  if (body.stream !== "stdout" && body.stream !== "stderr") return false;
+  if (!Number.isSafeInteger(body.startByte) || body.startByte < 0) return false;
+  if (!Number.isSafeInteger(body.endByte) || body.endByte < body.startByte)
+    return false;
+  if (body.byteLength !== body.endByte - body.startByte) return false;
+  return typeof body.sha256 === "string" && /^sha256:[a-f0-9]{64}$/.test(body.sha256);
+}
+async function readOutputSnapshot(directory, ownerId, body) {
+  const snapshot = await lookupOutputSnapshot(directory, ownerId, body.id);
+  const stored = snapshot.body;
+  if (stored.stream !== body.stream || stored.startByte !== body.startByte || stored.endByte !== body.endByte || stored.byteLength !== body.byteLength || stored.sha256 !== body.sha256)
+    throw outputFailure("snapshot_binding_invalid");
+  return snapshot;
+}
+
+// plugins/exec/source/request-resources.ts
+var ExecRequestResources = class {
+  constructor(manager, pending, preparation) {
+    this.manager = manager;
+    this.pending = pending;
+    const state = preparation?.requestState;
+    if (!state) return;
+    const saved = state.read("exec.terminal.v1");
+    if (saved !== void 0) this.restore(saved);
+    state.register("exec.terminal.v1", {
+      snapshot: () => this.snapshot(),
+      dispose: () => this.dispose()
+    });
+  }
+  manager;
+  pending;
+  owned = /* @__PURE__ */ new Map();
+  restored = /* @__PURE__ */ new Map();
+  deliveries = /* @__PURE__ */ new Map();
+  started(processId, scope, settled, context) {
+    this.owned.set(processId, scope);
+    context?.requestWork?.trackUntil(settled);
+  }
+  forget(processId) {
+    this.owned.delete(processId);
+    this.restored.delete(processId);
+    this.deliveries.delete(processId);
+  }
+  isRestored(processId) {
+    return this.restored.has(processId);
+  }
+  terminal(processId, scope, cursor) {
+    const entry = this.restored.get(processId);
+    if (!entry) return void 0;
+    if (entry.scope !== scope)
+      throw new ExecPluginError(
+        "unknown_exec_process",
+        "The exec process belongs to a different session."
+      );
+    if (cursor !== void 0 && cursor !== entry.cursor)
+      throw new ExecPluginError(
+        "stale_exec_process_cursor",
+        "The saved exec cursor is stale."
+      );
+    return this.deliveries.get(processId).reserve({
+      ...structuredClone(entry.snapshot),
+      nextCursor: entry.cursor
+    });
+  }
+  rejectTerminal(snapshot) {
+    this.deliveries.get(snapshot.processId)?.reject(snapshot);
+  }
+  snapshot() {
+    for (const delivery of this.deliveries.values()) delivery.assertAvailable();
+    const executions = [...this.restored.values()];
+    for (const [processId, scope] of this.owned) {
+      const execution = this.pending.get(processId);
+      if (!execution) continue;
+      const terminal = this.manager.snapshotSettled(processId, scope);
+      const before = execution.filesystemStateBefore;
+      executions.push({
+        processId,
+        scope,
+        ...terminal,
+        execution: {
+          ...execution,
+          filesystemStateBefore: before ? { ...before, entries: [...before.entries] } : null
+        }
+      });
+    }
+    return { kind: "exec_terminal_state_v2", executions };
+  }
+  restore(value) {
+    if (!isRecord(value) || value.kind !== "exec_terminal_state_v1" && value.kind !== "exec_terminal_state_v2" || !Array.isArray(value.executions))
+      throw invalid();
+    for (const entry of value.executions) {
+      if (!isSavedExecution(entry) || this.restored.has(entry.processId))
+        throw invalid();
+      const before = entry.execution.filesystemStateBefore;
+      this.restored.set(entry.processId, structuredClone(entry));
+      this.deliveries.set(entry.processId, new ExecTerminalDelivery());
+      this.pending.set(entry.processId, {
+        ...structuredClone(entry.execution),
+        filesystemStateBefore: before ? { ...before, entries: new Map(before.entries) } : null
+      });
+    }
+  }
+  async dispose() {
+    for (const [processId, scope] of this.owned) {
+      try {
+        await this.manager.cancel({ processId, scope });
+      } catch {
+      }
+      try {
+        await this.manager.release(processId, scope);
+      } catch {
+      }
+      this.pending.delete(processId);
+    }
+    for (const id of this.restored.keys()) this.pending.delete(id);
+    this.owned.clear();
+    this.restored.clear();
+    this.deliveries.clear();
+  }
+};
+function isSavedExecution(value) {
+  if (!isRecord(value) || typeof value.processId !== "string" || typeof value.scope !== "string" || !Number.isSafeInteger(value.cursor) || value.cursor < 1 || !isRecord(value.snapshot) || value.snapshot.processId !== value.processId || value.snapshot.status !== "settled" || !isStream(value.snapshot.stdout, "stdout") || !isStream(value.snapshot.stderr, "stderr") || !Number.isFinite(value.snapshot.elapsedMs) || !isRecord(value.execution) || typeof value.execution.commandPreview !== "string" || !isRecord(value.execution.cwd) || typeof value.execution.cwd.absolutePath !== "string" || typeof value.execution.cwd.logicalPath !== "string")
+    return false;
+  if (![value.execution.hardTimeoutMs, value.execution.idleTimeoutMs].every(
+    Number.isFinite
+  ))
+    return false;
+  const before = value.execution.filesystemStateBefore;
+  return before === null || isRecord(before) && typeof before.absoluteRoot === "string" && typeof before.logicalRoot === "string" && typeof before.rootExists === "boolean" && typeof before.complete === "boolean" && Array.isArray(before.entries) && before.entries.every(
+    (entry) => Array.isArray(entry) && entry.length === 2 && typeof entry[0] === "string" && isRecord(entry[1]) && typeof entry[1].kind === "string" && [entry[1].mode, entry[1].size, entry[1].mtimeMs].every(
+      Number.isFinite
+    )
+  );
+}
+function isStream(value, stream) {
+  return isRecord(value) && typeof value.text === "string" && typeof value.sawOutput === "boolean" && (value.body === void 0 || isExecOutputBody(value.body) && value.body.stream === stream) && isRecord(value.metadata) && typeof value.metadata.truncated === "boolean" && [
+    value.metadata.originalChars,
+    value.metadata.returnedChars,
+    value.metadata.omittedChars
+  ].every(Number.isFinite);
+}
+function isRecord(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function invalid() {
+  return new Error("exec_terminal_snapshot_invalid");
+}
+
+// plugins/exec/source/paths.ts
+var import_promises3 = require("node:fs/promises");
+var import_node_path3 = require("node:path");
 function resolveContextualDirectory(pluginContext, executionContext, requestedPath) {
-  if ((0, import_node_path2.isAbsolute)(requestedPath)) return { absolutePath: requestedPath };
+  if ((0, import_node_path3.isAbsolute)(requestedPath)) return { absolutePath: requestedPath };
   const isWorkspaceAlias = requestedPath === "workspace" || requestedPath.startsWith("workspace/");
   const base = resolvePluginPath(
     {
@@ -509,73 +1070,688 @@ function resolveContextualDirectory(pluginContext, executionContext, requestedPa
     { allowedLocations: [isWorkspaceAlias ? "workspace" : "agent_work"] }
   );
   const relativePath = isWorkspaceAlias ? requestedPath.slice("workspace".length + 1) || "." : requestedPath;
-  return { absolutePath: `${base.absolutePath}${import_node_path2.sep}${relativePath}`, base };
+  return { absolutePath: `${base.absolutePath}${import_node_path3.sep}${relativePath}`, base };
 }
 function isOutsideExecContextBase(relativePath) {
   if (relativePath === "..") return true;
-  if (relativePath.startsWith(`..${import_node_path2.sep}`)) return true;
-  return (0, import_node_path2.isAbsolute)(relativePath);
+  if (relativePath.startsWith(`..${import_node_path3.sep}`)) return true;
+  return (0, import_node_path3.isAbsolute)(relativePath);
 }
 function logicalDirectory(absolutePath, base) {
   if (!base) return absolutePath;
-  const fromBase = (0, import_node_path2.relative)(base.absolutePath, absolutePath);
+  const fromBase = (0, import_node_path3.relative)(base.absolutePath, absolutePath);
   if (isOutsideExecContextBase(fromBase)) return absolutePath;
-  return import_node_path2.posix.join(base.logicalPath, fromBase.split(import_node_path2.sep).join("/") || ".");
+  return import_node_path3.posix.join(base.logicalPath, fromBase.split(import_node_path3.sep).join("/") || ".");
+}
+async function resolveExecWorkingDirectory(pluginContext, executionContext, rawPath) {
+  const requestedPath = readRequiredString(rawPath, {
+    name: "cwd",
+    trim: false,
+    maxLength: 4096
+  });
+  if (requestedPath.includes("\0")) {
+    throw new ExecPluginError(
+      "exec_cwd_invalid",
+      "The selected cwd contains NUL characters."
