@abot-ai/runtime 1.7.0 → 1.8.1

package/dist/src/cli/host-companion-bundle.mjs

@@ -2809,20 +2809,20 @@ function createNativeHostState(directory, access5) {
   let connectionPath = join(directory, "connection.json"), statusPath = join(directory, "status.json");
   async function inspectPrivate(path) {
     await access5.ensureDirectory(directory);
-    let stat4 = await lstat(path).catch((error) => {
+    let stat3 = await lstat(path).catch((error) => {
       if (!isAbsentFile(error))
         throw error;
     });
-    if (stat4) {
-      if (!stat4.isFile() || stat4.isSymbolicLink())
+    if (stat3) {
+      if (!stat3.isFile() || stat3.isSymbolicLink())
         throw new Error("Host companion state must be a private regular file.");
-      return await access5.assertFile(path, stat4), stat4;
+      return await access5.assertFile(path, stat3), stat3;
     }
   }
   async function readPrivate(path) {
-    let stat4 = await inspectPrivate(path);
-    if (stat4) {
-      if (stat4.size > 16384)
+    let stat3 = await inspectPrivate(path);
+    if (stat3) {
+      if (stat3.size > 16384)
         throw new Error("Host companion state exceeds its size limit.");
       return JSON.parse(await readFile(path, "utf8"));
     }
@@ -4073,14 +4073,58 @@ function identityExcerpt(identity) {
 }
 
 // src/computer-access/handlers.ts
-function withSystemOperationErrors(operation) {
+var PROTECTION_FAILURE = "The system result could not be protected for delivery.";
+function protectSystemResult(operation) {
+  try {
+    return operation();
+  } catch {
+    throw new SystemOperationError("system_result_protection_failed", PROTECTION_FAILURE);
+  }
+}
+function failedSystemProtectionReceipt(target, result, evidenceScope) {
+  let safeProcess = {
+    status: result.status,
+    exitCode: result.exitCode,
+    outputTruncated: result.outputTruncated,
+    stdout: "[UNAVAILABLE: result protection failed]",
+    stderr: "[UNAVAILABLE: result protection failed]",
+    ...result.spawnedProcess ? {
+      spawnedProcess: {
+        pid: result.spawnedProcess.pid,
+        pidNamespace: result.spawnedProcess.pidNamespace,
+        identitySource: result.spawnedProcess.identitySource,
+        executable: "[REDACTED]"
+      }
+    } : {}
+  }, receipt = systemProcessResult(target, safeProcess, evidenceScope);
+  return failureResult({
+    errorCode: "system_result_protection_failed",
+    message: PROTECTION_FAILURE,
+    output: `The operation was dispatched. Inspect the process receipt before another action; the command was not replayed.
+` + receipt.output,
+    stdout: safeProcess.stdout,
+    stderr: safeProcess.stderr,
+    ...result.exitCode !== null ? { exitCode: result.exitCode } : {},
+    data: receipt.data
+  });
+}
+function withSystemOperationErrors(operation, protection) {
   return async (params, context) => {
     try {
       return await operation(params, context);
     } catch (error) {
+      let message = error instanceof Error ? error.message : void 0;
+      try {
+        protection && message !== void 0 && (message = protection.protectMessage(message));
+      } catch {
+        return failureResult({
+          errorCode: "system_result_protection_failed",
+          message: PROTECTION_FAILURE
+        });
+      }
       return error instanceof SystemOperationError ? failureResult({
         errorCode: error.code,
-        message: error.message,
+        message,
         data: {
           humanActionRequired: error.code === "system_authorization_required"
         }
@@ -4092,9 +4136,9 @@ function withSystemOperationErrors(operation) {
     }
   };
 }
-function createSystemHandlers(run2 = runSystemProcess, resolveTarget = (id) => resolveSystemTarget(id, run2), commandOutput) {
+function createSystemHandlers(run2 = runSystemProcess, resolveTarget = (id) => resolveSystemTarget(id, run2), commandOutput, protection) {
   let targets = async () => {
-    let observation = await observeSystemTargets(run2);
+    let observed = await observeSystemTargets(run2), observation = protection ? protectSystemResult(() => protection.protectTargets(observed)) : observed;
     return successResult({
       output: JSON.stringify(observation),
       data: {
@@ -4103,20 +4147,25 @@ function createSystemHandlers(run2 = runSystemProcess, resolveTarget = (id) => r
       }
     });
   }, command = async (params, context) => {
