@abot-ai/runtime 1.6.0 → 1.8.0

package/plugins/system/source/request-system-modules.ts

@@ -1,4 +1,6 @@
+import { createSystemCommandPathAdapter } from "./command-working-directory.js";
 import type {
+  RuntimeToolPathResolver,
   ToolCallAdapter,
   ToolImplementation,
   ToolModuleDeclaration,
@@ -34,6 +36,7 @@ import {
 export type SystemRequestDependencies = Readonly<{
   observeTargets?: () => Promise<SystemTargetObservation>;
   connection?: SystemHostConnection;
+  outputRetentionMs?: number;
   createNativeHandlers?: (
     resolveTarget: (id: SystemTargetId) => Promise<SystemTarget>,
   ) => Record<string, ToolImplementation>;
@@ -76,11 +79,19 @@ export async function prepareSystemRequestModules(
     snapshot,
     connection,
     nativeHandlers,
+    outputRetentionMs: dependencies.outputRetentionMs,
   });
   return Object.freeze([
     ...modules
       .filter((module) => !isComputerTool(module.definition.name))
-      .map((module) => projectSystemRequestModule(module, snapshot, handlers)),
+      .map((module) =>
+        projectSystemRequestModule(
+          module,
+          snapshot,
+          handlers,
+          preparation?.runtimePathResolver,
+        ),
+      ),
     ...computerModules,
   ]);
 }
@@ -106,6 +117,7 @@ function projectSystemRequestModule(
   module: ToolModuleDeclaration,
   snapshot: SystemTargetSnapshot,
   handlers: Readonly<Record<string, ToolImplementation>>,
+  resolver?: RuntimeToolPathResolver,
 ): ToolModuleDeclaration {
   const targets = Object.freeze(snapshot.map(routeTargetId));
   const availability = ` Available targets for this request: ${targets.join(", ")}.`;
@@ -129,7 +141,7 @@ function projectSystemRequestModule(
     },
     implementation: handlers[module.definition.name]!,
     adapter: {
-      ...module.adapter,
+      ...createSystemCommandPathAdapter(module.adapter, snapshot, resolver),
       executionBinding: systemExecutionBinding(snapshot),
     },
   });

package/plugins/system/source/request-target-snapshot.ts

@@ -10,6 +10,7 @@ import {
   type HostStatus,
 } from "../../../src/plugin-sdk/computer-access.js";
 import type { SystemTargetObservation } from "../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./security/secret-text.js";
 
 export type SystemRequestRoute = Readonly<
   | { kind: "native"; target: SystemTarget }
@@ -140,7 +141,7 @@ export function systemRouteMetadata(
   return {
     displayTarget: route.target,
     transport: "host_companion",
-    computerName: route.identity.name,
+    computerName: redactSecretText(route.identity.name),
   };
 }
 