+    );
+  }
+  const target = resolveContextualDirectory(
+    pluginContext,
+    executionContext,
+    requestedPath
+  );
+  let absolutePath;
+  let info;
+  try {
+    absolutePath = await (0, import_promises3.realpath)(target.absolutePath);
+    info = await (0, import_promises3.stat)(absolutePath);
+  } catch (error) {
+    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+      throw new ExecPluginError(
+        "exec_cwd_not_found",
+        "The selected cwd does not exist. Select an existing directory."
+      );
+    }
+    throw new ExecPluginError(
+      "exec_cwd_inaccessible",
+      "The selected cwd cannot be accessed by the runtime."
+    );
+  }
+  if (!info.isDirectory()) {
+    throw new ExecPluginError(
+      "exec_cwd_not_directory",
+      "The selected cwd is not a directory."
+    );
+  }
+  return Object.freeze({
+    absolutePath,
+    logicalPath: logicalDirectory(absolutePath, target.base)
+  });
+}
+
+// plugins/exec/source/process-manager.ts
+var import_node_child_process = require("node:child_process");
+var import_node_crypto6 = require("node:crypto");
+var import_node_os = require("node:os");
+var import_node_path6 = require("node:path");
+
+// plugins/exec/source/process-output.ts
+function streamReceipt2(body) {
+  return {
+    text: "",
+    sawOutput: (body?.endByte ?? 0) > 0,
+    metadata: {
+      truncated: false,
+      originalChars: 0,
+      returnedChars: 0,
+      omittedChars: 0
+    },
+    ...body ? { body } : {}
+  };
+}
+async function createExecProcessOutput(store, ownerId) {
+  const stdout = await store.createWriter({ ownerId, stream: "stdout" });
+  let stderr;
+  try {
+    stderr = await store.createWriter({ ownerId, stream: "stderr" });
+  } catch (error) {
+    await stdout.dispose();
+    throw error;
+  }
+  const offsets = { stdout: 0, stderr: 0 };
+  let settled;
+  let failure;
+  let finished2 = false;
+  let tail = Promise.resolve();
+  const serialize = async (operation) => {
+    const previous = tail;
+    let release = () => {
+    };
+    tail = new Promise((resolve2) => {
+      release = resolve2;
+    });
+    await previous;
+    try {
+      return await operation();
+    } finally {
+      release();
+    }
+  };
+  const recordFailure = (error) => {
+    failure ??= error instanceof Error ? error.message : "exec_output_write_failed";
+  };
+  const capture = async () => {
+    try {
+      const out = await stdout.snapshot({
+        startByte: offsets.stdout,
+        endByte: finished2 ? stdout.byteLength : stdout.utf8ByteLength
+      });
+      const err = await stderr.snapshot({
+        startByte: offsets.stderr,
+        endByte: finished2 ? stderr.byteLength : stderr.utf8ByteLength
+      });
+      return {
+        stdout: streamReceipt2(out),
+        stderr: streamReceipt2(err),
+        ...failureReceipt()
+      };
+    } catch (error) {
+      recordFailure(error);
+      return {
+        stdout: streamReceipt2(),
+        stderr: streamReceipt2(),
+        ...failureReceipt()
+      };
+    }
+  };
+  const failureReceipt = () => failure ? {
+    outputFailure: {
+      code: failure,
+      stdoutBytes: stdout.byteLength,
+      stderrBytes: stderr.byteLength
+    }
+  } : {};
+  return Object.freeze({
+    attach(streams, onActivity, onFailure) {
+      for (const name of ["stdout", "stderr"]) {
+        const source = streams[name];
+        const writer = name === "stdout" ? stdout : stderr;
+        source.on("data", onActivity);
+        const failed = (error) => {
+          recordFailure(error);
+          source.pause();
+          onFailure();
+        };
+        writer.sink.on("error", failed);
+        source.on("error", failed);
+        source.pipe(writer.sink);
+      }
+    },
+    async finish() {
+      if (!stdout.sink.writableEnded) stdout.sink.end();
+      if (!stderr.sink.writableEnded) stderr.sink.end();
+      const outcomes = await Promise.allSettled([
+        stdout.completion,
+        stderr.completion
+      ]);
+      for (const outcome of outcomes)
+        if (outcome.status === "rejected") recordFailure(outcome.reason);
+      await serialize(async () => {
+        finished2 = true;
+        settled = await capture();
+      });
+    },
+    peek() {
+      return serialize(async () => settled ?? await capture());
+    },
+    checkpoint() {
+      if (!settled) throw new Error("exec_snapshot_not_quiescent");
+      return settled;
+    },
+    accept(snapshot) {
+      return serialize(async () => {
+        if (snapshot.outputFailure)
+          throw new Error("exec_output_not_delivered");
+        for (const name of ["stdout", "stderr"]) {
+          const body = snapshot[name].body;
+          const writer = name === "stdout" ? stdout : stderr;
+          if (!body || body.startByte !== offsets[name] || body.endByte > writer.byteLength)
+            throw new Error("exec_output_snapshot_mismatch");
+        }
+        offsets.stdout = snapshot.stdout.body.endByte;
+        offsets.stderr = snapshot.stderr.body.endByte;
+        if (finished2) settled = await capture();
+      });
+    },
+    async dispose() {
+      await Promise.all([stdout.dispose(), stderr.dispose()]);
+    }
+  });
+}
+
+// plugins/exec/source/output-store.ts
+var import_promises9 = require("node:fs/promises");
+var import_node_path5 = require("node:path");
+
+// plugins/exec/source/output-contracts.ts
+var DEFAULT_EXEC_OUTPUT_RETENTION_MS = 7 * 24 * 60 * 6e4;
+var EXEC_OUTPUT_IO_CHUNK_BYTES = 64 * 1024;
+
+// plugins/exec/source/output-range-reader.ts
+var import_node_crypto4 = require("node:crypto");
+var import_promises4 = require("node:fs/promises");
+function assertOutputRange(startByte, endByte, availableBytes) {
+  if (!Number.isSafeInteger(startByte) || startByte < 0)
+    throw outputFailure("range_invalid");
+  if (!Number.isSafeInteger(endByte) || endByte < startByte)
+    throw outputFailure("range_invalid");
+  if (endByte > availableBytes) throw outputFailure("range_invalid");
+}
+async function* readOutputFileRange(path, range) {
+  assertOutputRange(
+    range.offset,
+    range.offset + range.length,
+    Number.MAX_SAFE_INTEGER
+  );
+  if (!Number.isSafeInteger(range.maxChunkBytes) || range.maxChunkBytes < 1 || range.maxChunkBytes > EXEC_OUTPUT_IO_CHUNK_BYTES)
+    throw outputFailure("chunk_size_invalid");
+  range.signal?.throwIfAborted();
+  const handle = await (0, import_promises4.open)(path, "r").catch((error) => {
+    throw outputFailure("read_failed", error);
+  });
+  try {
+    const end = range.offset + range.length;
+    let position = range.offset;
+    while (position < end) {
+      range.signal?.throwIfAborted();
+      const buffer = Buffer.allocUnsafe(
+        Math.min(range.maxChunkBytes, end - position)
+      );
+      const { bytesRead } = await handle.read(
+        buffer,
+        0,
+        buffer.length,
+        position
+      );
+      if (bytesRead === 0) throw outputFailure("body_incomplete");
+      position += bytesRead;
+      yield buffer.subarray(0, bytesRead);
+    }
+    range.signal?.throwIfAborted();
+  } catch (error) {
+    if (range.signal?.aborted) throw error;
+    if (error instanceof ExecPluginError) throw error;
+    throw outputFailure("read_failed", error);
+  } finally {
+    await handle.close();
+  }
+}
+async function hashOutputRange(path, startByte, endByte, signal) {
+  const hash = (0, import_node_crypto4.createHash)("sha256");
+  for await (const chunk of readOutputFileRange(path, {
+    offset: startByte,
+    length: endByte - startByte,
