@abot-ai/runtime 1.6.0 → 1.8.0

package/dist/src/web-ui/system-host-setup/routes.js

@@ -5,12 +5,15 @@ import { readBody, sendJson } from "../local-runtime/http.js";
 import { hostBearerCredential } from "./native-authorization.js";
 import { renderCompanionInstaller, } from "./installers.js";
 import { InstallerInputError } from "./installer-contract.js";
+import { WINDOWS_COMPANION_STORE_URL } from "../../computer-access/companion/windows-store/identity.js";
 import { readInstallerCompanionBundle } from "./companion-bundle.js";
 import { LocalHostConnection, LOCAL_HOST_SETUP_PATH } from "./local-connection.js";
+import { handleWindowsStoreConnection, WINDOWS_STORE_CONNECTION_PATH } from "./windows-store-route.js";
+import { HostSetupMutation } from "./setup-mutation.js";
 const setupPath = "/web-api/runtime/system-host/setup";
 const bundlePath = "/web-api/runtime/system-host/bundle";
 export function isHostSetupRoute(pathname) {
-    return [setupPath, bundlePath, LOCAL_HOST_SETUP_PATH].includes(pathname);
+    return [setupPath, bundlePath, LOCAL_HOST_SETUP_PATH, WINDOWS_STORE_CONNECTION_PATH].includes(pathname);
 }
 export function sendHostSetupInputError(response, error) {
     if (!(error instanceof InstallerInputError))
@@ -37,6 +40,9 @@ function isSetupPlatformRequest(value) {
         return true;
     return platform === "windows" || platform === "macos";
 }
+function canDownloadCompanionInstaller(platform) {
+    return platform === "macos" || platform === "linux";
+}
 function requestRuntimeOrigin(request) {
     const encrypted = "encrypted" in request.socket && request.socket.encrypted;
     return new URL(`${encrypted ? "https" : "http"}://${request.headers.host}`)
@@ -45,21 +51,29 @@ function requestRuntimeOrigin(request) {
 /** GUI writes use same-origin JSON; native code downloads use the expiring setup grant. */
 export class HostSetupRoutes {
     dependencies;
+    mutation = new HostSetupMutation();
     local;
     constructor(dependencies) {
         this.dependencies = dependencies;
-        this.local = new LocalHostConnection({ ...dependencies, bundle: () => this.bundle() });
+        this.local = new LocalHostConnection({ ...dependencies, mutation: this.mutation, bundle: () => this.bundle() });
     }
     rejectConcurrentMutation(response) {
-        return this.local.rejectConcurrentMutation(response);
+        return this.mutation.rejectConcurrentMutation(response);
     }
-    async close() { await this.local.close(); }
+    async close() { await this.mutation.close(); }
     async bundle() {
         if (this.dependencies.bundleFile)
             return readFile(this.dependencies.bundleFile);
         return readInstallerCompanionBundle();
     }
     async handle(request, response, pathname) {
+        if (pathname === WINDOWS_STORE_CONNECTION_PATH) {
+            await handleWindowsStoreConnection(request, response, {
+                ...this.dependencies,
+                mutation: this.mutation,
+            });
+            return;
+        }
         if (pathname === LOCAL_HOST_SETUP_PATH) {
             await this.local.handle(request, response);
             return;
@@ -89,10 +103,21 @@ export class HostSetupRoutes {
             });
             return;
         }
-        if (this.rejectConcurrentMutation(response))
+        const platform = input.platform;
+        if (!canDownloadCompanionInstaller(platform)) {
+            sendJson(response, 410, {
+                ok: false,
+                error: "windows_store_required",
+                message: "Install or update ABot AI Companion through Microsoft Store.",
+                storeUrl: WINDOWS_COMPANION_STORE_URL,
+            });
             return;
+        }
+        await this.mutation.run(response, () => this.issueSetupInstaller(request, response, platform));
+    }
+    async issueSetupInstaller(request, response, platform) {
         const readiness = await this.dependencies.readiness();
-        if (!readiness.platforms.includes(input.platform)) {
+        if (!readiness.platforms.includes(platform)) {
             sendJson(response, 409, {
                 ok: false,
                 error: "host_setup_not_required",
@@ -103,14 +128,12 @@ export class HostSetupRoutes {
         // Read and hash the exact running build before creating a setup grant.
         const bundle = await this.bundle();
         await this.dependencies.prepareCompanion();
-        if (this.rejectConcurrentMutation(response))
-            return;
         const upgrading = Boolean(this.dependencies.store.host());
         const pairing = upgrading
             ? this.dependencies.store.beginBundleUpgrade()
             : this.dependencies.store.begin(15 * 60_000);
         const installer = await renderCompanionInstaller({
-            platform: input.platform,
+            platform,
             url: requestRuntimeOrigin(request),
             code: pairing.code,
             expiresAt: pairing.expiresAt,

