@abot-ai/runtime 1.6.0 → 1.8.0

package/dist/src/plugin-sdk/files-windows/read-script.js

@@ -0,0 +1,43 @@
+import { WINDOWS_FILESYSTEM_NATIVE } from "../../shared/windows-file-io/native-script.js";
+import { WINDOWS_FILESYSTEM_AUTHORITY } from "../../shared/windows-file-io/authority-script.js";
+import { WINDOWS_FILE_READ_BYTES } from "../../shared/windows-file-io/read-bytes-script.js";
+const BOUNDED_READ = String.raw `
+public static partial class AbotFilesystem {
+  static object ReadBounded(Dictionary<string,object> request) {
+    long maximum;
+    if (!Int64.TryParse(Text(request, "maxBytes"), out maximum) || maximum < 0 ||
+        maximum > 9007199254740991L) throw new FsFault("filesystem_invalid_request");
+    string[] parts=Components(request);
+    if (parts.Length == 0) return Record("ok", false, "reason", "not_regular_file");
+    using (var chain=new DirectoryChain(request)) {
+      chain.Walk(parts, parts.Length-1, false);
+      using (var file=OpenHandle(chain.Current, parts[parts.Length-1], false, 1, 0x80000000, 1)) {
+        var expected=request["targetIdentity"] as Dictionary<string,object>;
+        if (expected == null || !MatchesIdentity(Identity(file), expected))
+          return Record("ok", false, "reason", "changed_during_read");
+        var before=Metadata(file);
+        long size=Convert.ToInt64(before["size"]);
+        // Both the byte array and the base64 JSON response must fit .NET strings.
+        if (size > maximum || size > (Int32.MaxValue-4096L)/4*3)
+          return Record("ok", false, "reason", "too_large", "byteCount", size);
+        var bytes=ReadBytes(file, 0, (int)size);
+        if (!SameMetadata(before, Metadata(file)))
+          return Record("ok", false, "reason", "changed_during_read");
+        return Record("ok", true, "bytes", Convert.ToBase64String(bytes), "byteCount", size);
+      }
+    }
+  }
+  public static string Run(string input) {
+    var json=new JavaScriptSerializer { MaxJsonLength=Int32.MaxValue };
+    try { return json.Serialize(ReadBounded(json.Deserialize<Dictionary<string,object>>(input))); }
+    catch (FsFault error) { return json.Serialize(Record("ok", false, "code", error.Code)); }
+    catch { return json.Serialize(Record("ok", false, "code", "filesystem_native_operation_failed")); }
+  }
+}
+`;
+export const WINDOWS_BOUNDED_READ_SOURCE = [
+    WINDOWS_FILESYSTEM_NATIVE,
+    WINDOWS_FILESYSTEM_AUTHORITY,
+    WINDOWS_FILE_READ_BYTES,
+    BOUNDED_READ,
+].join("\n");

package/dist/src/plugin-sdk/files-windows/read.d.ts

@@ -0,0 +1,6 @@
+import type { BoundedRegularFileReadResult } from "../files.js";
+export declare function readWindowsBoundedRegularFile(absolutePath: string, options: Readonly<{
+    maxBytes: number;
+    rootPath: string;
+    signal?: AbortSignal;
+}>): Promise<BoundedRegularFileReadResult>;