package/plugins/system/source/security/desktop-result.ts

@@ -0,0 +1,177 @@
+import type {
+  NativeComputerBackend,
+  NativeComputerResult,
+  PhysicalRectangle,
+} from "../../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./secret-text.js";
+
+type TextScanner = (input: string) => string;
+
+function rectangle(value: PhysicalRectangle): PhysicalRectangle {
+  return { x: value.x, y: value.y, width: value.width, height: value.height };
+}
+
+/** Explicit native observation fields; binding identities are never rewritten. */
+function projectDesktopFields(
+  result: NativeComputerResult,
+  text: TextScanner,
+): NativeComputerResult {
+  const capability = (
+    value: NativeComputerResult["desktop"]["capabilities"]["capture"],
+  ) => ({
+    supported: value.supported,
+    available: value.available,
+    ...(value.reason === undefined ? {} : { reason: text(value.reason) }),
+  });
+  const desktop = result.desktop;
+  return {
+    desktop: {
+      platform: desktop.platform,
+      binding: desktop.binding,
+      name: text(desktop.name),
+      available: desktop.available,
+      ...(desktop.reason === undefined ? {} : { reason: text(desktop.reason) }),
+      bounds: rectangle(desktop.bounds),
+      ...(desktop.coordinateSpace === undefined
+        ? {}
+        : { coordinateSpace: desktop.coordinateSpace }),
+      capabilities: {
+        capture: capability(desktop.capabilities.capture),
+        accessibility: capability(desktop.capabilities.accessibility),
+        input: capability(desktop.capabilities.input),
+        windows: capability(desktop.capabilities.windows),
+      },
+      targetingGuarantee: desktop.targetingGuarantee,
+    },
+    windows: result.windows.map((window) => ({
+      binding: window.binding,
+      title: text(window.title),
+      ...(window.application === undefined
+        ? {}
+        : { application: text(window.application) }),
+      bounds: rectangle(window.bounds),
+      focused: window.focused,
+    })),
+    ...(result.focusedWindow === undefined
+      ? {}
+      : { focusedWindow: result.focusedWindow }),
+    ...(result.observation
+      ? {
+          observation: {
+            capturedAt: text(result.observation.capturedAt),
+            region: rectangle(result.observation.region),
+            imageWidth: result.observation.imageWidth,
+            imageHeight: result.observation.imageHeight,
+            accessibility: result.observation.accessibility.map((node) => ({
+              role: text(node.role),
+              ...(node.name === undefined ? {} : { name: text(node.name) }),
+              ...(node.value === undefined ? {} : { value: text(node.value) }),
+              ...(node.bounds === undefined
+                ? {}
+                : { bounds: rectangle(node.bounds) }),
+              ...(node.focused === undefined ? {} : { focused: node.focused }),
+            })),
+            accessibilityTruncated: result.observation.accessibilityTruncated,
+          },
+        }
+      : {}),
+    ...(result.dispatch
+      ? {
+          dispatch: {
+            status: result.dispatch.status,
+            requestedInputCount: result.dispatch.requestedInputCount,
+            ...(result.dispatch.acceptedInputCount === undefined
+              ? {}
+              : { acceptedInputCount: result.dispatch.acceptedInputCount }),
+            ...(result.dispatch.reason === undefined
+              ? {}
+              : { reason: text(result.dispatch.reason) }),
+          },
+        }
+      : {}),
+    ...(result.error
+      ? {
+          error: {
+            code: text(result.error.code),
+            message: text(result.error.message),
+          },
+        }
+      : {}),
+  };
+}
+
+/**
+ * Best-effort text protection before frame retention or result projection.
+ * Pixels are not inspected: a text match withholds the associated entire image.
+ */
+export function protectDesktopResult(
+  result: NativeComputerResult,
+  scan: TextScanner = redactSecretText,
+): NativeComputerResult {
+  let suspected = false;
+  try {
+    const protectedResult = projectDesktopFields(result, (input) => {
+      const output = scan(input);
+      if (typeof output !== "string")
+        throw new Error("desktop_text_scan_failed");
+      suspected ||= output !== input;
+      return output;
+    });
+    if (!suspected)
+      return {
+        ...protectedResult,
+        ...(result.image
+          ? {
+              image: {
+                mimeType: result.image.mimeType,
+                bytes: result.image.bytes,
+              },
+            }
+          : {}),
+      };
+    result.image?.bytes.fill(0);
+    return {
+      ...protectedResult,
+      ...(result.image && !protectedResult.error
+        ? {
+            error: {
+              code: "computer_image_secret_blocked",
+              message:
+                "Image withheld because desktop text contained a suspected secret. The dispatch receipt is unchanged.",
+            },
+          }
+        : {}),
+    };
+  } catch {
+    result.image?.bytes.fill(0);
+    const safe = projectDesktopFields(result, () => "[REDACTED]");
+    return {
+      desktop: {
+        ...safe.desktop,
+        reason: "Desktop content withheld because its protection check failed.",
+      },
+      windows: [],
+      ...(safe.focusedWindow === undefined
+        ? {}
+        : { focusedWindow: safe.focusedWindow }),
+      ...(safe.dispatch ? { dispatch: safe.dispatch } : {}),
+      error: {
+        code: "computer_observation_protection_failed",
+        message:
+          "Desktop content withheld because its protection check failed. The dispatch receipt is unchanged.",
+      },
+    };
+  }
+}
+
+/** Local SYSTEM policy only; Companion results are protected by their producer. */
+export function protectNativeDesktopBackend(
+  backend: NativeComputerBackend,
+): NativeComputerBackend {
+  return {
+    async execute(request, signal) {
+      return protectDesktopResult(await backend.execute(request, signal));
+    },
+    close: () => backend.close(),
+  };
+}