+    maxChunkBytes: EXEC_OUTPUT_IO_CHUNK_BYTES,
+    ...signal ? { signal } : {}
+  }))
+    hash.update(chunk);
+  return `sha256:${hash.digest("hex")}`;
+}
+async function assertOutputBodyHash(path, body, signal) {
+  assertOutputRange(body.startByte, body.endByte, Number.MAX_SAFE_INTEGER);
+  if (body.byteLength !== body.endByte - body.startByte)
+    throw outputFailure("snapshot_binding_invalid");
+  if (await hashOutputRange(path, body.startByte, body.endByte, signal) !== body.sha256)
+    throw outputFailure("body_hash_mismatch");
+}
+
+// plugins/exec/source/output-maintenance.ts
+var import_promises5 = require("node:fs/promises");
+var MAX_CLEANUP_INTERVAL_MS = 60 * 6e4;
+var jobs = /* @__PURE__ */ new Map();
+function scheduleExecOutputCleanup(root, retentionMs, cleanup) {
+  const intervalMs = Math.max(
+    1,
+    Math.min(retentionMs, MAX_CLEANUP_INTERVAL_MS)
+  );
+  const previous = jobs.get(root);
+  if (previous) {
+    previous.cleanup = cleanup;
+    previous.intervalMs = intervalMs;
+    previous.requested = true;
+    return;
+  }
+  const job = { cleanup, intervalMs, requested: false };
+  jobs.set(root, job);
+  const sweep = async () => {
+    job.requested = false;
+    let empty = false;
+    try {
+      await job.cleanup();
+      empty = (await (0, import_promises5.readdir)(root).catch((error) => {
+        if (error.code === "ENOENT") return [];
+        throw error;
+      })).length === 0;
+    } catch {
+      process.emitWarning(
+        "EXEC output cleanup failed; a later sweep will retry.",
+        {
+          code: "EXEC_OUTPUT_CLEANUP_FAILED"
+        }
+      );
+    }
+    if (empty && !job.requested) {
+      jobs.delete(root);
+      return;
+    }
+    const timer = setTimeout(() => {
+      void sweep();
+    }, job.intervalMs);
+    timer.unref();
+  };
+  void sweep();
+}
+
+// plugins/exec/source/output-retention.ts
+var import_promises6 = require("node:fs/promises");
+var import_node_path4 = require("node:path");
+async function outputCaptureCompletedAt(directory, owner) {
+  if (owner?.completedAt !== null && owner?.completedAt !== void 0)
+    return owner.completedAt;
+  const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
+  const captures = entries.filter(
+    (entry) => entry.isFile() && entry.name.endsWith(".bytes")
+  );
+  if (!captures.length) return (await (0, import_promises6.stat)(directory)).mtimeMs;
+  const times = await Promise.all(
+    captures.map(
+      async (entry) => (await (0, import_promises6.stat)((0, import_node_path4.join)(directory, entry.name))).mtimeMs
+    )
+  );
+  return Math.max(...times);
+}
+async function hasOutputExpired(directory, owner, now, retentionMs) {
+  return now - await outputCaptureCompletedAt(directory, owner) >= retentionMs;
+}
+
+// plugins/exec/source/output-utf8-boundary.ts
+function incompleteUtf8TailBytes(tail) {
+  if (tail.length === 0) return 0;
+  let lead = tail.length - 1;
+  while (lead >= 0 && (tail[lead] & 192) === 128) lead -= 1;
+  if (lead < 0) return 0;
+  const byte = tail[lead];
+  let expected = 1;
+  if (byte >= 194 && byte <= 223) expected = 2;
+  if (byte >= 224 && byte <= 239) expected = 3;
+  if (byte >= 240 && byte <= 244) expected = 4;
+  const available = tail.length - lead;
+  return available < expected ? available : 0;
+}
+
+// plugins/exec/source/output-writer.ts
+var import_node_crypto5 = require("node:crypto");
+var import_promises7 = require("node:fs/promises");
+var import_node_stream = require("node:stream");
+var import_promises8 = require("node:stream/promises");
+var OutputFileSink = class extends import_node_stream.Writable {
+  constructor(file) {
+    super({ highWaterMark: EXEC_OUTPUT_IO_CHUNK_BYTES });
+    this.file = file;
+  }
+  file;
+  committedBytes = 0;
+  utf8ByteLength = 0;
+  tail = Buffer.alloc(0);
+  _write(chunk, _encoding, callback) {
+    this.writeChunk(chunk).then(
+      () => callback(),
+      (error) => callback(outputFailure("write_failed", error))
+    );
+  }
+  async writeChunk(chunk) {
+    let offset = 0;
+    while (offset < chunk.length) {
+      const length = Math.min(
+        EXEC_OUTPUT_IO_CHUNK_BYTES,
+        chunk.length - offset
+      );
+      const { bytesWritten } = await this.file.write(
+        chunk,
+        offset,
+        length,
+        this.committedBytes
+      );
+      if (bytesWritten === 0) throw outputFailure("write_zero_progress");
+      const written = chunk.subarray(offset, offset + bytesWritten);
+      this.tail = Buffer.concat([this.tail, written.subarray(-4)]).subarray(-4);
+      offset += bytesWritten;
+      this.committedBytes += bytesWritten;
+      this.utf8ByteLength = this.committedBytes - incompleteUtf8TailBytes(this.tail);
+    }
+  }
+  _final(callback) {
+    this.file.datasync().then(
+      () => callback(),
+      (error) => callback(outputFailure("write_failed", error))
+    );
+  }
+  _destroy(error, callback) {
+    this.file.close().then(
+      () => callback(error),
+      (cause) => callback(error ?? outputFailure("close_failed", cause))
+    );
+  }
+};
+async function createOutputWriter(params) {
+  const streamId = (0, import_node_crypto5.randomUUID)();
+  const path = outputStreamPath(params.directory, streamId);
+  const file = await (0, import_promises7.open)(path, "wx+", 384).catch((error) => {
+    throw outputFailure("write_failed", error);
+  });
+  const sink = new OutputFileSink(file);
+  const completion = (0, import_promises8.finished)(sink).finally(params.onClosed);
+  void completion.catch(() => void 0);
+  return Object.freeze({
+    sink,
+    get byteLength() {
+      return sink.committedBytes;
+    },
+    get utf8ByteLength() {
+      return sink.utf8ByteLength;
+    },
+    completion,
+    async snapshot(range = {
+      startByte: 0
+    }) {
+      if (sink.errored) throw sink.errored;
+      const startByte = range.startByte;
+      const endByte = range.endByte ?? sink.committedBytes;
+      assertOutputRange(startByte, endByte, sink.committedBytes);
+      const body = Object.freeze({
+        id: (0, import_node_crypto5.randomUUID)(),
+        stream: params.stream,
+        startByte,
+        endByte,
+        byteLength: endByte - startByte,
+        sha256: await hashOutputRange(path, startByte, endByte)
+      });
+      await writeOutputMetadata(outputSnapshotPath(params.directory, body.id), {
+        kind: "exec_output_snapshot_v1",
+        ownerId: params.ownerId,
+        streamId,
+        body
+      });
+      return body;
+    },
+    async dispose() {
+      if (!sink.destroyed) sink.destroy();
+      await completion.catch(() => void 0);
+    }
+  });
+}
+
+// plugins/exec/source/output-store.ts
+var activeWriters = /* @__PURE__ */ new Map();
+var activeReaders = /* @__PURE__ */ new Map();
+var ownerOperations = /* @__PURE__ */ new Map();
+async function withOutputOwnerLock(directory, operation) {
+  const previous = ownerOperations.get(directory) ?? Promise.resolve();
+  let release = () => {
+  };
+  const current = new Promise((resolve2) => {
+    release = resolve2;
+  });
+  ownerOperations.set(directory, current);
+  await previous;
+  try {
+    return await operation();
+  } finally {
+    release();
+    if (ownerOperations.get(directory) === current)
+      ownerOperations.delete(directory);
+  }
+}
+function createExecOutputStore(params) {
+  const root = outputStorageRoot(params.stateDir);
+  const retentionMs = params.retentionMs ?? DEFAULT_EXEC_OUTPUT_RETENTION_MS;
+  if (!Number.isSafeInteger(retentionMs) || retentionMs < 0)
+    throw outputFailure("retention_invalid");
