@abot-ai/runtime 1.6.0 → 1.8.0

package/dist/src/computer-access/security/desktop-result.js

@@ -0,0 +1,146 @@
+import { redactSecretText } from "./secret-text.js";
+function rectangle(value) {
+    return { x: value.x, y: value.y, width: value.width, height: value.height };
+}
+/** Explicit native observation fields; binding identities are never rewritten. */
+function projectDesktopFields(result, text) {
+    const capability = (value) => ({
+        supported: value.supported,
+        available: value.available,
+        ...(value.reason === undefined ? {} : { reason: text(value.reason) }),
+    });
+    const desktop = result.desktop;
+    return {
+        desktop: {
+            platform: desktop.platform,
+            binding: desktop.binding,
+            name: text(desktop.name),
+            available: desktop.available,
+            ...(desktop.reason === undefined ? {} : { reason: text(desktop.reason) }),
+            bounds: rectangle(desktop.bounds),
+            ...(desktop.coordinateSpace === undefined
+                ? {}
+                : { coordinateSpace: desktop.coordinateSpace }),
+            capabilities: {
+                capture: capability(desktop.capabilities.capture),
+                accessibility: capability(desktop.capabilities.accessibility),
+                input: capability(desktop.capabilities.input),
+                windows: capability(desktop.capabilities.windows),
+            },
+            targetingGuarantee: desktop.targetingGuarantee,
+        },
+        windows: result.windows.map((window) => ({
+            binding: window.binding,
+            title: text(window.title),
+            ...(window.application === undefined
+                ? {}
+                : { application: text(window.application) }),
+            bounds: rectangle(window.bounds),
+            focused: window.focused,
+        })),
+        ...(result.focusedWindow === undefined
+            ? {}
+            : { focusedWindow: result.focusedWindow }),
+        ...(result.observation
+            ? {
+                observation: {
+                    capturedAt: text(result.observation.capturedAt),
+                    region: rectangle(result.observation.region),
+                    imageWidth: result.observation.imageWidth,
+                    imageHeight: result.observation.imageHeight,
+                    accessibility: result.observation.accessibility.map((node) => ({
+                        role: text(node.role),
+                        ...(node.name === undefined ? {} : { name: text(node.name) }),
+                        ...(node.value === undefined ? {} : { value: text(node.value) }),
+                        ...(node.bounds === undefined
+                            ? {}
+                            : { bounds: rectangle(node.bounds) }),
+                        ...(node.focused === undefined ? {} : { focused: node.focused }),
+                    })),
+                    accessibilityTruncated: result.observation.accessibilityTruncated,
+                },
+            }
+            : {}),
+        ...(result.dispatch
+            ? {
+                dispatch: {
+                    status: result.dispatch.status,
+                    requestedInputCount: result.dispatch.requestedInputCount,
+                    ...(result.dispatch.acceptedInputCount === undefined
+                        ? {}
+                        : { acceptedInputCount: result.dispatch.acceptedInputCount }),
+                    ...(result.dispatch.reason === undefined
+                        ? {}
+                        : { reason: text(result.dispatch.reason) }),
+                },
+            }
+            : {}),
+        ...(result.error
+            ? {
+                error: {
+                    code: text(result.error.code),
+                    message: text(result.error.message),
+                },
+            }
+            : {}),
+    };
+}
+/**
+ * Best-effort text protection before frame retention or result projection.
+ * Pixels are not inspected: a text match withholds the associated entire image.
+ */
+export function protectDesktopResult(result, scan = redactSecretText) {
+    let suspected = false;
+    try {
+        const protectedResult = projectDesktopFields(result, (input) => {
+            const output = scan(input);
+            if (typeof output !== "string")
+                throw new Error("desktop_text_scan_failed");
+            suspected ||= output !== input;
+            return output;
+        });
+        if (!suspected)
+            return {
+                ...protectedResult,
+                ...(result.image
+                    ? {
+                        image: {
+                            mimeType: result.image.mimeType,
+                            bytes: result.image.bytes,
+                        },
+                    }
+                    : {}),
+            };
+        result.image?.bytes.fill(0);
+        return {
+            ...protectedResult,
+            ...(result.image && !protectedResult.error
+                ? {
+                    error: {
+                        code: "computer_image_secret_blocked",
+                        message: "Image withheld because desktop text contained a suspected secret. The dispatch receipt is unchanged.",
+                    },
+                }
+                : {}),
+        };
+    }
+    catch {
+        result.image?.bytes.fill(0);
+        const safe = projectDesktopFields(result, () => "[REDACTED]");
+        return {
+            desktop: {
+                ...safe.desktop,
+                reason: "Desktop content withheld because its protection check failed.",
+            },
+            windows: [],
+            ...(safe.focusedWindow === undefined
+                ? {}
+                : { focusedWindow: safe.focusedWindow }),
+            ...(safe.dispatch ? { dispatch: safe.dispatch } : {}),
+            error: {
+                code: "computer_observation_protection_failed",
+                message: "Desktop content withheld because its protection check failed. The dispatch receipt is unchanged.",
+            },
+        };
+    }
+}