package/dist/src/web-ui/system-host-setup/setup-mutation.d.ts

@@ -0,0 +1,9 @@
+import type { ServerResponse } from "node:http";
+/** One installation owns one in-flight computer setup across connection routes. */
+export declare class HostSetupMutation {
+    private pending?;
+    get busy(): boolean;
+    rejectConcurrentMutation(response: ServerResponse): boolean;
+    run(response: ServerResponse, operation: () => Promise<void>): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/src/web-ui/system-host-setup/setup-mutation.js

@@ -0,0 +1,27 @@
+import { sendJson } from "../local-runtime/http.js";
+/** One installation owns one in-flight computer setup across connection routes. */
+export class HostSetupMutation {
+    pending;
+    get busy() { return this.pending !== undefined; }
+    rejectConcurrentMutation(response) {
+        if (!this.busy)
+            return false;
+        sendJson(response, 409, { ok: false, error: "host_setup_in_progress",
+            message: "Computer access is being connected. Wait for setup to finish." });
+        return true;
+    }
+    async run(response, operation) {
+        if (this.rejectConcurrentMutation(response))
+            return;
+        const pending = Promise.resolve().then(operation);
+        this.pending = pending;
+        try {
+            await pending;
+        }
+        finally {
+            if (this.pending === pending)
+                this.pending = undefined;
+        }
+    }
+    async close() { await this.pending?.catch(() => undefined); }
+}

package/dist/src/web-ui/system-host-setup/windows-store-route.d.ts

@@ -0,0 +1,13 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { HostPairingStore } from "../../computer-access/companion/pairing-store.js";
+import type { HostReadiness } from "./readiness.js";
+import type { HostSetupMutation } from "./setup-mutation.js";
+export declare const WINDOWS_STORE_CONNECTION_PATH = "/web-api/runtime/system-host/store-connect";
+type StoreConnectionDependencies = Readonly<{
+    store: HostPairingStore;
+    readiness(): Promise<HostReadiness>;
+    prepareCompanion(): Promise<void>;
+    mutation: HostSetupMutation;
+}>;
+export declare function handleWindowsStoreConnection(request: IncomingMessage, response: ServerResponse, dependencies: StoreConnectionDependencies): Promise<void>;
+export {};