+  const now = params.now ?? Date.now;
+  async function retain(directory, ownerId) {
+    await prepareOutputOwnerDirectory(directory);
+    const previous = await readOutputOwner(directory);
+    if (previous && previous.ownerId !== ownerId)
+      throw outputFailure("owner_binding_invalid");
+    if (previous?.completedAt === null) return;
+    await writeOutputMetadata((0, import_node_path5.join)(directory, "owner.json"), {
+      kind: "exec_output_owner_v1",
+      ownerId,
+      completedAt: null
+    });
+  }
+  const store = Object.freeze({
+    async createWriter(input) {
+      if (input.stream !== "stdout" && input.stream !== "stderr")
+        throw outputFailure("stream_invalid");
+      const directory = outputOwnerDirectory(root, input.ownerId);
+      return withOutputOwnerLock(directory, async () => {
+        await retain(directory, input.ownerId);
+        const writer = await createOutputWriter({
+          directory,
+          ownerId: input.ownerId,
+          stream: input.stream,
+          async onClosed() {
+            await withOutputOwnerLock(directory, async () => {
+              const count = (activeWriters.get(directory) ?? 1) - 1;
+              if (count > 0) activeWriters.set(directory, count);
+              if (count > 0) return;
+              activeWriters.delete(directory);
+              await writeOutputMetadata((0, import_node_path5.join)(directory, "owner.json"), {
+                kind: "exec_output_owner_v1",
+                ownerId: input.ownerId,
+                completedAt: now()
+              });
+            });
+          }
+        });
+        activeWriters.set(directory, (activeWriters.get(directory) ?? 0) + 1);
+        store.startMaintenance();
+        return writer;
+      });
+    },
+    async *readRange(input) {
+      const directory = outputOwnerDirectory(root, input.ownerId);
+      assertOutputRange(
+        input.offset,
+        input.offset + input.length,
+        input.body.byteLength
+      );
+      await withOutputOwnerLock(directory, async () => {
+        const owner = await readOutputOwner(directory);
+        if (!owner) throw outputFailure("expired_or_unavailable");
+        if (owner.ownerId !== input.ownerId)
+          throw outputFailure("owner_binding_invalid");
+        if (!activeWriters.has(directory) && await hasOutputExpired(directory, owner, now(), retentionMs))
+          throw outputFailure("expired");
+        activeReaders.set(directory, (activeReaders.get(directory) ?? 0) + 1);
+      });
+      try {
+        const snapshot = await readOutputSnapshot(
+          directory,
+          input.ownerId,
+          input.body
+        );
+        const path = outputStreamPath(directory, snapshot.streamId);
+        await assertOutputBodyHash(path, input.body, input.signal);
+        yield* readOutputFileRange(path, {
+          offset: input.body.startByte + input.offset,
+          length: input.length,
+          maxChunkBytes: input.maxChunkBytes,
+          ...input.signal ? { signal: input.signal } : {}
+        });
+      } finally {
+        const count = (activeReaders.get(directory) ?? 1) - 1;
+        if (count > 0) activeReaders.set(directory, count);
+        if (count === 0) activeReaders.delete(directory);
+      }
+    },
+    startMaintenance() {
+      scheduleExecOutputCleanup(
+        root,
+        retentionMs,
+        () => store.cleanupExpired()
+      );
+    },
+    async cleanupExpired() {
+      const directories = await (0, import_promises9.readdir)(root, { withFileTypes: true }).catch(
+        (error) => {
+          if (error.code === "ENOENT") return [];
+          throw outputFailure("cleanup_failed", error);
+        }
+      );
+      let removed = 0;
+      for (const entry of directories) {
+        if (!entry.isDirectory() || !/^[a-f0-9]{64}$/.test(entry.name))
+          continue;
+        const directory = (0, import_node_path5.join)(root, entry.name);
+        await withOutputOwnerLock(directory, async () => {
+          if (activeWriters.has(directory)) return;
+          if (activeReaders.has(directory)) return;
+          const owner = await readOutputOwner(directory);
+          if (owner && outputOwnerDirectory(root, owner.ownerId) !== directory)
+            throw outputFailure("owner_binding_invalid");
+          if (!await hasOutputExpired(directory, owner, now(), retentionMs))
+            return;
+          await (0, import_promises9.rm)(directory, { recursive: true });
+          removed += 1;
+        });
+      }
+      return removed;
+    }
+  });
+  return store;
+}
+
+// plugins/exec/source/output-snapshot.ts
+var import_node_string_decoder = require("node:string_decoder");
+
+// plugins/exec/source/process-output-buffer.ts
+var ExecOutputBuffer = class {
+  text = "";
+  sawOutput = false;
+  append(chunk) {
+    if (!chunk) return;
+    this.sawOutput = true;
+    this.text += sanitizeJsonText(chunk);
+  }
+  peek() {
+    const text = this.text;
+    return Object.freeze({
+      text,
+      sawOutput: this.sawOutput,
+      metadata: Object.freeze({
+        truncated: false,
+        originalChars: text.length,
+        returnedChars: text.length,
+        omittedChars: 0
+      })
+    });
+  }
+  accept(snapshot) {
+    if (!this.text.startsWith(snapshot.text)) {
+      throw new Error("exec_output_snapshot_mismatch");
+    }
+    this.text = this.text.slice(snapshot.text.length);
+  }
+  consume() {
+    const result = this.peek();
+    this.accept(result);
+    return result;
+  }
+};
+
+// plugins/exec/source/output-snapshot.ts
+function execOutputOwner(scope, processId) {
+  return JSON.stringify([scope, processId]);
 }
-async function resolveExecWorkingDirectory(pluginContext, executionContext, rawPath) {
-  const requestedPath = readRequiredString(rawPath, {
-    name: "cwd",
-    trim: false,
-    maxLength: 4096
-  });
-  if (requestedPath.includes("\0")) {
-    throw new ExecPluginError(
-      "exec_cwd_invalid",
-      "The selected cwd contains NUL characters."
-    );
+async function materializeExecOutput(store, scope, snapshot) {
+  if (snapshot.outputFailure) return snapshot;
+  const ownerId = execOutputOwner(scope, snapshot.processId);
+  async function read(stream) {
+    if (!stream.body) return stream;
+    const decoder = new import_node_string_decoder.StringDecoder("utf8");
+    const buffer = new ExecOutputBuffer();
+    for await (const chunk of store.readRange({
+      ownerId,
+      body: stream.body,
+      offset: 0,
+      length: stream.body.byteLength,
+      maxChunkBytes: EXEC_OUTPUT_IO_CHUNK_BYTES
+    }))
+      buffer.append(decoder.write(Buffer.from(chunk)));
+    buffer.append(decoder.end());
+    return { ...buffer.peek(), sawOutput: stream.sawOutput, body: stream.body };
   }
-  const target = resolveContextualDirectory(
-    pluginContext,
-    executionContext,
-    requestedPath
-  );
-  let absolutePath;
-  let info;
   try {
-    absolutePath = await (0, import_promises2.realpath)(target.absolutePath);
-    info = await (0, import_promises2.stat)(absolutePath);
+    const stdout = await read(snapshot.stdout);
+    const stderr = await read(snapshot.stderr);
+    return { ...snapshot, stdout, stderr };
   } catch (error) {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      throw new ExecPluginError(
-        "exec_cwd_not_found",
-        "The selected cwd does not exist. Select an existing directory."
-      );
-    }
-    throw new ExecPluginError(
-      "exec_cwd_inaccessible",
-      "The selected cwd cannot be accessed by the runtime."