package/dist/src/computer-access/security/observed-error.d.ts

@@ -0,0 +1,2 @@
+/** Protect the complete observed message before transport or model projection. */
+export declare function protectObservedError(error: unknown, fallback: string): string;

package/dist/src/computer-access/security/observed-error.js

@@ -0,0 +1,10 @@
+import { redactSecretText } from "./secret-text.js";
+/** Protect the complete observed message before transport or model projection. */
+export function protectObservedError(error, fallback) {
+    try {
+        return redactSecretText(error instanceof Error ? error.message : fallback);
+    }
+    catch {
+        return "Observed error details withheld because the protection check failed.";
+    }
+}

package/dist/src/computer-access/security/secret-text.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Mask the entire field when a known secret indicator is present, including
+ * surrounding useful text. No value boundaries or source-language grammar are
+ * inferred. Unlabelled arbitrary secrets and unknown encodings remain outside
+ * detection; this is not a guarantee that unchanged text contains no secrets.
+ */
+export declare function redactSecretText(input: string): string;

package/dist/src/computer-access/security/secret-text.js

@@ -0,0 +1,111 @@
+const REDACTED = "[REDACTED]";
+const CREDENTIAL_KEY_SOURCE = String.raw `(?:[A-Za-z][A-Za-z0-9_-]*\.)*(?:[A-Za-z][A-Za-z0-9]*[-_])*(?:password|passwd|pwd|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|client[_ -]?secret|secret[_ -]?access[_ -]?key|recovery[_ -]?code)`;
+const credentialIndicator = new RegExp(String.raw `(?<![\p{L}\p{N}_.-])(?:-{1,2})?(?:${CREDENTIAL_KEY_SOURCE}|(?:proxy-)?authorization)[\s"'\\]*[:=]`, "iu");
+/** Detection only: normalize ASCII encodings once, without interpreting a language. */
+function detectionText(input) {
+    const percentDecoded = input.replace(/%([0-7][0-9a-f])/giu, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+    return percentDecoded.replace(/\\(?:u00|x|U000000)([0-7][0-9a-fA-F])/gu, (_, hex) => String.fromCharCode(Number.parseInt(hex, 16)));
+}
+function hasPrivateKeyIndicator(text) {
+    return /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/u.test(text);
+}
+function hasUrlCredentials(text) {
+    return /\b[a-z][a-z0-9+.-]*(?::|%3a)(?:\/|%2f){2}[^\s/?#<>]*(?:@|%40)/iu.test(text);
+}
+function hasAuthorizationCredentials(text) {
+    for (const match of text.matchAll(/\b(Bearer|Basic)[ \t]+([A-Za-z0-9._~+/-]+={0,2})/giu)) {
+        if (match[1].toLowerCase() === "bearer")
+            return true;
+        const value = match[2];
+        if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(value))
+            continue;
+        if (value.length < 8)
+            continue;
+        if (Buffer.from(value, "base64").toString("utf8").includes(":"))
+            return true;
+    }
+    return false;
+}
+function isAwsAccessKeyValue(value, atEnd) {
+    if (/^[A-Z0-9]{16}$/u.test(value))
+        return true;
+    if (!atEnd)
+        return false;
+    return /^[A-Z0-9]{4,15}$/u.test(value);
