@abot-ai/runtime 1.6.0 → 1.7.0

package/docs/projects-and-full-plus.md

@@ -206,12 +206,8 @@ system action. Cancellation or revocation attempts to stop an in-flight command,
 but effects already performed are not rolled back. If a connection is lost during
 execution, inspect the actual host state before trying the action again.
 
-## Validation status
+## Platform validation
 
-Implementation and validation progress are recorded in the task journal. Native
-Mac QA is performed separately with the owner; mocked platform tests are not a
-claim that an actual Mac was tested. No release or installation update is implied
-by changes in a development worktree.
 Native Windows/macOS companion installation, login startup and visible-application
-QA remain separate checks on the real desktop systems; Linux protocol and package
+behavior require checks on the target systems; Linux protocol and package
 tests do not establish those results.

package/docs/runtime-library.md

@@ -13,7 +13,6 @@ For invariant coverage, see
 [runtime-invariant-coverage.md](runtime-invariant-coverage.md).
 For bridge/runtime ownership, see [bridge-compatibility.md](bridge-compatibility.md).
 For current limitations, see [known-limitations.md](known-limitations.md).
-For package and publication gates, see [publishing.md](publishing.md).
 
 ## Basic Composition
 

package/docs/windows-companion-store.md

@@ -0,0 +1,127 @@
+# Windows Companion Store delivery
+
+## Current status
+
+**ABot AI Companion** is available from
+[Microsoft Store](https://apps.microsoft.com/detail/9PK2FDQQLQS9), product ID
+`9PK2FDQQLQS9`. Runtime 1.7.0 provides the guided connection flow described below.
+
+The Store app and Runtime have separate releases.
+
+## Connection experience
+
+The Web UI links to the Store for one installation. The user returns to ABot,
+requests a connection link and explicitly opens Companion. Companion shows the
+Runtime address and asks for confirmation before pairing. Users who already
+installed Companion go directly to connecting. The Web UI confirms the live
+connection after pairing.
+
+Before **Allow connection** is enabled, users must select an initially unchecked
+acknowledgment of the described computer access and data sharing. The dialog
+links to the [software terms](https://abot-ai.com/terms/#software) and
+[privacy policy](https://abot-ai.com/privacy/#software); opening either link does
+not grant consent. Task permissions and optional SPARK controls remain separate.
+Disconnecting does not erase data already sent to the Runtime or other services.
+
+For a paired computer that is offline, **Open Companion** uses the fixed
+`abot-companion://open` activation without creating an invitation. It opens the
+saved connection or explains how to re-pair when local credentials are missing.
+**Set up again** requires confirmation, revokes the old server pairing using
+the existing endpoint, then requests a fresh invitation. An upgrade invitation
+never substitutes for a new pairing grant when local credentials are missing.
+After explicit consent, a fresh connection consumes the new grant even when an
+old local credential remains. The previous owned process is stopped before that
+exchange. A failed exchange preserves the saved credential but does not restart
+the previous process;
+an upgrade continues to use the matching saved host identity.
+
+Every user installs the same package. The personalized, expiring invitation is
+sent through the `abot-companion:` protocol after installation. It carries the
+existing pairing or upgrade grant, not a second authentication scheme. The Web UI
+keeps it only in the current surface, clears it after connection or expiry, and
+does not save it to browser storage. Do not put connection links in logs, support
+reports or screenshots.
+
+The current invitation contract accepts a local HTTP loopback Runtime address.
+Docker must publish its Web UI port on the Windows host's loopback; other setups
+must expose the Runtime through an appropriate local forward. Opening ABot on a
+different computer does not make that remote Runtime address a valid invitation.
+
+## Shared components
+
+| Owner | Responsibility |
+| --- | --- |
+| Shared Web UI connection manager | Connection status, readiness polling, unpairing and onboarding lifecycle. |
+| Windows Store UI module and route | Store link, temporary invitation and explicit launch. The route uses the existing pairing store. |
+| Windows desktop shell | Display connection status and consent, activate links and call the bundled Node entry. |
+| Shared Companion and CLI lifecycle | Pairing credentials, command and desktop capabilities, connection protocol, reconnect behavior and permission checks. |
+| Windows Store lifecycle adapter and MSIX package | Windows package activation, startup integration, notification identity and package updates. |
+
+The desktop shell does not implement another pairing store or copy the Companion
+protocol. Shared fixes belong in the shared Companion implementation; Windows
+presentation and package integration stay in the Windows adapter. The package
+contains the runtime dependencies needed for connection.
+
+The Store integration changes Windows delivery. Native macOS connection, manual
+Mac connection, Linux setup and WSL command routing keep their existing owners
+and behavior. A WSL Runtime can use the Windows desktop Companion without a WSL
+restart.
+
+## Version and update ownership
+
+The **MSIX package version** orders Windows package updates. The **Companion
+release version**, owned by `src/computer-access/companion/release-version.ts`,
+describes the Companion behavior expected by the Runtime. These are different
+values: a packaging or shell-only rebuild can require a newer MSIX version
+without changing the Companion release contract.
+
+If the Runtime requires a Companion release newer than the installed package,
+the invitation is rejected with a request to update through Microsoft Store.
+The Store supplies the replacement package; the Runtime does not overwrite
+Store-owned executable files. Store updates are intended to preserve the user's
+saved pairing.
+
+The Store identity is owned by
+`src/computer-access/companion/windows-store/identity.ts`. Packaging and the
+Companion must use this same identity. Do not create another copy of protocol
+version or package identity policy in the Web UI or desktop shell.
+
+## Build from source
+
+Build Companion from this repository.
+The build uses the pinned Windows Node.js distributions, checking the archive
+hash before extracting only `node.exe` and its license. Supply an explicit
+four-part Store version with a zero last component.
+
+```sh
+npx tsx scripts/build-windows-companion-store.ts \
+  --output-dir <new-layout-directory> \
+  --node-archive <verified-node-windows-zip> \
+  --version <major.minor.patch.0> --architecture x64
+```
+
+Then, in Windows PowerShell, use the .NET Framework compiler and an authentic
+Microsoft Windows SDK `MakeAppx.exe`:
+
+```powershell
+./scripts/build-windows-companion-store.ps1 `
+  -LayoutDirectory <layout-directory> `
+  -MakeAppxPath <local-windows-sdk-makeappx-path> `
+  -OutputPath <new-msix-path>
+```
+
+Keep the SDK tools on a local Windows volume. Package inputs and output can
+remain in the WSL checkout. The output is unsigned and is not installed,
+registered, signed or submitted by these scripts.
+
+## Package contents
+
+The public source includes the Windows shell and packaging scripts. The MSIX
+contains the compiled shell, bundled shared Companion, pinned Node executable,
+licenses, icons and Windows manifest. The Store package and Node executable are
+not part of the Runtime npm package.
+
+Pairing invitations are generated when the user requests a connection. They are
+never baked into the Store package. Local configurations, API keys, saved pairing
+and logs must stay outside the Store package. Store product and publisher identity
+values are public package metadata, not authentication credentials.

