@abot-ai/runtime 1.6.0 → 1.8.0

package/plugins/system/src/index.cjs

@@ -234,9 +234,27 @@ function failureFromError(error, options) {
   });
 }
 
+// src/plugin-sdk/context-text-result.ts
+function deliverPluginTextResult(result, fields, budget) {
+  const assessed = enforcePluginResultByteBudget(result, budget);
+  if (!canHandOffContextText(result, assessed, budget)) return assessed;
+  return enforcePluginResultByteBudget(
+    { ...result, contextTextFields: Object.freeze([...fields]) },
+    budget
+  );
+}
+function canHandOffContextText(original, assessed, budget) {
+  if (budget?.acceptsContextText !== true) return false;
+  if (assessed === original) return false;
+  return assessed.errorCode === "plugin_result_too_large";
+}
+
 // src/capabilities/tool-media.ts
 var TOOL_IMAGE_MAX_BYTES = 10 * 1024 * 1024;
 
+// src/computer-access/companion/secret-protection-protocol.ts
+var HOST_SECRET_PROTECTION_CAPABILITY = "host_secret_protection_v1";
+
 // src/computer-access/companion/broker-client.ts
 var import_node_net = require("node:net");
 
@@ -255,25 +273,25 @@ function hostStateDirectory(rootDir) {
 }
 function ensureHostStateDirectory(directory) {
   (0, import_node_fs.mkdirSync)(directory, { recursive: true, mode: 448 });
-  const stat2 = (0, import_node_fs.lstatSync)(directory);
-  if (!stat2.isDirectory()) throw new Error("host_state_directory_invalid");
+  const stat3 = (0, import_node_fs.lstatSync)(directory);
+  if (!stat3.isDirectory()) throw new Error("host_state_directory_invalid");
   if (process.platform === "win32") return;
-  if (stat2.uid !== process.getuid?.())
+  if (stat3.uid !== process.getuid?.())
     throw new Error("host_state_owner_invalid");
-  if ((stat2.mode & 63) !== 0)
+  if ((stat3.mode & 63) !== 0)
     throw new Error("host_state_directory_not_private");
 }
 function readHostPrivateJson(path) {
   try {
-    const stat2 = (0, import_node_fs.lstatSync)(path);
-    if (!stat2.isFile()) throw new Error("host_state_file_invalid");
+    const stat3 = (0, import_node_fs.lstatSync)(path);
+    if (!stat3.isFile()) throw new Error("host_state_file_invalid");
     if (process.platform !== "win32") {
-      if (stat2.uid !== process.getuid?.())
+      if (stat3.uid !== process.getuid?.())
         throw new Error("host_state_owner_invalid");
-      if ((stat2.mode & 63) !== 0)
+      if ((stat3.mode & 63) !== 0)
         throw new Error("host_state_file_not_private");
     }
-    if (stat2.size > 16384) throw new Error("host_state_file_too_large");
+    if (stat3.size > 16384) throw new Error("host_state_file_too_large");
     return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
@@ -2124,7 +2142,7 @@ function createUnixNativeProcess(options) {
   let failedReason;
   let buffer = Buffer.alloc(0);
   let queue = Promise.resolve();
-  let lastResult;
+  let lastDesktop;
   function interruptedResult(reason) {
     const dispatch = pending?.request.operation === "act" ? pending.dispatch ?? {
       status: "unknown",
@@ -2132,12 +2150,8 @@ function createUnixNativeProcess(options) {
       reason
     } : void 0;
     const result = unavailableUnixDesktop(options.platform, reason, dispatch);
-    if (!lastResult) return result;
-    return {
-      ...result,
-      desktop: { ...lastResult.desktop, available: false, reason },
-      windows: lastResult.windows
-    };
+    if (!lastDesktop) return result;
+    return { ...result, desktop: { ...result.desktop, ...lastDesktop } };
   }
   function terminate(reason) {
     failedReason = reason;
@@ -2150,6 +2164,7 @@ function createUnixNativeProcess(options) {
       retiring.once("exit", () => clearTimeout(hardStop));
     }
     child = void 0;
+    buffer.fill(0);
     buffer = Buffer.alloc(0);
   }
   function receiveLine(line) {
@@ -2165,7 +2180,17 @@ function createUnixNativeProcess(options) {
     }
     if (message.type !== "result") throw new Error("native_protocol_invalid");
     const result = readUnixNativeResult(message.result, options.platform);
-    lastResult = result;
+    lastDesktop = {
+      binding: result.desktop.binding,
+      bounds: {
+        x: result.desktop.bounds.x,
+        y: result.desktop.bounds.y,
+        width: result.desktop.bounds.width,
+        height: result.desktop.bounds.height
+      },
+      coordinateSpace: result.desktop.coordinateSpace,
+      targetingGuarantee: result.desktop.targetingGuarantee
+    };
     pending.finish(result);
   }
   function ensureHelper() {
@@ -2178,15 +2203,19 @@ function createUnixNativeProcess(options) {
     child.stderr.resume();
     child.stdout.on("data", (chunk) => {
       if (closed || failedReason) return;
-      buffer = Buffer.concat([buffer, chunk]);
+      const previous = buffer;
+      buffer = Buffer.concat([previous, chunk]);
+      previous.fill(0);
       if (buffer.length > NATIVE_JSON_LIMIT) {
         terminate("computer_native_result_limit");
         return;
       }
       let boundary = buffer.indexOf(10);
       while (boundary >= 0) {
-        const line = buffer.subarray(0, boundary).toString("utf8");
-        buffer = buffer.subarray(boundary + 1);
+        const received = buffer;
+        const line = received.subarray(0, boundary).toString("utf8");
+        buffer = Buffer.from(received.subarray(boundary + 1));
+        received.fill(0);
         try {
           receiveLine(line);
         } catch {
@@ -4259,7 +4288,7 @@ var import_node_path4 = require("node:path");
 // src/computer-access/process-runner.ts
 var import_node_child_process4 = require("node:child_process");
 var STREAM_MAX_CHARS = 16e3;
-function runSystemProcess(input) {
+function runSystemProcess(input, capture) {
   if (input.abortSignal?.aborted)
     return Promise.resolve({
       exitCode: null,
@@ -4287,6 +4316,7 @@ function runSystemProcess(input) {
       if (timeout) clearTimeout(timeout);
       if (stopGrace) clearTimeout(stopGrace);
       input.abortSignal?.removeEventListener("abort", abort);
+      capture?.end();
       resolve(
         Object.freeze({
           exitCode,
@@ -4330,18 +4360,25 @@ function runSystemProcess(input) {
       stopGrace.unref();
     };
     const abort = () => stop("aborted");
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
-    child.stdout.on("data", (chunk) => {
-      const remaining = streamMaxChars - stdout.length;
-      truncated ||= chunk.length > remaining;
-      stdout += chunk.slice(0, remaining);
-    });
-    child.stderr.on("data", (chunk) => {
-      const remaining = streamMaxChars - stderr.length;
-      truncated ||= chunk.length > remaining;
-      stderr += chunk.slice(0, remaining);
-    });
+    const attachOutput = () => {
+      if (capture) {
+        capture.attach(child.stdout, child.stderr, () => stop("output_failed"));
+        return;
+      }
+      child.stdout.setEncoding("utf8");
+      child.stderr.setEncoding("utf8");
+      child.stdout.on("data", (chunk) => {
+        const remaining = streamMaxChars - stdout.length;
+        truncated ||= chunk.length > remaining;
+        stdout += chunk.slice(0, remaining);
+      });
+      child.stderr.on("data", (chunk) => {
+        const remaining = streamMaxChars - stderr.length;
+        truncated ||= chunk.length > remaining;
+        stderr += chunk.slice(0, remaining);
+      });
+    };
+    attachOutput();
     child.once("error", (error) => {
       status = "spawn_failed";
       stderr = error.message.slice(0, STREAM_MAX_CHARS);
@@ -4963,7 +5000,7 @@ async function executeSystemCommand(input) {
     );
   await requireNativeWorkingDirectory(target, cwd);
   const plan = params.elevated === true ? await elevatedSystemCommand({ target, command, cwd, run }) : unprivilegedSystemCommand(target, command, cwd);
-  return run({
+  return (input.runCommand ?? run)({
     ...plan,
     timeoutMs,
     ...input.abortSignal ? { abortSignal: input.abortSignal } : {}
@@ -5007,6 +5044,11 @@ var LEGACY_EVIDENCE_LABELS = {
   launch_request_dispatch: "application launch request dispatch"
 };
 function systemProcessResult(target, result, evidenceScope, application) {
+  return enforcePluginResultByteBudget(
+    buildSystemProcessResult(target, result, evidenceScope, application)
+  );
+}
+function buildSystemProcessResult(target, result, evidenceScope, application) {
   const stdoutOmittedChars = Math.max(
     0,
     result.stdout.length - STREAM_EXCERPT_CHARS
@@ -5049,24 +5091,28 @@ function systemProcessResult(target, result, evidenceScope, application) {
     `Summary omitted characters: stdout=${stdoutOmittedChars}, stderr=${stderrOmittedChars}. Raw stream capture truncated: ${result.outputTruncated}.`
   ].join("\n");
   if (hasSuccessfulSystemObservation(result)) {
-    return successResult({
+    return {
+      ok: true,
+      producedNewInformation: true,
       output,
       stdout: result.stdout,