+}
+function isRecognizedProviderToken(prefix, value, atEnd) {
+    if (prefix === "AKIA" || prefix === "ASIA")
+        return isAwsAccessKeyValue(value, atEnd);
+    if (value.length >= 20)
+        return true;
+    const partialMinimum = prefix === "sk-" ? 8 : 1;
+    return atEnd && value.length >= partialMinimum;
+}
+function hasProviderToken(text) {
+    const provider = /\b(sk-(?:proj-|svcacct-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|ASIA)([A-Za-z0-9_-]+)/gu;
+    for (const match of text.matchAll(provider)) {
+        const atEnd = match.index + match[0].length === text.length;
+        if (isRecognizedProviderToken(match[1], match[2], atEnd))
+            return true;
+    }
+    return false;
+}
+function compactJoseSegmentCount(header) {
+    try {
+        const value = JSON.parse(Buffer.from(header, "base64url").toString("utf8"));
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            return undefined;
+        const fields = value;
+        if (typeof fields.alg !== "string")
+            return undefined;
+        return typeof fields.enc === "string" ? 5 : 3;
+    }
+    catch {
+        return undefined;
+    }
+}
+function hasCompactJoseToken(text) {
+    const jose = /\b([A-Za-z0-9_-]+)(?:\.[A-Za-z0-9_-]*)+/gu;
+    for (const match of text.matchAll(jose)) {
+        const parts = match[0].split(".");
+        const capturedAtEnd = match.index + match[0].length === text.length;
+        for (let index = 0; index < parts.length - 1; index += 1) {
+            const expected = compactJoseSegmentCount(parts[index]);
+            if (expected === undefined)
+                continue;
+            if (expected === 3 && parts[index + 1] === "")
+                continue;
+            if (parts.length - index >= expected)
+                return true;
+            if (capturedAtEnd)
+                return true;
+        }
+    }
+    return false;
+}
+function hasSecretIndicator(text) {
+    if (credentialIndicator.test(text))
+        return true;
+    if (hasPrivateKeyIndicator(text))
+        return true;
+    if (hasUrlCredentials(text))
+        return true;
+    if (hasAuthorizationCredentials(text))
+        return true;
+    if (hasProviderToken(text))
+        return true;
+    return hasCompactJoseToken(text);
+}
+/**
+ * Mask the entire field when a known secret indicator is present, including
+ * surrounding useful text. No value boundaries or source-language grammar are
+ * inferred. Unlabelled arbitrary secrets and unknown encodings remain outside
+ * detection; this is not a guarantee that unchanged text contains no secrets.
+ */
+export function redactSecretText(input) {
+    if (hasSecretIndicator(input))
+        return REDACTED;
+    if (hasSecretIndicator(detectionText(input)))
+        return REDACTED;
+    return input;
+}

package/dist/src/computer-access/security/system-results.d.ts

@@ -0,0 +1,2 @@
+import type { SystemResultProtection } from "../system-result-protection.js";
+export declare const systemResultProtection: SystemResultProtection;

