@abot-ai/runtime 1.6.0 → 1.8.0

package/plugins/system/README.md

@@ -9,6 +9,76 @@ configuration. Ask and Full retain exact-action approvals; Full+ retains its nor
 approval policy. OS accessibility, screen-recording and portal permissions still
 apply. An available shell or connected companion does not prove desktop readiness.
 
+## Command working directory
+
+On native Windows, `system_command.cwd` accepts the same logical paths as
+`filesystem`: `.` and ordinary relative paths use the request's agent-work root;
+`workspace/...` uses the configured workspace. The request-bound resolver checks
+these roots and resolves the full directory before exact-action approval. Approval,
+activity and execution use that same captured absolute path. Absolute paths retain
+their existing target-OS meaning and may be outside those roots.
+
+The request root is also retained across approval resume, even if the configured
+agent-work root changes. The adapter does not rewrite the command or choose a tool
+or execution strategy. Linux/macOS, WSL interop and Companion targeting retain the
+existing absolute-cwd contract; no guest-to-host directory mapping is performed.
+
+## Local command output
+
+Local `system_command` execution, including Windows through WSL interop, captures
+stdout and stderr to private files under the plugin state directory. Temporary raw
+disk storage is allowed inside this boundary. Once both streams reach natural EOF,
+SYSTEM's independent secret detector checks their full text before any output read
+or delivery. Suspected streams are replaced with `[REDACTED]`. An incomplete check,
+invalid UTF-8 or scanner failure withholds output, attempts to remove raw stream
+files and retains a safe process receipt.
+
+There is no new total-output quota or truncation. Checking and final delivery still
+materialize text in memory. The existing SDK context-text contract lets the Runtime
+admit or compact the checked text using its normal model-context budget; even the
+compaction model receives only checked text. Small clean results are unchanged.
+
+`extensions["ai.abot.runtime"].settings.defaults.outputRetentionMs` in the plugin's
+`plugin.json` controls retention; the default is seven days after capture completes. Cleanup protects active captures and removes expired
+captures during plugin initialization and periodic maintenance, including raw
+leftovers after a crash or interrupted cleanup. Removal is ordinary file cleanup,
+not guaranteed forensic erasure. Reads do not renew
+retention. Completed captures keep the retention recorded at creation across
+Companion reconnects and later configuration changes. Each capture has an opaque
+ID, byte counts and a saved process receipt;
+files are private implementation storage, not user-authored artifacts or model
+instructions. No wait/cancel operation or automatic command replay is added.
+
+A storage failure before dispatch prevents the command from starting. A capture
+write failure stops observation of that command and reports incomplete output;
+external descendants are not assumed terminated. Delivery failures retain the
+capture receipt, recorded helper PID, process status and exit code when available.
+This does not grant a new model-facing operation for reading retained captures.
+
+Application/target descriptions and launch results are checked before excerpts.
+Sensitive actionable catalog identities are withheld instead of replaced by a
+fabricated executable identifier. Input receipts retain their mechanical meaning.
+
+## Companion command output
+
+Updated companions advertise `host_secret_protection_v1` and
+`system_command_output_v1`. SYSTEM then uses private
+capture/read/close operations over the existing connection: the Companion stores
+checked streams in its private state directory using its own detector with the
+capture implementation,
+returns the process receipt, and serves 64 KiB byte chunks. SYSTEM verifies the
+capture ID, stream, offset, byte count and SHA-256 before delivering text through
+the existing context-text contract. UTF-8 characters may cross chunk boundaries.
+The model receives one tool result; transport chunks do not invoke a model.
+
+Output references belong to the authenticated Companion connection. Transfers
+protect their captures from expiry until closed or disconnected; the configured
+SYSTEM retention then continues on disk. A failed transfer preserves the command
+receipt and never repeats execution. Companions missing protection or complete
+command capture fail before dispatch with an upgrade-required result; there is no
+unprotected legacy fallback. This transfer adds no model-facing tool, and final
+text delivery still materializes the streams in memory.
+
 ## Shared connection
 
 Use **Home → Computer access** for one installation shared
@@ -94,9 +164,18 @@ request. Metadata remains within the ordinary tool-result budgets. A companion s
 64 KiB private chunks through the existing bounded local protocol; bytes never enter
 model-visible JSON output.
 