-    let target = await resolveTarget(readSystemTargetId(params.target)), output = commandOutput?.(context), result = await executeSystemCommand({
+    let target = await resolveTarget(readSystemTargetId(params.target)), output = commandOutput?.(context), observed = await executeSystemCommand({
       target,
       params,
       run: run2,
       ...output ? { runCommand: output.run } : {},
       ...context?.abortSignal ? { abortSignal: context.abortSignal } : {}
-    });
+    }), result = observed;
+    try {
+      protection && (result = protection.protectProcess(observed));
+    } catch {
+      return failedSystemProtectionReceipt(target, observed, "command_process_completion");
+    }
     return output ? output.present(target, result) : systemProcessResult(target, result, "command_process_completion");
   }, applications = async (params) => {
     let target = await resolveTarget(readSystemTargetId(params.target)), query = (readOptionalString(params.query) ?? "").toLowerCase(), limit = params.limit === void 0 ? 50 : readBoundedInteger(params.limit, {
       name: "limit",
       minimum: 1,
       maximum: 100
-    }), catalog = await readSystemApplications(target, run2), { output, data } = systemApplicationObservation(
+    }), observed = await readSystemApplications(target, run2), catalog = protection ? protectSystemResult(() => protection.protectCatalog(observed)) : observed, { output, data } = systemApplicationObservation(
       target,
       catalog,
       query,
@@ -4135,19 +4184,24 @@ function createSystemHandlers(run2 = runSystemProcess, resolveTarget = (id) => r
       params,
       run: run2,
       ...context?.abortSignal ? { abortSignal: context.abortSignal } : {}
-    });
+    }), process2 = result.process, application = result.application;
+    try {
+      protection && (process2 = protection.protectProcess(result.process), application = protection.protectApplication(result.application));
+    } catch {
+      return failedSystemProtectionReceipt(target, result.process, "launch_request_dispatch");
+    }
     return systemProcessResult(
       target,
-      result.process,
+      process2,
       "launch_request_dispatch",
-      result.application
+      application
     );
   };
   return {
-    system_targets: withSystemOperationErrors(targets),
-    system_command: withSystemOperationErrors(command),
-    system_applications: withSystemOperationErrors(applications),
-    system_launch: withSystemOperationErrors(launch)
+    system_targets: withSystemOperationErrors(targets, protection),
+    system_command: withSystemOperationErrors(command, protection),
+    system_applications: withSystemOperationErrors(applications, protection),
+    system_launch: withSystemOperationErrors(launch, protection)
   };
 }
 
@@ -4155,12 +4209,62 @@ function createSystemHandlers(run2 = runSystemProcess, resolveTarget = (id) => r
 import { createHash, randomUUID as randomUUID2 } from "node:crypto";
 import { once } from "node:events";
 import { createWriteStream } from "node:fs";
-import { mkdir, open, readFile as readFile4, rename as rename2, stat as stat3, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdir, open, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 import { finished } from "node:stream/promises";
 
+// src/computer-access/command-output-protection.ts
+import { readFile as readFile3, rm, writeFile as writeFile2 } from "node:fs/promises";
+var CapturedOutputProtectionError = class extends Error {
+  constructor(reason) {
+    super(reason);
+    this.reason = reason;
+  }
+  reason;
+};
+async function protectCapturedOutput(paths, redact) {
+  let stdout2, stderr;
+  try {
+    stdout2 = await protectStream(paths.stdout, redact), stderr = await protectStream(paths.stderr, redact);
+    let writes = await Promise.allSettled([
+      writeFile2(paths.stdout, stdout2, { flag: "w", mode: 384, flush: !0 }),
+      writeFile2(paths.stderr, stderr, { flag: "w", mode: 384, flush: !0 })
+    ]);
+    if (hasRejectedOutputWrite(writes)) throw new CapturedOutputProtectionError("output_storage_failed");
+    return { stdout: stdout2, stderr };
+  } catch (error) {
+    throw stdout2?.fill(0), stderr?.fill(0), error;
+  }
+}
+async function protectStream(path, redact) {
+  let bytes;
+  try {
+    bytes = await readFile3(path);
+  } catch {
+    throw new CapturedOutputProtectionError("output_storage_failed");
+  }
+  try {