package/plugins/system/source/security/observed-error.ts

@@ -0,0 +1,10 @@
+import { redactSecretText } from "./secret-text.js";
+
+/** Protect the complete observed message before transport or model projection. */
+export function protectObservedError(error: unknown, fallback: string): string {
+  try {
+    return redactSecretText(error instanceof Error ? error.message : fallback);
+  } catch {
+    return "Observed error details withheld because the protection check failed.";
+  }
+}

package/plugins/system/source/security/secret-text.ts

@@ -0,0 +1,118 @@
+const REDACTED = "[REDACTED]";
+const CREDENTIAL_KEY_SOURCE = String.raw`(?:[A-Za-z][A-Za-z0-9_-]*\.)*(?:[A-Za-z][A-Za-z0-9]*[-_])*(?:password|passwd|pwd|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|client[_ -]?secret|secret[_ -]?access[_ -]?key|recovery[_ -]?code)`;
+const credentialIndicator = new RegExp(
+  String.raw`(?<![\p{L}\p{N}_.-])(?:-{1,2})?(?:${CREDENTIAL_KEY_SOURCE}|(?:proxy-)?authorization)[\s"'\\]*[:=]`,
+  "iu",
+);
+
+/** Detection only: normalize ASCII encodings once, without interpreting a language. */
+function detectionText(input: string): string {
+  const percentDecoded = input.replace(/%([0-7][0-9a-f])/giu, (_, hex: string) =>
+    String.fromCharCode(Number.parseInt(hex, 16)),
+  );
+  return percentDecoded.replace(
+    /\\(?:u00|x|U000000)([0-7][0-9a-fA-F])/gu,
+    (_, hex: string) => String.fromCharCode(Number.parseInt(hex, 16)),
+  );
+}
+
+function hasPrivateKeyIndicator(text: string): boolean {
+  return /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/u.test(text);
+}
+
+function hasUrlCredentials(text: string): boolean {
+  return /\b[a-z][a-z0-9+.-]*(?::|%3a)(?:\/|%2f){2}[^\s/?#<>]*(?:@|%40)/iu.test(text);
+}
+
+function hasAuthorizationCredentials(text: string): boolean {
+  for (const match of text.matchAll(
+    /\b(Bearer|Basic)[ \t]+([A-Za-z0-9._~+/-]+={0,2})/giu,
+  )) {
+    if (match[1]!.toLowerCase() === "bearer") return true;
+    const value = match[2]!;
+    if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(value)) continue;
+    if (value.length < 8) continue;
+    if (Buffer.from(value, "base64").toString("utf8").includes(":")) return true;
+  }
+  return false;
+}
+
+function isAwsAccessKeyValue(value: string, atEnd: boolean): boolean {
+  if (/^[A-Z0-9]{16}$/u.test(value)) return true;
+  if (!atEnd) return false;
+  return /^[A-Z0-9]{4,15}$/u.test(value);
+}
+
+function isRecognizedProviderToken(
+  prefix: string,
+  value: string,
+  atEnd: boolean,
+): boolean {
+  if (prefix === "AKIA" || prefix === "ASIA")
+    return isAwsAccessKeyValue(value, atEnd);
+  if (value.length >= 20) return true;
+  const partialMinimum = prefix === "sk-" ? 8 : 1;
+  return atEnd && value.length >= partialMinimum;
+}
+
+function hasProviderToken(text: string): boolean {
+  const provider =
+    /\b(sk-(?:proj-|svcacct-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|ASIA)([A-Za-z0-9_-]+)/gu;
+  for (const match of text.matchAll(provider)) {
+    const atEnd = match.index + match[0].length === text.length;
+    if (isRecognizedProviderToken(match[1]!, match[2]!, atEnd)) return true;
+  }
+  return false;
+}
+
+function compactJoseSegmentCount(header: string): number | undefined {
+  try {
+    const value: unknown = JSON.parse(
+      Buffer.from(header, "base64url").toString("utf8"),
+    );
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return undefined;
+    const fields = value as Record<string, unknown>;
+    if (typeof fields.alg !== "string") return undefined;
+    return typeof fields.enc === "string" ? 5 : 3;
+  } catch {
+    return undefined;
+  }
+}
+
+function hasCompactJoseToken(text: string): boolean {
+  const jose = /\b([A-Za-z0-9_-]+)(?:\.[A-Za-z0-9_-]*)+/gu;
+  for (const match of text.matchAll(jose)) {
+    const parts = match[0].split(".");
+    const capturedAtEnd = match.index + match[0].length === text.length;
+    for (let index = 0; index < parts.length - 1; index += 1) {
+      const expected = compactJoseSegmentCount(parts[index]!);
+      if (expected === undefined) continue;
+      if (expected === 3 && parts[index + 1] === "") continue;
+      if (parts.length - index >= expected) return true;
+      if (capturedAtEnd) return true;
+    }
+  }
+  return false;
+}
+
+function hasSecretIndicator(text: string): boolean {
+  if (credentialIndicator.test(text)) return true;
+  if (hasPrivateKeyIndicator(text)) return true;
+  if (hasUrlCredentials(text)) return true;
+  if (hasAuthorizationCredentials(text)) return true;
+  if (hasProviderToken(text)) return true;
+  return hasCompactJoseToken(text);
+}
+
+/**
+ * Mask the entire field when a known secret indicator is present, including
+ * surrounding useful text. No value boundaries or source-language grammar are
+ * inferred. Unlabelled arbitrary secrets and unknown encodings remain outside
+ * detection; this is not a guarantee that unchanged text contains no secrets.
+ */
+export function redactSecretText(input: string): string {
+  if (hasSecretIndicator(input)) return REDACTED;
+  if (hasSecretIndicator(detectionText(input))) return REDACTED;
+  return input;
+}