package/package.json

@@ -95,11 +95,11 @@
     "docs/bridge-compatibility.md",
     "docs/configuration.md",
     "docs/installation.md",
+    "docs/windows-companion-store.md",
     "docs/known-limitations.md",
     "docs/long-term-memory.md",
     "docs/plugins.md",
     "docs/projects-and-full-plus.md",
-    "docs/publishing.md",
     "docs/running-locally.md",
     "docs/runtime-invariant-coverage.md",
     "docs/runtime-library.md",
@@ -128,7 +128,7 @@
     "plugins/system-probe/",
     "plugins/web/"
   ],
-  "homepage": "https://github.com/Dorshitrit/abot-runtime#readme",
+  "homepage": "https://abot-ai.com/",
   "keywords": [
     "llm",
     "runtime",
@@ -181,5 +181,5 @@
   },
   "type": "module",
   "types": "./dist/src/runtime/index.d.ts",
-  "version": "1.6.0"
+  "version": "1.7.0"
 }

package/plugins/document-reader/plugin.json

@@ -42,6 +42,7 @@
           "operations": {
             "read_document": {
               "summary": "Extract document text, not source code. For .js, .ts, .html, .css and other code files, use read_one_file or inspect_target when available. Accepts only PDF, DOCX, XLSX, PPTX, TXT, CSV, MD, JSON and RTF; returns one bounded character window.",
+              "outputChannels": {"text": "content", "data": "metadata"},
               "attachmentInput": {
                 "param": "source",
                 "acceptedMimeTypes": [