+Before frame/media retention, each owner checks desktop/window/accessibility text
+and diagnostic fields. Suspected text is masked and its associated image is
+withheld; input that already occurred retains its dispatch receipt. Ordinary
+images remain available. Pixel-only content is not inspected: OCR and additional
+installation dependencies are deferred. Version 1 is best-effort known-indicator
+protection, not a guarantee that an admitted image or text is free of secrets.
+
 The Runtime stores images in request-owned memory, projects them only to consumers
-of the original tool evidence, excludes them from history/provider traces, and
-disposes buffers and registered resources at request end or abort. A non-vision
+of the original tool evidence, and excludes them from history/provider traces.
+Approval-wait continuation snapshots may persist request-owned image bytes; the
+owner's checks therefore precede media admission, not merely model projection.
+Buffers and registered resources are disposed at request end or abort. A non-vision
 model receives an explicit image-input limitation and can still use available text
 observations. Companion frames are erased after transfer, replacement or close;
 abandoned native sessions have a bounded idle expiry and close on disconnection.
@@ -108,6 +187,3 @@ source compilation where available. They prove transport, identity, cancellation
 image lifetime and projection invariants. Interactive acceptance on each actual OS,
 permission configuration, compositor and provider remains a distinct live check;
 unit checks alone do not establish all native integrations work on a user's machine.
-The Windows helper has been compiled on Windows; its interactive behavior has not
-been exercised. macOS native compilation and interactive Linux/macOS checks remain
-unverified in this Windows/WSL development environment.

package/plugins/system/plugin.json

@@ -4,9 +4,18 @@
   "version": "1.0.0",
   "description": "System commands, applications and structured observation/control of existing user desktops across native and locally connected OS targets.",
   "extensions": {
+    "ai.abot.compatibility": {
+      "version": 1,
+      "runtimePlatforms": ["linux", "darwin", "win32"]
+    },
     "ai.abot.runtime": {
       "version": 1,
       "entrypoint": "./src/index.cjs",
+      "settings": {
+        "defaults": {
+          "outputRetentionMs": 604800000
+        }
+      },
       "catalogGroups": [
         "system"
       ],
@@ -76,7 +85,7 @@
           ],
           "operations": {
             "run_system_command": {
-              "summary": "Run a shell command on an available OS target with absolute cwd in its namespace. The complete command, including inline file content, is limited to 4096 characters. File payload tools support larger bodies in the runtime-host namespace. Can read exposed application/browser text via native accessibility APIs, including signed-in pages. Verify the document and text. Capability references are not commands; exit zero is not effect evidence.",
+              "summary": "Run a shell command in the selected OS. cwd must be absolute; native Windows also accepts agent-work-relative paths and workspace/. The entire command is limited to 4096 characters; use file payload tools for larger bodies. Native accessibility APIs can read exposed app/browser text, including signed-in pages; verify the document and text. Capability references are not commands; exit zero is not effect evidence.",
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/system/skills/system_actions/SKILL.md

@@ -16,7 +16,7 @@ When this catalog is insufficient, continue bounded, task-relevant inspection wi
 
 ## Execute the user's task
 
-system_command executes general system commands using Bash for Linux/macOS or PowerShell for Windows. Supply an absolute cwd in the target OS namespace; it may be outside the project. Commands can inspect or manage applications, processes, services, installations, settings, network and files for the user's task. They run with actual host identity; elevated=true requests the supported native privilege path. Linux needs existing noninteractive sudo authorization, macOS uses its native administrator dialog, and Windows needs an authorized elevated host. Never fabricate credentials or bypass an OS authorization prompt.
+system_command executes general system commands using Bash for Linux/macOS or PowerShell for Windows. Supply an absolute cwd in the target OS namespace; it may be outside the project. On native Windows only, cwd also accepts the runtime filesystem namespace: `.` and relative paths start at the request agent-work root, and `workspace/...` selects the configured workspace. The adapter resolves that directory before approval. WSL interop and Companion still require an absolute target-OS path; no cross-OS path mapping is implied. Commands can inspect or manage applications, processes, services, installations, settings, network and files for the user's task. They run with actual host identity; elevated=true requests the supported native privilege path. Linux needs existing noninteractive sudo authorization, macOS uses its native administrator dialog, and Windows needs an authorized elevated host. Never fabricate credentials or bypass an OS authorization prompt.
 
