@abot-ai/runtime 1.5.0 → 1.7.0

package/dist/src/runtime/capabilities/request-permission-catalog.js

@@ -1,13 +1,22 @@
 import { permitsRequiredToolMode, } from "../../capabilities/tool-permission-mode.js";
+import { captureModelPluginConfig, } from "../config/model-plugin-config.js";
+import { matchesToolSelectionId } from "../../shared/tool-selection.js";
 /** One lazy registration snapshot; any declared restriction wins across projections. */
-export function captureRequestPermissionCatalog(registry, mode) {
+export function captureRequestPermissionCatalog(registry, mode, modelPlugins) {
+    const modelDeniedSelectors = captureModelPluginConfig(modelPlugins)?.deny ?? [];
     const definitions = Object.freeze([...registry.listDefinitions()]);
     const definitionByName = new Map(definitions.map((definition) => [definition.name, definition]));
     let registrations;
     let resolvedRegistrations = false;
     const registeredAllowedNames = new Set();
     const registeredDeniedNames = new Set();
-    const permitsDefinition = (definition) => permitsRequiredToolMode(mode, definition.requiredPermissionMode);
+    const registeredModelDeniedNames = new Set();
+    const isDefinitionBlockedForModel = (definition) => modelDeniedSelectors.some((selector) => matchesToolSelectionId(definition.pluginName ?? "", definition.name, selector));
+    const permitsDefinition = (definition) => {
+        if (isDefinitionBlockedForModel(definition))
+            return false;
+        return permitsRequiredToolMode(mode, definition.requiredPermissionMode);
+    };
     const permitsRegistration = (registration) => {
         const definition = definitionByName.get(registration.toolName);
         if (definition && !permitsDefinition(definition))
@@ -23,6 +32,8 @@ export function captureRequestPermissionCatalog(registry, mode) {
             return undefined;
         }
         for (const registration of source) {
+            if (isDefinitionBlockedForModel(registration.definition))
+                registeredModelDeniedNames.add(registration.toolName);
             const names = permitsRegistration(registration)
                 ? registeredAllowedNames
                 : registeredDeniedNames;
@@ -41,7 +52,15 @@ export function captureRequestPermissionCatalog(registry, mode) {
             return permitsDefinition(definition);
         return registeredAllowedNames.has(name);
     }
+    function isRequestToolBlockedForModel(name) {
+        resolveRegistrations();
+        if (registeredModelDeniedNames.has(name))
+            return true;
+        const definition = definitionByName.get(name);
+        return definition !== undefined && isDefinitionBlockedForModel(definition);
+    }
     return Object.freeze({
+        isRequestToolBlockedForModel,
         listDefinitions: () => definitions.filter(({ name }) => isRequestToolAvailable(name)),
         listNormalInvocations: resolveRegistrations,
         getDefinition: (name) => isRequestToolAvailable(name) ? definitionByName.get(name) : undefined,

package/dist/src/runtime/capabilities/request-permission-tool-registry.d.ts

@@ -1,4 +1,5 @@
 import { type ToolPermissionMode } from "../../capabilities/tool-permission-mode.js";
 import type { ToolRegistry } from "../ports.js";
+import type { RuntimeModelPluginConfig } from "../config/model-plugin-config.js";
 /** Captures user authority once; all discovery and execution use the same gate. */
-export declare function restrictToolRegistryToRequestMode(registry: ToolRegistry, mode: ToolPermissionMode): ToolRegistry;
+export declare function restrictToolRegistryToRequestMode(registry: ToolRegistry, mode: ToolPermissionMode, modelPlugins?: RuntimeModelPluginConfig): ToolRegistry;