package/plugins/exec/plugin.json

@@ -42,6 +42,7 @@
           "operations": {
             "execute_command": {
               "summary": "Execute one trusted non-interactive /bin/bash command in an explicit existing directory. This sensitive operation requires exact-action approval in Ask/Full and runs automatically in FULL+. The OS user permissions still apply; the selected folder is not a sandbox.",
+              "outputChannels": {"text": "metadata", "data": "metadata"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,
@@ -75,6 +76,7 @@
           "operations": {
             "wait_for_process": {
               "summary": "Wait for the next bounded observation from one running exec process without restarting it.",
+              "outputChannels": {"text": "metadata", "data": "metadata"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,
@@ -111,6 +113,7 @@
           "operations": {
             "cancel_process": {
               "summary": "Stop one active exec process and report its final state.",
+              "outputChannels": {"text": "metadata", "data": "metadata"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/filesystem/plugin.json

@@ -35,6 +35,7 @@
           "operations": {
             "inspect_target": {
               "summary": "Read a bounded line-numbered window from source code or another text file, or inspect a directory sample. Choose a locator or numeric lines; locator takes precedence. Results declare truncation explicitly.",
+              "outputChannels": {"text": "content", "data": "conditional"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,
@@ -194,6 +195,7 @@
           "operations": {
             "read_one_file": {
               "summary": "Read one source-code or text file, including JS, TS, Python, HTML and CSS. Returns complete content within the read budget or an explicitly truncated head/tail view.",
+              "outputChannels": {"text": "content", "data": "metadata"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/local-search/plugin.json

@@ -37,6 +37,7 @@
           "operations": {
             "search_local_files": {
               "summary": "Find bounded filename or exact-content matches beneath the current Worker root. Omit path or use '.' for that root; use only relative subpaths (or workspace/... when configured).",
+              "outputChannels": {"text": "content", "data": "metadata"},
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/system/README.md

@@ -9,6 +9,49 @@ configuration. Ask and Full retain exact-action approvals; Full+ retains its nor
 approval policy. OS accessibility, screen-recording and portal permissions still
 apply. An available shell or connected companion does not prove desktop readiness.
 
+## Local command output
+
+Local `system_command` execution, including Windows through WSL interop, writes
+stdout and stderr to private files under the plugin state directory. Capture
+uses bounded stream buffers with disk backpressure. The completed observation is
+then loaded for delivery; full text is still materialized in memory at that point.
+The existing SDK context-text contract lets the Runtime admit or compact that
+text using its normal model-context budget. Small-result text is unchanged.
+
+`extensions["ai.abot.runtime"].settings.defaults.outputRetentionMs` in the plugin's
+`plugin.json` controls retention; the default is seven days after capture completes. Cleanup protects active captures and removes expired
+captures during plugin initialization and periodic maintenance. Reads do not renew
+retention. Completed captures keep the retention recorded at creation across
+Companion reconnects and later configuration changes. Each capture has an opaque
+ID, byte counts and a saved process receipt;
+files are private implementation storage, not user-authored artifacts or model
+instructions. No wait/cancel operation or automatic command replay is added.
+
+A storage failure before dispatch prevents the command from starting. A capture
+write failure stops observation of that command and reports incomplete output;
+external descendants are not assumed terminated. Delivery failures retain the
+capture receipt, recorded helper PID, process status and exit code when available.
+This does not grant a new model-facing operation for reading retained captures.
+
+Application launch, target probes and desktop images retain their existing behavior.
+
+## Companion command output
+
+Updated companions advertise `system_command_output_v1`. SYSTEM then uses private
+capture/read/close operations over the existing connection: the Companion stores
+both streams in its private state directory using the same capture implementation,
+returns the process receipt, and serves 64 KiB byte chunks. SYSTEM verifies the
+capture ID, stream, offset, byte count and SHA-256 before delivering text through
+the existing context-text contract. UTF-8 characters may cross chunk boundaries.
+The model receives one tool result; transport chunks do not invoke a model.
+
+Output references belong to the authenticated Companion connection. Transfers
+protect their captures from expiry until closed or disconnected; the configured
+SYSTEM retention then continues on disk. A failed transfer preserves the command
+receipt and never repeats execution. Old companions keep their existing bounded
+command path. This transfer does not add model-facing tools or change screenshot
+handling, and final text delivery still materializes the streams in memory.
+
 ## Shared connection
 