package/dist/src/computer-access/security/system-results.js

@@ -0,0 +1,53 @@
+import { redactSecretText } from "./secret-text.js";
+const INCOMPLETE_STREAM = "[UNAVAILABLE: incomplete output cannot be scanned for secrets]";
+const SENSITIVE_TARGET = "Target unavailable because its shell identity contains sensitive text.";
+function protectApplication(application) {
+    if (redactSecretText(application.id) !== application.id)
+        return undefined;
+    return { ...application, name: redactSecretText(application.name) };
+}
+function protectCatalog(catalog) {
+    const applications = catalog.applications.flatMap((application) => {
+        const protectedApplication = protectApplication(application);
+        return protectedApplication ? [protectedApplication] : [];
+    });
+    return {
+        ...catalog,
+        applications,
+        complete: catalog.complete && applications.length === catalog.applications.length,
+        scope: { ...catalog.scope, roots: catalog.scope.roots.map(redactSecretText) },
+    };
+}
+function protectTargets(observation) {
+    return {
+        ...observation,
+        host: { ...observation.host, kernelRelease: redactSecretText(observation.host.kernelRelease) },
+        targets: observation.targets.map((target) => {
+            if (!target.available)
+                return { ...target, reason: redactSecretText(target.reason) };
+            if (redactSecretText(target.shell) !== target.shell)
+                return { id: target.id, available: false, reason: SENSITIVE_TARGET };
+            return target;
+        }),
+    };
+}
+function protectProcess(result) {
+    return {
+        ...result,
+        stdout: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stdout),
+        stderr: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stderr),
+        ...(result.spawnedProcess ? {
+            spawnedProcess: {
+                ...result.spawnedProcess,
+                executable: redactSecretText(result.spawnedProcess.executable),
+            },
+        } : {}),
+    };
+}
+export const systemResultProtection = Object.freeze({
+    protectTargets,
+    protectCatalog,
+    protectProcess,
+    protectApplication,
+    protectMessage: redactSecretText,
+});

package/dist/src/computer-access/system-result-protection.d.ts

@@ -0,0 +1,11 @@
+import type { SystemApplicationCatalog } from "./application-catalog.js";
+import type { SystemApplication, SystemProcessResult } from "./contracts.js";
+import type { SystemTargetObservation } from "./target-observation.js";
+/** Producer-owned protection, applied before formatting or delivering observations. */
+export type SystemResultProtection = Readonly<{
+    protectTargets(observation: SystemTargetObservation): SystemTargetObservation;
+    protectCatalog(catalog: SystemApplicationCatalog): SystemApplicationCatalog;
+    protectProcess(result: SystemProcessResult): SystemProcessResult;
+    protectApplication(application: SystemApplication): SystemApplication | undefined;
+    protectMessage(message: string): string;
+}>;

package/dist/src/computer-access/system-result-protection.js

@@ -0,0 +1 @@
+export {};

package/dist/src/model-gateway/observability/provider-response-capture.d.ts

@@ -0,0 +1,60 @@
+/** Reads only the trace clone. Original provider bytes and errors stay untouched. */
+export declare function captureProviderResponseBody(response: Response, startedAt: number): Promise<{
+    outcome: "completed";
+    body: string;
+    stream: {
+        sse?: {
+            eventCount: number;
+            eventTypes: {
+                [k: string]: number;
+            };
+            recentEvents: {
+                type: string;
+                afterMs: number;
+            }[];
+            oversizedLineCount: number;
+        } | undefined;
+        headersAfterMs: number;
+        elapsedMs: number;
+        bytesReceived: number;
+        chunkCount: number;
+        firstChunkAfterMs: number | null;
+        lastChunkAfterMs: number | null;
+    };
+    error?: undefined;
+    partialBodyPrefix?: undefined;
+    partialBodyPrefixBytes?: undefined;
+    partialBodyPrefixTruncated?: undefined;
+    partialBody?: undefined;
+    partialBodyBytes?: undefined;
+    bodyTruncated?: undefined;
+} | {
+    outcome: "failed";
+    error: unknown;
+    partialBodyPrefix: string;
+    partialBodyPrefixBytes: number;
+    partialBodyPrefixTruncated: boolean;
+    partialBody: string;
+    partialBodyBytes: number;
+    bodyTruncated: boolean;
+    stream: {
+        sse?: {
+            eventCount: number;
+            eventTypes: {
+                [k: string]: number;
+            };
+            recentEvents: {
+                type: string;
+                afterMs: number;
+            }[];
+            oversizedLineCount: number;
+        } | undefined;
+        headersAfterMs: number;
+        elapsedMs: number;
+        bytesReceived: number;
+        chunkCount: number;
+        firstChunkAfterMs: number | null;
+        lastChunkAfterMs: number | null;
+    };
+    body?: undefined;
+}>;