package/dist/src/runtime/capabilities/request-permission-tool-registry.js

@@ -1,16 +1,24 @@
 import { captureRequestPermissionCatalog } from "./request-permission-catalog.js";
 /** Captures user authority once; all discovery and execution use the same gate. */
-export function restrictToolRegistryToRequestMode(registry, mode) {
-    const catalog = captureRequestPermissionCatalog(registry, mode);
+export function restrictToolRegistryToRequestMode(registry, mode, modelPlugins) {
+    const catalog = captureRequestPermissionCatalog(registry, mode, modelPlugins);
     const isRequestToolAvailable = catalog.isRequestToolAvailable;
-    const rejectUnavailableTool = (tool) => ({
-        ok: false,
-        tool,
-        output: "This tool is unavailable for the captured request permission mode.",
-        producedNewInformation: false,
-        error: "This tool is unavailable for the captured request permission mode.",
-        errorCode: "tool_permission_mode_required",
-    });
+    const rejectUnavailableTool = (tool) => {
+        const blockedForModel = catalog.isRequestToolBlockedForModel(tool);
+        const message = blockedForModel
+            ? "This tool is blocked for the selected request model profile."
+            : "This tool is unavailable for the captured request permission mode.";
+        return {
+            ok: false,
+            tool,
+            output: message,
+            producedNewInformation: false,
+            error: message,
+            errorCode: blockedForModel
+                ? "tool_model_policy_denied"
+                : "tool_permission_mode_required",
+        };
+    };
     const bindAuthority = (state) => ({
         ...state,
         requestContext: Object.freeze({

package/dist/src/runtime/capabilities/request-runtime-tool-registry.d.ts

@@ -1,5 +1,6 @@
 import type { ToolPermissionMode } from "../../capabilities/tool-permission-mode.js";
 import type { RuntimeConfig, ToolRegistry } from "../ports.js";
+import type { RuntimeModelPluginConfig } from "../config/model-plugin-config.js";
 import type { BoundRequestModelInvocationContext } from "../request/contracts.js";
 import type { ToolRequestAttachment } from "../../capabilities/tool-types.js";
 /**
@@ -10,6 +11,7 @@ import type { ToolRequestAttachment } from "../../capabilities/tool-types.js";
 export declare function createRequestRuntimeToolRegistry(params: Readonly<{
     request: BoundRequestModelInvocationContext;
     toolPermissionMode?: ToolPermissionMode;
+    modelPlugins?: RuntimeModelPluginConfig;
     requestAttachments?: readonly ToolRequestAttachment[];
     runtimeConfig?: RuntimeConfig;
     requestWorkingDirectory?: string;

package/dist/src/runtime/capabilities/request-runtime-tool-registry.js

@@ -9,7 +9,7 @@ import { bindRequestToolRegistry } from "./request-bound-tool-registry.js";
  */
 export function createRequestRuntimeToolRegistry(params) {
     const registry = restrictToolRegistryToRequestMode(params.toolRegistryOverride ??
-        createConfiguredToolRegistry(params.runtimeConfig, []), params.toolPermissionMode ?? "ask");
+        createConfiguredToolRegistry(params.runtimeConfig, []), params.toolPermissionMode ?? "ask", params.modelPlugins);
     return bindRequestToolRegistry({
         registry,
         modelInvoker: createRequestToolModelInvoker(params.request),

package/dist/src/runtime/capabilities/runtime-path-namespace.d.ts

@@ -0,0 +1,6 @@
+/** A relative component cannot normalize into a foreign drive namespace. */
+export declare function isRuntimePathNamespaceCompatible(value: string, platform?: NodeJS.Platform): boolean;
+/** Preserve a native Windows UNC root while normalizing scoped tool paths. */
+export declare function normalizeRuntimePathForScope(value: string, platform?: NodeJS.Platform): string;
+/** A different Windows drive or share produces an absolute relative result. */
+export declare function isRuntimePathWithinRoot(target: string, root: string, platform?: NodeJS.Platform): boolean;