+    let text = new TextDecoder("utf-8", { fatal: !0, ignoreBOM: !0 }).decode(bytes), protectedText = redact(text);
+    if (!isProtectedOutputText(protectedText)) throw new Error("output_protection_failed");
+    return Buffer.from(protectedText, "utf8");
+  } catch {
+    throw new CapturedOutputProtectionError("output_protection_failed");
+  } finally {
+    bytes.fill(0);
+  }
+}
+async function discardCapturedOutput(paths) {
+  return (await Promise.allSettled(Object.values(paths).map((path) => rm(path, { force: !0 })))).every((entry) => entry.status === "fulfilled");
+}
+function isProtectedOutputText(value) {
+  return typeof value == "string";
+}
+function hasRejectedOutputWrite(writes) {
+  return writes.some((entry) => entry.status === "rejected");
+}
+
 // src/computer-access/command-output-retention.ts
-import { readFile as readFile3, readdir as readdir2, rm, stat as stat2 } from "node:fs/promises";
+import { readFile as readFile4, readdir as readdir2, rm as rm2, stat as stat2 } from "node:fs/promises";
 import { join as join4 } from "node:path";
 var DEFAULT_SYSTEM_OUTPUT_RETENTION_MS = 10080 * 6e4, activeSystemCaptures = /* @__PURE__ */ new Set(), jobs = /* @__PURE__ */ new Map(), CAPTURE_ID = /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/;
 async function cleanupSystemOutput(root, retentionMs) {
@@ -4173,14 +4277,14 @@ async function cleanupSystemOutput(root, retentionMs) {
     let directory = join4(root, entry.name);
     if (activeSystemCaptures.has(directory)) continue;
     let files = await readdir2(directory), times = await Promise.all(files.map(async (file) => (await stat2(join4(directory, file))).mtimeMs)), completedAt = Math.max((await stat2(directory)).mtimeMs, ...times), captureRetentionMs = await readCaptureRetention(directory, entry.name, retentionMs);
-    Date.now() - completedAt < captureRetentionMs || activeSystemCaptures.has(directory) || (await rm(directory, { recursive: !0 }), removed += 1);
+    Date.now() - completedAt < captureRetentionMs || activeSystemCaptures.has(directory) || (await rm2(directory, { recursive: !0 }), removed += 1);
   }
   return removed;
 }
 async function readCaptureRetention(directory, id, fallbackMs) {
   let receipt;
   try {
-    receipt = JSON.parse(await readFile3(join4(directory, "receipt.json"), "utf8"));
+    receipt = JSON.parse(await readFile4(join4(directory, "receipt.json"), "utf8"));
   } catch (error) {
     if (error.code === "ENOENT" || error instanceof SyntaxError) return fallbackMs;
     throw error;
@@ -4218,8 +4322,10 @@ function scheduleSystemOutputCleanup(root, retentionMs) {
 }
 
 // src/computer-access/command-output-capture.ts
-var OUTPUT_IO_CHUNK_BYTES = 64 * 1024;
-async function createSystemOutputCapture(root, retentionMs) {
+var STREAMS = ["stdout", "stderr"], OUTPUT_IO_CHUNK_BYTES = 64 * 1024;
+async function createSystemOutputCapture(root, retentionMs, redact) {
+  if (!hasOutputProtection(redact))
+    throw new SystemOperationError("system_output_protection_failed", "Command output protection is unavailable. The command was not dispatched.");
   let id = randomUUID2(), directory = join5(root, id);
   activeSystemCaptures.add(directory);
   try {
@@ -4227,11 +4333,11 @@ async function createSystemOutputCapture(root, retentionMs) {
   } catch {
     throw activeSystemCaptures.delete(directory), new SystemOperationError("system_output_storage_failed", "Output storage could not be prepared. The command was not dispatched.");
   }
-  let failure, stop, ended = !1, retained = !1, sources = [], streams = ["stdout", "stderr"].map((name) => {
-    let path = join5(directory, name + ".bytes"), sink = createWriteStream(path, { flags: "wx", mode: 384, highWaterMark: OUTPUT_IO_CHUNK_BYTES, flush: !0 }), completion = finished(sink).catch(() => {
-      failure ??= "write_failed", stop?.();
+  let storageFailure, securityFailure, stop, ended = !1, retained = !1, admitted = !1, receipt, processResult, finishing, sources = [], completeStreams = /* @__PURE__ */ new Set(), paths = { stdout: join5(directory, "stdout.bytes"), stderr: join5(directory, "stderr.bytes") }, streams = STREAMS.map((name) => {
+    let sink = createWriteStream(paths[name], { flags: "wx", mode: 384, highWaterMark: OUTPUT_IO_CHUNK_BYTES, flush: !0 }), completion = finished(sink).catch(() => {
+      storageFailure ??= "write_failed", stop?.();
     });