package/dist/src/model-gateway/observability/provider-response-capture.js

@@ -0,0 +1,68 @@
+import { ProviderSseDiagnostics } from "./provider-sse-diagnostics.js";
+import { ProviderResponsePrefix } from "./provider-response-prefix.js";
+import { ProviderResponseTail } from "./provider-response-tail.js";
+/** Reads only the trace clone. Original provider bytes and errors stay untouched. */
+export async function captureProviderResponseBody(response, startedAt) {
+    const headersAfterMs = Math.max(0, Date.now() - startedAt);
+    const sse = isEventStreamResponse(response) ? new ProviderSseDiagnostics() : undefined;
+    const decoder = new TextDecoder();
+    const parts = [];
+    const prefix = new ProviderResponsePrefix();
+    const tail = new ProviderResponseTail();
+    let bytesReceived = 0;
+    let chunkCount = 0;
+    let firstChunkAfterMs = null;
+    let lastChunkAfterMs = null;
+    const reader = response.body?.getReader();
+    const streamSnapshot = () => ({
+        headersAfterMs,
+        elapsedMs: Math.max(0, Date.now() - startedAt),
+        bytesReceived,
+        chunkCount,
+        firstChunkAfterMs,
+        lastChunkAfterMs,
+        ...(sse ? { sse: sse.snapshot() } : {}),
+    });
+    try {
+        while (reader) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            const afterMs = Math.max(0, Date.now() - startedAt);
+            bytesReceived += value.byteLength;
+            chunkCount += 1;
+            firstChunkAfterMs ??= afterMs;
+            lastChunkAfterMs = afterMs;
+            prefix.append(value);
+            tail.append(value);
+            const text = decoder.decode(value, { stream: true });
+            parts.push(text);
+            sse?.observe(text, afterMs);
+        }
+        const finalText = decoder.decode();
+        parts.push(finalText);
+        sse?.observe(finalText, Math.max(0, Date.now() - startedAt));
+        return { outcome: "completed", body: parts.join(""), stream: streamSnapshot() };
+    }
+    catch (error) {
+        const partialBodyPrefix = prefix.snapshot();
+        const partialBody = tail.snapshot();
+        return {
+            outcome: "failed",
+            error,
+            partialBodyPrefix: partialBodyPrefix.toString("utf8"),
+            partialBodyPrefixBytes: partialBodyPrefix.byteLength,
+            partialBodyPrefixTruncated: bytesReceived > partialBodyPrefix.byteLength,
+            partialBody: partialBody.toString("utf8"),
+            partialBodyBytes: partialBody.byteLength,
+            bodyTruncated: bytesReceived > partialBody.byteLength,
+            stream: streamSnapshot(),
+        };
+    }
+    finally {
+        reader?.releaseLock();
+    }
+}
+function isEventStreamResponse(response) {
+    return response.headers.get("content-type")?.split(";", 1)[0].trim().toLowerCase() === "text/event-stream";
+}

package/dist/src/model-gateway/observability/provider-response-prefix.d.ts

@@ -0,0 +1,7 @@
+/** Retains the first source bytes without allocating more storage as the stream grows. */
+export declare class ProviderResponsePrefix {
+    private readonly bytes;
+    private usedBytes;
+    append(chunk: Uint8Array): void;
+    snapshot(): Buffer;
+}