package/dist/src/web-ui/system-host-setup/windows-store-route.js

@@ -0,0 +1,68 @@
+import { COMPANION_RELEASE_VERSION } from "../../computer-access/companion/release-version.js";
+import { createStoreConnectionLink, normalizeStoreConnectionOrigin } from "../../computer-access/companion/windows-store/connection-link.js";
+import { WINDOWS_COMPANION_STORE_URL } from "../../computer-access/companion/windows-store/identity.js";
+import { acceptConfigMutationRequest } from "../local-runtime/config-mutation-request.js";
+import { readBody, sendJson } from "../local-runtime/http.js";
+export const WINDOWS_STORE_CONNECTION_PATH = "/web-api/runtime/system-host/store-connect";
+function canStartWindowsStoreConnection(readiness) {
+    if (!readiness.platforms.includes("windows"))
+        return false;
+    if (readiness.restartRequired)
+        return false;
+    if (readiness.route === "wsl_interop")
+        return false;
+    return readiness.route !== "native";
+}
+function hasEmptyConnectionBody(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.keys(value).length === 0;
+}
+export async function handleWindowsStoreConnection(request, response, dependencies) {
+    response.setHeader("Cache-Control", "no-store");
+    if (request.method !== "POST") {
+        sendJson(response, 405, { ok: false, error: "method_not_allowed" });
+        return;
+    }
+    if (!acceptConfigMutationRequest(request, response))
+        return;
+    let body;
+    try {
+        body = JSON.parse((await readBody(request, { maxBytes: 1_024 })).toString());
+    }
+    catch { /* rejected below */ }
+    if (!hasEmptyConnectionBody(body)) {
+        sendJson(response, 400, { ok: false, error: "invalid_store_connection_request" });
+        return;
+    }
+    await dependencies.mutation.run(response, () => issueWindowsStoreConnection(request, response, dependencies));
+}
+async function issueWindowsStoreConnection(request, response, dependencies) {
+    if (!canStartWindowsStoreConnection(await dependencies.readiness())) {
+        sendJson(response, 409, { ok: false, error: "host_setup_not_required", message: "Refresh the computer connection status." });
+        return;
+    }
+    const encrypted = "encrypted" in request.socket && request.socket.encrypted;
+    let origin;
+    try {
+        origin = normalizeStoreConnectionOrigin(`${encrypted ? "https" : "http"}://${request.headers.host}`);
+    }
+    catch {
+        sendJson(response, 400, { ok: false, error: "host_store_connection_rejected", message: "Store connection requires a local HTTP Runtime origin on this computer." });
+        return;
+    }
+    await dependencies.prepareCompanion();
+    const previous = dependencies.store.host();
+    const pairing = previous ? dependencies.store.beginBundleUpgrade() : dependencies.store.begin(15 * 60_000);
+    try {
+        const launchUrl = createStoreConnectionLink({
+            version: 1, url: origin, code: pairing.code, expiresAt: pairing.expiresAt,
+            companionRelease: COMPANION_RELEASE_VERSION,
+            ...(previous ? { upgradeHostId: previous.hostId } : {}),
+        });
+        sendJson(response, 200, { ok: true, launchUrl, expiresAt: pairing.expiresAt, storeUrl: WINDOWS_COMPANION_STORE_URL });
+    }
+    catch {
+        sendJson(response, 400, { ok: false, error: "host_store_connection_rejected", message: "Store connection requires a local HTTP Runtime origin on this computer." });
+    }
+}

package/docs/configuration.md

@@ -17,6 +17,21 @@ local paths, and profile choices there. The provider, concrete model id, and
 default profile are required configuration; the runtime does not supply a
 built-in model choice.
 
+## Web UI history pages
+
+`webUi.pageSize` controls the number of sessions or messages loaded per page in
+ordinary conversations and SPARK. It defaults to `20` and accepts a positive integer:
+
+```json
+{ "webUi": { "pageSize": 20 } }
+```
+
+The Web UI loads more sessions while scrolling down and older messages while
+scrolling up. Message activity travels with the corresponding message page.
+Read state and active requests remain independent of the displayed page.
+Pagination does not truncate model history or change the session file format;
+opening a conversation still reads its canonical JSON file before projecting a page.
+
 ## Secrets
 
 Do not put secret values in JSON config. Store them in `.env`, service
@@ -427,6 +442,37 @@ secrets declarations, and skill bindings remain in each plugin package.
 Runtime orchestration does not hardcode concrete tool names or use the catalog
 to classify the user request.
 