 Use system_launch with the exact application identity returned by the target catalog; it revalidates that identity before dispatch. A catalog identity is not a raw executable path. There is no brand-specific application allowlist. Documented native invocations and further application control use system_command. Linux and Windows catalog identities do not define generic raw arguments; use the application's actual command interface when arguments are needed.
 

package/plugins/system/source/command-working-directory.ts

@@ -0,0 +1,47 @@
+import { win32 } from "node:path";
+import type {
+  RuntimeToolPathResolver,
+  ToolCall,
+  ToolCallAdapter,
+} from "../../../src/plugin-sdk/index.js";
+import type { SystemTargetSnapshot } from "./request-target-snapshot.js";
+
+/** Resolve before exact-action approval; execution consumes the captured absolute cwd. */
+export function createSystemCommandPathAdapter(
+  adapter: ToolCallAdapter | undefined,
+  snapshot: SystemTargetSnapshot,
+  resolver: RuntimeToolPathResolver | undefined,
+): ToolCallAdapter | undefined {
+  if (!resolver) return adapter;
+  return {
+    ...adapter,
+    normalizeCall(input) {
+      const call = adapter?.normalizeCall?.(input) ?? input;
+      if (!hasNativeWindowsRelativeDirectory(call, snapshot)) return call;
+      const directory = resolver.resolve(call.params.cwd, {
+        requirePath: true,
+        allowedLocations: ["agent_work", "workspace"],
+      });
+      return {
+        ...call,
+        params: { ...call.params, cwd: directory.absolutePath },
+      };
+    },
+  };
+}
+
+function hasNativeWindowsRelativeDirectory(
+  call: ToolCall,
+  snapshot: SystemTargetSnapshot,
+): boolean {
+  if (call.tool !== "system_command") return false;
+  if (call.params.target !== "windows") return false;
+  if (typeof call.params.cwd !== "string") return false;
+  if (win32.isAbsolute(call.params.cwd.trim())) return false;
+  const route = snapshot.find((entry) => {
+    if (entry.kind !== "native") return false;
+    if (entry.target.id !== "windows") return false;
+    return entry.target.transport === "native";
+  });
+  return route !== undefined;
+}