-    );
-  }
-  if (!info.isDirectory()) {
-    throw new ExecPluginError(
-      "exec_cwd_not_directory",
-      "The selected cwd is not a directory."
-    );
+    return {
+      ...snapshot,
+      outputFailure: {
+        code: error instanceof ExecPluginError ? error.code : "exec_output_read_failed",
+        stdoutBytes: snapshot.stdout.body?.byteLength ?? 0,
+        stderrBytes: snapshot.stderr.body?.byteLength ?? 0
+      }
+    };
   }
-  return Object.freeze({
-    absolutePath,
-    logicalPath: logicalDirectory(absolutePath, target.base)
-  });
 }
 
-// plugins/exec/source/process-manager.ts
-var import_node_child_process = require("node:child_process");
-var import_node_crypto2 = require("node:crypto");
-var import_node_string_decoder = require("node:string_decoder");
-
 // plugins/exec/source/shell-platform.ts
 var import_node_fs2 = require("node:fs");
-var import_promises3 = require("node:fs/promises");
+var import_promises10 = require("node:fs/promises");
 var EXEC_SHELL = "/bin/bash";
 function isSupportedExecPlatform(platform) {
   return platform === "linux" || platform === "darwin";
@@ -588,7 +1764,7 @@ async function assertSupportedShell(platform = process.platform) {
     );
   }
   try {
-    await (0, import_promises3.access)(EXEC_SHELL, import_node_fs2.constants.X_OK);
+    await (0, import_promises10.access)(EXEC_SHELL, import_node_fs2.constants.X_OK);
   } catch {
     throw new ExecPluginError(
       "exec_shell_unavailable",
@@ -598,59 +1774,23 @@ async function assertSupportedShell(platform = process.platform) {
 }
 
 // plugins/exec/source/process-manager.ts
-var COMPLETED_PROCESS_RETENTION_MS = 5 * 6e4;
 var MAX_ACTIVE_PROCESSES_PER_SCOPE = 4;
-var CappedTextBuffer = class {
-  constructor(maxChars) {
-    this.maxChars = maxChars;
-  }
-  maxChars;
-  text = "";
-  originalChars = 0;
-  omittedChars = 0;
-  sawOutput = false;
-  append(chunk) {
-    if (!chunk) return;
-    const safeChunk = sanitizeJsonText(chunk);
-    this.sawOutput = true;
-    this.originalChars += safeChunk.length;
-    const available = Math.max(this.maxChars - this.text.length, 0);
-    this.text += safeChunk.slice(0, available);
-    this.omittedChars += Math.max(safeChunk.length - available, 0);
-  }
-  consume() {
-    const text = this.text;
-    const originalChars = this.originalChars;
-    const omittedChars = this.omittedChars;
-    this.text = "";
-    this.originalChars = 0;
-    this.omittedChars = 0;
-    return Object.freeze({
-      text,
-      sawOutput: this.sawOutput,
-      metadata: Object.freeze({
-        truncated: omittedChars > 0,
-        originalChars,
-        returnedChars: text.length,
-        omittedChars
-      })
-    });
-  }
-};
-function createExecProcessManager() {
+function createExecProcessManager(store = createExecOutputStore({
+  stateDir: (0, import_node_path6.join)((0, import_node_os.tmpdir)(), "abot-exec")
+})) {
   const processes = /* @__PURE__ */ new Map();
+  const opening = /* @__PURE__ */ new Map();
   const unknownProcess = () => new ExecPluginError(
     "unknown_exec_process",
     "The exec process is unknown to this plugin instance and session."
   );
   const dispose = (managed) => {
-    if (managed.retentionTimeout) clearTimeout(managed.retentionTimeout);
     processes.delete(managed.processId);
     managed.onDisposed?.(managed.processId);
   };
   const activeProcessCount = (scope) => [...processes.values()].filter(
     (managed) => managed.scope === scope && !managed.settled
-  ).length;
+  ).length + (opening.get(scope) ?? 0);
   const killProcessTree = (managed) => {
     const pid = managed.child.pid;
     if (typeof pid === "number") {
@@ -666,8 +1806,13 @@ function createExecProcessManager() {
     if (managed.settled || managed.terminationReason) return;
     managed.terminationReason = reason;
     killProcessTree(managed);
+    if (reason === "output_storage_failed") {
+      managed.child.stdout.destroy();
+      managed.child.stderr.destroy();
+    }
   };
   const scheduleIdleTimeout = (managed, idleTimeoutMs) => {
+    if (managed.settling || managed.settled) return;
     if (managed.idleTimeout) clearTimeout(managed.idleTimeout);
     managed.idleTimeout = setTimeout(
       () => requestTermination(managed, "idle_timeout"),
@@ -675,11 +1820,17 @@ function createExecProcessManager() {
     );
     managed.idleTimeout.unref?.();
   };
-  const settle = (managed, exitCode, fallbackReason) => {
-    if (managed.settled) return;
+  const settle = async (managed, exitCode, fallbackReason) => {
+    if (managed.settling || managed.settled) return;
+    managed.settling = true;
+    if (managed.hardTimeout) clearTimeout(managed.hardTimeout);
+    if (managed.idleTimeout) clearTimeout(managed.idleTimeout);
+    await managed.output.finish();
     managed.settled = true;
+    if (managed.output.checkpoint().outputFailure)
+      managed.terminationReason = "output_storage_failed";
     managed.terminationReason ??= fallbackReason;
-    managed.exitCode = managed.terminationReason === "hard_timeout" || managed.terminationReason === "idle_timeout" ? 124 : managed.terminationReason === "cancelled" || managed.terminationReason === "aborted" ? 130 : exitCode;
+    managed.exitCode = managed.terminationReason === "hard_timeout" || managed.terminationReason === "idle_timeout" ? 124 : managed.terminationReason === "cancelled" || managed.terminationReason === "aborted" ? 130 : managed.terminationReason === "output_storage_failed" ? -1 : exitCode;
     if (managed.hardTimeout) clearTimeout(managed.hardTimeout);
     if (managed.idleTimeout) clearTimeout(managed.idleTimeout);
     if (managed.abortSignal && managed.abortListener) {
@@ -690,35 +1841,43 @@ function createExecProcessManager() {
       dispose(managed);
       return;
     }
-    managed.retentionTimeout = setTimeout(
-      () => dispose(managed),
-      COMPLETED_PROCESS_RETENTION_MS
-    );
-    managed.retentionTimeout.unref?.();
   };
-  const consumeSnapshot = (managed) => {
-    if (managed.settled) {
-      if (managed.terminalSnapshotClaimed) throw unknownProcess();
-      managed.terminalSnapshotClaimed = true;
+  const peekSnapshot = async (managed) => {
+    managed.terminalDelivery.assertAvailable();
+    const status = managed.settled ? "settled" : "running";
+    const output = await managed.output.peek();
+    if (output.outputFailure && !managed.settled) {
+      requestTermination(managed, "output_storage_failed");
+      await managed.settlePromise;
+      return peekSnapshot(managed);
     }
-    return Object.freeze({
-      processId: managed.processId,
-      status: managed.settled ? "settled" : "running",
-      ...!managed.settled ? { nextCursor: managed.cursor } : {},
-      ...managed.exitCode === void 0 ? {} : { exitCode: managed.exitCode },
-      stdout: managed.stdout.consume(),
-      stderr: managed.stderr.consume(),
-      ...managed.terminationReason ? { terminationReason: managed.terminationReason } : {},
-      elapsedMs: Date.now() - managed.startedAt
-    });
+    const snapshot = await materializeExecOutput(
+      store,
+      managed.scope,
+      Object.freeze({
+        processId: managed.processId,
+        status,
+        nextCursor: managed.cursor,
+        ...managed.exitCode === void 0 ? {} : { exitCode: managed.exitCode },
+        ...output,
+        ...managed.terminationReason ? { terminationReason: managed.terminationReason } : {},
+        elapsedMs: Date.now() - managed.startedAt
+      })
+    );
+    if (snapshot.outputFailure && !managed.settled) {
+      requestTermination(managed, "output_storage_failed");
+      await managed.settlePromise;
+      return peekSnapshot(managed);
+    }
+    return managed.terminalDelivery.reserve(snapshot);
   };
   const waitForSettlement = async (managed, waitMs) => {
     if (managed.settled) return;
     let timeout;
     await Promise.race([
       managed.settlePromise,
-      new Promise((resolve) => {
-        timeout = setTimeout(resolve, waitMs);
+      new Promise((resolve2) => {
+        timeout = setTimeout(resolve2, waitMs);
         timeout.unref?.();
       })
     ]);
@@ -734,8 +1893,8 @@ function createExecProcessManager() {
   const withProcessTransition = async (managed, operation) => {
     const previous = managed.transitionTail;
     let releaseTransition = () => void 0;
-    managed.transitionTail = new Promise((resolve) => {
-      releaseTransition = resolve;
+    managed.transitionTail = new Promise((resolve2) => {
+      releaseTransition = resolve2;
     });
     await previous;
     try {
@@ -754,9 +1913,27 @@ function createExecProcessManager() {
           `The session already has ${MAX_ACTIVE_PROCESSES_PER_SCOPE} active exec processes.`
         );
       }
+      opening.set(params.scope, (opening.get(params.scope) ?? 0) + 1);
+      const processId = `exec_${(0, import_node_crypto6.randomUUID)()}`;
+      let output;
+      try {
+        await store.cleanupExpired();
+        output = await createExecProcessOutput(
+          store,
+          execOutputOwner(params.scope, processId)
+        );
+        if (params.abortSignal?.aborted) {
+          await output.dispose();
+          params.abortSignal.throwIfAborted();
+        }
+      } finally {
+        const count = opening.get(params.scope) - 1;
+        if (count) opening.set(params.scope, count);
+        else opening.delete(params.scope);
+      }
       let resolveSettled = () => void 0;
-      const settlePromise = new Promise((resolve) => {
-        resolveSettled = resolve;
+      const settlePromise = new Promise((resolve2) => {
+        resolveSettled = resolve2;
       });
       let child;
       try {
@@ -766,50 +1943,41 @@ function createExecProcessManager() {
           stdio: ["ignore", "pipe", "pipe"]
         });
       } catch {
+        await output.dispose();
         throw new ExecPluginError(
           "exec_spawn_failed",
           "The runtime could not start the configured non-interactive shell."