 Use **Home → Computer access** for one installation shared
@@ -108,6 +151,3 @@ source compilation where available. They prove transport, identity, cancellation
 image lifetime and projection invariants. Interactive acceptance on each actual OS,
 permission configuration, compositor and provider remains a distinct live check;
 unit checks alone do not establish all native integrations work on a user's machine.
-The Windows helper has been compiled on Windows; its interactive behavior has not
-been exercised. macOS native compilation and interactive Linux/macOS checks remain
-unverified in this Windows/WSL development environment.

package/plugins/system/plugin.json

@@ -7,6 +7,11 @@
     "ai.abot.runtime": {
       "version": 1,
       "entrypoint": "./src/index.cjs",
+      "settings": {
+        "defaults": {
+          "outputRetentionMs": 604800000
+        }
+      },
       "catalogGroups": [
         "system"
       ],

package/plugins/system/source/companion-command-output.ts

@@ -0,0 +1,82 @@
+import { createHash } from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+import { deliverPluginTextResult, failureResult, type ToolExecutionContext,
+  type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import { SYSTEM_OUTPUT_CAPABILITY, SYSTEM_OUTPUT_CHUNK_BYTES, readSystemOutputTransfer,
+  type ComputerAccessConnection, type HostOperation } from "../../../src/plugin-sdk/computer-access.js";
+import type { SystemRequestRoute } from "./request-target-snapshot.js";
+
+type CompanionRoute = Extract<SystemRequestRoute, { kind: "companion" }>;
+type Transfer = ReturnType<typeof readSystemOutputTransfer>;
+type HostCall = (operation: HostOperation, params: Record<string, unknown>, signal?: AbortSignal) => Promise<ToolImplementationOutput>;
+
+export function supportsCompanionCommandOutput(route: CompanionRoute): boolean {
+  return route.capabilities?.includes(SYSTEM_OUTPUT_CAPABILITY) === true;
+}
+
+/** Transfer is private adapter IO; the model receives one settled tool result. */
+export async function executeCompanionCommand(input: {
+  rootDir: string;
+  route: CompanionRoute;
+  connection: ComputerAccessConnection;
+  params: Record<string, unknown>;
+  outputRetentionMs?: number;
+  context?: ToolExecutionContext;
+}): Promise<ToolImplementationOutput> {
+  const { route, context } = input;
+  const call: HostCall = (operation, params, signal) => input.connection.executeHostOperation(input.rootDir, {
+    hostId: route.hostId, connectionId: route.connectionId, operation,
+    params: { ...params, target: route.target }, ...(signal ? { abortSignal: signal } : {}),
+  });
+  const receipt = await call("system_command_capture", {
+    ...input.params, ...(input.outputRetentionMs !== undefined ? { outputRetentionMs: input.outputRetentionMs } : {}),
+  }, context?.abortSignal);
+  if (!receipt.data?.outputTransfer && !receipt.ok) return receipt;
+  let transfer: Transfer | undefined;
+  try {
+    transfer = readSystemOutputTransfer(receipt.data?.outputTransfer);
+    const stdout = await readStream(call, transfer, "stdout", context?.abortSignal);
+    const stderr = await readStream(call, transfer, "stderr", context?.abortSignal);
+    const { outputTransfer: _transfer, ...data } = receipt.data ?? {};
+    const delivered = deliverPluginTextResult({ ...receipt, stdout, stderr: stderr || receipt.stderr,
+      data: { ...data, outputDelivery: "complete", summaryOmittedChars: { stdout: stdout.length, stderr: stderr.length } },
+    }, ["stdout", "stderr"], context?.resultBudget);
+    if (delivered.errorCode === "plugin_result_too_large") return transferFailure(receipt, context);
+    return delivered;
+  } catch {
+    return transferFailure(receipt, context);
+  } finally {
+    if (transfer) await call("system_command_output_close", { captureId: transfer.id }, AbortSignal.timeout(3_000)).catch(() => undefined);
+  }
+}
+
+async function readStream(call: HostCall, transfer: Transfer, stream: "stdout" | "stderr", signal?: AbortSignal): Promise<string> {
+  const size = stream === "stdout" ? transfer.stdoutBytes : transfer.stderrBytes;
+  const digest = stream === "stdout" ? transfer.stdoutSha256 : transfer.stderrSha256;
+  const hash = createHash("sha256");
+  const decoder = new StringDecoder("utf8");
+  let text = "";
+  for (let offset = 0; offset < size; offset += SYSTEM_OUTPUT_CHUNK_BYTES) {
+    signal?.throwIfAborted();
+    const part = await call("system_command_output", { captureId: transfer.id, stream, offset }, signal);
+    if (!part.ok) throw new Error("system_output_transfer_failed");
+    const data = part.data;
+    if (data?.captureId !== transfer.id || data.stream !== stream || data.offset !== offset) throw new Error("system_output_chunk_binding_invalid");
+    if (typeof data.bytes !== "string" || data.bytes.length > SYSTEM_OUTPUT_CHUNK_BYTES * 2) throw new Error("system_output_chunk_invalid");
+    const bytes = Buffer.from(data.bytes, "base64");
+    if (bytes.toString("base64") !== data.bytes) throw new Error("system_output_chunk_invalid");
+    if (bytes.length !== Math.min(SYSTEM_OUTPUT_CHUNK_BYTES, size - offset)) throw new Error("system_output_chunk_size_invalid");
+    hash.update(bytes);
+    text += decoder.write(bytes);
+  }
+  if (hash.digest("hex") !== digest) throw new Error("system_output_digest_invalid");
+  return text + decoder.end();
+}
+
+function transferFailure(receipt: ToolImplementationOutput, context?: ToolExecutionContext): ToolImplementationOutput {
+  return failureResult({ errorCode: "system_output_delivery_pending",
+    message: "The command settled, but its retained output could not be delivered completely. Process receipt is preserved; the command was not replayed.",
+    ...(receipt.exitCode !== undefined ? { exitCode: receipt.exitCode } : {}),
+    data: { ...receipt.data, outputDelivery: "pending", commandOk: receipt.ok, commandErrorCode: receipt.errorCode ?? null },
+  }, context?.resultBudget);
+}