package/dist/src/runtime/capabilities/runtime-path-namespace.js

@@ -0,0 +1,48 @@
+import { posix, win32 } from "node:path";
+function logicalSeparators(value) {
+    return value.replaceAll("\\", "/");
+}
+function hasDrivePrefix(value) {
+    return /^[A-Za-z]:/u.test(value);
+}
+function hasQualifiedDrive(value) {
+    return /^[A-Za-z]:\//u.test(value);
+}
+function hasQualifiedNetworkRoot(value) {
+    if (value.startsWith("//?/") || value.startsWith("//./"))
+        return false;
+    return /^\/\/[^/]+\/[^/]+(?:\/|$)/u.test(value);
+}
+function hasBackslashNetworkOrDeviceRoot(value) {
+    const prefix = value.slice(0, 2);
+    const networkRoot = /^[\\/]{2}$/u.test(prefix) && prefix.includes("\\");
+    return networkRoot || value.startsWith("\\??\\");
+}
+/** A relative component cannot normalize into a foreign drive namespace. */
+export function isRuntimePathNamespaceCompatible(value, platform = process.platform) {
+    const logical = logicalSeparators(value);
+    if (platform !== "win32" && hasBackslashNetworkOrDeviceRoot(value))
+        return false;
+    if (hasDrivePrefix(logical))
+        return platform === "win32" && hasQualifiedDrive(logical);
+    if (platform === "win32" && logical.startsWith("/"))
+        return hasQualifiedNetworkRoot(logical);
+    // Use the standard path grammar before checking a relative drive prefix.
+    return !hasDrivePrefix(posix.normalize(logical));
+}
+/** Preserve a native Windows UNC root while normalizing scoped tool paths. */
+export function normalizeRuntimePathForScope(value, platform = process.platform) {
+    if (platform === "win32" && win32.isAbsolute(value)) {
+        return logicalSeparators(win32.normalize(value));
+    }
+    return posix.normalize(logicalSeparators(value));
+}
+/** A different Windows drive or share produces an absolute relative result. */
+export function isRuntimePathWithinRoot(target, root, platform = process.platform) {
+    const paths = platform === "win32" ? win32 : posix;
+    const relative = paths.relative(root, target);
+    if (paths.isAbsolute(relative))
+        return false;
+    return (relative === "" ||
+        (relative !== ".." && !relative.startsWith(`..${paths.sep}`)));
+}

package/dist/src/runtime/capabilities/runtime-target-path.d.ts

@@ -2,6 +2,7 @@ import type { RuntimeToolPathErrorCode, RuntimeToolPathResolver, ToolExecutionSh
 export declare const RUNTIME_TOOL_PATH_ERROR_CODES: Readonly<{
     readonly REQUIRED: "runtime_tool_path_required";
     readonly NULL_BYTE: "runtime_tool_path_null_byte";
+    readonly NAMESPACE_INVALID: "runtime_tool_path_namespace_invalid";
     readonly LOCATION_REQUIRED: "runtime_tool_path_location_required";
     readonly ROOT_UNAVAILABLE: "runtime_tool_path_root_unavailable";
     readonly WORKSPACE_UNAVAILABLE: "runtime_tool_path_workspace_unavailable";

