@abot-ai/runtime 1.6.0 → 1.7.0

package/dist/src/runtime/plugins/installation/package.js

@@ -0,0 +1,79 @@
+import { mkdtemp, readFile, readdir, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { PluginInstallError, } from "../../../plugin-contract/install-source.js";
+import { ABOT_RUNTIME_EXTENSION } from "../../../plugin-contract/manifest.js";
+import { parseAgentPluginManifest } from "../manifest-validator.js";
+import { projectManifestRuntimeContract } from "../manifest-projection.js";
+import { discoverConfiguredRuntimePluginManifests } from "../configured-manifests.js";
+import { extractPluginArchive } from "./archive.js";
+import { isPortablePluginPathComponent } from "./portable-path.js";
+import { downloadGitHubPlugin, } from "./github-download.js";
+async function requireAvailableInstallMetadataPath(staging) {
+    const names = await readdir(staging);
+    if (names.some((name) => name.toLowerCase() === ".abot-install.json"))
+        throw new PluginInstallError("plugin_package_invalid", "The selected plugin contains the reserved .abot-install.json path.");
+}
+export async function preparePluginPackage(rootDir, source, download = downloadGitHubPlugin) {
+    const downloaded = await download(source);
+    if (!/^[a-f0-9]{40}$/u.test(downloaded.source.ref))
+        throw new PluginInstallError("plugin_revision_invalid", "The source must resolve to an exact commit.");
+    const staging = await mkdtemp(join(rootDir, ".abot-plugin-install-"));
+    try {
+        const digest = await extractPluginArchive(downloaded.archive, staging, downloaded.source.path);
+        await requireAvailableInstallMetadataPath(staging);
+        const raw = JSON.parse(await readFile(join(staging, "plugin.json"), "utf8"));
+        const manifest = parseAgentPluginManifest(raw, typeof raw.name === "string" ? raw.name : "");
+        if (!isPortablePluginPathComponent(manifest.name))
+            throw new PluginInstallError("plugin_package_invalid", "The plugin ID cannot be used as a portable installation folder name.");
+        const extension = manifest.extensions[ABOT_RUNTIME_EXTENSION];
+        if (!extension.entrypoint.endsWith(".cjs"))
+            throw new PluginInstallError("plugin_package_not_built", "This plugin must include a ready-to-run CommonJS .cjs entrypoint.");
+        const capabilities = Object.keys(extension.capabilities);
+        projectManifestRuntimeContract({
+            pluginRoot: staging,
+            manifestPath: join(staging, "plugin.json"),
+            manifest,
+        }, capabilities);
+        requireNewPluginIdentity(rootDir, manifest.name, capabilities);
+        return {
+            staging,
+            manifest,
+            review: {
+                source: downloaded.source,
+                digest,
+                id: manifest.name,
+                version: manifest.version ?? "",
+                description: manifest.description ?? "",
+                capabilities: capabilities.map((id) => ({
+                    id,
+                    description: extension.capabilities[id].description,
+                    operations: Object.entries(extension.capabilities[id].operations).map(([name, operation]) => ({
+                        name,
+                        effect: operation.effect,
+                        approval: operation.approval,
+                    })),
+                })),
+                settings: extension.settings?.defaults ?? {},
+                secrets: Object.entries(extension.secrets ?? {}).map(([name, secret]) => ({
+                    name,
+                    env: secret.env,
+                    required: secret.required,
+                })),
+            },
+        };
+    }
+    catch (error) {
+        await rm(staging, { recursive: true, force: true });
+        if (error instanceof PluginInstallError)
+            throw error;
+        throw new PluginInstallError("plugin_package_invalid", "The selected folder is not a complete, valid ABot plugin. Check plugin.json, its built entrypoint and referenced skills.");
+    }
+}
+export function requireNewPluginIdentity(rootDir, id, capabilityIds) {
+    const installed = discoverConfiguredRuntimePluginManifests(rootDir);
+    if (installed.some((plugin) => plugin.manifest.name === id))
+        throw new PluginInstallError("plugin_already_installed", "A plugin with this ID is already installed. Existing plugins are never replaced.", 409);
+    const existing = new Set(installed.flatMap((plugin) => Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities)));
+    if (capabilityIds.some((capability) => existing.has(capability)))
+        throw new PluginInstallError("plugin_capability_conflict", "This plugin declares a capability ID already provided by another installed plugin.", 409);
+}