package/plugins/system/source/security/system-results.ts

@@ -0,0 +1,62 @@
+import type {
+  SystemApplicationCatalog, SystemApplication, SystemProcessResult,
+  SystemResultProtection, SystemTargetObservation,
+} from "../../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./secret-text.js";
+
+const INCOMPLETE_STREAM = "[UNAVAILABLE: incomplete output cannot be scanned for secrets]";
+const SENSITIVE_TARGET = "Target unavailable because its shell identity contains sensitive text.";
+
+function protectApplication(application: SystemApplication): SystemApplication | undefined {
+  if (redactSecretText(application.id) !== application.id) return undefined;
+  return { ...application, name: redactSecretText(application.name) };
+}
+
+function protectCatalog(catalog: SystemApplicationCatalog): SystemApplicationCatalog {
+  const applications = catalog.applications.flatMap((application) => {
+    const protectedApplication = protectApplication(application);
+    return protectedApplication ? [protectedApplication] : [];
+  });
+  return {
+    ...catalog,
+    applications,
+    complete: catalog.complete && applications.length === catalog.applications.length,
+    scope: { ...catalog.scope, roots: catalog.scope.roots.map(redactSecretText) },
+  };
+}
+
+function protectTargets(observation: SystemTargetObservation): SystemTargetObservation {
+  return {
+    ...observation,
+    host: { ...observation.host, kernelRelease: redactSecretText(observation.host.kernelRelease) },
+    targets: observation.targets.map((target) => {
+      if (!target.available)
+        return { ...target, reason: redactSecretText(target.reason) };
+      if (redactSecretText(target.shell) !== target.shell)
+        return { id: target.id, available: false, reason: SENSITIVE_TARGET };
+      return target;
+    }),
+  };
+}
+
+function protectProcess(result: SystemProcessResult): SystemProcessResult {
+  return {
+    ...result,
+    stdout: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stdout),
+    stderr: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stderr),
+    ...(result.spawnedProcess ? {
+      spawnedProcess: {
+        ...result.spawnedProcess,
+        executable: redactSecretText(result.spawnedProcess.executable),
+      },
+    } : {}),
+  };
+}
+
+export const systemResultProtection: SystemResultProtection = Object.freeze({
+  protectTargets,
+  protectCatalog,
+  protectProcess,
+  protectApplication,
+  protectMessage: redactSecretText,
+});