package/dist/src/plugin-sdk/files-windows/read.js

@@ -0,0 +1,56 @@
+import { lstat, open, realpath } from "node:fs/promises";
+import { win32 } from "node:path";
+import { runWindowsBoundedRead } from "./process.js";
+import { decodeWindowsReadResult, windowsReadAbortError } from "./result.js";
+function isOutsideRoot(rootRelative) {
+    if (win32.isAbsolute(rootRelative))
+        return true;
+    if (rootRelative === "..")
+        return true;
+    return rootRelative.startsWith("..\\");
+}
+function identity(stats) {
+    return {
+        device: String(stats.dev),
+        inode: String(stats.ino),
+        birthtimeNs: String(stats.birthtimeNs),
+    };
+}
+export async function readWindowsBoundedRegularFile(absolutePath, options) {
+    const relativePath = win32.relative(options.rootPath, absolutePath);
+    if (isOutsideRoot(relativePath))
+        return Object.freeze({ ok: false, reason: "outside_root" });
+    if (relativePath === "")
+        return Object.freeze({ ok: false, reason: "not_regular_file" });
+    let root;
+    try {
+        const canonicalRoot = await realpath(options.rootPath);
+        root = await open(canonicalRoot, "r");
+        const rootStats = await root.stat({ bigint: true });
+        if (!rootStats.isDirectory() || rootStats.ino <= 0n)
+            return Object.freeze({ ok: false, reason: "safe_open_unsupported" });
+        // Metadata only: all content reads happen through the rooted native handles.
+        const targetPath = win32.resolve(canonicalRoot, relativePath);
+        const target = await lstat(targetPath, { bigint: true });
+        if (!target.isFile())
+            return Object.freeze({ ok: false, reason: "not_regular_file" });
+        const canonicalTarget = await realpath(targetPath);
+        if (isOutsideRoot(win32.relative(canonicalRoot, canonicalTarget)))
+            return Object.freeze({ ok: false, reason: "outside_root" });
+        if (options.signal?.aborted)
+            throw windowsReadAbortError();
+        const raw = await runWindowsBoundedRead({
+            rootPath: canonicalRoot,
+            relativePath: relativePath.split(win32.sep).join("/"),
+            rootIdentity: identity(rootStats),
+            targetIdentity: identity(target),
+            maxBytes: String(options.maxBytes),
+        }, options.maxBytes, options.signal);
+        if (options.signal?.aborted)
+            throw windowsReadAbortError();
+        return decodeWindowsReadResult(raw, options.maxBytes);
+    }
+    finally {
+        await root?.close();
+    }
+}

package/dist/src/plugin-sdk/files-windows/result.d.ts

@@ -0,0 +1,4 @@
+import type { BoundedRegularFileReadResult } from "../files.js";
+export declare function windowsReadError(code: string): Error;
+export declare function windowsReadAbortError(): Error;
+export declare function decodeWindowsReadResult(raw: string, maxBytes: number): BoundedRegularFileReadResult;

package/dist/src/plugin-sdk/files-windows/result.js

@@ -0,0 +1,67 @@
+export function windowsReadError(code) {
+    const error = new Error("The Windows safe file read failed (" + code + "). No fallback read was attempted.");
+    return Object.assign(error, { code });
+}
+export function windowsReadAbortError() {
+    const error = new Error("The file read was cancelled.");
+    error.name = "AbortError";
+    return error;
+}
+const FAILURE_REASONS = new Set([
+    "not_regular_file",
+    "too_large",
+    "changed_during_read",
+    "outside_root",
+    "safe_open_unsupported",
+]);
+function hasByteCount(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function decodeNativeFailure(code) {
+    switch (code) {
+        case "filesystem_windows_policy_blocked":
+        case "filesystem_windows_helper_unavailable":
+        case "filesystem_safe_io_unsupported":
+            return Object.freeze({ ok: false, reason: "safe_open_unsupported" });
+        case "filesystem_path_changed":
+        case "filesystem_target_changed":
+        case "filesystem_read_changed":
+        case "filesystem_read_incomplete":
+            return Object.freeze({ ok: false, reason: "changed_during_read" });
+        case "file_too_large":
+            return Object.freeze({ ok: false, reason: "too_large" });
+        case "file_not_found": throw windowsReadError("ENOENT");
+        case "filesystem_access_denied": throw windowsReadError("EACCES");
+        default: throw windowsReadError("EIO");
+    }
+}
+export function decodeWindowsReadResult(raw, maxBytes) {
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw windowsReadError("EIO");
+    }
+    if (value?.ok === false && typeof value.code === "string")
+        return decodeNativeFailure(value.code);
+    if (value?.ok === false && FAILURE_REASONS.has(value.reason)) {
+        if (value.byteCount !== undefined && !hasByteCount(value.byteCount))
+            throw windowsReadError("EIO");
+        return Object.freeze({
+            ok: false,
+            reason: value.reason,
+            ...(value.byteCount !== undefined ? { byteCount: value.byteCount } : {}),
+        });
+    }
+    if (value?.ok !== true || !hasByteCount(value.byteCount))
+        throw windowsReadError("EIO");
+    if (value.byteCount > maxBytes || typeof value.bytes !== "string")
+        throw windowsReadError("EIO");
+    if (value.bytes.length !== 4 * Math.ceil(value.byteCount / 3))
+        throw windowsReadError("EIO");
+    const bytes = Buffer.from(value.bytes, "base64");
+    if (bytes.length !== value.byteCount || bytes.toString("base64") !== value.bytes)
+        throw windowsReadError("EIO");
+    return Object.freeze({ ok: true, bytes, byteCount: value.byteCount });
+}