package/plugins/system/source/companion-command-output.ts

@@ -0,0 +1,82 @@
+import { createHash } from "node:crypto";
+import { StringDecoder } from "node:string_decoder";
+import { deliverPluginTextResult, failureResult, type ToolExecutionContext,
+  type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import { SYSTEM_OUTPUT_CAPABILITY, SYSTEM_OUTPUT_CHUNK_BYTES, readSystemOutputTransfer,
+  type ComputerAccessConnection, type HostOperation } from "../../../src/plugin-sdk/computer-access.js";
+import type { SystemRequestRoute } from "./request-target-snapshot.js";
+
+type CompanionRoute = Extract<SystemRequestRoute, { kind: "companion" }>;
+type Transfer = ReturnType<typeof readSystemOutputTransfer>;
+type HostCall = (operation: HostOperation, params: Record<string, unknown>, signal?: AbortSignal) => Promise<ToolImplementationOutput>;
+
+export function supportsCompanionCommandOutput(route: CompanionRoute): boolean {
+  return route.capabilities?.includes(SYSTEM_OUTPUT_CAPABILITY) === true;
+}
+
+/** Transfer is private adapter IO; the model receives one settled tool result. */
+export async function executeCompanionCommand(input: {
+  rootDir: string;
+  route: CompanionRoute;
+  connection: ComputerAccessConnection;
+  params: Record<string, unknown>;
+  outputRetentionMs?: number;
+  context?: ToolExecutionContext;
+}): Promise<ToolImplementationOutput> {
+  const { route, context } = input;
+  const call: HostCall = (operation, params, signal) => input.connection.executeHostOperation(input.rootDir, {
+    hostId: route.hostId, connectionId: route.connectionId, operation,
+    params: { ...params, target: route.target }, ...(signal ? { abortSignal: signal } : {}),
+  });
+  const receipt = await call("system_command_capture", {
+    ...input.params, ...(input.outputRetentionMs !== undefined ? { outputRetentionMs: input.outputRetentionMs } : {}),
+  }, context?.abortSignal);
+  if (!receipt.data?.outputTransfer && !receipt.ok) return receipt;
+  let transfer: Transfer | undefined;
+  try {
+    transfer = readSystemOutputTransfer(receipt.data?.outputTransfer);
+    const stdout = await readStream(call, transfer, "stdout", context?.abortSignal);
+    const stderr = await readStream(call, transfer, "stderr", context?.abortSignal);
+    const { outputTransfer: _transfer, ...data } = receipt.data ?? {};
+    const delivered = deliverPluginTextResult({ ...receipt, stdout, stderr: stderr || receipt.stderr,
+      data: { ...data, outputDelivery: "complete", summaryOmittedChars: { stdout: stdout.length, stderr: stderr.length } },
+    }, ["stdout", "stderr"], context?.resultBudget);
+    if (delivered.errorCode === "plugin_result_too_large") return transferFailure(receipt, context);
+    return delivered;
+  } catch {
+    return transferFailure(receipt, context);
+  } finally {
+    if (transfer) await call("system_command_output_close", { captureId: transfer.id }, AbortSignal.timeout(3_000)).catch(() => undefined);
+  }
+}
+
+async function readStream(call: HostCall, transfer: Transfer, stream: "stdout" | "stderr", signal?: AbortSignal): Promise<string> {
+  const size = stream === "stdout" ? transfer.stdoutBytes : transfer.stderrBytes;
+  const digest = stream === "stdout" ? transfer.stdoutSha256 : transfer.stderrSha256;
+  const hash = createHash("sha256");
+  const decoder = new StringDecoder("utf8");
+  let text = "";
+  for (let offset = 0; offset < size; offset += SYSTEM_OUTPUT_CHUNK_BYTES) {
+    signal?.throwIfAborted();
+    const part = await call("system_command_output", { captureId: transfer.id, stream, offset }, signal);
+    if (!part.ok) throw new Error("system_output_transfer_failed");
+    const data = part.data;
+    if (data?.captureId !== transfer.id || data.stream !== stream || data.offset !== offset) throw new Error("system_output_chunk_binding_invalid");
+    if (typeof data.bytes !== "string" || data.bytes.length > SYSTEM_OUTPUT_CHUNK_BYTES * 2) throw new Error("system_output_chunk_invalid");
+    const bytes = Buffer.from(data.bytes, "base64");
+    if (bytes.toString("base64") !== data.bytes) throw new Error("system_output_chunk_invalid");
+    if (bytes.length !== Math.min(SYSTEM_OUTPUT_CHUNK_BYTES, size - offset)) throw new Error("system_output_chunk_size_invalid");
+    hash.update(bytes);
+    text += decoder.write(bytes);
+  }
+  if (hash.digest("hex") !== digest) throw new Error("system_output_digest_invalid");
+  return text + decoder.end();
+}
+
+function transferFailure(receipt: ToolImplementationOutput, context?: ToolExecutionContext): ToolImplementationOutput {
+  return failureResult({ errorCode: "system_output_delivery_pending",
+    message: "The command settled, but its retained output could not be delivered completely. Process receipt is preserved; the command was not replayed.",
+    ...(receipt.exitCode !== undefined ? { exitCode: receipt.exitCode } : {}),
+    data: { ...receipt.data, outputDelivery: "pending", commandOk: receipt.ok, commandErrorCode: receipt.errorCode ?? null },
+  }, context?.resultBudget);
+}