package/plugins/system/source/security/windows-output-directory.ts

@@ -0,0 +1,82 @@
+import { execFile } from "node:child_process";
+import { lstat, mkdir, mkdtemp, rename, rmdir } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { promisify } from "node:util";
+import { SystemOperationError } from "../../../../src/plugin-sdk/computer-access.js";
+
+const execute = promisify(execFile);
+// The empty candidate is secured before publication. Paths remain environment data.
+const privateDirectoryScript = `
+$env:PSModulePath = "$PSHOME\\Modules"
+$ErrorActionPreference = 'Stop'
+$target = $env:ABOT_SYSTEM_OUTPUT_DIRECTORY
+$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$item = Get-Item -LiteralPath $target -Force
+if (-not $item.PSIsContainer) { exit 2 }
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { exit 2 }
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+if ($env:ABOT_SYSTEM_OUTPUT_CREATE_PRIVATE -eq '1') {
+  $acl = New-Object System.Security.AccessControl.DirectorySecurity
+  $acl.SetOwner($current)
+  $acl.SetAccessRuleProtection($true, $false)
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($current, 'FullControl', $inherit, [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]::Allow)
+  $acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $target -AclObject $acl
+}
+$observed = Get-Acl -LiteralPath $target
+if ($observed.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $current.Value) { exit 3 }
+if (-not $observed.AreAccessRulesProtected) { exit 4 }
+$rules = @($observed.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if ($rules.Count -ne 1) { exit 5 }
+$rule = $rules[0]
+if ($rule.IdentityReference.Value -ne $current.Value) { exit 5 }
+if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { exit 5 }
+if ($rule.FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl) { exit 5 }
+if ($rule.InheritanceFlags -ne $inherit) { exit 5 }
+if ($rule.PropagationFlags -ne [System.Security.AccessControl.PropagationFlags]::None) { exit 5 }
+`;
+
+async function verifyPrivateOutputDirectory(directory: string, create = false): Promise<void> {
+  const info = await lstat(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("output_directory_unavailable");
+  const powershell = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  await execute(powershell, ["-NoProfile", "-NonInteractive", "-EncodedCommand",
+    Buffer.from(privateDirectoryScript, "utf16le").toString("base64")], {
+    windowsHide: true, timeout: 10_000, maxBuffer: 16_384,
+    env: { ...process.env, ABOT_SYSTEM_OUTPUT_DIRECTORY: directory, ABOT_SYSTEM_OUTPUT_CREATE_PRIVATE: create ? "1" : "0" },
+  });
+}
+
+function isAbsentPath(error: unknown): boolean {
+  if (!error || typeof error !== "object" || !("code" in error)) return false;
+  return error.code === "ENOENT";
+}
+async function hasOutputDirectoryPath(directory: string): Promise<boolean> {
+  try { await lstat(directory); return true; }
+  catch (error) { if (isAbsentPath(error)) return false; throw error; }
+}
+
+async function installPrivateOutputDirectory(directory: string): Promise<void> {
+  if (await hasOutputDirectoryPath(directory)) return;
+  const parent = dirname(directory);
+  await mkdir(parent, { recursive: true });
+  const candidate = await mkdtemp(join(parent, `.${basename(directory)}.private-`));
+  try {
+    await verifyPrivateOutputDirectory(candidate, true);
+    try { await rename(candidate, directory); }
+    catch (error) { if (!await hasOutputDirectoryPath(directory)) throw error; }
+  } finally {
+    await rmdir(candidate).catch(error => { if (!isAbsentPath(error)) throw error; });
+  }
+}
+
+/** Windows raw output stays below a verified inheritable private DACL, before dispatch. */
+export async function ensureWindowsOutputDirectory(directory: string): Promise<void> {
+  if (process.platform !== "win32") return;
+  try {
+    await installPrivateOutputDirectory(directory);
+    await verifyPrivateOutputDirectory(directory);
+  } catch {
+    throw new SystemOperationError("system_output_storage_failed", "Private output storage could not be prepared. The command was not dispatched.");
+  }
+}