package/dist/src/plugin-sdk/files.js

@@ -24,6 +24,10 @@ export async function readBoundedRegularFile(absolutePath, options) {
         throw new RangeError("maxBytes must be a non-negative safe integer");
     }
     throwIfAborted(options.signal);
+    if (process.platform === "win32") {
+        const { readWindowsBoundedRegularFile } = await import("./files-windows/read.js");
+        return readWindowsBoundedRegularFile(absolutePath, options);
+    }
     if (typeof constants.O_NOFOLLOW !== "number") {
         return Object.freeze({ ok: false, reason: "safe_open_unsupported" });
     }

package/dist/src/plugin-sdk/index.d.ts

@@ -4,6 +4,7 @@ export * from "./parameters.js";
 export * from "./paths.js";
 export * from "./plugin.js";
 export * from "./results.js";
+export * from "./mutation-result.js";
 export * from "./context-text-result.js";
 export * from "../capabilities/tool-media.js";
 export * from "./tool-availability-brief.js";

package/dist/src/plugin-sdk/index.js

@@ -4,6 +4,7 @@ export * from "./parameters.js";
 export * from "./paths.js";
 export * from "./plugin.js";
 export * from "./results.js";
+export * from "./mutation-result.js";
 export * from "./context-text-result.js";
 export * from "../capabilities/tool-media.js";
 export * from "./tool-availability-brief.js";

package/dist/src/plugin-sdk/mutation-result.d.ts

@@ -0,0 +1,7 @@
+import type { ToolImplementationOutput } from "../plugin-contract/entrypoint.js";
+import { type SuccessResultInput, type ToolResultBudget } from "./results.js";
+/**
+ * Reports a mutation already confirmed by the owning plugin. This helper
+ * preserves its receipt; it does not execute or independently verify a change.
+ */
+export declare function mutationSuccessResult(input: SuccessResultInput, resultBudget?: ToolResultBudget): ToolImplementationOutput;

package/dist/src/plugin-sdk/mutation-result.js

@@ -0,0 +1,11 @@
+import { successResult, } from "./results.js";
+/**
+ * Reports a mutation already confirmed by the owning plugin. This helper
+ * preserves its receipt; it does not execute or independently verify a change.
+ */
+export function mutationSuccessResult(input, resultBudget) {
+    return successResult({
+        ...input,
+        data: { ...input.data, mutationEvidence: true },
+    }, resultBudget);
+}

package/dist/src/runtime/adapters/in-memory-session-store.js

@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { assertSessionProjectUnchanged, copySessionProject, } from "../../sessions/project-binding.js";
 import { assertValidSessionArtifactPathInputs, upsertSessionArtifactPaths, } from "../../sessions/artifact-paths.js";
-import { clientVisibleMessages, compactRequestEvents, filterMessagesAfter, getRequestFinalState, getSessionRequest, isSameMessageId, normalizeAfterSeq, normalizeCursor, normalizeLimit, normalizeSessionTitle, toClientReplayEvent, toEpochMs, toSessionListItem, toSnapshotMessage, toSnapshotRequest, } from "../../sessions/record/projection.js";
+import { compactRequestEvents, getRequestFinalState, getSessionRequest, isSameMessageId, normalizeAfterSeq, normalizeCursor, normalizeLimit, normalizeSessionTitle, toClientReplayEvent, toEpochMs, toSessionListItem, } from "../../sessions/record/projection.js";
+import { projectSessionSnapshot } from "../../sessions/snapshot.js";
 import { assertValidRequestId, assertValidSessionId, createContextEntryId, defaultCreateMessageId, pruneSupersededContextEntries, } from "../../sessions/record/rules.js";
 import { resolveSessionMemoryCheckpointCommit } from "../../sessions/memory/rules.js";
 import { assertSessionKindUnchanged, sessionKindCreationFields } from "../../sessions/spark-session.js";
@@ -99,21 +100,10 @@ class InMemorySessionStore {
         return session ? cloneSession(session) : null;
     }
     async getSessionSnapshot(sessionId, options = {}) {
-        const session = await this.getSessionById(sessionId);
-        if (!session) {
-            return null;
-        }
-        return {
-            sessionId,
-            ...(session.kind ? { kind: session.kind } : {}),
-            ...(session.project ? { project: session.project } : {}),
-            title: session.title,
-            messages: filterMessagesAfter(clientVisibleMessages(session.messages), options.afterMessageId).map((message) => toSnapshotMessage(sessionId, message, session.requests ?? [])),
-            requests: options.includeRequests === false
-                ? []
-                : (session.requests ?? []).map(toSnapshotRequest),
-            nextCursor: null,
-        };
+        assertValidSessionId(sessionId);
+        const session = this.sessions.get(sessionId);
+        // Copy only the projection; identities-only reads never clone history bodies/events.
+        return session ? structuredClone(projectSessionSnapshot(session, options)) : null;
     }
     async getRequestReplayById(requestId, afterSeq = 0) {
         assertValidRequestId(requestId);