package/plugins/system/source/host-dispatch.ts

@@ -1,3 +1,4 @@
+import { executeCompanionCommand, supportsCompanionCommandOutput } from "./companion-command-output.js";
 import type { ComputerAccessConnection } from "../../../src/plugin-sdk/computer-access.js";
 import {
   failureResult,
@@ -32,6 +33,7 @@ export function createBoundSystemHandlers(
     snapshot: SystemTargetSnapshot;
     nativeHandlers: Readonly<Record<string, ToolImplementation>>;
     connection: SystemHostConnection;
+    outputRetentionMs?: number;
   }>,
 ): Record<string, ToolImplementation> {
   return Object.fromEntries(
@@ -67,6 +69,8 @@ function boundOperation(
       const route = requireSystemRequestRoute(input.snapshot, params.target);
       if (route.kind === "native")
         return await input.nativeHandlers[operation]!(params, context);
+      if (operation === "system_command" && supportsCompanionCommandOutput(route))
+        return await executeCompanionCommand({ ...input, route, params, context });
       return await input.connection.executeHostOperation(input.rootDir, {
         hostId: route.hostId,
         connectionId: route.connectionId,

package/plugins/system/source/index.ts

@@ -1,10 +1,16 @@
 import { defineRuntimePlugin } from "../../../src/plugin-sdk/index.js";
 import { createSystemHandlers } from "../../../src/plugin-sdk/computer-access.js";
 import { prepareSystemRequestModules } from "./request-system-modules.js";
+import { createLocalSystemCommandOutput, systemCommandOutputRetentionMs } from "./local-command-output.js";
 import { unboundComputerHandlers } from "./computer/request-modules.js";
 
-export default defineRuntimePlugin(({ rootDir }) => ({
-  handlers: { ...createSystemHandlers(), ...unboundComputerHandlers() },
-  prepareRequest: (modules, preparation) =>
-    prepareSystemRequestModules(rootDir, modules, {}, preparation),
-}));
+export default defineRuntimePlugin((context) => {
+  const output = createLocalSystemCommandOutput(context);
+  return {
+    handlers: { ...createSystemHandlers(undefined, undefined, output), ...unboundComputerHandlers() },
+    prepareRequest: (modules, preparation) => prepareSystemRequestModules(context.rootDir, modules, {
+      outputRetentionMs: systemCommandOutputRetentionMs(context),
+      createNativeHandlers: (resolve) => createSystemHandlers(undefined, resolve, output),
+    }, preparation),
+  };
+});