package/dist/src/runtime/plugins/installation/portable-path.d.ts

@@ -0,0 +1,2 @@
+/** Files and manifest-derived installation folders share the same portable naming rules. */
+export declare function isPortablePluginPathComponent(name: string): boolean;

package/dist/src/runtime/plugins/installation/portable-path.js

@@ -0,0 +1,10 @@
+/** Files and manifest-derived installation folders share the same portable naming rules. */
+export function isPortablePluginPathComponent(name) {
+    if (!name || name === "." || name === "..")
+        return false;
+    if (/[<>:"/\\|?*\u0000-\u001f\u007f]/u.test(name))
+        return false;
+    if (/[. ]$/u.test(name))
+        return false;
+    return !/^(con|prn|aux|nul|com[1-9\u00b9\u00b2\u00b3]|lpt[1-9\u00b9\u00b2\u00b3])(?:\.|$)/iu.test(name);
+}

package/dist/src/runtime/plugins/installation/publication.d.ts

@@ -0,0 +1,10 @@
+import { type ConfigFileTransaction } from "../../adapters/config-file-transaction.js";
+/** Publish, save selection and roll back under the same lock used by Apply. */
+export declare function publishPluginPackage<T>(options: {
+    staging: string;
+    target: string;
+    pluginId: string;
+    configPath: string;
+    requireMutationIdle?: () => void;
+    saveSelection: (pluginId: string, transaction: ConfigFileTransaction) => Promise<T>;
+}): Promise<T>;

package/dist/src/runtime/plugins/installation/publication.js

@@ -0,0 +1,17 @@
+import { rename, rm } from "node:fs/promises";
+import { withConfigFileTransaction, } from "../../adapters/config-file-transaction.js";
+/** Publish, save selection and roll back under the same lock used by Apply. */
+export function publishPluginPackage(options) {
+    return withConfigFileTransaction(options.configPath, async (transaction) => {
+        options.requireMutationIdle?.();
+        await rename(options.staging, options.target);
+        try {
+            return await options.saveSelection(options.pluginId, transaction);
+        }
+        catch (error) {
+            // Apply cannot load the uncommitted package while rollback is in progress.
+            await rm(options.target, { recursive: true, force: true });
+            throw error;
+        }
+    });
+}

package/dist/src/runtime/plugins/installation/service.d.ts

@@ -0,0 +1,41 @@
+import type { ConfigFileTransaction } from "../../adapters/config-file-transaction.js";
+import type { PluginSourceFetcher } from "./github-download.js";
+export declare function inspectPluginPackage(rootDir: string, input: unknown, download?: PluginSourceFetcher): Promise<{
+    source: Readonly<{
+        repository: string;
+        ref?: string;
+        path?: string;
+    }> & {
+        ref: string;
+    };
+    digest: string;
+    id: string;
+    version: string;
+    description: string;
+    capabilities: {
+        id: string;
+        description: string;
+        operations: {
+            name: string;
+            effect: import("../../../capabilities/tool-types.js").ToolNormalInvocationEffect;
+            approval: import("../../../capabilities/tool-types.js").ToolNormalInvocationApproval;
+        }[];
+    }[];
+    settings: Readonly<Record<string, unknown>>;
+    secrets: {
+        name: string;
+        env: string;
+        required: boolean;
+    }[];
+}>;
+export declare function installPluginPackage<T>(options: {
+    rootDir: string;
+    input: unknown;
+    download?: PluginSourceFetcher;
+    configPath?: string;
+    saveSelection: (pluginId: string, transaction: ConfigFileTransaction) => Promise<T>;
+    requireMutationIdle?: () => void;
+}): Promise<{
+    installed: Awaited<ReturnType<typeof inspectPluginPackage>>;
+    snapshot: T;
+}>;