       stderr: result.stderr,
       exitCode: 0,
       data
-    });
+    };
   }
   const errorCode = result.status === "completed" ? "system_command_failed" : `system_${result.status}`;
-  return failureResult({
+  return {
+    ok: false,
+    producedNewInformation: false,
     errorCode,
-    message: hasUncertainDescendantState(result) ? "System command observation stopped. External or detached descendants may remain; inspect the target before retrying." : "The target did not report successful command completion.",
+    error: hasUncertainDescendantState(result) ? "System command observation stopped. External or detached descendants may remain; inspect the target before retrying." : "The target did not report successful command completion.",
     output,
     stdout: result.stdout,
     stderr: result.stderr,
     ...result.exitCode !== null ? { exitCode: result.exitCode } : {},
     data
-  });
+  };
 }
 function hasSuccessfulSystemObservation(result) {
   if (result.status !== "completed") return false;
@@ -5082,15 +5128,60 @@ function identityExcerpt(identity) {
 }
 
 // src/computer-access/handlers.ts
-function withSystemOperationErrors(operation) {
+var PROTECTION_FAILURE = "The system result could not be protected for delivery.";
+function protectSystemResult(operation) {
+  try {
+    return operation();
+  } catch {
+    throw new SystemOperationError("system_result_protection_failed", PROTECTION_FAILURE);
+  }
+}
+function failedSystemProtectionReceipt(target, result, evidenceScope) {
+  const safeProcess = {
+    status: result.status,
+    exitCode: result.exitCode,
+    outputTruncated: result.outputTruncated,
+    stdout: "[UNAVAILABLE: result protection failed]",
+    stderr: "[UNAVAILABLE: result protection failed]",
+    ...result.spawnedProcess ? {
+      spawnedProcess: {
+        pid: result.spawnedProcess.pid,
+        pidNamespace: result.spawnedProcess.pidNamespace,
+        identitySource: result.spawnedProcess.identitySource,
+        executable: "[REDACTED]"
+      }
+    } : {}
+  };
+  const receipt = systemProcessResult(target, safeProcess, evidenceScope);
+  return failureResult({
+    errorCode: "system_result_protection_failed",
+    message: PROTECTION_FAILURE,
+    output: "The operation was dispatched. Inspect the process receipt before another action; the command was not replayed.\n" + receipt.output,
+    stdout: safeProcess.stdout,
+    stderr: safeProcess.stderr,
+    ...result.exitCode !== null ? { exitCode: result.exitCode } : {},
+    data: receipt.data
+  });
+}
+function withSystemOperationErrors(operation, protection) {
   return async (params, context) => {
     try {
       return await operation(params, context);
     } catch (error) {
+      let message = error instanceof Error ? error.message : void 0;
+      try {
+        if (protection && message !== void 0)
+          message = protection.protectMessage(message);
+      } catch {
+        return failureResult({
+          errorCode: "system_result_protection_failed",
+          message: PROTECTION_FAILURE
+        });
+      }
       if (error instanceof SystemOperationError)
         return failureResult({
           errorCode: error.code,
-          message: error.message,
+          message,
           data: {
             humanActionRequired: error.code === "system_authorization_required"
           }
@@ -5103,9 +5194,10 @@ function withSystemOperationErrors(operation) {
     }
   };
 }
-function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => resolveSystemTarget(id, run)) {
+function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => resolveSystemTarget(id, run), commandOutput, protection) {
   const targets = async () => {
-    const observation = await observeSystemTargets(run);
+    const observed = await observeSystemTargets(run);
+    const observation = protection ? protectSystemResult(() => protection.protectTargets(observed)) : observed;
     return successResult({
       output: JSON.stringify(observation),
       data: {
@@ -5116,12 +5208,21 @@ function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => re
   };
   const command = async (params, context) => {
     const target = await resolveTarget(readSystemTargetId(params.target));
-    const result = await executeSystemCommand({
+    const output = commandOutput?.(context);
+    const observed = await executeSystemCommand({
       target,
       params,
       run,
+      ...output ? { runCommand: output.run } : {},
       ...context?.abortSignal ? { abortSignal: context.abortSignal } : {}
     });
+    let result = observed;
+    try {
+      if (protection) result = protection.protectProcess(observed);
+    } catch {
+      return failedSystemProtectionReceipt(target, observed, "command_process_completion");
+    }
+    if (output) return output.present(target, result);
     return systemProcessResult(target, result, "command_process_completion");
   };
   const applications = async (params) => {
@@ -5132,7 +5233,8 @@ function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => re
       minimum: 1,
       maximum: 100
     });
-    const catalog = await readSystemApplications(target, run);
+    const observed = await readSystemApplications(target, run);
+    const catalog = protection ? protectSystemResult(() => protection.protectCatalog(observed)) : observed;
     const { output, data } = systemApplicationObservation(
       target,
       catalog,
@@ -5155,20 +5257,447 @@ function createSystemHandlers(run = runSystemProcess, resolveTarget = (id) => re
       run,
       ...context?.abortSignal ? { abortSignal: context.abortSignal } : {}
     });
+    let process2 = result.process;
+    let application = result.application;
+    try {
+      if (protection) {
+        process2 = protection.protectProcess(result.process);
+        application = protection.protectApplication(result.application);
+      }
+    } catch {
+      return failedSystemProtectionReceipt(target, result.process, "launch_request_dispatch");
+    }
     return systemProcessResult(
       target,
-      result.process,
+      process2,
       "launch_request_dispatch",
-      result.application
+      application
     );
   };
   return {
-    system_targets: withSystemOperationErrors(targets),
-    system_command: withSystemOperationErrors(command),
-    system_applications: withSystemOperationErrors(applications),
-    system_launch: withSystemOperationErrors(launch)
+    system_targets: withSystemOperationErrors(targets, protection),
+    system_command: withSystemOperationErrors(command, protection),
+    system_applications: withSystemOperationErrors(applications, protection),
+    system_launch: withSystemOperationErrors(launch, protection)
+  };
+}
+
+// src/computer-access/command-output-capture.ts
+var import_node_crypto6 = require("node:crypto");
+var import_node_events = require("node:events");
+var import_node_fs5 = require("node:fs");
+var import_promises7 = require("node:fs/promises");
+var import_node_path8 = require("node:path");
+var import_promises8 = require("node:stream/promises");
+
+// src/computer-access/command-output-protection.ts
+var import_promises5 = require("node:fs/promises");
+var CapturedOutputProtectionError = class extends Error {
+  constructor(reason) {
+    super(reason);
+    this.reason = reason;
+  }
+  reason;
+};
+async function protectCapturedOutput(paths, redact) {
+  let stdout, stderr;
+  try {
+    stdout = await protectStream(paths.stdout, redact);
+    stderr = await protectStream(paths.stderr, redact);
+    const writes = await Promise.allSettled([
+      (0, import_promises5.writeFile)(paths.stdout, stdout, { flag: "w", mode: 384, flush: true }),
+      (0, import_promises5.writeFile)(paths.stderr, stderr, { flag: "w", mode: 384, flush: true })
+    ]);
+    if (hasRejectedOutputWrite(writes)) throw new CapturedOutputProtectionError("output_storage_failed");
+    return { stdout, stderr };
+  } catch (error) {
+    stdout?.fill(0);
+    stderr?.fill(0);
+    throw error;
+  }
+}
+async function protectStream(path, redact) {
+  let bytes;
+  try {
+    bytes = await (0, import_promises5.readFile)(path);
+  } catch {
+    throw new CapturedOutputProtectionError("output_storage_failed");
+  }
+  try {
+    const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+    const protectedText = redact(text);
+    if (!isProtectedOutputText(protectedText)) throw new Error("output_protection_failed");
+    return Buffer.from(protectedText, "utf8");
+  } catch {
+    throw new CapturedOutputProtectionError("output_protection_failed");
+  } finally {
+    bytes.fill(0);
+  }
+}
+async function discardCapturedOutput(paths) {
+  const removed = await Promise.allSettled(Object.values(paths).map((path) => (0, import_promises5.rm)(path, { force: true })));