package/dist/src/runtime/adapters/long-term-memory/file-lock/acquisition.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { removeEmptyLockTree, removeObservedOwner } from "./cleanup.js";
 import { fileSystemErrorCode, INCOMPLETE_LOCK_GRACE_MS, LOCK_ACQUIRE_TIMEOUT_MS, LOCK_RETRY_DELAY_MS, ownerFileName, } from "./contracts.js";
 import { installLockDirectory } from "./install.js";
+import { isWindowsLockReadDenial } from "./path-observation.js";
 import { readLockSnapshot } from "./snapshot.js";
 import { removeObservedOwnerSynchronously } from "./synchronous-release.js";
 export async function acquireFileLock(lockPath, options) {
@@ -18,7 +19,7 @@ export async function acquireFileLock(lockPath, options) {
         catch (error) {
             if (!isLockContention(error))
                 throw error;
-            const removed = await removeAbandonedLock(lockPath, processIsAlive);
+            const removed = await removeAbandonedLock(lockPath, processIsAlive, deadline, retryDelayMs);
             if (removed)
                 continue;
             if (Date.now() >= deadline) {
@@ -45,8 +46,8 @@ function createRelease(lockPath, token, releaseMode) {
 function requiresSynchronousRelease(mode) {
     return mode === "synchronous";
 }
-async function removeAbandonedLock(lockPath, processIsAlive) {
-    const snapshot = await readLockSnapshot(lockPath);
+async function removeAbandonedLock(lockPath, processIsAlive, deadline, retryDelayMs) {
+    const snapshot = await readContendedSnapshot(lockPath, deadline, retryDelayMs);
     if (!snapshot)
         return true;
     if (snapshot.kind === "legacy_file" || !snapshot.reclaimable)
@@ -64,6 +65,22 @@ async function removeAbandonedLock(lockPath, processIsAlive) {
     }
     return removeEmptyLockTree(lockPath, snapshot.hasLeaseDirectory);
 }
+async function readContendedSnapshot(lockPath, deadline, retryDelayMs) {
+    for (;;) {
+        try {
+            return await readLockSnapshot(lockPath);
+        }
+        catch (error) {
+            if (!isWindowsLockReadDenial(error))
+                throw error;
+            if (Date.now() >= deadline)
+                throw error;
+            // Windows can deny a pending deletion while stat still sees the directory.
+            // Wait within the acquisition budget; an unreadable owner is never reclaimed.
+            await delay(Math.min(retryDelayMs, Math.max(deadline - Date.now(), 0)));
+        }
+    }
+}
 async function hasLiveObservedOwner(snapshot, processIsAlive) {
     if (snapshot.ownerPid === undefined)
         return false;

package/dist/src/runtime/adapters/long-term-memory/file-lock/owner-record.js

@@ -3,10 +3,12 @@ import { open } from "node:fs/promises";
 import { join } from "node:path";
 import { directorySnapshot, fileSystemErrorCode, LEASE_DIRECTORY_NAME, MAX_LOCK_RECORD_BYTES, } from "./contracts.js";
 import { isLockOwnerIdentity } from "./owner-identity.js";
+import { observeLockReadFailure } from "./path-observation.js";
 export async function readOwnerRecord(lockPath, entryName, expectedToken, directoryModifiedAtMs) {
     let handle;
     try {
-        handle = await open(join(lockPath, LEASE_DIRECTORY_NAME, entryName), constants.O_RDONLY | constants.O_NOFOLLOW);
+        const ownerPath = join(lockPath, LEASE_DIRECTORY_NAME, entryName);
+        handle = await open(ownerPath, constants.O_RDONLY | constants.O_NOFOLLOW).catch(async (error) => { throw await observeLockReadFailure(ownerPath, error); });
         const before = await handle.stat({ bigint: true });
         const modifiedAtMs = Math.max(directoryModifiedAtMs, Number(before.mtimeMs));
         const hasReadableRecord = before.isFile() &&

package/dist/src/runtime/adapters/long-term-memory/file-lock/path-observation.d.ts