package/dist/src/runtime/plugins/installation/service.js

@@ -0,0 +1,80 @@
+import { lstat, mkdir, realpath, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { PluginInstallError, parsePluginInstallSource, } from "../../../plugin-contract/install-source.js";
+import { inspectRuntimeConfigFileWithMeta } from "../../config/loader.js";
+import { publishPluginPackage } from "./publication.js";
+import { withFileLock } from "../../adapters/long-term-memory/file-lock.js";
+import { preparePluginPackage, requireNewPluginIdentity } from "./package.js";
+function isAbsentPath(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+async function installationDirectory(rootDir) {
+    const path = join(rootDir, "plugins");
+    await mkdir(path, { mode: 0o700 }).catch((error) => {
+        if (error.code !== "EEXIST")
+            throw error;
+    });
+    const stat = await lstat(path);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new PluginInstallError("plugin_destination_invalid", "The plugins destination must be a local directory.");
+    return path;
+}
+export async function inspectPluginPackage(rootDir, input, download) {
+    const root = await realpath(rootDir);
+    const prepared = await preparePluginPackage(root, parsePluginInstallSource(input), download);
+    try {
+        return prepared.review;
+    }
+    finally {
+        await rm(prepared.staging, { recursive: true, force: true });
+    }
+}
+export async function installPluginPackage(options) {
+    const input = options.input;
+    if (!input ||
+        typeof input !== "object" ||
+        typeof input.digest !== "string" ||
+        !/^[a-f0-9]{64}$/u.test(input.digest))
+        throw new PluginInstallError("plugin_review_required", "Review the plugin before installing it.");
+    const source = parsePluginInstallSource(input.source);
+    if (!source.ref || !/^[a-f0-9]{40}$/u.test(source.ref))
+        throw new PluginInstallError("plugin_review_required", "Installation requires the exact reviewed commit.");
+    const root = await realpath(options.rootDir);
+    const prepared = await preparePluginPackage(root, source, options.download);
+    try {
+        if (prepared.review.digest !== input.digest ||
+            prepared.review.source.ref !== source.ref)
+            throw new PluginInstallError("plugin_review_changed", "The plugin changed since review. Inspect it again.", 409);
+        return await withFileLock(join(root, ".abot-plugin-installation"), async () => {
+            const directory = await installationDirectory(root);
+            requireNewPluginIdentity(root, prepared.manifest.name, prepared.review.capabilities.map((capability) => capability.id));
+            const target = join(directory, prepared.manifest.name);
+            const existing = await lstat(target).catch((error) => {
+                if (isAbsentPath(error))
+                    return undefined;
+                throw error;
+            });
+            if (existing)
+                throw new PluginInstallError("plugin_already_installed", "The destination already exists; it will not be overwritten.", 409);
+            await writeFile(join(prepared.staging, ".abot-install.json"), JSON.stringify({
+                schemaVersion: 1,
+                source: prepared.review.source,
+                digest: prepared.review.digest,
+                installedAt: new Date().toISOString(),
+            }) + "\n", { flag: "wx", mode: 0o600 });
+            const snapshot = await publishPluginPackage({
+                staging: prepared.staging,
+                target,
+                pluginId: prepared.manifest.name,
+                configPath: inspectRuntimeConfigFileWithMeta(root, options.configPath)
+                    .path,
+                requireMutationIdle: options.requireMutationIdle,
+                saveSelection: options.saveSelection,
+            });
+            return { installed: prepared.review, snapshot };
+        });
+    }
+    finally {
+        await rm(prepared.staging, { recursive: true, force: true });
+    }
+}