+
+A model profile can further restrict that catalog with `plugins.deny`, including
+inside its linked `models/<profile>.config.json` file:
+
+```json
+{
+  "plugins": {
+    "deny": ["filesystem.read_file", "memory"]
+  }
+}
+```
+
+These selectors use the same matching rules as the global deny list. They can
+only remove globally available capabilities. Omission or an empty list adds no
+model restriction. The effective primary profile selected for the request owns
+the restriction for the entire request, including delegated roles, per-step
+model overrides and approval resumes. Both Supervisor/Worker and Execution
+Agent use the same filtered catalog and execution guard. This metadata stays in
+the Runtime and is not sent to the model provider. Plugin loading and
+`prepareRequest` hooks remain part of the existing shared plugin lifecycle.
+
+In the Web UI **Models** workspace, expand **Plugin access** to allow or block
+plugins for the selected model. Expand a plugin to control its individual tools.
+The switches edit exact plugin IDs and qualified `plugin.tool` deny selectors;
+turning a plugin off and on preserves its individual tool restrictions. Counts
+show the tools available after global and model restrictions. Save the model
+file, then apply configuration changes. Global restrictions still apply and
+cannot be lifted here. Shared bare-tool rules, wildcards, missing-plugin IDs and
+selectors that affect another plugin remain unchanged; review them under
+**Saved rules** and edit them in the displayed model configuration file.
+
 For public or multi-model installs, keep each model's detailed calibration in a
 separate model profile file instead of expanding the main runtime config:
 

package/docs/installation.md

@@ -140,10 +140,69 @@ See [Passive Long-Term Memory](long-term-memory.md) before enabling persistence.
 
 ### Computer Access During Setup
 
-The optional **Computer** step and **Home → Computer access** manage one
-Computer access connection shared by SYSTEM tools, ABot Spark and compatible
-plugins. Direct native/WSL command access can already work; the shared companion
-adds desktop access and background collection without a second ABot Spark setup.
+The **Computer** step and computer card on **Home** use the platform where the
+Runtime is running. Direct native/WSL command access can already work; compatible
+plugins still require their own permissions.
+
+#### Native Windows
+
+When the Runtime runs directly on Windows, computer setup does not require
+Companion or a pairing link. Compatible tools run locally with their existing
+approval controls. Spark uses the same Windows collection implementation locally.
+Opening a WSL or Docker Runtime in a Windows browser still uses the Companion
+connection described below.
+
+#### Spark collection acknowledgment
+
+On every platform, Spark asks for an explicit, initially unchecked acknowledgment
+before granting collection permission or starting collection. It explains the
+application content collected and how the configured learning model may receive
+it, with links to the [Software Terms](https://abot-ai.com/terms/#software) and
+[Privacy Policy](https://abot-ai.com/privacy/#software).
+
+The acknowledgment is saved once per ABot installation, shared across environments,
+and retained across updates and computer re-pairing. Existing installations also
+need to acknowledge it once. This record does not enable collection or learning:
+activity permissions and Start/Stop remain separate. Previously enabled collection
+resumes after a Runtime restart according to its saved schedule and permissions.
+Where Companion is required, connect the computer as an additional step before
+starting collection.
+
+#### Windows computer connected to WSL or Docker: Microsoft Store connection
+
+**ABot AI Companion** is available from
+[Microsoft Store](https://apps.microsoft.com/detail/9PK2FDQQLQS9).
+The product ID is `9PK2FDQQLQS9`.
+
+Start with the computer connection card on **Home**, or the optional **Computer**
+setup step:
+
+1. Choose **Install from Microsoft Store** to open **ABot AI Companion**.
+2. Install it once on the Windows computer you want to connect.
+3. Return to ABot and choose **I already have it**.
+4. Choose **Open Companion**. The browser may ask permission to open it.
+5. Check the Runtime address shown by Companion and approve the connection.
+6. Companion shows connection progress; this can take a few seconds. Wait for
+   **Your computer is ready** in the Web UI.
+
+If Companion is already installed, start at step 3. The short-lived connection
+link is a private invitation; do not share it. Request a new link if it expires.
+The Web UI confirms the live connection rather than guessing whether the app is
+installed.
+
+If the computer is already paired but offline, choose **Open Companion**, then
+start the saved connection in the app. If you disconnected inside Companion or
+removed its saved connection, choose **Set up again** in ABot. Confirm the
+reset, then open Companion and approve the new connection. Re-pairing revokes the
+previous computer connection; it does not erase saved insights.
+
+Store updates are intended to preserve the saved pairing. Computer actions and
+optional Spark collection retain their existing, separate permission controls.
+Computer content used by ABot may reach your selected model provider. Installation
+alone does not start Spark collection. See [Windows Companion Store delivery](windows-companion-store.md)
+for connection details and update compatibility.
+
+#### macOS
 