@@ -0,0 +1,3 @@
+/** Only confirmed disappearance can normalize a Windows pending-delete denial. */
+export declare function observeLockReadFailure(path: string, error: unknown): Promise<unknown>;
+export declare function isWindowsLockReadDenial(error: unknown): boolean;

package/dist/src/runtime/adapters/long-term-memory/file-lock/path-observation.js

@@ -0,0 +1,20 @@
+import { lstat } from "node:fs/promises";
+import { fileSystemErrorCode } from "./contracts.js";
+/** Only confirmed disappearance can normalize a Windows pending-delete denial. */
+export async function observeLockReadFailure(path, error) {
+    if (!isWindowsLockReadDenial(error))
+        return error;
+    try {
+        await lstat(path);
+    }
+    catch (observedError) {
+        if (fileSystemErrorCode(observedError) === "ENOENT")
+            return observedError;
+    }
+    return error;
+}
+export function isWindowsLockReadDenial(error) {
+    if (process.platform !== "win32")
+        return false;
+    return fileSystemErrorCode(error) === "EPERM";
+}

package/dist/src/runtime/adapters/long-term-memory/file-lock/snapshot.js

@@ -2,6 +2,7 @@ import { lstat, readdir } from "node:fs/promises";
 import { join } from "node:path";
 import { directorySnapshot, fileSystemErrorCode, LEASE_DIRECTORY_NAME, OWNER_FILE_PATTERN, } from "./contracts.js";
 import { readOwnerRecord } from "./owner-record.js";
+import { observeLockReadFailure } from "./path-observation.js";
 export async function readLockSnapshot(lockPath) {
     const lockInfo = await readLockInfo(lockPath);
     if (!lockInfo)
@@ -13,7 +14,8 @@ export async function readLockSnapshot(lockPath) {
     try {
         lockEntries = await readdir(lockPath, { withFileTypes: true });
     }
-    catch (error) {
+    catch (readError) {
+        const error = await observeLockReadFailure(lockPath, readError);
         const code = fileSystemErrorCode(error);
         if (code === "ENOENT")
             return undefined;
@@ -45,7 +47,8 @@ async function readLockInfo(lockPath) {
     try {
         return await lstat(lockPath);
     }
-    catch (error) {
+    catch (readError) {
+        const error = await observeLockReadFailure(lockPath, readError);
         if (fileSystemErrorCode(error) === "ENOENT")
             return undefined;
         throw error;
@@ -62,7 +65,8 @@ async function readLeaseSnapshot(lockPath, lockModifiedAtMs) {
         }
         leaseEntries = await readdir(leasePath, { withFileTypes: true });
     }
-    catch (error) {
+    catch (readError) {
+        const error = await observeLockReadFailure(leasePath, readError);
         if (fileSystemErrorCode(error) === "ENOENT") {
             return invalidLeaseSnapshot(lockModifiedAtMs);
         }

package/dist/src/runtime/adapters/passive-learning-runtime.d.ts

@@ -1,7 +1,7 @@
 import type { RuntimeConfig, ModelGatewayClient, SessionStore } from "../ports.js";
 import type { LongTermMemoryService } from "../long-term-memory/contracts.js";
 import type { SessionRequestAdmission } from "../request/session-admission.js";
-/** The environment owns learning; the paired desktop owns native collection. */
+/** The environment owns learning; the collection adapter owns the selected desktop source. */
 export declare function createRuntimePassiveLearning(params: {
     config: RuntimeConfig;
     models: ModelGatewayClient;