package/dist/src/runtime/plugins/loader.js

@@ -1,3 +1,5 @@
+import { pluginLoadConfiguration } from "./configuration-context.js";
+import { readPluginConfigurationStore, } from "./configuration-store.js";
 import { validateManifestEntrypoint } from "./entrypoint-validation.js";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -16,9 +18,6 @@ const bundledCatalogCache = new Map();
 function isRecord(value) {
     return !!value && typeof value === "object" && !Array.isArray(value);
 }
-function nonEmptyString(value) {
-    return typeof value === "string" && value.trim().length > 0;
-}
 function unwrapPluginExport(rawModule) {
     if (isRecord(rawModule) &&
         "default" in rawModule &&
@@ -36,32 +35,14 @@ function compiledCapabilityFromDeclaration(tool) {
         normalInvocation: tool.normalInvocation,
     };
 }
-function createManifestSecretAccessor(pluginId, declarations) {
-    if (!declarations || Object.keys(declarations).length === 0) {
-        return undefined;
-    }
-    for (const [name, declaration] of Object.entries(declarations)) {
-        if (declaration.required && !nonEmptyString(process.env[declaration.env])) {
-            throw new Error(`Runtime plugin ${pluginId} requires secret ${name} from environment variable ${declaration.env}`);
-        }
-    }
-    return Object.freeze({
-        get(name) {
-            const declaration = declarations[name];
-            if (!declaration) {
-                throw new Error(`Runtime plugin ${pluginId} requested undeclared secret ${name}`);
-            }
-            const value = process.env[declaration.env];
-            return nonEmptyString(value) ? value : undefined;
-        },
-    });
-}
 function loadManifestRuntimePlugin(host, discovered, selectedCapabilityIds) {
     const manifest = discovered.manifest;
     const extension = manifest.extensions[ABOT_RUNTIME_EXTENSION];
     const capabilityIds = Object.keys(extension.capabilities);
     const projection = projectManifestRuntimeContract(discovered, selectedCapabilityIds);
-    const secrets = createManifestSecretAccessor(manifest.name, extension.secrets);
+    const configuration = pluginLoadConfiguration(manifest.name, extension, Object.hasOwn(host.pluginConfiguration, manifest.name)
+        ? host.pluginConfiguration[manifest.name]
+        : undefined);
     let loaded;
     try {
         loaded = unwrapPluginExport(require(projection.entryPath));
@@ -80,10 +61,7 @@ function loadManifestRuntimePlugin(host, discovered, selectedCapabilityIds) {
         runtimePaths: host.runtimePaths,
         runtimePathResolver: createRuntimeToolPathResolver(host.runtimePaths),
         pluginRoot: discovered.pluginRoot,
-        ...(extension.settings
-            ? { config: { ...extension.settings.defaults } }
-            : {}),
-        ...(secrets ? { secrets } : {}),
+        ...configuration,
     };
     const rawEntrypoint = typeof loaded === "function"
         ? loaded(loadContext)
@@ -134,11 +112,18 @@ export function loadConfiguredRuntimePlugins(config) {
     }
     const host = {
         rootDir: config.paths.rootDir,
+        pluginConfiguration: readPluginConfigurationStore(config.paths.rootDir)
+            .plugins,
         runtimeId: config.runtimeId,
         agentBridgeUrl: config.agentBridgeUrl,
         runtimePaths: config.paths,
     };
-    const manifestPlugins = discoverConfiguredRuntimePluginManifests(config.paths.rootDir, { excludedPluginIds: new Set(selection.deny) })
+    const manifestPlugins = discoverConfiguredRuntimePluginManifests(config.paths.rootDir, {
+        excludedPluginIds: new Set([
+            ...selection.deny,
+            ...selection.disabledPluginIds,
+        ]),
+    })
         .map((plugin) => ({
         plugin,
         selectedCapabilityIds: Object.keys(plugin.manifest.extensions[ABOT_RUNTIME_EXTENSION].capabilities).filter((capabilityId) => isPluginToolSelected({
@@ -192,6 +177,7 @@ export function loadBundledRuntimePlugins() {
     }
     const host = {
         rootDir,
+        pluginConfiguration: readPluginConfigurationStore(rootDir).plugins,
         runtimeId: "default",
         agentBridgeUrl: "",
         runtimePaths: createUnconfiguredRuntimePaths(rootDir),