package/plugins/system/source/computer/handlers.ts

@@ -5,10 +5,14 @@ import {
   type ToolImplementation,
 } from "../../../../src/plugin-sdk/index.js";
 import { SystemOperationError } from "../../../../src/plugin-sdk/computer-access.js";
-import { computerFields, readPhysicalRectangle } from "../../../../src/plugin-sdk/computer-access.js";
+import {
+  computerFields,
+  readPhysicalRectangle,
+} from "../../../../src/plugin-sdk/computer-access.js";
 import { readPublicComputerAction } from "./public-action.js";
 import { withDesktopQueue } from "../../../../src/plugin-sdk/computer-access.js";
 import { serializeComputerDesktops } from "./observation-output.js";
+import { protectObservedError } from "../security/observed-error.js";
 import {
   describeDesktop,
   projectComputerResult,
@@ -53,10 +57,10 @@ export function createComputerHandlers(
             error instanceof SystemOperationError
               ? error.code
               : "computer_operation_interrupted",
-          message:
-            error instanceof Error
-              ? error.message
-              : "Computer operation interrupted; effects may be partial. Observe before another action.",
+          message: protectObservedError(
+            error,
+            "Computer operation interrupted; effects may be partial. Observe before another action.",
+          ),
         });
       }
     };
@@ -79,10 +83,10 @@ export function createComputerHandlers(
               return {
                 ...computerRouteLabel(entry),
                 available: false,
-                reason:
-                  error instanceof Error
-                    ? error.message
-                    : "Desktop inspection failed.",
+                reason: protectObservedError(
+                  error,
+                  "Desktop inspection failed.",
+                ),
               };
             }
           },

package/plugins/system/source/computer/observation-result.ts

@@ -10,6 +10,7 @@ import {
   type RequestComputer,
 } from "./request-computers.js";
 import { serializeComputerObservation } from "./observation-output.js";
+import { protectObservedError } from "../security/observed-error.js";
 
 export function describeDesktop(
   entry: RequestComputer,
@@ -45,8 +46,7 @@ export async function projectComputerResult(
         );
       media.push(image);
     } catch (error) {
-      imageFailure =
-        error instanceof Error ? error.message : "Image admission failed.";
+      imageFailure = protectObservedError(error, "Image admission failed.");
     } finally {
       result.image.bytes.fill(0);
     }
@@ -57,9 +57,14 @@ export async function projectComputerResult(
     description.observation_ref = undefined;
   }
   const hasPartialInputDispatch = result.dispatch?.status === "partial";
-  const operationError = result.error ?? (hasPartialInputDispatch
-    ? { code: "computer_input_partial", message: "Only part of the input was accepted." }
-    : undefined);
+  const operationError =
+    result.error ??
+    (hasPartialInputDispatch
+      ? {
+          code: "computer_input_partial",
+          message: "Only part of the input was accepted.",
+        }
+      : undefined);
   const data = {
     desktop_ref: entry.ref,
     ...(description.observation_ref

package/plugins/system/source/computer/request-computers.ts

@@ -13,8 +13,12 @@ import { SystemOperationError } from "../../../../src/plugin-sdk/computer-access
 import type { NativeComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
 import { createNativeComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
 import { createCompanionComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
-import { COMPUTER_CAPABILITY } from "../../../../src/plugin-sdk/computer-access.js";
+import {
+  COMPUTER_CAPABILITY,
+  HOST_SECRET_PROTECTION_CAPABILITY,
+} from "../../../../src/plugin-sdk/computer-access.js";
 import { DesktopBindings } from "./desktop-bindings.js";
+import { protectNativeDesktopBackend } from "../security/desktop-result.js";
 
 export type RequestComputer = {
   ref: string;
@@ -80,7 +84,7 @@ export class RequestComputers {
     if (entry.backend) return entry.backend;
     entry.backend =
       entry.route.kind === "native"
-        ? this.nativeFactory(entry.route.target)
+        ? protectNativeDesktopBackend(this.nativeFactory(entry.route.target))
         : createCompanionComputerBackend(
             this.rootDir,
             entry.route,
@@ -110,7 +114,10 @@ export function computerQueueIdentity(entry: RequestComputer): string {
 }
 function supportsComputerRoute(route: SystemRequestRoute): boolean {
   if (route.kind === "native") return true;
-  return route.capabilities?.includes(COMPUTER_CAPABILITY) === true;
+  return (
+    route.capabilities?.includes(COMPUTER_CAPABILITY) === true &&
+    route.capabilities.includes(HOST_SECRET_PROTECTION_CAPABILITY)
+  );
 }
 