+  return removed.every((entry) => entry.status === "fulfilled");
+}
+function isProtectedOutputText(value) {
+  return typeof value === "string";
+}
+function hasRejectedOutputWrite(writes) {
+  return writes.some((entry) => entry.status === "rejected");
+}
+
+// src/computer-access/command-output-retention.ts
+var import_promises6 = require("node:fs/promises");
+var import_node_path7 = require("node:path");
+var DEFAULT_SYSTEM_OUTPUT_RETENTION_MS = 7 * 24 * 60 * 6e4;
+var activeSystemCaptures = /* @__PURE__ */ new Set();
+var jobs = /* @__PURE__ */ new Map();
+var CAPTURE_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/;
+async function cleanupSystemOutput(root, retentionMs) {
+  const entries = await (0, import_promises6.readdir)(root, { withFileTypes: true }).catch((error) => {
+    if (error.code === "ENOENT") return [];
+    throw error;
+  });
+  let removed = 0;
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !CAPTURE_ID.test(entry.name)) continue;
+    const directory = (0, import_node_path7.join)(root, entry.name);
+    if (activeSystemCaptures.has(directory)) continue;
+    const files = await (0, import_promises6.readdir)(directory);
+    const times = await Promise.all(files.map(async (file) => (await (0, import_promises6.stat)((0, import_node_path7.join)(directory, file))).mtimeMs));
+    const completedAt = Math.max((await (0, import_promises6.stat)(directory)).mtimeMs, ...times);
+    const captureRetentionMs = await readCaptureRetention(directory, entry.name, retentionMs);
+    if (Date.now() - completedAt < captureRetentionMs) continue;
+    if (activeSystemCaptures.has(directory)) continue;
+    await (0, import_promises6.rm)(directory, { recursive: true });
+    removed += 1;
+  }
+  return removed;
+}
+async function readCaptureRetention(directory, id, fallbackMs) {
+  let receipt;
+  try {
+    receipt = JSON.parse(await (0, import_promises6.readFile)((0, import_node_path7.join)(directory, "receipt.json"), "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return fallbackMs;
+    if (error instanceof SyntaxError) return fallbackMs;
+    throw error;
+  }
+  if (receipt === null || typeof receipt !== "object") return fallbackMs;
+  if (!("kind" in receipt) || receipt.kind !== "system_command_output_v1") return fallbackMs;
+  if (!("id" in receipt) || receipt.id !== id) return fallbackMs;
+  if (!("retentionMs" in receipt) || typeof receipt.retentionMs !== "number") return fallbackMs;
+  if (!Number.isSafeInteger(receipt.retentionMs) || receipt.retentionMs < 1) return fallbackMs;
+  return receipt.retentionMs;
+}
+function scheduleSystemOutputCleanup(root, retentionMs) {
+  const previous = jobs.get(root);
+  if (previous) {
+    previous.retentionMs = retentionMs;
+    previous.requested = true;
+    return;
+  }
+  const job = { retentionMs, requested: false };
+  jobs.set(root, job);
+  const sweep = async () => {
+    job.requested = false;
+    let empty = false;
+    try {
+      await cleanupSystemOutput(root, job.retentionMs);
+      empty = (await (0, import_promises6.readdir)(root).catch((error) => {
+        if (error.code === "ENOENT") return [];
+        throw error;
+      })).length === 0;
+    } catch {
+      process.emitWarning("SYSTEM output cleanup failed; retained output was not confirmed removed.", { code: "SYSTEM_OUTPUT_CLEANUP_FAILED" });
+    }
+    if (empty && !job.requested) {
+      jobs.delete(root);
+      return;
+    }
+    const timer = setTimeout(() => {
+      void sweep();
+    }, Math.max(1, Math.min(job.retentionMs, 60 * 6e4)));
+    timer.unref();
+  };
+  void sweep();
+}
+
+// src/computer-access/command-output-capture.ts
+var STREAMS = ["stdout", "stderr"];
+var OUTPUT_IO_CHUNK_BYTES = 64 * 1024;
+async function createSystemOutputCapture(root, retentionMs, redact) {
+  if (!hasOutputProtection(redact))
+    throw new SystemOperationError("system_output_protection_failed", "Command output protection is unavailable. The command was not dispatched.");
+  const id = (0, import_node_crypto6.randomUUID)();
+  const directory = (0, import_node_path8.join)(root, id);
+  activeSystemCaptures.add(directory);
+  try {
+    await (0, import_promises7.mkdir)(directory, { recursive: true, mode: 448 });
+  } catch {
+    activeSystemCaptures.delete(directory);
+    throw new SystemOperationError("system_output_storage_failed", "Output storage could not be prepared. The command was not dispatched.");
+  }
+  let storageFailure, securityFailure;
+  let stop;
+  let ended = false, retained = false, admitted = false;
+  let receipt;
+  let processResult;
+  let finishing;
+  const sources = [];
+  const completeStreams = /* @__PURE__ */ new Set();
+  const paths = { stdout: (0, import_node_path8.join)(directory, "stdout.bytes"), stderr: (0, import_node_path8.join)(directory, "stderr.bytes") };
+  const streams = STREAMS.map((name) => {
+    const sink = (0, import_node_fs5.createWriteStream)(paths[name], { flags: "wx", mode: 384, highWaterMark: OUTPUT_IO_CHUNK_BYTES, flush: true });
+    const completion = (0, import_promises8.finished)(sink).catch(() => {
+      storageFailure ??= "write_failed";
+      stop?.();
+    });
+    return { sink, completion };
+  });
+  try {
+    await Promise.all(streams.map(({ sink }) => (0, import_node_events.once)(sink, "open")));
+  } catch {
+    for (const { sink } of streams) sink.destroy();
+    await Promise.all(streams.map(({ completion }) => completion));
+    activeSystemCaptures.delete(directory);
+    scheduleSystemOutputCleanup(root, retentionMs);
+    throw new SystemOperationError("system_output_storage_failed", "Output files could not be opened. The command was not dispatched.");
+  }
+  scheduleSystemOutputCleanup(root, retentionMs);
+  const failure = () => storageFailure ?? securityFailure;
+  const capture = {
+    attach(stdout, stderr, onFailure) {
+      if (!canAttachCapture()) {
+        securityFailure ??= "output_protection_failed";
+        onFailure();
+        return;
+      }
+      stop = onFailure;
+      sources.push(stdout, stderr);
+      for (const [index, source] of sources.entries()) {
+        source.once("end", () => completeStreams.add(STREAMS[index]));
+        source.once("error", () => {
+          securityFailure ??= "output_incomplete";
+          stop?.();
+        });
+        source.pipe(streams[index].sink);
+      }
+      if (failure()) onFailure();
+    },
+    end() {
+      if (ended) return;
+      ended = true;
+      if (!hasCompleteStreams()) securityFailure ??= "output_incomplete";
+      for (const source of sources) {
+        source.unpipe();
+        source.destroy();
+      }
+      for (const { sink } of streams) if (!sink.destroyed && !sink.writableEnded) sink.end();
+    }
+  };
+  function canAttachCapture() {
+    return sources.length === 0 && !ended;
+  }
+  function hasCompleteStreams() {
+    return completeStreams.size === 2;
+  }
+  function protectProcess2(result) {
+    if (!result) return;
+    let spawnedProcess = result.spawnedProcess;
+    if (spawnedProcess) {
+      let executable = "[REDACTED]";
+      try {
+        executable = redact(spawnedProcess.executable);
+        if (!hasProtectedIdentity(executable)) throw new Error("output_protection_failed");
+      } catch {
+        securityFailure ??= "output_protection_failed";
+        executable = "[REDACTED]";
+      }
+      spawnedProcess = { ...spawnedProcess, executable };
+    }
+    processResult = {
+      exitCode: result.exitCode,
+      status: result.status,
+      outputTruncated: result.outputTruncated,
+      stdout: "",
+      stderr: "",
+      ...spawnedProcess ? { spawnedProcess } : {}
+    };
+  }
+  async function finish(result, materialize = true) {
+    capture.end();
+    await Promise.all(streams.map(({ completion }) => completion));
+    protectProcess2(result);
+    let protectedBytes;
+    try {
+      if (!failure()) {
+        try {
+          protectedBytes = await protectCapturedOutput(paths, redact);
+        } catch (error) {
+          if (isOutputStorageFailure(error)) storageFailure ??= "write_failed";
+          else securityFailure ??= "output_protection_failed";
+        }
+      }
+      if (failure() && !await discardCapturedOutput(paths)) storageFailure = "capture_purge_failed";
+      receipt = {
+        id,
+        stdoutBytes: protectedBytes?.stdout.length ?? 0,
+        stderrBytes: protectedBytes?.stderr.length ?? 0,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        retentionMs,
+        complete: !failure(),
+        ...!materialize && protectedBytes ? {
+          stdoutSha256: (0, import_node_crypto6.createHash)("sha256").update(protectedBytes.stdout).digest("hex"),
+          stderrSha256: (0, import_node_crypto6.createHash)("sha256").update(protectedBytes.stderr).digest("hex")
+        } : {}
+      };
+      try {