         );
       }
       const managed = {
-        processId: `exec_${(0, import_node_crypto2.randomUUID)()}`,
+        processId,
         scope: params.scope,
         child,
         startedAt: Date.now(),
         cursor: 1,
-        stdout: new CappedTextBuffer(params.outputMaxChars),
-        stderr: new CappedTextBuffer(params.outputMaxChars),
-        stdoutDecoder: new import_node_string_decoder.StringDecoder("utf8"),
-        stderrDecoder: new import_node_string_decoder.StringDecoder("utf8"),
+        output,
+        settling: false,
         settled: false,
         settlePromise,
         resolveSettled,
         transitionTail: Promise.resolve(),
-        terminalSnapshotClaimed: false,
+        terminalDelivery: new ExecTerminalDelivery(),
         waitInFlight: false,
         ...params.abortSignal ? { abortSignal: params.abortSignal } : {},
         ...params.onDisposed ? { onDisposed: params.onDisposed } : {}
       };
       processes.set(managed.processId, managed);
-      const observe = (stream, chunk) => {
-        if (managed.settled || !chunk) return;
-        if (stream === "stdout") managed.stdout.append(chunk);
-        else managed.stderr.append(chunk);
-        scheduleIdleTimeout(managed, params.idleTimeoutMs);
-      };
-      child.stdout.on(
-        "data",
-        (chunk) => observe("stdout", managed.stdoutDecoder.write(chunk))
-      );
-      child.stderr.on(
-        "data",
-        (chunk) => observe("stderr", managed.stderrDecoder.write(chunk))
+      params.onStarted?.(managed.processId, managed.settlePromise);
+      output.attach(
+        child,
+        () => scheduleIdleTimeout(managed, params.idleTimeoutMs),
+        () => requestTermination(managed, "output_storage_failed")
       );
-      child.on("error", () => settle(managed, -1, "spawn_failed"));
+      child.on("error", () => {
+        void settle(managed, -1, "spawn_failed");
+      });
       child.on("close", (code) => {
-        observe("stdout", managed.stdoutDecoder.end());
-        observe("stderr", managed.stderrDecoder.end());
-        settle(managed, typeof code === "number" ? code : -1, "completed");
+        void settle(managed, typeof code === "number" ? code : -1, "completed");
       });
       managed.hardTimeout = setTimeout(
         () => requestTermination(managed, "hard_timeout"),
@@ -831,12 +1999,12 @@ function createExecProcessManager() {
       } else {
         await waitForSettlement(managed, params.yieldAfterMs);
       }
-      return consumeSnapshot(managed);
+      return peekSnapshot(managed);
     },
     async wait(params) {
       const managed = getScopedProcess(params.processId, params.scope);
       await withProcessTransition(managed, () => {
-        if (managed.terminalSnapshotClaimed) throw unknownProcess();
+        managed.terminalDelivery.assertAvailable();
         if (managed.waitInFlight) {
           throw new ExecPluginError(
             "exec_wait_in_progress",
@@ -855,19 +2023,59 @@ function createExecProcessManager() {
       await waitForSettlement(managed, params.waitMs);
       return withProcessTransition(managed, () => {
         managed.waitInFlight = false;
-        if (managed.terminalSnapshotClaimed) throw unknownProcess();
-        return consumeSnapshot(managed);
+        managed.terminalDelivery.assertAvailable();
+        return peekSnapshot(managed);
       });
     },
     async cancel(params) {
       const managed = getScopedProcess(params.processId, params.scope);
       return withProcessTransition(managed, async () => {
-        if (managed.terminalSnapshotClaimed) throw unknownProcess();
+        managed.terminalDelivery.assertAvailable();
         if (!managed.settled) {
           requestTermination(managed, "cancelled");
           await managed.settlePromise;
         }
-        return consumeSnapshot(managed);
+        return peekSnapshot(managed);
+      });
+    },
+    snapshotSettled(processId, scope) {
+      const managed = getScopedProcess(processId, scope);
+      if (!managed.settled || managed.waitInFlight || managed.terminalDelivery.isClaimed)
+        throw new Error("exec_snapshot_not_quiescent");
+      return Object.freeze({
+        cursor: managed.cursor,
+        snapshot: Object.freeze({
+          processId,
+          status: "settled",
+          ...managed.exitCode === void 0 ? {} : { exitCode: managed.exitCode },
+          ...managed.output.checkpoint(),
+          ...managed.terminationReason ? { terminationReason: managed.terminationReason } : {},
+          elapsedMs: Date.now() - managed.startedAt
+        })
+      });
+    },
+    async accept(snapshot, scope) {
+      const wasReleasedAfterAbort = snapshot.terminationReason === "aborted" && !processes.has(snapshot.processId);
+      if (wasReleasedAfterAbort) return;
+      const managed = getScopedProcess(snapshot.processId, scope);
+      await withProcessTransition(managed, async () => {
+        managed.terminalDelivery.assertOwner(snapshot);
+        if (snapshot.nextCursor !== managed.cursor) {
+          throw new ExecPluginError(
+            "stale_exec_process_cursor",
+            "The output receipt no longer matches the current exec cursor."