 function restoreComputers(

package/plugins/system/source/computer/request-modules.ts

@@ -1,5 +1,4 @@
 import {
-  failureResult,
   type ToolImplementation,
   type ToolRequestPreparationContext,
   type ToolModuleDeclaration,
@@ -12,17 +11,14 @@ import {
 import type { SystemHostConnection } from "../host-dispatch.js";
 import { createComputerHandlers, COMPUTER_TOOLS } from "./handlers.js";
 import { RequestComputers } from "./request-computers.js";
+import { supportsRuntimeDesktopTools, unboundComputerFailure } from "./runtime-platform.js";
 
 /** Load-time placeholders cannot allocate a desktop outside request ownership. */
 export function unboundComputerHandlers(): Record<string, ToolImplementation> {
   return Object.fromEntries(
     COMPUTER_TOOLS.map((name) => [
       name,
-      async () =>
-        failureResult({
-          errorCode: "computer_request_binding_required",
-          message: "Computer control requires a prepared request.",
-        }),
+      async () => unboundComputerFailure(),
     ]),
   );
 }
@@ -35,6 +31,7 @@ export function prepareComputerModules(
   preparation?: ToolRequestPreparationContext,
 ): readonly ToolModuleDeclaration[] {
   if (modules.length === 0) return [];
+  if (!supportsRuntimeDesktopTools()) return [];
   const computers = new RequestComputers(
     rootDir,
     routes,

package/plugins/system/source/computer/runtime-platform.ts

@@ -0,0 +1,18 @@
+import { failureResult } from "../../../../src/plugin-sdk/index.js";
+
+/** Windows desktop images and input await the separate OCR rollout. */
+export function supportsRuntimeDesktopTools(platform: NodeJS.Platform = process.platform): boolean {
+  return platform !== "win32";
+}
+
+export function unboundComputerFailure() {
+  if (!supportsRuntimeDesktopTools())
+    return failureResult({
+      errorCode: "computer_runtime_platform_unsupported",
+      message: "Desktop observation and control are unavailable on Windows Runtime. System commands and applications remain available.",
+    });
+  return failureResult({
+    errorCode: "computer_request_binding_required",
+    message: "Computer control requires a prepared request.",
+  });
+}

package/plugins/system/source/host-dispatch.ts

@@ -1,3 +1,5 @@
+import { executeCompanionCommand, supportsCompanionCommandOutput } from "./companion-command-output.js";
+import { redactSecretText } from "./security/secret-text.js";
 import type { ComputerAccessConnection } from "../../../src/plugin-sdk/computer-access.js";
 import {
   failureResult,
@@ -10,6 +12,7 @@ import {
 } from "../../../src/plugin-sdk/computer-access.js";
 import {
   HOST_OPERATIONS,
+  HOST_SECRET_PROTECTION_CAPABILITY,
   type HostOperation,
 } from "../../../src/plugin-sdk/computer-access.js";
 import { SystemOperationError } from "../../../src/plugin-sdk/computer-access.js";
@@ -32,6 +35,7 @@ export function createBoundSystemHandlers(
     snapshot: SystemTargetSnapshot;
     nativeHandlers: Readonly<Record<string, ToolImplementation>>;
     connection: SystemHostConnection;
+    outputRetentionMs?: number;
   }>,
 ): Record<string, ToolImplementation> {
   return Object.fromEntries(
@@ -67,6 +71,18 @@ function boundOperation(
       const route = requireSystemRequestRoute(input.snapshot, params.target);
       if (route.kind === "native")
         return await input.nativeHandlers[operation]!(params, context);
+      if (!supportsProtectedCompanionResults(route.capabilities))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected system results. The operation was not dispatched.",
+        });
+      if (operation === "system_command" && !supportsCompanionCommandOutput(route))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected complete command output. The command was not dispatched.",
+        });
+      if (operation === "system_command")
+        return await executeCompanionCommand({ ...input, route, params, context });
       return await input.connection.executeHostOperation(input.rootDir, {
         hostId: route.hostId,
         connectionId: route.connectionId,
@@ -76,7 +92,7 @@ function boundOperation(
       });
     } catch (error) {
       if (error instanceof SystemOperationError)
-        return failureResult({ errorCode: error.code, message: error.message });
+        return failureResult({ errorCode: error.code, message: redactSecretText(error.message) });
       return failureResult({
         errorCode: "system_execution_route_failed",
         message:
@@ -86,6 +102,10 @@ function boundOperation(
   };
 }
 