+        const temporary = (0, import_node_path8.join)(directory, "receipt.tmp");
+        await (0, import_promises7.writeFile)(
+          temporary,
+          JSON.stringify({
+            kind: "system_command_output_v1",
+            ...receipt,
+            processStatus: processResult?.status,
+            exitCode: processResult?.exitCode,
+            spawnedProcess: processResult?.spawnedProcess,
+            ...securityFailure ? { securityFailure } : {},
+            ...storageFailure ? { storageFailure } : {}
+          }),
+          { flag: "wx", mode: 384, flush: true }
+        );
+        await (0, import_promises7.rename)(temporary, (0, import_node_path8.join)(directory, "receipt.json"));
+      } catch {
+        storageFailure ??= "receipt_write_failed";
+        receipt = { ...receipt, complete: false };
+      }
+      admitted = receipt.complete;
+      if (!admitted || !materialize || !protectedBytes) return { stdout: "", stderr: "" };
+      return { stdout: protectedBytes.stdout.toString("utf8"), stderr: protectedBytes.stderr.toString("utf8") };
+    } finally {
+      protectedBytes?.stdout.fill(0);
+      protectedBytes?.stderr.fill(0);
+      if (!retained) activeSystemCaptures.delete(directory);
+    }
+  }
+  return {
+    capture,
+    get receipt() {
+      return receipt;
+    },
+    get failure() {
+      return failure();
+    },
+    get failureKind() {
+      if (storageFailure) return "storage";
+      return securityFailure ? "security" : void 0;
+    },
+    get processResult() {
+      return processResult;
+    },
+    retain() {
+      retained = true;
+      activeSystemCaptures.add(directory);
+    },
+    release() {
+      retained = false;
+      activeSystemCaptures.delete(directory);
+    },
+    async read(stream, offset, length) {
+      if (!admitted) throw new Error("system_output_unavailable");
+      if (!isAdmittedOutputRead(stream, offset, length, receipt)) throw new Error("system_output_reference_invalid");
+      const file = await (0, import_promises7.open)(paths[stream], "r");
+      try {
+        const size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes;
+        const bytes = Buffer.alloc(Math.min(length, size - offset));
+        const { bytesRead } = await file.read(bytes, 0, bytes.length, offset);
+        return bytes.subarray(0, bytesRead);
+      } finally {
+        await file.close();
+      }
+    },
+    finish(result, materialize = true) {
+      finishing ??= finish(result, materialize);
+      return finishing;
+    }
+  };
+}
+function hasOutputProtection(value) {
+  return typeof value === "function";
+}
+function hasProtectedIdentity(value) {
+  return typeof value === "string";
+}
+function isOutputStorageFailure(error) {
+  return error instanceof CapturedOutputProtectionError && error.reason === "output_storage_failed";
+}
+function isAdmittedOutputRead(stream, offset, length, receipt) {
+  if (stream !== "stdout" && stream !== "stderr") return false;
+  if (!Number.isSafeInteger(offset) || offset < 0) return false;
+  if (!Number.isSafeInteger(length) || length < 0) return false;
+  const size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes;
+  return offset <= size;
+}
+
+// src/computer-access/companion/command-output-protocol.ts
+var SYSTEM_OUTPUT_CAPABILITY = "system_command_output_v1";
+var SYSTEM_OUTPUT_CHUNK_BYTES = 64 * 1024;
+function isStreamByteCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+function isStreamDigest(value) {
+  return typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+}
+function readSystemOutputTransfer(value) {
+  if (!isHostRecord(value)) throw new Error("system_output_receipt_invalid");
+  if (value.kind !== SYSTEM_OUTPUT_CAPABILITY) throw new Error("system_output_receipt_invalid");
+  if (!isHostIdentifier(value.id)) throw new Error("system_output_receipt_invalid");
+  if (!isStreamByteCount(value.stdoutBytes)) throw new Error("system_output_receipt_invalid");
+  if (!isStreamByteCount(value.stderrBytes)) throw new Error("system_output_receipt_invalid");
+  if (!isStreamDigest(value.stdoutSha256)) throw new Error("system_output_receipt_invalid");
+  if (!isStreamDigest(value.stderrSha256)) throw new Error("system_output_receipt_invalid");
+  return {
+    kind: SYSTEM_OUTPUT_CAPABILITY,
+    id: value.id,
+    stdoutBytes: value.stdoutBytes,
+    stderrBytes: value.stderrBytes,
+    stdoutSha256: value.stdoutSha256,
+    stderrSha256: value.stderrSha256
+  };
+}
+
+// plugins/system/source/command-working-directory.ts
+var import_node_path9 = require("node:path");
+function createSystemCommandPathAdapter(adapter, snapshot, resolver) {
+  if (!resolver) return adapter;
+  return {
+    ...adapter,
+    normalizeCall(input) {
+      const call = adapter?.normalizeCall?.(input) ?? input;
+      if (!hasNativeWindowsRelativeDirectory(call, snapshot)) return call;
+      const directory = resolver.resolve(call.params.cwd, {
+        requirePath: true,
+        allowedLocations: ["agent_work", "workspace"]
+      });
+      return {
+        ...call,
+        params: { ...call.params, cwd: directory.absolutePath }
+      };
+    }
   };
 }
+function hasNativeWindowsRelativeDirectory(call, snapshot) {
+  if (call.tool !== "system_command") return false;
+  if (call.params.target !== "windows") return false;
+  if (typeof call.params.cwd !== "string") return false;
+  if (import_node_path9.win32.isAbsolute(call.params.cwd.trim())) return false;
+  const route = snapshot.find((entry) => {
+    if (entry.kind !== "native") return false;
+    if (entry.target.id !== "windows") return false;
+    return entry.target.transport === "native";
+  });
+  return route !== void 0;
+}
 
 // plugins/system/source/computer/public-action.ts
 function readPublicComputerAction(params) {
@@ -5331,8 +5860,115 @@ function fits(value) {
   return Buffer.byteLength(value, "utf8") <= COMPUTER_OBSERVATION_OUTPUT_MAX_BYTES;
 }
 
+// plugins/system/source/security/secret-text.ts
+var REDACTED = "[REDACTED]";
+var CREDENTIAL_KEY_SOURCE = String.raw`(?:[A-Za-z][A-Za-z0-9_-]*\.)*(?:[A-Za-z][A-Za-z0-9]*[-_])*(?:password|passwd|pwd|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|client[_ -]?secret|secret[_ -]?access[_ -]?key|recovery[_ -]?code)`;
+var credentialIndicator = new RegExp(
+  String.raw`(?<![\p{L}\p{N}_.-])(?:-{1,2})?(?:${CREDENTIAL_KEY_SOURCE}|(?:proxy-)?authorization)[\s"'\\]*[:=]`,
+  "iu"
+);
+function detectionText(input) {
+  const percentDecoded = input.replace(
+    /%([0-7][0-9a-f])/giu,
+    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
+  );
+  return percentDecoded.replace(
+    /\\(?:u00|x|U000000)([0-7][0-9a-fA-F])/gu,
+    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
+  );
+}
+function hasPrivateKeyIndicator(text) {
+  return /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/u.test(text);
+}
+function hasUrlCredentials(text) {
+  return /\b[a-z][a-z0-9+.-]*(?::|%3a)(?:\/|%2f){2}[^\s/?#<>]*(?:@|%40)/iu.test(text);
+}
+function hasAuthorizationCredentials(text) {
+  for (const match of text.matchAll(
+    /\b(Bearer|Basic)[ \t]+([A-Za-z0-9._~+/-]+={0,2})/giu
+  )) {
+    if (match[1].toLowerCase() === "bearer") return true;
+    const value = match[2];
+    if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(value)) continue;
+    if (value.length < 8) continue;
+    if (Buffer.from(value, "base64").toString("utf8").includes(":")) return true;
+  }
+  return false;
+}
+function isAwsAccessKeyValue(value, atEnd) {
+  if (/^[A-Z0-9]{16}$/u.test(value)) return true;
+  if (!atEnd) return false;
+  return /^[A-Z0-9]{4,15}$/u.test(value);
+}
+function isRecognizedProviderToken(prefix, value, atEnd) {
+  if (prefix === "AKIA" || prefix === "ASIA")
+    return isAwsAccessKeyValue(value, atEnd);
+  if (value.length >= 20) return true;
+  const partialMinimum = prefix === "sk-" ? 8 : 1;
+  return atEnd && value.length >= partialMinimum;
+}
+function hasProviderToken(text) {
+  const provider = /\b(sk-(?:proj-|svcacct-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|ASIA)([A-Za-z0-9_-]+)/gu;
+  for (const match of text.matchAll(provider)) {
+    const atEnd = match.index + match[0].length === text.length;
+    if (isRecognizedProviderToken(match[1], match[2], atEnd)) return true;
+  }
+  return false;
+}
+function compactJoseSegmentCount(header) {
+  try {
+    const value = JSON.parse(
+      Buffer.from(header, "base64url").toString("utf8")
+    );
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+      return void 0;
+    const fields = value;
+    if (typeof fields.alg !== "string") return void 0;
+    return typeof fields.enc === "string" ? 5 : 3;
+  } catch {
+    return void 0;
+  }
+}
+function hasCompactJoseToken(text) {
+  const jose = /\b([A-Za-z0-9_-]+)(?:\.[A-Za-z0-9_-]*)+/gu;
+  for (const match of text.matchAll(jose)) {