package/dist/src/runtime/capabilities/runtime-target-path.js

@@ -1,8 +1,10 @@
 import { lstatSync, realpathSync } from "node:fs";
 import { basename, dirname, isAbsolute, parse, posix, relative, resolve, sep, } from "node:path";
+import { isRuntimePathNamespaceCompatible, isRuntimePathWithinRoot, normalizeRuntimePathForScope, } from "./runtime-path-namespace.js";
 export const RUNTIME_TOOL_PATH_ERROR_CODES = Object.freeze({
     REQUIRED: "runtime_tool_path_required",
     NULL_BYTE: "runtime_tool_path_null_byte",
+    NAMESPACE_INVALID: "runtime_tool_path_namespace_invalid",
     LOCATION_REQUIRED: "runtime_tool_path_location_required",
     ROOT_UNAVAILABLE: "runtime_tool_path_root_unavailable",
     WORKSPACE_UNAVAILABLE: "runtime_tool_path_workspace_unavailable",
@@ -28,9 +30,10 @@ function configuredRoot(value) {
     const trimmed = value?.trim();
     return trimmed ? resolve(trimmed) : undefined;
 }
-function isWithinRoot(target, root) {
-    const rel = relative(root, target);
-    return rel === "" || (rel !== ".." && !rel.startsWith(`..${sep}`));
+function assertRuntimePathNamespace(value) {
+    if (!isRuntimePathNamespaceCompatible(value)) {
+        throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.NAMESPACE_INVALID);
+    }
 }
 /**
  * Qualifies one manifest-owned operation target against the canonical Worker
@@ -40,6 +43,7 @@ function isWithinRoot(target, root) {
  * physical directory. The returned value remains a logical tool target.
  */
 export function scopeRuntimeTargetPath(params) {
+    assertRuntimePathNamespace(params.rawPath.trim());
     const workingDirectory = params.workingDirectory?.trim();
     if (!workingDirectory) {
         return params.rawPath;
@@ -48,6 +52,7 @@ export function scopeRuntimeTargetPath(params) {
     if (!requested) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.REQUIRED, "runtime_target_path_missing");
     }
+    assertRuntimePathNamespace(workingDirectory);
     const normalizedTarget = normalizeLogicalPath(requested);
     const normalizedWorkingDirectory = normalizeLogicalPath(workingDirectory);
     if (hasTraversalSegment(normalizedTarget) ||
@@ -55,7 +60,7 @@ export function scopeRuntimeTargetPath(params) {
         isAbsolute(normalizedWorkingDirectory)) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.TRAVERSAL, "runtime_target_path_traversal");
     }
-    const normalized = posix.normalize(normalizedTarget);
+    const normalized = normalizeRuntimePathForScope(requested);
     const scoped = isAbsolute(normalized) ||
         normalized === "workspace" ||
         normalized.startsWith("workspace/") ||
@@ -67,7 +72,7 @@ export function scopeRuntimeTargetPath(params) {
     // then enforce the call-owned physical scope for explicit forms as well.
     const resolvedWorkingDirectory = resolveRuntimeTargetPath(normalizedWorkingDirectory, params.sharedState);
     const resolvedTarget = resolveRuntimeTargetPath(scoped, params.sharedState);
-    if (!isWithinRoot(resolvedTarget, resolvedWorkingDirectory)) {
+    if (!isRuntimePathWithinRoot(resolvedTarget, resolvedWorkingDirectory)) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.OUTSIDE_WORKING_DIRECTORY, "runtime_target_path_outside_working_directory");
     }
     return scoped;
@@ -169,6 +174,7 @@ function resolveRuntimeToolPath(rawPath, options) {
     if (requested.includes("\0")) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.NULL_BYTE);
     }
+    assertRuntimePathNamespace(requested);
     const allowed = Object.freeze([...(options.allowedLocations ?? DEFAULT_TOOL_PATH_LOCATIONS)].filter((location, index, values) => values.indexOf(location) === index));
     if (allowed.length === 0) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.LOCATION_REQUIRED);
@@ -188,6 +194,8 @@ function resolveRuntimeToolPath(rawPath, options) {
     let selected;
     let lexicalTarget;
     if (workspaceRelative !== undefined) {
+        // Validate the alias payload before root resolution can hide its namespace.
+        assertRuntimePathNamespace(requested.slice("workspace/".length));
         const workspace = availableRoots.find(({ location }) => location === "workspace");
         if (!workspace) {
             throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.WORKSPACE_UNAVAILABLE);
@@ -198,7 +206,7 @@ function resolveRuntimeToolPath(rawPath, options) {
     else if (isAbsolute(requested)) {
         lexicalTarget = resolve(requested);
         const rootedMatch = availableRoots
-            .filter(({ root }) => isWithinRoot(lexicalTarget, root))
+            .filter(({ root }) => isRuntimePathWithinRoot(lexicalTarget, root))
             .sort((left, right) => right.root.length - left.root.length)[0];
         if (rootedMatch) {
             selected = rootedMatch;
@@ -219,12 +227,12 @@ function resolveRuntimeToolPath(rawPath, options) {
         selected = rootedDefault;
         lexicalTarget = resolve(selected.root, normalized === "." ? "" : normalized);
     }
-    if (!isWithinRoot(lexicalTarget, selected.root)) {
+    if (!isRuntimePathWithinRoot(lexicalTarget, selected.root)) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.OUTSIDE_CONFIGURED_ROOTS);
     }
     const absolutePath = resolveThroughExistingAncestor(lexicalTarget);
     const canonicalRoot = resolveThroughExistingAncestor(selected.root);
-    if (!isWithinRoot(absolutePath, canonicalRoot)) {
+    if (!isRuntimePathWithinRoot(absolutePath, canonicalRoot)) {
         throwRuntimeToolPathError(RUNTIME_TOOL_PATH_ERROR_CODES.SYMLINK_ESCAPE);
     }
     const relativePath = relative(canonicalRoot, absolutePath).replaceAll(sep, "/");