+function supportsProtectedCompanionResults(capabilities?: readonly string[]): boolean {
+  return capabilities?.includes(HOST_SECRET_PROTECTION_CAPABILITY) === true;
+}
+
 function hasConnectionControl(params: Record<string, unknown>): boolean {
   if (Object.hasOwn(params, "host_id")) return true;
   if (Object.hasOwn(params, "hostId")) return true;

package/plugins/system/source/index.ts

@@ -1,10 +1,18 @@
 import { defineRuntimePlugin } from "../../../src/plugin-sdk/index.js";
-import { createSystemHandlers } from "../../../src/plugin-sdk/computer-access.js";
+import { createSystemHandlers, observeSystemTargets } from "../../../src/plugin-sdk/computer-access.js";
 import { prepareSystemRequestModules } from "./request-system-modules.js";
+import { createLocalSystemCommandOutput, systemCommandOutputRetentionMs } from "./local-command-output.js";
 import { unboundComputerHandlers } from "./computer/request-modules.js";
+import { systemResultProtection } from "./security/system-results.js";
 
-export default defineRuntimePlugin(({ rootDir }) => ({
-  handlers: { ...createSystemHandlers(), ...unboundComputerHandlers() },
-  prepareRequest: (modules, preparation) =>
-    prepareSystemRequestModules(rootDir, modules, {}, preparation),
-}));
+export default defineRuntimePlugin((context) => {
+  const output = createLocalSystemCommandOutput(context);
+  return {
+    handlers: { ...createSystemHandlers(undefined, undefined, output, systemResultProtection), ...unboundComputerHandlers() },
+    prepareRequest: (modules, preparation) => prepareSystemRequestModules(context.rootDir, modules, {
+      outputRetentionMs: systemCommandOutputRetentionMs(context),
+      observeTargets: async () => systemResultProtection.protectTargets(await observeSystemTargets()),
+      createNativeHandlers: (resolve) => createSystemHandlers(undefined, resolve, output, systemResultProtection),
+    }, preparation),
+  };
+});

package/plugins/system/source/local-command-output-retention.ts

@@ -0,0 +1,16 @@
+import { scheduleSystemOutputCleanup } from "../../../src/plugin-sdk/computer-access.js";
+import { ensureWindowsOutputDirectory } from "./security/windows-output-directory.js";
+
+/** Retention may traverse only a verified Windows output root, including at plugin load. */
+export function scheduleLocalSystemOutputCleanup(root: string, retentionMs: number): Promise<void> {
+  if (process.platform !== "win32") {
+    scheduleSystemOutputCleanup(root, retentionMs);
+    return Promise.resolve();
+  }
+  return ensureWindowsOutputDirectory(root).then(
+    () => scheduleSystemOutputCleanup(root, retentionMs),
+    () => process.emitWarning("SYSTEM output cleanup skipped because private storage could not be verified.", {
+      code: "SYSTEM_OUTPUT_PRIVATE_STORAGE_UNAVAILABLE",
+    }),
+  );
+}