+          );
+        }
+        await managed.output.accept(snapshot);
+        managed.terminalDelivery.accept(snapshot);
+      });
+    },
+    async reject(snapshot, scope) {
+      const managed = processes.get(snapshot.processId);
+      if (!managed) return;
+      if (managed.scope !== scope) throw unknownProcess();
+      await withProcessTransition(managed, () => {
+        managed.terminalDelivery.reject(snapshot);
       });
     },
     async release(processId, scope) {
@@ -887,11 +2095,15 @@ function createExecProcessManager() {
 var DEFAULT_EXEC_HARD_TIMEOUT_MS = 6e5;
 var DEFAULT_EXEC_YIELD_AFTER_MS = 15e3;
 var DEFAULT_EXEC_IDLE_TIMEOUT_MS = 12e4;
-var DEFAULT_EXEC_OUTPUT_MAX_CHARS = 8e3;
-var EXEC_OUTPUT_MAX_CHARS = 8e3;
-var EXEC_COMMAND_MAX_CHARS = 4096;
+var EXEC_COMMAND_MAX_CHARS = 8192;
 function readExecSettings(config) {
   return Object.freeze({
+    outputRetentionMs: readBoundedInteger(config?.outputRetentionMs, {
+      defaultValue: DEFAULT_EXEC_OUTPUT_RETENTION_MS,
+      minimum: 1,
+      maximum: Number.MAX_SAFE_INTEGER,
+      name: "outputRetentionMs"
+    }),
     hardTimeoutMs: readBoundedInteger(config?.timeoutMs, {
       defaultValue: DEFAULT_EXEC_HARD_TIMEOUT_MS,
       minimum: 1,
@@ -909,12 +2121,6 @@ function readExecSettings(config) {
       minimum: 1,
       maximum: 36e5,
       name: "idleTimeoutMs"
-    }),
-    outputMaxChars: readBoundedInteger(config?.outputMaxChars, {
-      defaultValue: DEFAULT_EXEC_OUTPUT_MAX_CHARS,
-      minimum: 64,
-      maximum: EXEC_OUTPUT_MAX_CHARS,
-      name: "outputMaxChars"
     })
   });
 }
@@ -947,12 +2153,12 @@ function isInvalidExecParameter(name, value) {
 function createExecAdapter() {
   return {
     validateCall(input) {
-      const invalid = ["command", "cwd"].filter(
+      const invalid2 = ["command", "cwd"].filter(
         (name) => isInvalidExecParameter(name, input.params[name])
       );
-      if (invalid.length === 0) return null;
+      if (invalid2.length === 0) return null;
       return {
-        error: `invalid params for exec: invalid ${invalid.join(", ")}`,
+        error: `invalid params for exec: invalid ${invalid2.join(", ")}`,
         repairHint: "Provide one command without NUL characters and one explicit existing cwd."
       };
     }
@@ -965,191 +2171,66 @@ function processScope(context) {
   const sessionId = context?.sharedState?.currentSessionId?.trim();
   return sessionId || "anonymous";
 }
-function streamDisplay(snapshot) {
-  if (snapshot.text) return snapshot.text;
-  return snapshot.sawOutput ? "(no new output; earlier output was already returned)" : "(empty)";
-}
-function renderedOutput(lines, outputMaxChars) {
-  const bounded = boundText(lines.join("\n"), {
-    maxChars: outputMaxChars,
-    marker: "\n[exec output truncated]"
-  });
-  return Object.freeze({ output: bounded.text, metadata: bounded.metadata });
-}
-function outputBoundsData(snapshot, rendered, maxChars) {
-  return Object.freeze({
-    maxChars,
-    stdout: snapshot.stdout.metadata,
-    stderr: snapshot.stderr.metadata,
-    rendered
-  });
-}
-function runningResult(snapshot, execution) {
-  const nextCursor = snapshot.nextCursor ?? 1;
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      `CWD: ${execution.cwd.logicalPath}`,
-      "Process status: running",
-      `Process ID: ${snapshot.processId}`,
-      `Next cursor: ${nextCursor}`,
-      "STDOUT since the previous observation:",
-      streamDisplay(snapshot.stdout),
-      "STDERR since the previous observation:",
-      streamDisplay(snapshot.stderr),
-      "Continue this exact process with exec_wait; do not run the command again."
-    ],
-    execution.outputMaxChars
-  );
-  return failureResult({
-    errorCode: "exec_process_running",
-    message: "The command is still running. Continue it with exec_wait using the returned process ID and cursor.",
-    output: rendered.output,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data: {
-      processId: snapshot.processId,
-      processStatus: "running",
-      nextCursor,
-      outputBounds: outputBoundsData(
-        snapshot,
-        rendered.metadata,
-        execution.outputMaxChars
-      ),
-      observationMeta: {
-        kind: "volatile_external",
-        carryPolicy: "never"
-      }
-    }
-  });
-}
-async function captureFilesystemDelta(execution) {
-  if (!execution.filesystemStateBefore) return null;
-  try {
-    const after = await captureExecFilesystemSnapshot(
-      execution.cwd.absolutePath,
-      execution.cwd.logicalPath
-    );
-    return diffExecFilesystemSnapshots(execution.filesystemStateBefore, after);
-  } catch {
-    return null;
-  }
-}
-function projectExecFilesystemEvidence(delta, logicalRoot) {
-  const effects = delta.actions.map(renderExecFilesystemEffect);
-  const omittedEffectCount = Math.max(
-    0,
-    delta.changedEntryCount - effects.length
-  );
-  const omittedEffectLine = omittedEffectCount > 0 ? `- ${omittedEffectCount} additional changed ${omittedEffectCount === 1 ? "entry" : "entries"} omitted by the ${delta.observation.actionLimit}-effect projection limit.` : void 0;
-  const outputLines = Object.freeze([
-    `Filesystem changes observed: ${delta.changedEntryCount}${delta.observation.complete ? "" : " (bounded observation)"}`,
-    "Filesystem effects observed:",
-    ...effects,
-    ...omittedEffectLine ? [omittedEffectLine] : []
-  ]);
-  return Object.freeze({
-    outputLines,
-    mutationGrounding: [
-      "Observed post-command filesystem effects (settled tool evidence; not command intent, semantic verification, or complete artifact content):",
-      `- observation root: ${logicalRoot}`,
-      `- observation complete: ${delta.observation.complete}`,
-      `- changed entries: ${delta.changedEntryCount}`,
-      `- listed effects: ${effects.length}`,
-      `- effects truncated: ${delta.observation.actionsTruncated}`,
-      "Effects:",
-      ...effects,
-      ...omittedEffectLine ? [omittedEffectLine] : []
-    ].join("\n")
-  });
-}
-function renderExecFilesystemEffect(action) {
-  const target = action.target ? `: ${action.target}` : "";
-  const state = action.details === "exec_filesystem_created" ? "created" : action.details === "exec_filesystem_modified" ? "modified" : action.details === "exec_filesystem_removed" ? "removed" : void 0;
-  return `- ${action.type}${target}${state ? ` (${state})` : ""}`;
-}
-async function finalizeExecResult(params) {
-  const { snapshot, execution } = params;
-  const exitCode = snapshot.exitCode ?? -1;
-  const cancellationIsSuccess = params.cancellationIsSuccess === true && snapshot.terminationReason === "cancelled";
-  const filesystemDelta = await captureFilesystemDelta(execution);
-  const observedStateChange = filesystemDelta?.observedStateChange === true;
-  const filesystemEvidence = observedStateChange && filesystemDelta ? projectExecFilesystemEvidence(
-    filesystemDelta,
-    execution.cwd.logicalPath
-  ) : null;
-  const commandHasData = snapshot.stdout.sawOutput || snapshot.stderr.sawOutput;
-  const ok = exitCode === 0 || cancellationIsSuccess;
-  const inconclusiveSuccess = exitCode === 0 && !commandHasData && !observedStateChange;
-  const producedNewInformation = observedStateChange || cancellationIsSuccess || ok && commandHasData;
-  const actions = filesystemDelta?.actions ?? [];
-  const resultSummary = cancellationIsSuccess ? "Result summary: the running command was cancelled." : inconclusiveSuccess ? "Result summary: the command completed without observable output or filesystem change. Inspect a concrete target or use a dedicated creation capability." : "";
-  const rendered = renderedOutput(
-    [
-      `Command: ${execution.commandPreview}`,
-      `CWD: ${execution.cwd.logicalPath}`,
-      `Process ID: ${snapshot.processId}`,
-      `Process status: ${snapshot.terminationReason ?? "completed"}`,
-      `Exit code: ${exitCode}`,
-      ...filesystemEvidence ? filesystemEvidence.outputLines : [],
-      "STDOUT:",
-      streamDisplay(snapshot.stdout),
-      "STDERR:",
-      streamDisplay(snapshot.stderr),
-      ...resultSummary ? [resultSummary] : []
-    ],
-    execution.outputMaxChars
-  );
-  const processStatus = snapshot.terminationReason ?? "completed";
-  const data = {
-    ...commandHasData ? { hasData: true } : {},
-    ...observedStateChange ? { mutationEvidence: true } : {},