package/dist/src/runtime/capabilities/scheduling/create-operations.d.ts

@@ -1,55 +1,67 @@
 export declare const scheduleCreateOperations: readonly [Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>, Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>, Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>, Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>, Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>, Readonly<{
     operationId: string;
     summary: string;
+    outputChannels?: import("../../../capabilities/tool-types.js").ToolNormalInvocationOutputChannels;
     input: import("../../../capabilities/tool-types.js").ToolNormalInvocationInput;
     selectionControlIds?: readonly string[];
     fixedParams?: Readonly<Record<string, import("../../../capabilities/tool-types.js").ToolNormalInvocationFixedValue>>;
     payload?: import("../../../capabilities/tool-types.js").ToolNormalInvocationPayload;
+    attachmentInput?: import("../../../capabilities/tool-types.js").ToolNormalInvocationAttachmentInput;
     effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
     approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
 }>];

package/dist/src/runtime/capabilities/scheduling/job-list-page.d.ts

@@ -5,6 +5,9 @@ export declare function createSchedulerJobPage(jobs: readonly SchedulerJob[], pa
     limit?: unknown;
 }): {
     jobs: {
+        target?: Readonly<{
+            kind: "request";
+        }>;
         id: string;
         environmentId: string;
         sessionId: string;
@@ -13,7 +16,7 @@ export declare function createSchedulerJobPage(jobs: readonly SchedulerJob[], pa
         agentMode: import("../../../shared/types.js").AgentMode;
         toolPermissionMode: import("../../scheduler/tool-permission-mode.js").SchedulerToolPermissionMode;
         timeZone: string;
-        schedule: import("../../scheduler/contracts.js").SchedulerSchedule;
+        schedule: import("../../scheduler/contracts.js").SchedulerTimedSchedule;
         state: import("../../scheduler/contracts.js").SchedulerJobState;
         createdAt: string;
         updatedAt: string;

package/dist/src/runtime/composition.d.ts

@@ -9,6 +9,7 @@ import type { SchedulerRun, SchedulerService } from "./scheduler/contracts.js";
 import { SessionRequestAdmission } from "./request/session-admission.js";
 import type { RequestSteeringAppendResult } from "./request/request-steering.js";
 import type { PassiveLearningService } from "./passive-learning/contracts.js";
+import type { AutomationService } from "./automations/service.js";
 export type RuntimeEnvironmentServices = Readonly<{
     config: RuntimeConfig;
     sessions: SessionStore;
@@ -20,12 +21,13 @@ export type RuntimeEnvironmentServices = Readonly<{
     sessionMemoryCompactor: SessionMemoryCompactor;
     longTermMemory: LongTermMemoryService;
     passiveLearning?: PassiveLearningService;
+    automations?: AutomationService;
     scheduler?: SchedulerService;
     startScheduler?: () => Promise<void>;
     stopScheduler?: () => Promise<void>;
     requestAdmission?: SessionRequestAdmission;
 }>;
-export type RuntimeRequestOptions = Pick<RequestHandlerOptions, "toolApprovalController" | "requestSteering" | "abortSignal" | "claimFinalization" | "durableApprovals" | "approvalExecution">;
+export type RuntimeRequestOptions = Pick<RequestHandlerOptions, "toolApprovalController" | "requestSteering" | "abortSignal" | "claimFinalization" | "durableApprovals" | "approvalExecution" | "effectPersistence">;
 export type RuntimeRequestHandler = Readonly<{
     cancel?: (requestId: string, sessionId: string, wait?: import("./request/cancellation.js").SavedWaitCancellation) => Promise<import("./request/cancellation.js").RequestCancellationResult>;
     steer?: (requestId: string, input: Readonly<{
@@ -53,12 +55,13 @@ export type RuntimeDependencies = {
     sessionMemoryCompactor: SessionMemoryCompactor;
     longTermMemory: LongTermMemoryService;
     passiveLearning?: PassiveLearningService;
+    automations?: AutomationService;
     scheduler?: SchedulerService;
     startScheduler?: () => Promise<void>;
     stopScheduler?: () => Promise<void>;
     requestAdmission?: SessionRequestAdmission;
 };
-export type RuntimeDependencyOverrides = Partial<Omit<RuntimeDependencies, "config" | "scheduler" | "startScheduler" | "stopScheduler" | "requestAdmission">>;
+export type RuntimeDependencyOverrides = Partial<Omit<RuntimeDependencies, "config" | "scheduler" | "automations" | "startScheduler" | "stopScheduler" | "requestAdmission">>;
 export type RuntimeApplicationOverrides = RuntimeDependencyOverrides & {
     scheduledRequestOptions?: (run: SchedulerRun) => RuntimeRequestOptions;
 };

