@abot-ai/runtime 1.7.0 → 1.8.0

package/docs/tool-execution-result-evidence-contract.md

@@ -96,6 +96,63 @@ secrets. Secret acquisition and redaction remain responsibilities of the
 owning tool/host boundary; core orchestration must not guess sensitive field
 semantics from arbitrary JSON keys.
 
+### Observed-content secret protection, version 1
+
+Companion and the internal passive collector own host-side protection. The same
+collector protects SPARK whether it runs inside Companion or locally in Runtime.
+SYSTEM owns a separate implementation for its independent native operations.
+The implementations share conformance cases, not a runtime detector dependency.
+
+Required text checks preserve the existing SPARK whole-field detector: credential
+labels, authorization/userinfo, supported provider tokens, private-key indicators
+and compact JOSE tokens, including the supported escaped and encoded forms.
+Successful checking means no known indicator was found; it is not a claim that
+the content contains no secrets. Unknown encodings and arbitrary unlabelled
+secrets remain outside detection. SPARK's existing collection semantics stay intact.
+
+Check full observed fields before excerpts or delivery. A suspected field is
+replaced with `[REDACTED]`; unchecked content must not reach logs, model evidence,
+continuation snapshots or cross-host transport. Desktop frame/media retention
+also follows these checks. Temporary local acquisition belongs inside the checking
+boundary; checking must not use a remote model.
+An incomplete required check, malformed encoding or scanner failure withholds
+the affected content and preserves only a non-sensitive technical receipt.
+
+Command capture may write unchecked bytes to private local files using the existing
+disk-backed capture mechanism. After natural EOF, both full streams must pass
+checking before any read or delivery is admitted. Suspected content is replaced
+with checked text; failed checking withholds output and attempts to remove the raw
+capture. Existing retention cleanup handles leftovers after failure or interruption.
+This permits temporary raw disk storage, not model access before checking; the
+compaction model must also receive only checked text. Deletion is ordinary file
+cleanup, not a claim of forensic erasure.
+
+There is no new logical total-output quota: admitted complete stdout/stderr retain
+the existing context-text handoff, canonical evidence and core compaction path.
+Full-text checking and delivery still materialize text in memory. Capture/storage
+failure does not erase an already dispatched action or justify replaying it for
+output. Published byte counts and digests describe admitted bytes only.
+
+Version 1 desktop checks cover descriptive metadata and accessibility text.
+Suspicion in those fields also withholds the associated image before frame or
+media retention. Control bindings, coordinates and dispatch receipts keep their
+mechanical meaning; sensitive actionable catalog identities are withheld rather
+than replaced by a synthetic actionable identifier. Pixel-only content is not
+inspected: OCR and its deployment requirements are explicitly deferred.
+
+SYSTEM requires `host_secret_protection_v1` before dispatching protected Companion
+operations, and the existing complete-output capability for commands. A missing
+capability is an upgrade-required failure before dispatch, not a fallback to an
+unprotected path. Installed Companion and independently distributed SYSTEM bundles
+must be validated separately; changing Runtime source does not update either.
+
+Conformance covers known indicators, ordinary text, encodings and chunk boundaries,
+late suspicion, scanner/transport failure, pre-admission storage and frame sinks,
+and preservation of exact clean large output and accepted action receipts. Both
+supported implementations must pass the same applicable cases before release.
+This contract does not sandbox an arbitrary third-party plugin's own filesystem
+or network access, nor retroactively remove previously retained observations.
+
 ## Canonical Lifecycle
 
 ```text

package/docs/windows-companion-store.md

@@ -10,6 +10,11 @@ The Store app and Runtime have separate releases.
 
 ## Connection experience
 
+A Runtime running directly on Windows uses local access and collection without
+Companion pairing. The Store connection remains available for a Windows computer
+used with a WSL or Docker Runtime. Spark also requires an installation-wide
+collection acknowledgment in the Web UI; accepting it does not start collection.
+
 The Web UI links to the Store for one installation. The user returns to ABot,
 requests a connection link and explicitly opens Companion. Companion shows the
 Runtime address and asks for confirmation before pairing. Users who already

package/package.json

@@ -18,12 +18,14 @@
   },
   "description": "Open runtime for local AI agents.",
   "devDependencies": {
+    "@actions/expressions": "^0.3.61",
     "@types/node": "^25.5.2",
     "esbuild": "^0.28.2",
     "prettier": "^3.8.1",
     "tsx": "^4.23.13",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.11",
+    "yaml": "^2.9.1"
   },
   "engines": {
     "node": "^20.19.0 || >=22.12.0"
@@ -181,5 +183,5 @@
   },
   "type": "module",
   "types": "./dist/src/runtime/index.d.ts",
-  "version": "1.7.0"
+  "version": "1.8.0"
 }

package/plugins/capability-brief/plugin.json

@@ -4,6 +4,10 @@
   "version": "1.0.0",
   "description": "Describe the request-effective ABot tool catalog on demand.",
   "extensions": {
+    "ai.abot.compatibility": {
+      "version": 1,
+      "runtimePlatforms": ["linux", "darwin", "win32"]
+    },
     "ai.abot.runtime": {
       "version": 1,
       "entrypoint": "./src/index.cjs",

package/plugins/code-outline/README.md

@@ -0,0 +1,20 @@
+# Code Outline