-    ...filesystemEvidence ? { mutationGrounding: filesystemEvidence.mutationGrounding } : {},
-    processId: snapshot.processId,
-    processStatus,
-    outputBounds: outputBoundsData(
-      snapshot,
-      rendered.metadata,
-      execution.outputMaxChars
-    ),
-    ...filesystemDelta ? { filesystemObservation: filesystemDelta.observation } : { filesystemObservation: { available: false } },
-    observationMeta: {
-      kind: "volatile_external",
-      carryPolicy: "never"
-    }
-  };
-  const common = {
-    output: rendered.output,
-    progress: observedStateChange || cancellationIsSuccess,
-    producedNewInformation,
-    actions: [...actions],
-    exitCode,
-    stdout: snapshot.stdout.text,
-    stderr: snapshot.stderr.text,
-    data
-  };
-  if (ok && (!inconclusiveSuccess || cancellationIsSuccess)) {
-    return enforcePluginResultByteBudget({ ok: true, ...common });
-  }
-  const errorCode = inconclusiveSuccess ? "no_observable_result" : snapshot.terminationReason === "aborted" ? "exec_aborted" : snapshot.terminationReason === "spawn_failed" ? "exec_spawn_failed" : snapshot.terminationReason === "idle_timeout" ? "exec_idle_timeout" : snapshot.terminationReason === "hard_timeout" ? "exec_hard_timeout" : "non_zero_exit";
-  const error = inconclusiveSuccess ? resultSummary : errorCode === "exec_aborted" ? "The exec request was aborted." : errorCode === "exec_spawn_failed" ? "The runtime could not start the configured non-interactive shell." : errorCode === "exec_idle_timeout" ? `The command produced no output for ${execution.idleTimeoutMs}ms.` : errorCode === "exec_hard_timeout" ? `The command exceeded the ${execution.hardTimeoutMs}ms hard timeout.` : `The command exited with code ${exitCode}.`;
-  return enforcePluginResultByteBudget({
-    ok: false,
-    ...common,
-    error,
-    errorCode
+function createExecHandlers(pluginContext, settings, preparation) {
+  const outputStore = createExecOutputStore({
+    stateDir: pluginContext.stateDir,
+    retentionMs: settings.outputRetentionMs
   });
-}
-function createExecHandlers(pluginContext, settings) {
-  const processManager = createExecProcessManager();
+  outputStore.startMaintenance();
+  const processManager = createExecProcessManager(outputStore);
   const pendingExecutions = /* @__PURE__ */ new Map();
+  const requestResources = new ExecRequestResources(
+    processManager,
+    pendingExecutions,
+    preparation
+  );
   const finalizeAndRelease = async (params) => {
+    pendingExecutions.set(params.snapshot.processId, params.execution);
     try {
-      return await finalizeExecResult(params);
-    } finally {
+      if (params.snapshot.outputFailure) {
+        return retainedOutputFailure(params.snapshot, params.context);
+      }
+      const result = await finalizeExecResult({
+        ...params,
+        resultBudget: params.context?.resultBudget
+      });
+      if (result.errorCode === "plugin_result_too_large") {
+        return retainedOutputFailure(params.snapshot, params.context);
+      }
+      try {
+        if (!requestResources.isRestored(params.snapshot.processId)) {
+          await processManager.accept(params.snapshot, params.scope);
+        }
+      } catch (error) {
+        return retainedOutputFailure(
+          {
+            ...params.snapshot,
+            outputFailure: {
+              code: error instanceof Error ? error.message : "exec_output_acknowledgement_failed",
+              stdoutBytes: params.snapshot.stdout.body?.byteLength ?? 0,
+              stderrBytes: params.snapshot.stderr.body?.byteLength ?? 0
+            }
+          },
+          params.context
+        );
+      }
       pendingExecutions.delete(params.snapshot.processId);
+      requestResources.forget(params.snapshot.processId);
       await processManager.release(params.snapshot.processId, params.scope);
+      return result;
+    } finally {
+      requestResources.rejectTerminal(params.snapshot);
+      await processManager.reject(params.snapshot, params.scope);
+    }
+  };
+  const deliverRunning = async (snapshot, execution, scope, context) => {
+    if (snapshot.outputFailure) return retainedOutputFailure(snapshot, context);
+    const result = runningResult(snapshot, execution, context?.resultBudget);
+    if (result.errorCode === "plugin_result_too_large") {
+      return retainedOutputFailure(snapshot, context);
     }
+    await processManager.accept(snapshot, scope);
+    return result;
   };
   const exec = async (params, context) => {
     try {
@@ -1172,26 +2253,28 @@ function createExecHandlers(pluginContext, settings) {
         cwd,
         filesystemStateBefore,
         hardTimeoutMs: settings.hardTimeoutMs,
-        idleTimeoutMs: Math.min(settings.idleTimeoutMs, settings.hardTimeoutMs),
-        outputMaxChars: settings.outputMaxChars
+        idleTimeoutMs: Math.min(settings.idleTimeoutMs, settings.hardTimeoutMs)
       });
       const scope = processScope(context);
       const snapshot = await processManager.start({
         scope,
         shellCommand: command,
         cwd: cwd.absolutePath,
-        outputMaxChars: settings.outputMaxChars,
         yieldAfterMs: Math.min(settings.yieldAfterMs, settings.hardTimeoutMs),
         idleTimeoutMs: execution.idleTimeoutMs,
         hardTimeoutMs: execution.hardTimeoutMs,
         ...context?.abortSignal ? { abortSignal: context.abortSignal } : {},
-        onDisposed: (processId) => pendingExecutions.delete(processId)
+        onDisposed: (processId) => {
+          pendingExecutions.delete(processId);
+          requestResources.forget(processId);
+        },
+        onStarted: (processId, settled) => requestResources.started(processId, scope, settled, context)
       });
       if (snapshot.status === "running") {
         pendingExecutions.set(snapshot.processId, execution);
-        return runningResult(snapshot, execution);
+        return deliverRunning(snapshot, execution, scope, context);
       }
-      return finalizeAndRelease({ snapshot, execution, scope });
+      return finalizeAndRelease({ snapshot, execution, scope, context });
     } catch (error) {
       return execFailureFromError(error, "exec");
     }
@@ -1215,13 +2298,14 @@ function createExecHandlers(pluginContext, settings) {
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.wait({
+      const restored = requestResources.terminal(processId, scope, cursor);
+      const snapshot = restored ? await materializeExecOutput(outputStore, scope, restored) : await processManager.wait({
         processId,
         scope,
         cursor,
         waitMs: settings.yieldAfterMs
       });
-      return snapshot.status === "running" ? runningResult(snapshot, execution) : finalizeAndRelease({ snapshot, execution, scope });
+      return snapshot.status === "running" ? deliverRunning(snapshot, execution, scope, context) : finalizeAndRelease({ snapshot, execution, scope, context });
     } catch (error) {
       return execFailureFromError(error, "exec_wait");
     }
@@ -1240,12 +2324,14 @@ function createExecHandlers(pluginContext, settings) {
         );
       }
       const scope = processScope(context);
-      const snapshot = await processManager.cancel({ processId, scope });
+      const restored = requestResources.terminal(processId, scope);
+      const snapshot = restored ? await materializeExecOutput(outputStore, scope, restored) : await processManager.cancel({ processId, scope });
       return finalizeAndRelease({
         snapshot,
         execution,
         scope,
-        cancellationIsSuccess: true
+        cancellationIsSuccess: true,
+        context
       });
     } catch (error) {
       return execFailureFromError(error, "exec_cancel");
@@ -1257,6 +2343,18 @@ function createExecHandlers(pluginContext, settings) {
 // plugins/exec/source/index.ts
 var index_default = defineRuntimePlugin((context) => ({
   handlers: createExecHandlers(context, readExecSettings(context.config)),
+  prepareRequest: async (modules, preparation) => {
+    if (!preparation?.requestState) return modules;
+    const handlers = createExecHandlers(
+      context,
+      readExecSettings(context.config),
+      preparation
+    );
+    return modules.map((module2) => ({
+      ...module2,
+      implementation: handlers[module2.definition.name]
+    }));
+  },
   adapters: {
     exec: createExecAdapter()
   }