package/dist/src/runtime/config/builders.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { DEFAULT_RUNTIME_LOGGING_ENABLED, DEFAULT_RUNTIME_LOG_ROTATION_CONFIG, } from "./constants.js";
-import { isRequestExecutionPolicyId } from "./model-execution-policy.js";
+import { buildRuntimeModelExecutionPolicy } from "./model-execution-policy.js";
 import { RuntimeConfigValidationError, validateModelProfileConfig, } from "./validation.js";
 import { readConfigPositiveInt, isRecord, readNestedConfigString, readNestedConfigStringArray, readOptionalBoolean, readOptionalStringMap, } from "./utils.js";
 export function compactTimeouts(timeouts) {
@@ -56,7 +56,9 @@ export function buildPluginConfig(config) {
     const enabled = readOptionalBoolean(config.plugins, "enabled");
     const allow = readNestedConfigStringArray(config.plugins, "allow");
     const deny = readNestedConfigStringArray(config.plugins, "deny");
+    const disabledPluginIds = readNestedConfigStringArray(config.plugins, "disabledPluginIds");
     const pluginConfig = {
+        ...(disabledPluginIds ? { disabledPluginIds } : {}),
         ...(enabled !== undefined ? { enabled } : {}),
         ...(allow ? { allow } : {}),
         ...(deny ? { deny } : {}),
@@ -432,10 +434,9 @@ function buildModelProfiles(profiles, options) {
         if (modelProfile) {
             gatewayEntries.push([profileId, modelProfile]);
         }
-        const execution = isRecord(source.execution) ? source.execution : undefined;
-        if (execution && isRequestExecutionPolicyId(execution.policy)) {
-            executionEntries.push([profileId, { policy: execution.policy }]);
-        }
+        const execution = buildRuntimeModelExecutionPolicy(source);
+        if (execution)
+            executionEntries.push([profileId, execution]);
     }
     return {
         ...(gatewayEntries.length > 0