+    const parts = match[0].split(".");
+    const capturedAtEnd = match.index + match[0].length === text.length;
+    for (let index = 0; index < parts.length - 1; index += 1) {
+      const expected = compactJoseSegmentCount(parts[index]);
+      if (expected === void 0) continue;
+      if (expected === 3 && parts[index + 1] === "") continue;
+      if (parts.length - index >= expected) return true;
+      if (capturedAtEnd) return true;
+    }
+  }
+  return false;
+}
+function hasSecretIndicator(text) {
+  if (credentialIndicator.test(text)) return true;
+  if (hasPrivateKeyIndicator(text)) return true;
+  if (hasUrlCredentials(text)) return true;
+  if (hasAuthorizationCredentials(text)) return true;
+  if (hasProviderToken(text)) return true;
+  return hasCompactJoseToken(text);
+}
+function redactSecretText(input) {
+  if (hasSecretIndicator(input)) return REDACTED;
+  if (hasSecretIndicator(detectionText(input))) return REDACTED;
+  return input;
+}
+
+// plugins/system/source/security/observed-error.ts
+function protectObservedError(error, fallback) {
+  try {
+    return redactSecretText(error instanceof Error ? error.message : fallback);
+  } catch {
+    return "Observed error details withheld because the protection check failed.";
+  }
+}
+
 // plugins/system/source/computer/request-computers.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 
 // plugins/system/source/request-target-snapshot.ts
 async function captureSystemTargetSnapshot(input) {
@@ -5420,7 +6056,7 @@ function systemRouteMetadata(route) {
   return {
     displayTarget: route.target,
     transport: "host_companion",
-    computerName: route.identity.name
+    computerName: redactSecretText(route.identity.name)
   };
 }
 function observeCapturedSystemTargets(snapshot) {
@@ -5449,14 +6085,14 @@ function modelSafeRouteObservation(route) {
 }
 
 // plugins/system/source/computer/desktop-bindings.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var DesktopBindings = class {
   current;
   windows = /* @__PURE__ */ new Map();
   observe(result) {
     this.windows.clear();
     const windows = result.windows.map((window) => {
-      const id2 = (0, import_node_crypto6.randomUUID)();
+      const id2 = (0, import_node_crypto7.randomUUID)();
       this.windows.set(id2, window.binding);
       const { binding: _binding, ...details } = window;
       return {
@@ -5472,7 +6108,7 @@ var DesktopBindings = class {
         observation_ref: void 0,
         coordinateSpace: result.desktop.coordinateSpace ?? "native_desktop"
       };
-    const id = (0, import_node_crypto6.randomUUID)();
+    const id = (0, import_node_crypto7.randomUUID)();
     this.current = {
       id,
       issuedAt: Date.now(),
@@ -5567,7 +6203,7 @@ var DesktopBindings = class {
     this.current = void 0;
     this.windows.clear();
   }
-  regionalObservation(observationRef, rectangle) {
+  regionalObservation(observationRef, rectangle2) {
     const current = this.current;
     if (!current || current.id !== observationRef)
       throw new SystemOperationError(
@@ -5575,7 +6211,7 @@ var DesktopBindings = class {
         "Use a current observation to select a smaller region."
       );
     const observation = current.observation;
-    if (!isRegionInsideImage(rectangle, observation))
+    if (!isRegionInsideImage(rectangle2, observation))
       throw new SystemOperationError(
         "computer_region_outside_image",
         "Select a region inside the returned image."
@@ -5587,10 +6223,10 @@ var DesktopBindings = class {
       desktopBinding: current.result.desktop.binding,
       expectedGeometry: current.result.desktop.bounds,
       region: {
-        x: Math.round(observation.region.x + rectangle.x * scaleX),
-        y: Math.round(observation.region.y + rectangle.y * scaleY),
-        width: Math.max(1, Math.floor(rectangle.width * scaleX)),
-        height: Math.max(1, Math.floor(rectangle.height * scaleY))
+        x: Math.round(observation.region.x + rectangle2.x * scaleX),
+        y: Math.round(observation.region.y + rectangle2.y * scaleY),
+        width: Math.max(1, Math.floor(rectangle2.width * scaleX)),
+        height: Math.max(1, Math.floor(rectangle2.height * scaleY))
       }
     };
   }
@@ -5622,10 +6258,10 @@ function imageRectangle(bounds, observation) {
     height: bounds.height * scaleY
   };
 }
-function isRegionInsideImage(rectangle, observation) {
-  if (rectangle.x < 0 || rectangle.y < 0) return false;
-  if (rectangle.x + rectangle.width > observation.imageWidth) return false;
-  return rectangle.y + rectangle.height <= observation.imageHeight;
+function isRegionInsideImage(rectangle2, observation) {
+  if (rectangle2.x < 0 || rectangle2.y < 0) return false;
+  if (rectangle2.x + rectangle2.width > observation.imageWidth) return false;
+  return rectangle2.y + rectangle2.height <= observation.imageHeight;
 }
 function translateAction(action, observation) {
   const point = (value) => {
@@ -5650,6 +6286,131 @@ function translateAction(action, observation) {
   return action;
 }
 
+// plugins/system/source/security/desktop-result.ts
+function rectangle(value) {
+  return { x: value.x, y: value.y, width: value.width, height: value.height };
+}
+function projectDesktopFields(result, text) {
+  const capability = (value) => ({
+    supported: value.supported,
+    available: value.available,
+    ...value.reason === void 0 ? {} : { reason: text(value.reason) }
+  });
+  const desktop = result.desktop;
+  return {
+    desktop: {
+      platform: desktop.platform,
+      binding: desktop.binding,
+      name: text(desktop.name),
+      available: desktop.available,
+      ...desktop.reason === void 0 ? {} : { reason: text(desktop.reason) },
+      bounds: rectangle(desktop.bounds),
+      ...desktop.coordinateSpace === void 0 ? {} : { coordinateSpace: desktop.coordinateSpace },
+      capabilities: {
+        capture: capability(desktop.capabilities.capture),
+        accessibility: capability(desktop.capabilities.accessibility),
+        input: capability(desktop.capabilities.input),
+        windows: capability(desktop.capabilities.windows)
+      },
+      targetingGuarantee: desktop.targetingGuarantee
+    },
+    windows: result.windows.map((window) => ({
+      binding: window.binding,
+      title: text(window.title),
+      ...window.application === void 0 ? {} : { application: text(window.application) },
+      bounds: rectangle(window.bounds),
+      focused: window.focused
+    })),
+    ...result.focusedWindow === void 0 ? {} : { focusedWindow: result.focusedWindow },
+    ...result.observation ? {
+      observation: {
+        capturedAt: text(result.observation.capturedAt),
+        region: rectangle(result.observation.region),
+        imageWidth: result.observation.imageWidth,
+        imageHeight: result.observation.imageHeight,
+        accessibility: result.observation.accessibility.map((node) => ({
+          role: text(node.role),
+          ...node.name === void 0 ? {} : { name: text(node.name) },
+          ...node.value === void 0 ? {} : { value: text(node.value) },
+          ...node.bounds === void 0 ? {} : { bounds: rectangle(node.bounds) },
+          ...node.focused === void 0 ? {} : { focused: node.focused }
+        })),
+        accessibilityTruncated: result.observation.accessibilityTruncated
+      }
+    } : {},
+    ...result.dispatch ? {
+      dispatch: {
+        status: result.dispatch.status,
+        requestedInputCount: result.dispatch.requestedInputCount,
+        ...result.dispatch.acceptedInputCount === void 0 ? {} : { acceptedInputCount: result.dispatch.acceptedInputCount },
+        ...result.dispatch.reason === void 0 ? {} : { reason: text(result.dispatch.reason) }
+      }
+    } : {},
+    ...result.error ? {
+      error: {
+        code: text(result.error.code),
+        message: text(result.error.message)
+      }
+    } : {}
+  };
+}
+function protectDesktopResult(result, scan = redactSecretText) {
+  let suspected = false;
+  try {
+    const protectedResult = projectDesktopFields(result, (input) => {
+      const output = scan(input);
+      if (typeof output !== "string")
+        throw new Error("desktop_text_scan_failed");
+      suspected ||= output !== input;
+      return output;
+    });
+    if (!suspected)
+      return {
+        ...protectedResult,
+        ...result.image ? {
+          image: {
+            mimeType: result.image.mimeType,
+            bytes: result.image.bytes
+          }
+        } : {}
+      };
+    result.image?.bytes.fill(0);
+    return {
+      ...protectedResult,
+      ...result.image && !protectedResult.error ? {
+        error: {
+          code: "computer_image_secret_blocked",
+          message: "Image withheld because desktop text contained a suspected secret. The dispatch receipt is unchanged."