package/dist/src/runtime/adapters/passive-learning-runtime.js

@@ -1,10 +1,10 @@
 import { createHash } from "node:crypto";
 import { join } from "node:path";
-import { connectHostObservations } from "../../computer-access/companion/observation-client.js";
+import { connectRuntimeObservations } from "./runtime-observation-connection.js";
 import { createPassiveLearningService } from "../passive-learning/service.js";
 import { createRuntimePassiveLearningModel } from "../passive-learning/model.js";
 import { createCoWorkerResourceDependencies } from "./co-worker-resources.js";
-/** The environment owns learning; the paired desktop owns native collection. */
+/** The environment owns learning; the collection adapter owns the selected desktop source. */
 export function createRuntimePassiveLearning(params) {
     const { config, models, memory } = params;
     const ownerId = createHash("sha256")
@@ -19,7 +19,7 @@ export function createRuntimePassiveLearning(params) {
             config, models, memory, context, ownerId, directory: join(config.paths.runtimeDir, "passive-learning"),
             sessions: params.sessions, deliveryAdmission: params.deliveryAdmission,
         }),
-        connect: (input) => connectHostObservations({
+        connect: (input) => connectRuntimeObservations({
             ...input,
             ownerId,
             rootDir: config.paths.rootDir,

package/dist/src/runtime/adapters/runtime-observation-connection.d.ts

@@ -0,0 +1,5 @@
+import type { HostObservationSubscription } from "../../shared/passive-observation.js";
+/** Installation consent gates every collection route before transport or helper startup. */
+export declare function connectRuntimeObservations(options: HostObservationSubscription): Promise<Readonly<{
+    close(): void;
+}>>;

package/dist/src/runtime/adapters/runtime-observation-connection.js

@@ -0,0 +1,13 @@
+import { connectHostObservations } from "../../computer-access/companion/observation-client.js";
+import { connectNativeObservations } from "../../computer-access/native-observation-connection.js";
+import { requireCollectionConsent } from "../../computer-access/collection-consent.js";
+import { readRuntimeCollectionSource } from "../../computer-access/observation-source.js";
+/** Installation consent gates every collection route before transport or helper startup. */
+export async function connectRuntimeObservations(options) {
+    options.abortSignal.throwIfAborted();
+    await requireCollectionConsent(options.rootDir);
+    options.abortSignal.throwIfAborted();
+    if (readRuntimeCollectionSource().mode === "native")
+        return connectNativeObservations(options);
+    return connectHostObservations(options);
+}

package/dist/src/runtime/admin/config-control.js

@@ -5,6 +5,7 @@ import { loadRuntimeConfig } from "../config.js";
 import { DEFAULT_RUNTIME_CONFIG_FILE } from "../config/constants.js";
 import { loadRuntimeConfigFile } from "../config/loader.js";
 import { RUNTIME_CONFIG_JSON_SCHEMA } from "../config/schema.js";
+import { resolveRuntimePath } from "../config/utils.js";
 import { RuntimeConfigValidationError, validateRuntimeConfigFile, } from "../config/validation.js";
 const NON_SECRET_TOKEN_CONFIG_KEYS = new Set([
     "contextwindowtokens",
@@ -23,7 +24,7 @@ function isRecord(value) {
 }
 function resolveConfigPath(rootDir, configPath) {
     return configPath
-        ? join(rootDir, configPath)
+        ? resolveRuntimePath(rootDir, configPath)
         : join(rootDir, DEFAULT_RUNTIME_CONFIG_FILE);
 }
 function redactConfigValue(value) {

package/dist/src/runtime/automations/catalog.d.ts

@@ -8,6 +8,7 @@ export type AutomationCatalogOperation = Readonly<{
     operationId: string;
     contractVersion: number;
     label: string;
+    outputChannels?: ToolNormalInvocationOperation["outputChannels"];
     pluginName?: string;
     catalogGroups: readonly ToolCatalogGroup[];
     toolDescription?: string;
@@ -32,6 +33,7 @@ export declare function readAutomationCatalog(input: {
         operationId: string;
         contractVersion: number;
         label: string;
+        outputChannels?: ToolNormalInvocationOperation["outputChannels"];
         pluginName?: string;
         catalogGroups: readonly ToolCatalogGroup[];
         toolDescription?: string;
@@ -49,6 +51,7 @@ export declare function readAutomationCatalog(input: {
         operationId: string;
         contractVersion: number;
         label: string;
+        outputChannels?: ToolNormalInvocationOperation["outputChannels"];
         pluginName?: string;
         catalogGroups: readonly ToolCatalogGroup[];
         toolDescription?: string;