package/dist/src/runtime/config/effective-model-config-validation.js

@@ -1,3 +1,4 @@
+import { validateProfileContextCapacity, } from "./model-context-capacity.js";
 import { RuntimeConfigValidationError } from "./validation.js";
 function hasConfiguredProfile(profiles, profileId) {
     return !!profileId && Object.hasOwn(profiles, profileId);
@@ -8,40 +9,6 @@ function hasConfiguredInvocationProfile(invocationProfiles, profileId) {
 function hasConfiguredCalibrationSlot(profiles, slotId) {
     return Object.values(profiles).some((profile) => Object.hasOwn(profile.calibration ?? {}, slotId));
 }
-function readPositiveSafeInteger(value) {
-    return typeof value === "number" &&
-        Number.isSafeInteger(value) &&
-        value > 0
-        ? value
-        : undefined;
-}
-function validateProfileContextCapacity(params) {
-    const field = `models.profiles.${params.profileId}.contextWindowTokens`;
-    const declared = readPositiveSafeInteger(params.profile.contextWindowTokens);
-    if (declared === undefined) {
-        params.issues.push(`${field} must declare the physical context-window capacity as a positive safe integer`);
-        return;
-    }
-    let effective = declared;
-    if (params.providerType === "ollama" &&
-        Object.hasOwn(params.profile.options ?? {}, "num_ctx")) {
-        const allocated = readPositiveSafeInteger(params.profile.options?.num_ctx);
-        if (allocated === undefined) {
-            params.issues.push(`models.profiles.${params.profileId}.options.num_ctx must be a positive safe integer when configured`);
-            return;
-        }
-        effective = Math.min(effective, allocated);
-    }
-    const profileFormatReserve = params.profile.context?.formatTokenAccounting?.fixedOverheadTokens ?? 0;
-    const defaultFormatReserve = params.defaultContext?.formatTokenAccounting?.fixedOverheadTokens ?? 0;
-    const configuredReserve = params.runnerConfig.context.outputReserveTokens +
-        params.runnerConfig.context.safetyReserveTokens +
-        params.runnerConfig.context.attachmentReserveTokens +
-        Math.max(profileFormatReserve, defaultFormatReserve);
-    if (configuredReserve >= effective) {
-        params.issues.push(`models.profiles.${params.profileId} effective context window ${effective} must exceed configured output, safety, attachment, and format reserves ${configuredReserve}`);
-    }
-}
 function validateProfileReference(params) {
     if (!hasConfiguredProfile(params.profiles, params.profileId)) {
         params.issues.push(`${params.field} references unknown model profile ${params.profileId}`);
@@ -73,6 +40,7 @@ function validateStepTarget(params) {
  */
 export function validateEffectiveRuntimeModelConfig(params) {
     const issues = [];
+    const capacityIssues = [];
     const providers = params.modelPolicy?.providers ?? {};
     const profiles = params.modelPolicy?.profiles ?? {};
     const invocationProfiles = params.modelPolicy?.invocationProfiles ?? {};
@@ -92,6 +60,7 @@ export function validateEffectiveRuntimeModelConfig(params) {
         }
         validateProfileContextCapacity({
             issues,
+            capacityIssues,
             profileId,
             profile,
             ...(providerId && providers[providerId]
@@ -169,6 +138,6 @@ export function validateEffectiveRuntimeModelConfig(params) {
         });
     }
     if (issues.length > 0) {
-        throw new RuntimeConfigValidationError(params.configPath, issues);
+        throw new RuntimeConfigValidationError(params.configPath, issues, capacityIssues);
     }
 }

package/dist/src/runtime/config/fields.js

@@ -137,6 +137,10 @@ export const RUNTIME_CONFIG_SCHEMA_FIELDS = [
         env: [field.env],
         description: field.description,
     })),
+    {
+        path: "webUi.pageSize", type: "positive-number", defaultValue: "20",
+        description: "Sessions and messages per Web UI history page, including SPARK.",
+    },
     {
         path: "webUi.openOnRuntimeServiceStart",
         type: "boolean",
@@ -185,6 +189,12 @@ export const RUNTIME_CONFIG_SCHEMA_FIELDS = [
         defaultValue: "[]",
         description: "Installed plugin or capability ids denied after applying the allow-list.",
     },
+    {
+        path: "plugins.disabledPluginIds",
+        type: "string-array",
+        defaultValue: "[]",
+        description: "Exact plugin ids disabled independently of tool selectors. Entries are literal ids, not wildcards.",
+    },
     {
         path: "models.providers",
         type: "object-map",
@@ -210,6 +220,11 @@ export const RUNTIME_CONFIG_SCHEMA_FIELDS = [
         type: "object-map",
         description: "Per-model calibration slots keyed by semantic slot id. Runtime step config maps modelStep names to these slot ids. Slots may tune timeout, generation, context, format, and short model-specific instructions.",
     },
+    {
+        path: "models.profiles.<profileId>.plugins.deny",
+        type: "string-array",
+        description: "Additional denied plugin or capability selectors for requests selected by this model profile, including configRef profiles. Global plugin restrictions still apply.",
+    },
     {
         path: "models.profiles.<profileId>.execution.policy",
         type: "non-empty-string",