+        }
+      } : {}
+    };
+  } catch {
+    result.image?.bytes.fill(0);
+    const safe = projectDesktopFields(result, () => "[REDACTED]");
+    return {
+      desktop: {
+        ...safe.desktop,
+        reason: "Desktop content withheld because its protection check failed."
+      },
+      windows: [],
+      ...safe.focusedWindow === void 0 ? {} : { focusedWindow: safe.focusedWindow },
+      ...safe.dispatch ? { dispatch: safe.dispatch } : {},
+      error: {
+        code: "computer_observation_protection_failed",
+        message: "Desktop content withheld because its protection check failed. The dispatch receipt is unchanged."
+      }
+    };
+  }
+}
+function protectNativeDesktopBackend(backend) {
+  return {
+    async execute(request, signal) {
+      return protectDesktopResult(await backend.execute(request, signal));
+    },
+    close: () => backend.close()
+  };
+}
+
 // plugins/system/source/computer/request-computers.ts
 var RequestComputers = class {
   constructor(rootDir, routes, connection, nativeFactory = createNativeComputerBackend, snapshot) {
@@ -5657,7 +6418,7 @@ var RequestComputers = class {
     this.connection = connection;
     this.nativeFactory = nativeFactory;
     this.entries = snapshot === void 0 ? routes.map((route) => ({
-      ref: (0, import_node_crypto7.randomUUID)(),
+      ref: (0, import_node_crypto8.randomUUID)(),
       route,
       bindings: new DesktopBindings()
     })) : restoreComputers(routes, snapshot);
@@ -5704,7 +6465,7 @@ var RequestComputers = class {
         "Install the companion from this Runtime build to enable desktop observation and input."
       );
     if (entry.backend) return entry.backend;
-    entry.backend = entry.route.kind === "native" ? this.nativeFactory(entry.route.target) : createCompanionComputerBackend(
+    entry.backend = entry.route.kind === "native" ? protectNativeDesktopBackend(this.nativeFactory(entry.route.target)) : createCompanionComputerBackend(
       this.rootDir,
       entry.route,
       this.connection
@@ -5731,7 +6492,7 @@ function computerQueueIdentity(entry) {
 }
 function supportsComputerRoute(route) {
   if (route.kind === "native") return true;
-  return route.capabilities?.includes(COMPUTER_CAPABILITY) === true;
+  return route.capabilities?.includes(COMPUTER_CAPABILITY) === true && route.capabilities.includes(HOST_SECRET_PROTECTION_CAPABILITY);
 }
 function restoreComputers(routes, value) {
   if (!value || typeof value !== "object" || !("kind" in value) || value.kind !== "request_computers_v1" || !("entries" in value) || !Array.isArray(value.entries))
@@ -5780,7 +6541,7 @@ async function projectComputerResult(entry, result, context) {
         );
       media.push(image);
     } catch (error) {
-      imageFailure = error instanceof Error ? error.message : "Image admission failed.";
+      imageFailure = protectObservedError(error, "Image admission failed.");
     } finally {
       result.image.bytes.fill(0);
     }
@@ -5791,7 +6552,10 @@ async function projectComputerResult(entry, result, context) {
     description.observation_ref = void 0;
   }
   const hasPartialInputDispatch = result.dispatch?.status === "partial";
-  const operationError = result.error ?? (hasPartialInputDispatch ? { code: "computer_input_partial", message: "Only part of the input was accepted." } : void 0);
+  const operationError = result.error ?? (hasPartialInputDispatch ? {
+    code: "computer_input_partial",
+    message: "Only part of the input was accepted."
+  } : void 0);
   const data = {
     desktop_ref: entry.ref,
     ...description.observation_ref ? { observation_ref: description.observation_ref } : {},
@@ -5870,7 +6634,10 @@ function createComputerHandlers(computers) {
     } catch (error) {
       return failureResult({
         errorCode: error instanceof SystemOperationError ? error.code : "computer_operation_interrupted",
-        message: error instanceof Error ? error.message : "Computer operation interrupted; effects may be partial. Observe before another action."
+        message: protectObservedError(
+          error,
+          "Computer operation interrupted; effects may be partial. Observe before another action."
+        )
       });
     }
   };
@@ -5891,7 +6658,10 @@ function createComputerHandlers(computers) {
               return {
                 ...computerRouteLabel(entry),
                 available: false,
-                reason: error instanceof Error ? error.message : "Desktop inspection failed."
+                reason: protectObservedError(
+                  error,
+                  "Desktop inspection failed."
+                )
               };
             }
           }
@@ -5960,20 +6730,34 @@ function requireMedia(context) {
     );
 }
 
+// plugins/system/source/computer/runtime-platform.ts
+function supportsRuntimeDesktopTools(platform = process.platform) {
+  return platform !== "win32";
+}
+function unboundComputerFailure() {
+  if (!supportsRuntimeDesktopTools())
+    return failureResult({
+      errorCode: "computer_runtime_platform_unsupported",
+      message: "Desktop observation and control are unavailable on Windows Runtime. System commands and applications remain available."
+    });
+  return failureResult({
+    errorCode: "computer_request_binding_required",
+    message: "Computer control requires a prepared request."
+  });
+}
+
 // plugins/system/source/computer/request-modules.ts
 function unboundComputerHandlers() {
   return Object.fromEntries(
     COMPUTER_TOOLS.map((name) => [
       name,
-      async () => failureResult({
-        errorCode: "computer_request_binding_required",
-        message: "Computer control requires a prepared request."