package/plugins/system/source/local-command-output.ts

@@ -0,0 +1,69 @@
+import { join } from "node:path";
+import { deliverPluginTextResult, failureResult, readBoundedInteger, type RuntimePluginLoadContext,
+  type ToolExecutionContext, type ToolImplementationOutput } from "../../../src/plugin-sdk/index.js";
+import { buildSystemProcessResult, runSystemProcess, type SystemCommandOutputFactory,
+  type SystemProcessResult, type SystemTarget } from "../../../src/plugin-sdk/computer-access.js";
+import { createSystemOutputCapture, type SystemOutputReceipt } from "../../../src/plugin-sdk/computer-access.js";
+import { DEFAULT_SYSTEM_OUTPUT_RETENTION_MS } from "../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./security/secret-text.js";
+import { ensureWindowsOutputDirectory } from "./security/windows-output-directory.js";
+import { scheduleLocalSystemOutputCleanup } from "./local-command-output-retention.js";
+
+type Capture = Awaited<ReturnType<typeof createSystemOutputCapture>>;
+const CONTEXT_STREAMS = Object.freeze(["stdout", "stderr"] as const);
+
+export function createLocalSystemCommandOutput(plugin: RuntimePluginLoadContext): SystemCommandOutputFactory {
+  const root = join(plugin.stateDir, "command-output");
+  const retentionMs = systemCommandOutputRetentionMs(plugin);
+  const initialization = scheduleLocalSystemOutputCleanup(root, retentionMs);
+  return (context) => {
+    let captured: Capture | undefined;
+    return {
+      async run(input) {
+        if (input.abortSignal?.aborted) return runSystemProcess(input);
+        await initialization;
+        await ensureWindowsOutputDirectory(root);
+        captured = await createSystemOutputCapture(root, retentionMs, redactSecretText);
+        let result: SystemProcessResult;
+        try { result = await runSystemProcess(input, captured.capture); }
+        catch (error) { await captured.finish(); throw error; }
+        const streams = await captured.finish(result);
+        return { ...captured.processResult!, stdout: streams.stdout, stderr: streams.stderr,
+          outputTruncated: Boolean(captured.failure) };
+      },
+      async present(target, result) {
+        if (captured?.failure) return outputFailure(target, result, context, captured.receipt, captured.failure, captured.failureKind);
+        const receipt = buildSystemProcessResult(target, result, "command_process_completion");
+        const delivered = deliverPluginTextResult({ ...receipt,
+          data: { ...receipt.data, ...(captured?.receipt ? { outputCapture: captured.receipt } : {}) } }, CONTEXT_STREAMS, context?.resultBudget);
+        if (delivered.errorCode === "plugin_result_too_large")
+          return outputFailure(target, result, context, captured?.receipt);
+        return delivered;
+      },
+    };
+  };
+}
+
+function outputFailure(target: SystemTarget, result: SystemProcessResult, context?: ToolExecutionContext,
+  capture?: SystemOutputReceipt, captureFailure?: string, failureKind?: "security" | "storage"): ToolImplementationOutput {
+  const failureCode = failureKind === "security" ? "system_output_protection_failed" : "system_output_storage_failed";
+  return failureResult({
+    errorCode: captureFailure ? failureCode : "system_output_delivery_pending",
+    message: "The command was dispatched. Its output could not be delivered completely; do not repeat the command just to retrieve output. Inspect the process receipt and retained capture.",
+    ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
+    data: { target: target.id, transport: target.transport, processStatus: result.status,
+      spawnedProcess: result.spawnedProcess ?? null, exitCode: result.exitCode,
+      outputCapture: capture ?? null,
+      ...(captureFailure && failureKind === "security" ? { securityFailure: captureFailure } : {}),
+      ...(captureFailure && failureKind !== "security" ? { storageFailure: captureFailure } : {}),
+      outputDelivery: "pending", evidenceScope: "command_process_completion", independentOutcomeCheck: "not_performed",
+      observationMeta: { kind: "volatile_external", carryPolicy: "never" } },
+  }, context?.resultBudget);
+}
+
+export function systemCommandOutputRetentionMs(plugin: RuntimePluginLoadContext): number {
+  return readBoundedInteger(plugin.config?.outputRetentionMs, {
+    name: "outputRetentionMs", defaultValue: DEFAULT_SYSTEM_OUTPUT_RETENTION_MS,
+    minimum: 1, maximum: Number.MAX_SAFE_INTEGER,
+  });
+}