package/dist/src/runtime/plugins/manifest-projection.js

@@ -71,6 +71,7 @@ export function projectManifestRuntimeContract(discovered, selectedCapabilityIds
                 operations: Object.entries(capability.operations).map(([operationId, operation]) => ({
                     operationId,
                     summary: operation.summary,
+                    ...(operation.outputChannels ? { outputChannels: operation.outputChannels } : {}),
                     input: operation.input,
                     ...(operation.selectionControlIds
                         ? { selectionControlIds: operation.selectionControlIds }

package/dist/src/runtime/plugins/manifest-validator.js

@@ -1,3 +1,4 @@
+import { parseOptionalToolOutputChannels } from "../../capabilities/normal-invocation/output-channels.js";
 import { parseRequiredToolPermissionMode } from "../../capabilities/tool-permission-mode.js";
 import { isToolCatalogGroupId } from "../../capabilities/tool-types.js";
 import { parseEventResultMetadata } from "../../capabilities/tool-definition-validator/event-result-metadata.js";
@@ -276,6 +277,7 @@ function parseOperation(value, path) {
     const operation = expectRecord(value, path);
     rejectUnknownKeys(operation, [
         "summary",
+        "outputChannels",
         "input",
         "selectionControlIds",
         "effect",
@@ -309,6 +311,7 @@ function parseOperation(value, path) {
     return {
         manifest: {
             summary: operation.summary.trim(),
+            ...parseOptionalToolOutputChannels(operation.outputChannels, `${path}.outputChannels`),
             input: input,
             ...(selectionControlIds ? { selectionControlIds } : {}),
             effect: operation.effect,

package/dist/src/runtime/plugins/module-cache.d.ts

@@ -0,0 +1,2 @@
+/** Retire only this installation's CommonJS graph, including package-local helpers. */
+export declare function evictPluginModules(pluginRoot: string): void;

package/dist/src/runtime/plugins/module-cache.js

@@ -0,0 +1,19 @@
+import { createRequire } from "node:module";
+import { isAbsolute, relative, sep } from "node:path";
+const require = createRequire(import.meta.url);
+/** Retire only this installation's CommonJS graph, including package-local helpers. */
+export function evictPluginModules(pluginRoot) {
+    const removed = new Set();
+    for (const [path, module] of Object.entries(require.cache)) {
+        const child = relative(pluginRoot, path);
+        const outside = isAbsolute(child) || child === ".." || child.startsWith(`..${sep}`);
+        if (outside || !module)
+            continue;
+        removed.add(module);
+        delete require.cache[path];
+    }
+    for (const module of Object.values(require.cache)) {
+        if (module)
+            module.children = module.children.filter((child) => !removed.has(child));
+    }
+}

package/dist/src/runtime/plugins/selection.d.ts

@@ -3,9 +3,11 @@ export type PluginSelection = Readonly<{
     enabled: boolean;
     allow: readonly string[];
     deny: readonly string[];
+    disabledPluginIds: readonly string[];
 }>;
 export declare function normalizePluginSelection(config: RuntimePluginConfig | undefined): PluginSelection;
 export declare function pluginSelectionCacheKey(selection: PluginSelection): string;
+export declare function isPluginDisabledById(pluginId: string, selection: PluginSelection): boolean;
 export declare function isPluginCatalogDisabled(selection: PluginSelection): boolean;
 export declare function isPluginToolSelected(params: {
     pluginId: string;