-      })
+      async () => unboundComputerFailure()
     ])
   );
 }
 function prepareComputerModules(rootDir, modules, routes, connection, preparation) {
   if (modules.length === 0) return [];
+  if (!supportsRuntimeDesktopTools()) return [];
   const computers = new RequestComputers(
     rootDir,
     routes,
@@ -6026,6 +6810,77 @@ function prepareComputerModules(rootDir, modules, routes, connection, preparatio
   }));
 }
 
+// plugins/system/source/companion-command-output.ts
+var import_node_crypto9 = require("node:crypto");
+var import_node_string_decoder = require("node:string_decoder");
+function supportsCompanionCommandOutput(route) {
+  return route.capabilities?.includes(SYSTEM_OUTPUT_CAPABILITY) === true;
+}
+async function executeCompanionCommand(input) {
+  const { route, context } = input;
+  const call = (operation, params, signal) => input.connection.executeHostOperation(input.rootDir, {
+    hostId: route.hostId,
+    connectionId: route.connectionId,
+    operation,
+    params: { ...params, target: route.target },
+    ...signal ? { abortSignal: signal } : {}
+  });
+  const receipt = await call("system_command_capture", {
+    ...input.params,
+    ...input.outputRetentionMs !== void 0 ? { outputRetentionMs: input.outputRetentionMs } : {}
+  }, context?.abortSignal);
+  if (!receipt.data?.outputTransfer && !receipt.ok) return receipt;
+  let transfer;
+  try {
+    transfer = readSystemOutputTransfer(receipt.data?.outputTransfer);
+    const stdout = await readStream(call, transfer, "stdout", context?.abortSignal);
+    const stderr = await readStream(call, transfer, "stderr", context?.abortSignal);
+    const { outputTransfer: _transfer, ...data } = receipt.data ?? {};
+    const delivered = deliverPluginTextResult({
+      ...receipt,
+      stdout,
+      stderr: stderr || receipt.stderr,
+      data: { ...data, outputDelivery: "complete", summaryOmittedChars: { stdout: stdout.length, stderr: stderr.length } }
+    }, ["stdout", "stderr"], context?.resultBudget);
+    if (delivered.errorCode === "plugin_result_too_large") return transferFailure(receipt, context);
+    return delivered;
+  } catch {
+    return transferFailure(receipt, context);
+  } finally {
+    if (transfer) await call("system_command_output_close", { captureId: transfer.id }, AbortSignal.timeout(3e3)).catch(() => void 0);
+  }
+}
+async function readStream(call, transfer, stream, signal) {
+  const size = stream === "stdout" ? transfer.stdoutBytes : transfer.stderrBytes;
+  const digest = stream === "stdout" ? transfer.stdoutSha256 : transfer.stderrSha256;
+  const hash = (0, import_node_crypto9.createHash)("sha256");
+  const decoder = new import_node_string_decoder.StringDecoder("utf8");
+  let text = "";
+  for (let offset = 0; offset < size; offset += SYSTEM_OUTPUT_CHUNK_BYTES) {
+    signal?.throwIfAborted();
+    const part = await call("system_command_output", { captureId: transfer.id, stream, offset }, signal);
+    if (!part.ok) throw new Error("system_output_transfer_failed");
+    const data = part.data;
+    if (data?.captureId !== transfer.id || data.stream !== stream || data.offset !== offset) throw new Error("system_output_chunk_binding_invalid");
+    if (typeof data.bytes !== "string" || data.bytes.length > SYSTEM_OUTPUT_CHUNK_BYTES * 2) throw new Error("system_output_chunk_invalid");
+    const bytes = Buffer.from(data.bytes, "base64");
+    if (bytes.toString("base64") !== data.bytes) throw new Error("system_output_chunk_invalid");
+    if (bytes.length !== Math.min(SYSTEM_OUTPUT_CHUNK_BYTES, size - offset)) throw new Error("system_output_chunk_size_invalid");
+    hash.update(bytes);
+    text += decoder.write(bytes);
+  }
+  if (hash.digest("hex") !== digest) throw new Error("system_output_digest_invalid");
+  return text + decoder.end();
+}
+function transferFailure(receipt, context) {
+  return failureResult({
+    errorCode: "system_output_delivery_pending",
+    message: "The command settled, but its retained output could not be delivered completely. Process receipt is preserved; the command was not replayed.",
+    ...receipt.exitCode !== void 0 ? { exitCode: receipt.exitCode } : {},
+    data: { ...receipt.data, outputDelivery: "pending", commandOk: receipt.ok, commandErrorCode: receipt.errorCode ?? null }
+  }, context?.resultBudget);
+}
+
 // plugins/system/source/host-dispatch.ts
 var defaultSystemHostConnection = {
   readHostStatus,
@@ -6060,6 +6915,18 @@ function boundOperation(input, operation) {
       const route = requireSystemRequestRoute(input.snapshot, params.target);
       if (route.kind === "native")
         return await input.nativeHandlers[operation](params, context);
+      if (!supportsProtectedCompanionResults(route.capabilities))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected system results. The operation was not dispatched."
+        });
+      if (operation === "system_command" && !supportsCompanionCommandOutput(route))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected complete command output. The command was not dispatched."
+        });
+      if (operation === "system_command")
+        return await executeCompanionCommand({ ...input, route, params, context });
       return await input.connection.executeHostOperation(input.rootDir, {
         hostId: route.hostId,
         connectionId: route.connectionId,
@@ -6069,7 +6936,7 @@ function boundOperation(input, operation) {
       });
     } catch (error) {
       if (error instanceof SystemOperationError)
-        return failureResult({ errorCode: error.code, message: error.message });
+        return failureResult({ errorCode: error.code, message: redactSecretText(error.message) });
       return failureResult({
         errorCode: "system_execution_route_failed",
         message: "The bound execution route failed. No other destination was attempted; effects may be partial if dispatch began."
@@ -6077,6 +6944,9 @@ function boundOperation(input, operation) {
     }
   };
 }
+function supportsProtectedCompanionResults(capabilities) {
+  return capabilities?.includes(HOST_SECRET_PROTECTION_CAPABILITY) === true;
+}
 function hasConnectionControl(params) {
   if (Object.hasOwn(params, "host_id")) return true;
   if (Object.hasOwn(params, "hostId")) return true;
@@ -6112,10 +6982,18 @@ async function prepareSystemRequestModules(rootDir, modules, dependencies = {},
     rootDir,
     snapshot,
     connection,
-    nativeHandlers
+    nativeHandlers,
+    outputRetentionMs: dependencies.outputRetentionMs
   });
   return Object.freeze([
-    ...modules.filter((module2) => !isComputerTool(module2.definition.name)).map((module2) => projectSystemRequestModule(module2, snapshot, handlers)),
+    ...modules.filter((module2) => !isComputerTool(module2.definition.name)).map(
+      (module2) => projectSystemRequestModule(
+        module2,
+        snapshot,
+        handlers,
+        preparation?.runtimePathResolver
+      )
+    ),
     ...computerModules
   ]);
 }
@@ -6132,7 +7010,7 @@ function uniqueSystemCommandRoutes(candidates) {
     return true;
   });
 }
-function projectSystemRequestModule(module2, snapshot, handlers) {
+function projectSystemRequestModule(module2, snapshot, handlers, resolver) {
   const targets = Object.freeze(snapshot.map(routeTargetId));
   const availability = ` Available targets for this request: ${targets.join(", ")}.`;
   return Object.freeze({
@@ -6153,7 +7031,7 @@ function projectSystemRequestModule(module2, snapshot, handlers) {
     },
     implementation: handlers[module2.definition.name],
     adapter: {
-      ...module2.adapter,
+      ...createSystemCommandPathAdapter(module2.adapter, snapshot, resolver),
       executionBinding: systemExecutionBinding(snapshot)
     }
   });
@@ -6173,8 +7051,251 @@ function systemExecutionBinding(snapshot) {
   };
 }
 
+// plugins/system/source/local-command-output.ts
+var import_node_path11 = require("node:path");
+
+// plugins/system/source/security/windows-output-directory.ts
+var import_node_child_process5 = require("node:child_process");
+var import_promises9 = require("node:fs/promises");
+var import_node_path10 = require("node:path");
+var import_node_util2 = require("node:util");
+var execute = (0, import_node_util2.promisify)(import_node_child_process5.execFile);
+var privateDirectoryScript = `
+$env:PSModulePath = "$PSHOME\\Modules"
+$ErrorActionPreference = 'Stop'
+$target = $env:ABOT_SYSTEM_OUTPUT_DIRECTORY
+$current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$item = Get-Item -LiteralPath $target -Force
+if (-not $item.PSIsContainer) { exit 2 }
+if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { exit 2 }
+$inherit = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit, ObjectInherit'
+if ($env:ABOT_SYSTEM_OUTPUT_CREATE_PRIVATE -eq '1') {
+  $acl = New-Object System.Security.AccessControl.DirectorySecurity
+  $acl.SetOwner($current)
+  $acl.SetAccessRuleProtection($true, $false)
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($current, 'FullControl', $inherit, [System.Security.AccessControl.PropagationFlags]::None, [System.Security.AccessControl.AccessControlType]::Allow)
+  $acl.AddAccessRule($rule)
+  Set-Acl -LiteralPath $target -AclObject $acl
+}
+$observed = Get-Acl -LiteralPath $target
+if ($observed.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $current.Value) { exit 3 }
+if (-not $observed.AreAccessRulesProtected) { exit 4 }
+$rules = @($observed.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier]))
+if ($rules.Count -ne 1) { exit 5 }
+$rule = $rules[0]