package/dist/src/runtime/automations/catalog.js

@@ -16,6 +16,7 @@ export async function readAutomationCatalog(input) {
                 operationId: operation.operationId,
                 contractVersion: registration.contract.version,
                 label: operation.summary,
+                ...(operation.outputChannels ? { outputChannels: operation.outputChannels } : {}),
                 ...(registration.definition.pluginName
                     ? { pluginName: registration.definition.pluginName }
                     : {}),

package/dist/src/runtime/automations/model-dependency-projection.d.ts

@@ -10,11 +10,13 @@ export declare function projectAutomationModelDependencies(config: RuntimeConfig
         admission: Readonly<{
             policy: RequestExecutionPolicyId;
             primaryProfileId?: string;
+            plugins?: import("../config/model-plugin-config.js").RuntimeModelPluginConfig;
             source: "model_profile" | "default";
         }>;
         execution: Readonly<{
             policy: RequestExecutionPolicyId;
             primaryProfileId?: string;
+            plugins?: import("../config/model-plugin-config.js").RuntimeModelPluginConfig;
             source: "model_profile" | "default";
         }>;
         invocations: ({

package/dist/src/runtime/automations/service.d.ts

@@ -122,6 +122,7 @@ export declare function createAutomationService(options: {
             operationId: string;
             contractVersion: number;
             label: string;
+            outputChannels?: import("../../capabilities/tool-types.js").ToolNormalInvocationOperation["outputChannels"];
             pluginName?: string;
             catalogGroups: readonly import("../../capabilities/tool-types.js").ToolCatalogGroup[];
             toolDescription?: string;
@@ -139,6 +140,7 @@ export declare function createAutomationService(options: {
             operationId: string;
             contractVersion: number;
             label: string;
+            outputChannels?: import("../../capabilities/tool-types.js").ToolNormalInvocationOperation["outputChannels"];
             pluginName?: string;
             catalogGroups: readonly import("../../capabilities/tool-types.js").ToolCatalogGroup[];
             toolDescription?: string;

package/dist/src/runtime/capabilities/automation-builder/authoring-reference.d.ts

@@ -47,7 +47,7 @@ export declare const AUTOMATION_AUTHORING_REFERENCE: {
         readonly steps: readonly [{
             readonly key: "evidence";
             readonly kind: "tool";
-            readonly title: "Read structured evidence";
+            readonly title: "Read text evidence";
             readonly operation: {
                 readonly toolName: "catalog_tool";
                 readonly operationId: "catalog_operation";
@@ -63,7 +63,7 @@ export declare const AUTOMATION_AUTHORING_REFERENCE: {
                 readonly evidence: {
                     readonly kind: "node_result";
                     readonly nodeId: "$evidence";
-                    readonly select: "data";
+                    readonly select: "text";
                 };
             };
         }];
@@ -326,10 +326,15 @@ export declare const AUTOMATION_AUTHORING_REFERENCE: {
             };
         };
         readonly channels: {
-            readonly text: "Tool display output; may be counts/status only, not serialized data.";
-            readonly data: "Structured tool output, when provided. Omit pointer to pass it whole, without knowing field names.";
+            readonly text: "Saved text.";
+            readonly data: "Separate optional JSON; no implicit Text channel.";
         };
-        readonly policy: "Use literal for constants, run_input for definition.inputs. node_result needs a succeeded earlier node; no implicit output. Select the operation's documented channel: data for records/ids, text when sufficient. Optional data-only RFC6901 pointer: /field, /items/0; escape ~ as ~0 and / as ~1. Never invent fields or execute future steps to inspect output.";
+        readonly outputChannels: {
+            content: string;
+            metadata: string;
+            conditional: string;
+        };
+        readonly policy: "literal=constants; run_input=definition.inputs; node_result needs prior success. Follow operation.outputChannels; absent=unknown. Whole data needs no pointer. RFC6901 pointers need documented fields (/items/0; ~ as ~0, / as ~1). Never execute steps for output discovery.";
         readonly files: "run_file resolves a new file for each run under its working directory; fileName is one portable filename, no path. source_files requires a configured source and an agent consumer. source_file index selects the frozen batch entry; field=snapshot_path|original_path|version.";
         readonly parallel: "branch_results is agent-only after the referenced parallel join; it supplies each branch's settled tail output/status. A failed/skipped source has no successful node_result for downstream bindings.";
     };