package/dist/src/model-gateway/observability/provider-response-prefix.js

@@ -0,0 +1,14 @@
+const MAX_PARTIAL_BODY_PREFIX_BYTES = 16_384;
+/** Retains the first source bytes without allocating more storage as the stream grows. */
+export class ProviderResponsePrefix {
+    bytes = Buffer.alloc(MAX_PARTIAL_BODY_PREFIX_BYTES);
+    usedBytes = 0;
+    append(chunk) {
+        const length = Math.min(chunk.byteLength, this.bytes.length - this.usedBytes);
+        this.bytes.set(chunk.subarray(0, length), this.usedBytes);
+        this.usedBytes += length;
+    }
+    snapshot() {
+        return Buffer.from(this.bytes.subarray(0, this.usedBytes));
+    }
+}

package/dist/src/model-gateway/observability/provider-response-tail.d.ts

@@ -0,0 +1,8 @@
+/** Fixed storage: appending copies only incoming bytes, never the retained tail. */
+export declare class ProviderResponseTail {
+    private readonly bytes;
+    private writeOffset;
+    private usedBytes;
+    append(chunk: Uint8Array): void;
+    snapshot(): Buffer;
+}

package/dist/src/model-gateway/observability/provider-response-tail.js

@@ -0,0 +1,28 @@
+const MAX_PARTIAL_BODY_BYTES = 16_384;
+/** Fixed storage: appending copies only incoming bytes, never the retained tail. */
+export class ProviderResponseTail {
+    bytes = Buffer.alloc(MAX_PARTIAL_BODY_BYTES);
+    writeOffset = 0;
+    usedBytes = 0;
+    append(chunk) {
+        if (chunk.byteLength >= this.bytes.length) {
+            this.bytes.set(chunk.subarray(chunk.byteLength - this.bytes.length));
+            this.writeOffset = 0;
+            this.usedBytes = this.bytes.length;
+            return;
+        }
+        const firstLength = Math.min(chunk.byteLength, this.bytes.length - this.writeOffset);
+        this.bytes.set(chunk.subarray(0, firstLength), this.writeOffset);
+        this.bytes.set(chunk.subarray(firstLength), 0);
+        this.writeOffset = (this.writeOffset + chunk.byteLength) % this.bytes.length;
+        this.usedBytes = Math.min(this.usedBytes + chunk.byteLength, this.bytes.length);
+    }
+    snapshot() {
+        const result = Buffer.alloc(this.usedBytes);
+        const start = (this.writeOffset - this.usedBytes + this.bytes.length) % this.bytes.length;
+        const firstLength = Math.min(this.usedBytes, this.bytes.length - start);
+        result.set(this.bytes.subarray(start, start + firstLength));
+        result.set(this.bytes.subarray(0, this.usedBytes - firstLength), firstLength);
+        return result;
+    }
+}

package/dist/src/model-gateway/observability/provider-sse-diagnostics.d.ts

@@ -0,0 +1,30 @@
+/** Bounded SSE metadata only; never selects or forwards model output. */
+export declare class ProviderSseDiagnostics {
+    private pendingLine;
+    private droppingLine;
+    private afterCarriageReturn;
+    private eventType;
+    private hasData;
+    private data;
+    private dataTruncated;
+    private eventCount;
+    private oversizedLineCount;
+    private readonly counts;
+    private readonly recentEvents;
+    observe(text: string, afterMs: number): void;
+    snapshot(): {
+        eventCount: number;
+        eventTypes: {
+            [k: string]: number;
+        };
+        recentEvents: {
+            type: string;
+            afterMs: number;
+        }[];
+        oversizedLineCount: number;
+    };
+    private appendLinePart;
+    private finishLine;
+    private appendData;
+    private finishEvent;
+}