+if ($rule.IdentityReference.Value -ne $current.Value) { exit 5 }
+if ($rule.AccessControlType -ne [System.Security.AccessControl.AccessControlType]::Allow) { exit 5 }
+if ($rule.FileSystemRights -ne [System.Security.AccessControl.FileSystemRights]::FullControl) { exit 5 }
+if ($rule.InheritanceFlags -ne $inherit) { exit 5 }
+if ($rule.PropagationFlags -ne [System.Security.AccessControl.PropagationFlags]::None) { exit 5 }
+`;
+async function verifyPrivateOutputDirectory(directory, create = false) {
+  const info = await (0, import_promises9.lstat)(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw new Error("output_directory_unavailable");
+  const powershell = (0, import_node_path10.join)(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+  await execute(powershell, [
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    Buffer.from(privateDirectoryScript, "utf16le").toString("base64")
+  ], {
+    windowsHide: true,
+    timeout: 1e4,
+    maxBuffer: 16384,
+    env: { ...process.env, ABOT_SYSTEM_OUTPUT_DIRECTORY: directory, ABOT_SYSTEM_OUTPUT_CREATE_PRIVATE: create ? "1" : "0" }
+  });
+}
+function isAbsentPath(error) {
+  if (!error || typeof error !== "object" || !("code" in error)) return false;
+  return error.code === "ENOENT";
+}
+async function hasOutputDirectoryPath(directory) {
+  try {
+    await (0, import_promises9.lstat)(directory);
+    return true;
+  } catch (error) {
+    if (isAbsentPath(error)) return false;
+    throw error;
+  }
+}
+async function installPrivateOutputDirectory(directory) {
+  if (await hasOutputDirectoryPath(directory)) return;
+  const parent = (0, import_node_path10.dirname)(directory);
+  await (0, import_promises9.mkdir)(parent, { recursive: true });
+  const candidate = await (0, import_promises9.mkdtemp)((0, import_node_path10.join)(parent, `.${(0, import_node_path10.basename)(directory)}.private-`));
+  try {
+    await verifyPrivateOutputDirectory(candidate, true);
+    try {
+      await (0, import_promises9.rename)(candidate, directory);
+    } catch (error) {
+      if (!await hasOutputDirectoryPath(directory)) throw error;
+    }
+  } finally {
+    await (0, import_promises9.rmdir)(candidate).catch((error) => {
+      if (!isAbsentPath(error)) throw error;
+    });
+  }
+}
+async function ensureWindowsOutputDirectory(directory) {
+  if (process.platform !== "win32") return;
+  try {
+    await installPrivateOutputDirectory(directory);
+    await verifyPrivateOutputDirectory(directory);
+  } catch {
+    throw new SystemOperationError("system_output_storage_failed", "Private output storage could not be prepared. The command was not dispatched.");
+  }
+}
+
+// plugins/system/source/local-command-output-retention.ts
+function scheduleLocalSystemOutputCleanup(root, retentionMs) {
+  if (process.platform !== "win32") {
+    scheduleSystemOutputCleanup(root, retentionMs);
+    return Promise.resolve();
+  }
+  return ensureWindowsOutputDirectory(root).then(
+    () => scheduleSystemOutputCleanup(root, retentionMs),
+    () => process.emitWarning("SYSTEM output cleanup skipped because private storage could not be verified.", {
+      code: "SYSTEM_OUTPUT_PRIVATE_STORAGE_UNAVAILABLE"
+    })
+  );
+}
+
+// plugins/system/source/local-command-output.ts
+var CONTEXT_STREAMS = Object.freeze(["stdout", "stderr"]);
+function createLocalSystemCommandOutput(plugin) {
+  const root = (0, import_node_path11.join)(plugin.stateDir, "command-output");
+  const retentionMs = systemCommandOutputRetentionMs(plugin);
+  const initialization = scheduleLocalSystemOutputCleanup(root, retentionMs);
+  return (context) => {
+    let captured;
+    return {
+      async run(input) {
+        if (input.abortSignal?.aborted) return runSystemProcess(input);
+        await initialization;
+        await ensureWindowsOutputDirectory(root);
+        captured = await createSystemOutputCapture(root, retentionMs, redactSecretText);
+        let result;
+        try {
+          result = await runSystemProcess(input, captured.capture);
+        } catch (error) {
+          await captured.finish();
+          throw error;
+        }
+        const streams = await captured.finish(result);
+        return {
+          ...captured.processResult,
+          stdout: streams.stdout,
+          stderr: streams.stderr,
+          outputTruncated: Boolean(captured.failure)
+        };
+      },
+      async present(target, result) {
+        if (captured?.failure) return outputFailure(target, result, context, captured.receipt, captured.failure, captured.failureKind);
+        const receipt = buildSystemProcessResult(target, result, "command_process_completion");
+        const delivered = deliverPluginTextResult({
+          ...receipt,
+          data: { ...receipt.data, ...captured?.receipt ? { outputCapture: captured.receipt } : {} }
+        }, CONTEXT_STREAMS, context?.resultBudget);
+        if (delivered.errorCode === "plugin_result_too_large")
+          return outputFailure(target, result, context, captured?.receipt);
+        return delivered;
+      }
+    };
+  };
+}
+function outputFailure(target, result, context, capture, captureFailure, failureKind) {
+  const failureCode = failureKind === "security" ? "system_output_protection_failed" : "system_output_storage_failed";
+  return failureResult({
+    errorCode: captureFailure ? failureCode : "system_output_delivery_pending",
+    message: "The command was dispatched. Its output could not be delivered completely; do not repeat the command just to retrieve output. Inspect the process receipt and retained capture.",
+    ...result.exitCode !== null ? { exitCode: result.exitCode } : {},
+    data: {
+      target: target.id,
+      transport: target.transport,
+      processStatus: result.status,
+      spawnedProcess: result.spawnedProcess ?? null,
+      exitCode: result.exitCode,
+      outputCapture: capture ?? null,
+      ...captureFailure && failureKind === "security" ? { securityFailure: captureFailure } : {},
+      ...captureFailure && failureKind !== "security" ? { storageFailure: captureFailure } : {},
+      outputDelivery: "pending",
+      evidenceScope: "command_process_completion",
+      independentOutcomeCheck: "not_performed",
+      observationMeta: { kind: "volatile_external", carryPolicy: "never" }
+    }
+  }, context?.resultBudget);
+}
+function systemCommandOutputRetentionMs(plugin) {
+  return readBoundedInteger(plugin.config?.outputRetentionMs, {
+    name: "outputRetentionMs",
+    defaultValue: DEFAULT_SYSTEM_OUTPUT_RETENTION_MS,
+    minimum: 1,
+    maximum: Number.MAX_SAFE_INTEGER
+  });
+}
+
+// plugins/system/source/security/system-results.ts
+var INCOMPLETE_STREAM = "[UNAVAILABLE: incomplete output cannot be scanned for secrets]";
+var SENSITIVE_TARGET = "Target unavailable because its shell identity contains sensitive text.";
+function protectApplication(application) {
+  if (redactSecretText(application.id) !== application.id) return void 0;
+  return { ...application, name: redactSecretText(application.name) };
+}
+function protectCatalog(catalog) {
+  const applications = catalog.applications.flatMap((application) => {
+    const protectedApplication = protectApplication(application);
+    return protectedApplication ? [protectedApplication] : [];
+  });
+  return {
+    ...catalog,
+    applications,
+    complete: catalog.complete && applications.length === catalog.applications.length,
+    scope: { ...catalog.scope, roots: catalog.scope.roots.map(redactSecretText) }
+  };
+}
+function protectTargets(observation) {
+  return {
+    ...observation,
+    host: { ...observation.host, kernelRelease: redactSecretText(observation.host.kernelRelease) },
+    targets: observation.targets.map((target) => {
+      if (!target.available)
+        return { ...target, reason: redactSecretText(target.reason) };
+      if (redactSecretText(target.shell) !== target.shell)
+        return { id: target.id, available: false, reason: SENSITIVE_TARGET };
+      return target;
+    })
+  };
+}
+function protectProcess(result) {
+  return {
+    ...result,
+    stdout: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stdout),
+    stderr: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stderr),
+    ...result.spawnedProcess ? {
+      spawnedProcess: {
+        ...result.spawnedProcess,
+        executable: redactSecretText(result.spawnedProcess.executable)
+      }
+    } : {}
+  };
+}
+var systemResultProtection = Object.freeze({
+  protectTargets,
+  protectCatalog,
+  protectProcess,
+  protectApplication,
+  protectMessage: redactSecretText
+});
+
 // plugins/system/source/index.ts
-var index_default = defineRuntimePlugin(({ rootDir }) => ({
-  handlers: { ...createSystemHandlers(), ...unboundComputerHandlers() },
-  prepareRequest: (modules, preparation) => prepareSystemRequestModules(rootDir, modules, {}, preparation)
-}));
+var index_default = defineRuntimePlugin((context) => {
+  const output = createLocalSystemCommandOutput(context);
+  return {
+    handlers: { ...createSystemHandlers(void 0, void 0, output, systemResultProtection), ...unboundComputerHandlers() },
+    prepareRequest: (modules, preparation) => prepareSystemRequestModules(context.rootDir, modules, {
+      outputRetentionMs: systemCommandOutputRetentionMs(context),
+      observeTargets: async () => systemResultProtection.protectTargets(await observeSystemTargets()),
+      createNativeHandlers: (resolve) => createSystemHandlers(void 0, resolve, output, systemResultProtection)
+    }, preparation)
+  };
+});