+
+Extracts a bounded structural outline from one source file on Linux, macOS,
+or native Windows. Relative paths use the configured agent work directory;
+`workspace/...` uses configured workspace sources. Absolute host paths must
+remain inside an authorized root. Request path restrictions still apply.
+
+The existing parser and limits are shared across platforms: at most 512 KiB
+of source, 160 symbols, 40 imports and 6,000 output characters. JavaScript and
+TypeScript use the syntax parser; other supported formats use the existing
+pattern-based outline. The tool does not execute the source.
+
+## Windows requirements
+
+Windows uses the SDK's built-in Windows PowerShell/C# reader. No Companion,
+WSL, Docker, administrator elevation or execution-policy bypass is required.
+If computer policy blocks the reader, the tool reports
+`code_outline_safe_read_unavailable` and tells the model not to retry or
+bypass the restriction. Cancellation stops the read. Reparse-point escapes
+and files larger than the limit are rejected without returning source.

package/plugins/code-outline/plugin.json

@@ -4,6 +4,7 @@
   "version": "0.1.1",
   "description": "Extract a bounded structural outline from one source file.",
   "extensions": {
+    "ai.abot.compatibility": { "version": 1, "runtimePlatforms": ["linux", "darwin", "win32"] },
     "ai.abot.runtime": {
       "version": 1,
       "entrypoint": "./src/index.cjs",

package/plugins/code-outline/source/index.ts

@@ -13,6 +13,7 @@ import {
 } from "../../../src/plugin-sdk/index.js";
 
 import { buildCodeOutline } from "./parser.js";
+import { codeOutlineReadFailure } from "./read-failure.js";
 
 const MAX_FILE_BYTES = 512 * 1024;
 const DEFAULT_MAX_SYMBOLS = 160;
@@ -36,7 +37,8 @@ export default defineRuntimePlugin((context) => {
         const pathContext = {
           ...context,
           runtimePathResolver:
-            executionContext?.runtimePathResolver ?? context.runtimePathResolver,
+            executionContext?.runtimePathResolver ??
+            context.runtimePathResolver,
         };
         try {
           const requestedPath = readRequiredString(params.path, "path");
@@ -47,26 +49,9 @@ export default defineRuntimePlugin((context) => {
           const file = await readBoundedRegularFile(target.absolutePath, {
             maxBytes: MAX_FILE_BYTES,
             rootPath: target.rootPath,
+            signal: executionContext?.abortSignal,
           });
-          if (!file.ok && file.reason === "not_regular_file") {
-            return failureResult({
-              errorCode: "code_outline_target_not_file",
-              message:
-                "The requested code-outline target is not a regular file.",
-            });
-          }
-          if (!file.ok && file.reason === "too_large") {
-            return failureResult({
-              errorCode: "code_outline_file_too_large",
-              message: `The requested file exceeds the ${MAX_FILE_BYTES}-byte outline limit.`,
-            });
-          }
-          if (!file.ok) {
-            return failureResult({
-              errorCode: "code_outline_file_changed",
-              message: "The requested file changed while it was being read.",
-            });
-          }
+          if (!file.ok) return codeOutlineReadFailure(file, MAX_FILE_BYTES);
           const source = file.bytes.toString("utf8");
           const maxSymbols = readBoundedInteger(params.maxSymbols, {
             defaultValue: defaultMaxSymbols,
@@ -118,6 +103,17 @@ export default defineRuntimePlugin((context) => {
             },
           });
         } catch (error) {
+          const readWasAborted =
+            executionContext?.abortSignal?.aborted &&
+            error instanceof Error &&
+            error.name === "AbortError";
+          if (readWasAborted) {
+            return failureResult({
+              errorCode: "code_outline_cancelled",
+              message: "Code outline inspection was cancelled.",
+              interruption: "aborted",
+            });
+          }
           return failureFromError(error, {
             fallbackCode: "code_outline_failed",
             fallbackMessage: "Code outline inspection failed.",

package/plugins/code-outline/source/read-failure.ts

@@ -0,0 +1,40 @@
+import {
+  failureResult,
+  type BoundedRegularFileReadFailure,
+} from "../../../src/plugin-sdk/index.js";
+
+export function codeOutlineReadFailure(
+  file: BoundedRegularFileReadFailure,
+  maxBytes: number,
+) {
+  switch (file.reason) {
+    case "not_regular_file":
+      return failureResult({
+        errorCode: "code_outline_target_not_file",
+        message: "The requested code-outline target is not a regular file.",
+      });
+    case "too_large":
+      return failureResult({
+        errorCode: "code_outline_file_too_large",
+        message:
+          "The requested file exceeds the " + maxBytes + "-byte outline limit.",
+      });
+    case "outside_root":
+      return failureResult({
+        errorCode: "code_outline_outside_root",
+        message:
+          "The requested file resolves outside its authorized root. Do not retry this target or bypass the path restriction.",
+      });
+    case "safe_open_unsupported":
+      return failureResult({
+        errorCode: "code_outline_safe_read_unavailable",
+        message:
+          "Safe file reading is unavailable on this system. On Windows, computer policy may block the required PowerShell/C# helper. Do not retry or bypass this restriction with another tool; ask the user to check the system requirements or contact their administrator.",
+      });
+    case "changed_during_read":
+      return failureResult({
+        errorCode: "code_outline_file_changed",
+        message: "The requested file changed while it was being read.",
+      });
+  }
+}