package/dist/src/runtime/plugins/selection.js

@@ -1,3 +1,4 @@
+import { matchesToolSelectionId } from "../../shared/tool-selection.js";
 function uniqueSorted(values) {
     return [
         ...new Set((values ?? [])
@@ -10,29 +11,33 @@ export function normalizePluginSelection(config) {
         enabled: config?.enabled !== false,
         allow: Object.freeze(uniqueSorted(config?.allow)),
         deny: Object.freeze(uniqueSorted(config?.deny)),
+        disabledPluginIds: Object.freeze(uniqueSorted(config?.disabledPluginIds)),
     });
 }
 export function pluginSelectionCacheKey(selection) {
-    return JSON.stringify([selection.enabled, selection.allow, selection.deny]);
+    return JSON.stringify([
+        selection.enabled,
+        selection.allow,
+        selection.deny,
+        selection.disabledPluginIds,
+    ]);
+}
+export function isPluginDisabledById(pluginId, selection) {
+    return selection.disabledPluginIds.includes(pluginId);
 }
 export function isPluginCatalogDisabled(selection) {
     if (!selection.enabled)
         return true;
     return selection.deny.includes("*");
 }
-function matchesPluginToolId(pluginId, toolName, configuredId) {
-    return (configuredId === "*" ||
-        configuredId === pluginId ||
-        configuredId === toolName ||
-        configuredId === `${pluginId}.${toolName}`);
-}
 export function isPluginToolSelected(params) {
-    if (!params.selection.enabled) {
+    if (!params.selection.enabled)
+        return false;
+    if (isPluginDisabledById(params.pluginId, params.selection))
         return false;
-    }
     if (params.selection.allow.length > 0 &&
-        !params.selection.allow.some((entry) => matchesPluginToolId(params.pluginId, params.toolName, entry))) {
+        !params.selection.allow.some((entry) => matchesToolSelectionId(params.pluginId, params.toolName, entry))) {
         return false;
     }
-    return !params.selection.deny.some((entry) => matchesPluginToolId(params.pluginId, params.toolName, entry));
+    return !params.selection.deny.some((entry) => matchesToolSelectionId(params.pluginId, params.toolName, entry));
 }

package/dist/src/runtime/ports.d.ts

@@ -44,6 +44,8 @@ export type RuntimeRequestRunnerConfig = {
     configPath: string;
 };
 export type RuntimePluginConfig = {
+    /** Exact plugin IDs; never interpreted as capability IDs or wildcards. */
+    disabledPluginIds?: string[];
     enabled?: boolean;
     allow?: string[];
     deny?: string[];
@@ -60,6 +62,9 @@ export type RuntimeConfig = {
     agentBridgeToken?: string;
     modelGatewayUrl: string;
     paths: RuntimePaths;
+    webUi?: {
+        pageSize: number;
+    };
     logging?: RuntimeLoggingConfig;
     timeouts?: RuntimeTimeouts;
     plugins?: RuntimePluginConfig;
@@ -129,10 +134,7 @@ export type SessionStore = SessionMemoryRepository & {
         cursor?: string | null;
     }) => Promise<SessionListResult>;
     getSessionById: (sessionId: string) => Promise<SessionRecord | null>;
-    getSessionSnapshot: (sessionId: string, options?: {
-        afterMessageId?: string | number | null;
-        includeRequests?: boolean;
-    }) => Promise<SessionSnapshot | null>;
+    getSessionSnapshot: (sessionId: string, options?: import("../sessions/snapshot.js").SessionSnapshotOptions) => Promise<SessionSnapshot | null>;
     getRequestReplayById: (requestId: string, afterSeq?: number) => Promise<SessionRequestReplay | null>;
     updateSessionTitle: (sessionId: string, title: string) => Promise<SessionRecord | null>;
     updateSessionRuntimeMode?: (sessionId: string, runtimeModeId: string | null) => Promise<SessionRecord | null>;