package/plugins/system/source/local-command-output.ts

@@ -0,0 +1,61 @@
+import { join } from "node:path";
+import { deliverPluginTextResult, failureResult, readBoundedInteger, type RuntimePluginLoadContext,
+  type ToolExecutionContext, type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import { buildSystemProcessResult, runSystemProcess, type SystemCommandOutputFactory,
+  type SystemProcessResult, type SystemTarget } from "../../../src/plugin-sdk/computer-access.js";
+import { createSystemOutputCapture, type SystemOutputReceipt } from "../../../src/plugin-sdk/computer-access.js";
+import { DEFAULT_SYSTEM_OUTPUT_RETENTION_MS, scheduleSystemOutputCleanup } from "../../../src/plugin-sdk/computer-access.js";
+
+type Capture = Awaited<ReturnType<typeof createSystemOutputCapture>>;
+const CONTEXT_STREAMS = Object.freeze(["stdout", "stderr"] as const);
+
+export function createLocalSystemCommandOutput(plugin: RuntimePluginLoadContext): SystemCommandOutputFactory {
+  const root = join(plugin.stateDir, "command-output");
+  const retentionMs = systemCommandOutputRetentionMs(plugin);
+  scheduleSystemOutputCleanup(root, retentionMs);
+  return (context) => {
+    let captured: Capture | undefined;
+    return {
+      async run(input) {
+        if (input.abortSignal?.aborted) return runSystemProcess(input);
+        captured = await createSystemOutputCapture(root, retentionMs);
+        let result: SystemProcessResult;
+        try { result = await runSystemProcess(input, captured.capture); }
+        catch (error) { await captured.finish(); throw error; }
+        const streams = await captured.finish(result);
+        return { ...result, stdout: streams.stdout, stderr: streams.stderr || result.stderr,
+          outputTruncated: Boolean(captured.failure) };
+      },
+      async present(target, result) {
+        if (captured?.failure) return outputFailure(target, result, context, captured.receipt, captured.failure);
+        const receipt = buildSystemProcessResult(target, result, "command_process_completion");
+        const delivered = deliverPluginTextResult({ ...receipt,
+          data: { ...receipt.data, ...(captured?.receipt ? { outputCapture: captured.receipt } : {}) } }, CONTEXT_STREAMS, context?.resultBudget);
+        if (delivered.errorCode === "plugin_result_too_large")
+          return outputFailure(target, result, context, captured?.receipt);
+        return delivered;
+      },
+    };
+  };
+}
+
+function outputFailure(target: SystemTarget, result: SystemProcessResult, context?: ToolExecutionContext,
+  capture?: SystemOutputReceipt, storageFailure?: string): ToolImplementationOutput {
+  return failureResult({
+    errorCode: storageFailure ? "system_output_storage_failed" : "system_output_delivery_pending",
+    message: "The command was dispatched. Its output could not be delivered completely; do not repeat the command just to retrieve output. Inspect the process receipt and retained capture.",
+    ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
+    data: { target: target.id, transport: target.transport, processStatus: result.status,
+      spawnedProcess: result.spawnedProcess ?? null, exitCode: result.exitCode,
+      outputCapture: capture ?? null, ...(storageFailure ? { storageFailure } : {}),
+      outputDelivery: "pending", evidenceScope: "command_process_completion", independentOutcomeCheck: "not_performed",
+      observationMeta: { kind: "volatile_external", carryPolicy: "never" } },
+  }, context?.resultBudget);
+}
+
+export function systemCommandOutputRetentionMs(plugin: RuntimePluginLoadContext): number {
+  return readBoundedInteger(plugin.config?.outputRetentionMs, {
+    name: "outputRetentionMs", defaultValue: DEFAULT_SYSTEM_OUTPUT_RETENTION_MS,
+    minimum: 1, maximum: Number.MAX_SAFE_INTEGER,
+  });
+}

package/plugins/system/source/request-system-modules.ts

@@ -34,6 +34,7 @@ import {
 export type SystemRequestDependencies = Readonly<{
   observeTargets?: () => Promise<SystemTargetObservation>;
   connection?: SystemHostConnection;
+  outputRetentionMs?: number;
   createNativeHandlers?: (
     resolveTarget: (id: SystemTargetId) => Promise<SystemTarget>,
   ) => Record<string, ToolImplementation>;
@@ -76,6 +77,7 @@ export async function prepareSystemRequestModules(
     snapshot,
     connection,
     nativeHandlers,
+    outputRetentionMs: dependencies.outputRetentionMs,
   });
   return Object.freeze([
     ...modules