 When ABot runs natively on your Mac, open its local Web UI and choose **Connect
 this Mac**. ABot uses its installed Node runtime and companion bundle, pairs the
@@ -151,6 +210,22 @@ computer and enables startup at sign-in. This path does not download a Finder
 installer or require an Apple Developer account. Use **Repair Mac connection**
 to repair or update an existing connection while retaining its pairing.
 
+After updating and restarting Runtime, an already connected Mac may still have
+an older Marketplace installation-link handler. If **Repair Mac connection** is not
+offered, use the updated CLI on that Mac to refresh the connection:
+
+```sh
+abot host status
+abot host connect --url '<url from host status>'
+```
+
+For a project-local installation, run both commands as `npx --no-install abot ...`
+from that project instead. Use the exact saved `url` reported by `host status`,
+not a new address. This reuses the existing pairing, refreshes the managed
+Companion and link handler, and briefly reconnects Computer Access. Do not run
+`disconnect` first. Then retry the Marketplace link: it opens plugin review,
+not an automatic installation.
+
 For a Mac connecting to a Docker or forwarded Runtime, choose **Connect a Mac**.
 Install the ABot CLI on that Mac, run the displayed `abot host connect --url ...`
 command in its graphical login, then paste the one-time code when Terminal asks.
@@ -205,11 +280,15 @@ not change Computer access pairing or send a model request. Application-specific
 Automation/Apple Events and protected-file access may still require separate
 consent for the applications or locations used by a later SYSTEM command.
 
-For Windows or Linux, download setup and run it in that computer's graphical
-login. Windows setup installs the companion and a private Node runtime; Linux
-uses an existing Node.js installation. Setup pairs automatically and enables
-startup at sign-in. Wait for **Ready** in the Web UI; downloading alone does not
-establish a connection. WSL uses the same Windows companion setup, which does
+#### Linux and WSL
+
+For Linux, download setup and run it in that computer's graphical login. Setup
+uses an existing Node.js installation, pairs automatically and enables startup
+at sign-in. Wait for **Ready** in the Web UI; downloading alone does not establish
+a connection. This Linux flow is unchanged by the Windows Store integration.
+
+Running ABot in WSL and existing WSL interop access are unchanged. To connect the
+Windows desktop to a WSL Runtime, use the Windows Companion flow above; it does
 not require changing interop settings or restarting the distribution.
 
 Installation does not enable ABot Spark collection or disabled plugin tools.
@@ -355,22 +434,3 @@ profile without changing runtime policy or another model's settings.
 
 The repository ignores `.env`, `local/runtime.config.json`, `.runtime/`, and
 `dist/`. Do not commit local secrets or generated runtime state.
-
-## Verify Package Surface
-
-Before publishing or opening a release PR:
-
-```bash
-npm test -- --run
-npm run build
-npm run smoke:runtime-package
-npm run check:runtime-package
-npm run smoke:packed-runtime-package
-git diff --check
-```
-
-`npm run build` regenerates `runtime.config.schema.json`, clears stale `dist`,
-and compiles the published TypeScript declarations.
-
-For the full public release checklist, see
-[`docs/publishing.md`](publishing.md).