package/dist/src/runtime/request/dependencies.d.ts

@@ -18,7 +18,8 @@ export declare function resolveRequestDependencies(options: RequestHandlerOption
         runnerConfig: import("../config/runner/contracts.js").RequestRunnerConfig;
         modelPolicy: import("../../model-gateway/types.js").ModelGatewayPolicyConfig;
         modelExecutionPolicies: Readonly<Record<string, Readonly<{
-            policy: import("../config/model-execution-policy.js").RequestExecutionPolicyId;
+            policy?: import("../config/model-execution-policy.js").RequestExecutionPolicyId;
+            plugins?: import("../config/model-plugin-config.js").RuntimeModelPluginConfig;
         }>>> | undefined;
     };
 };

package/dist/src/runtime/request/execution-payload-compacted-evidence.d.ts

@@ -22,8 +22,8 @@ export declare function projectExecutionPayloadCompactedEvidence(request: Payloa
         adapterResult: import("../orchestration/capability-adapters/result.js").CapabilityAdapterResult;
     }> | Readonly<{
         compactedSourceRef: string;
-        capabilityId: string;
         summary: string;
+        capabilityId: string;
         callId: string;
         outcome: import("../orchestration/role-calls/contracts.js").RoleCapabilityExecutionOutcome;
         executionId: string;

package/dist/src/runtime/request/handler.js

@@ -7,6 +7,7 @@ import { isRequestCancelled, REQUEST_CANCELLED } from "./cancellation.js";
 import { isRequestInterrupted, REQUEST_INTERRUPTED } from "./interruption.js";
 import { RequestToolResources } from "../capabilities/request-tool-resources.js";
 import { traceDebug } from "../observability/debug-logger.js";
+import { traceRequestControl } from "../observability/request-control-diagnostics.js";
 import { RequestLifecycle } from "../orchestration/lifecycle/request-lifecycle.js";
 import { ROLE_CALL_RESPONSE_MAX_LENGTH } from "../orchestration/role-calls/index.js";
 import { runModelAuthoredDegradedFinalization } from "../steps/degraded-finalization/model-authored.js";
@@ -107,6 +108,13 @@ class RequestHandlingSession {
         }
     }
     async execute() {
+        traceRequestControl("runtime.request_control", "request.entered", {
+            requestId: this.input.requestId,
+            sessionId: this.input.sessionId,
+            environmentId: this.options.runtimeConfig?.runtimeId,
+            toolPermissionMode: this.input.toolPermissionMode,
+            resumed: Boolean(this.options.approvalExecution?.resume),
+        });
         const prepared = await prepareRequestExecution({
             ws: this.ws,
             options: this.options,

package/dist/src/runtime/request/prepared-execution.js

@@ -116,7 +116,9 @@ export async function prepareRequestExecution(params) {
         sessionId,
         prompt: initialized.prompt,
         temporalContext: params.temporalContext,
-        ...(isSparkSession(opened.session) ? { sessionKind: "spark" } : {}),
+        ...(isSparkSession(opened.session)
+            ? { sessionKind: "spark" }
+            : {}),
         historyMessages,
         shouldGenerateSessionTitle: generateSessionTitle,
         runnerConfig: loaded.runnerConfig,
@@ -214,6 +216,9 @@ export async function prepareRequestExecution(params) {
             requestWorkingDirectory,
             ...(filesystemScope ? { filesystemScope } : {}),
             executionPolicyAuthority: executionPolicy.authority,
+            ...(seed.executionPolicySelection?.plugins
+                ? { modelPlugins: seed.executionPolicySelection.plugins }
+                : {}),
             requestAttachments: toolAttachments,
             ...(options.runtimeConfig
                 ? { runtimeConfig: options.runtimeConfig }

package/dist/src/runtime/request/request-steering.d.ts

@@ -33,4 +33,8 @@ export declare function resolveRequestSteeringInbox(inbox: RequestSteeringInbox
 export declare function projectRequestSteeringSnapshot(inbox: RequestSteeringInbox | undefined, version: number): RequestSteeringSnapshot;
 export declare function createRequestSteeringInbox(params: {
     requestId: string;
+    diagnostics?: Readonly<{
+        inboxId?: string;
+        origin?: string;
+    }>;
 }): RequestSteeringInbox;