package/dist/src/runtime/capabilities/automation-builder/authoring-reference.js

@@ -61,10 +61,10 @@ export const AUTOMATION_AUTHORING_REFERENCE = {
     },
     bounds: { batch: AUTOMATION_DRAFT_BATCH_LIMITS, recipe: AUTOMATION_CREATION_RECIPE_LIMITS, graph: AUTOMATION_GRAPH_LIMITS },
     createPlanExample: { version: 1, settings: { objective: "Requested workflow outcome" }, steps: [
-            { key: "evidence", kind: "tool", title: "Read structured evidence", operation },
+            { key: "evidence", kind: "tool", title: "Read text evidence", operation },
             { key: "analysis", kind: "agent", title: "Analyze evidence", modelProfileId: "catalog_model_id",
                 prompt: "Analyze the supplied evidence.",
-                inputs: { evidence: { kind: "node_result", nodeId: "$evidence", select: "data" } } },
+                inputs: { evidence: { kind: "node_result", nodeId: "$evidence", select: "text" } } },
         ] },
     creationRules: "New drafts use settings + ordered steps with unique keys and node shapes below. Runtime fills IDs, parents, indices and commands. Defaults: onFailure=stop; tool controls={}; agentMode=fast, roleInstructions='', inputs={}, tools=[], result={kind:'text'}. Override explicitly. Bind earlier results via $key. Parallel: {key,kind:'parallel',branches:[[steps],[steps]]}; branches are ordered and nonempty. Edit with commands; never mix commands and steps.",
     creationCapacity: `Budget ${AUTOMATION_CREATION_RECIPE_LIMITS.compiledCommands}: leaf=1, parallel group=1, nonempty settings=1; total across all branches. With settings, max ${AUTOMATION_CREATION_RECIPE_LIMITS.compiledCommands - 1} flat steps. Oversize rejects atomically: automation_recipe_capacity_exceeded. Expand with later draft edits.`,
@@ -107,12 +107,13 @@ export const AUTOMATION_AUTHORING_REFERENCE = {
         acceptanceExample: [{ field: "ready", equals: true }],
         acceptancePolicy: "Optional acceptance compares required scalar JSON fields to string/number/boolean values of the same type. A mismatch fails the step under onFailure, not a conditional branch. Use [] to clear. No if/else graph construct exists.", },
     bindings: { examples: bindings,
-        channels: { text: "Tool display output; may be counts/status only, not serialized data.",
-            data: "Structured tool output, when provided. Omit pointer to pass it whole, without knowing field names." },
-        policy: "Use literal for constants, run_input for definition.inputs. node_result needs a succeeded earlier node; no implicit output. Select the operation's documented channel: data for records/ids, text when sufficient. Optional data-only RFC6901 pointer: /field, /items/0; escape ~ as ~0 and / as ~1. Never invent fields or execute future steps to inspect output.",
+        channels: { text: "Saved text.", data: "Separate optional JSON; no implicit Text channel." },
+        outputChannels: { content: "Substantive output; may be bounded/summarized.",
+            metadata: "IDs, status, counts or receipts; no content body.",
+            conditional: "Depends on operation inputs; do not assume content." },
+        policy: "literal=constants; run_input=definition.inputs; node_result needs prior success. Follow operation.outputChannels; absent=unknown. Whole data needs no pointer. RFC6901 pointers need documented fields (/items/0; ~ as ~0, / as ~1). Never execute steps for output discovery.",
         files: "run_file resolves a new file for each run under its working directory; fileName is one portable filename, no path. source_files requires a configured source and an agent consumer. source_file index selects the frozen batch entry; field=snapshot_path|original_path|version.",
-        parallel: "branch_results is agent-only after the referenced parallel join; it supplies each branch's settled tail output/status. A failed/skipped source has no successful node_result for downstream bindings.",
-    },
+        parallel: "branch_results is agent-only after the referenced parallel join; it supplies each branch's settled tail output/status. A failed/skipped source has no successful node_result for downstream bindings.", },
     definition: {
         editableFields: ["title", "objective", "workingDirectory", "trigger", "source", "inputs", "limits"],
         replacement: "A patch merges top-level fields only; inputs, controls, tools, result, acceptance, source, trigger and limits replace their entire field. Keep existing entries when changing part. Limits require all seven keys.",