package/dist/src/runtime/config/model-context-capacity.d.ts

@@ -0,0 +1,20 @@
+import type { ModelContextConfig, ModelGatewayPolicyConfig } from "../../model-gateway/types.js";
+import type { RequestRunnerConfig } from "./runner/contracts.js";
+export type ModelContextCapacityIssue = Readonly<{
+    profileId: string;
+    declaredTokens: number;
+    effectiveTokens: number;
+    reservedTokens: number;
+    minimumTokens: number;
+    allocationTokens?: number;
+}>;
+/** Keeps the admission invariant and its diagnostic evidence in one owner. */
+export declare function validateProfileContextCapacity(params: {
+    issues: string[];
+    capacityIssues: ModelContextCapacityIssue[];
+    profileId: string;
+    profile: NonNullable<ModelGatewayPolicyConfig["profiles"]>[string];
+    providerType?: string;
+    runnerConfig: RequestRunnerConfig;
+    defaultContext?: ModelContextConfig;
+}): void;

package/dist/src/runtime/config/model-context-capacity.js

@@ -0,0 +1,55 @@
+function readPositiveContextCapacity(value) {
+    if (typeof value !== "number")
+        return undefined;
+    if (!Number.isSafeInteger(value))
+        return undefined;
+    if (value <= 0)
+        return undefined;
+    return value;
+}
+function hasConfiguredOllamaContextAllocation(providerType, profile) {
+    if (providerType !== "ollama")
+        return false;
+    return Object.hasOwn(profile.options ?? {}, "num_ctx");
+}
+function hasInsufficientModelContextCapacity(effectiveTokens, reservedTokens) {
+    return reservedTokens >= effectiveTokens;
+}
+/** Keeps the admission invariant and its diagnostic evidence in one owner. */
+export function validateProfileContextCapacity(params) {
+    const field = `models.profiles.${params.profileId}.contextWindowTokens`;
+    const declaredTokens = readPositiveContextCapacity(params.profile.contextWindowTokens);
+    if (declaredTokens === undefined) {
+        params.issues.push(`${field} must declare the physical context-window capacity as a positive safe integer`);
+        return;
+    }
+    const hasAllocation = hasConfiguredOllamaContextAllocation(params.providerType, params.profile);
+    const allocationTokens = hasAllocation
+        ? readPositiveContextCapacity(params.profile.options?.num_ctx)
+        : undefined;
+    const hasInvalidOllamaAllocation = hasAllocation && allocationTokens === undefined;
+    if (hasInvalidOllamaAllocation) {
+        params.issues.push(`models.profiles.${params.profileId}.options.num_ctx must be a positive safe integer when configured`);
+        return;
+    }
+    const effectiveTokens = allocationTokens === undefined
+        ? declaredTokens
+        : Math.min(declaredTokens, allocationTokens);
+    const profileFormatReserve = params.profile.context?.formatTokenAccounting?.fixedOverheadTokens ?? 0;
+    const defaultFormatReserve = params.defaultContext?.formatTokenAccounting?.fixedOverheadTokens ?? 0;
+    const reservedTokens = params.runnerConfig.context.outputReserveTokens +
+        params.runnerConfig.context.safetyReserveTokens +
+        params.runnerConfig.context.attachmentReserveTokens +
+        Math.max(profileFormatReserve, defaultFormatReserve);
+    if (!hasInsufficientModelContextCapacity(effectiveTokens, reservedTokens))
+        return;
+    params.issues.push(`models.profiles.${params.profileId} effective context window ${effectiveTokens} must exceed configured output, safety, attachment, and format reserves ${reservedTokens}`);
+    params.capacityIssues.push({
+        profileId: params.profileId,
+        declaredTokens,
+        effectiveTokens,
+        reservedTokens,
+        minimumTokens: reservedTokens + 1,
+        ...(allocationTokens === undefined ? {} : { allocationTokens }),
+    });
+}