-    return { name, path, sink, completion, hash: createHash("sha256") };
+    return { sink, completion };
   });
   try {
     await Promise.all(streams.map(({ sink }) => once(sink, "open")));
@@ -4240,26 +4346,113 @@ async function createSystemOutputCapture(root, retentionMs) {
     throw await Promise.all(streams.map(({ completion }) => completion)), activeSystemCaptures.delete(directory), scheduleSystemOutputCleanup(root, retentionMs), new SystemOperationError("system_output_storage_failed", "Output files could not be opened. The command was not dispatched.");
   }
   scheduleSystemOutputCleanup(root, retentionMs);
-  let capture = {
+  let failure = () => storageFailure ?? securityFailure, capture = {
     attach(stdout2, stderr, onFailure) {
-      stop = onFailure, sources.push(stdout2, stderr), stdout2.on("data", (bytes) => streams[0].hash.update(bytes)), stderr.on("data", (bytes) => streams[1].hash.update(bytes)), stdout2.pipe(streams[0].sink), stderr.pipe(streams[1].sink), failure && onFailure();
+      if (!canAttachCapture()) {
+        securityFailure ??= "output_protection_failed", onFailure();
+        return;
+      }
+      stop = onFailure, sources.push(stdout2, stderr);
+      for (let [index, source] of sources.entries())
+        source.once("end", () => completeStreams.add(STREAMS[index])), source.once("error", () => {
+          securityFailure ??= "output_incomplete", stop?.();
+        }), source.pipe(streams[index].sink);
+      failure() && onFailure();
     },
     end() {
       if (!ended) {
-        ended = !0;
+        ended = !0, hasCompleteStreams() || (securityFailure ??= "output_incomplete");
         for (let source of sources)
           source.unpipe(), source.destroy();
         for (let { sink } of streams) !sink.destroyed && !sink.writableEnded && sink.end();
       }
     }
-  }, receipt;
+  };
+  function canAttachCapture() {
+    return sources.length === 0 && !ended;
+  }
+  function hasCompleteStreams() {
+    return completeStreams.size === 2;
+  }
+  function protectProcess2(result) {
+    if (!result) return;
+    let spawnedProcess = result.spawnedProcess;
+    if (spawnedProcess) {
+      let executable = "[REDACTED]";
+      try {
+        if (executable = redact(spawnedProcess.executable), !hasProtectedIdentity(executable)) throw new Error("output_protection_failed");
+      } catch {
+        securityFailure ??= "output_protection_failed", executable = "[REDACTED]";
+      }
+      spawnedProcess = { ...spawnedProcess, executable };
+    }
+    processResult = {
+      exitCode: result.exitCode,
+      status: result.status,
+      outputTruncated: result.outputTruncated,
+      stdout: "",
+      stderr: "",
+      ...spawnedProcess ? { spawnedProcess } : {}
+    };
+  }
+  async function finish(result, materialize = !0) {
+    capture.end(), await Promise.all(streams.map(({ completion }) => completion)), protectProcess2(result);
+    let protectedBytes;
+    try {
+      if (!failure())
+        try {
+          protectedBytes = await protectCapturedOutput(paths, redact);
+        } catch (error) {
+          isOutputStorageFailure(error) ? storageFailure ??= "write_failed" : securityFailure ??= "output_protection_failed";
+        }
+      failure() && !await discardCapturedOutput(paths) && (storageFailure = "capture_purge_failed"), receipt = {
+        id,
+        stdoutBytes: protectedBytes?.stdout.length ?? 0,
+        stderrBytes: protectedBytes?.stderr.length ?? 0,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        retentionMs,
+        complete: !failure(),
+        ...!materialize && protectedBytes ? {
+          stdoutSha256: createHash("sha256").update(protectedBytes.stdout).digest("hex"),
+          stderrSha256: createHash("sha256").update(protectedBytes.stderr).digest("hex")
+        } : {}
+      };
+      try {
+        let temporary = join5(directory, "receipt.tmp");
+        await writeFile3(
+          temporary,
+          JSON.stringify({
+            kind: "system_command_output_v1",
+            ...receipt,
+            processStatus: processResult?.status,
+            exitCode: processResult?.exitCode,
+            spawnedProcess: processResult?.spawnedProcess,
+            ...securityFailure ? { securityFailure } : {},
+            ...storageFailure ? { storageFailure } : {}
+          }),
+          { flag: "wx", mode: 384, flush: !0 }
+        ), await rename2(temporary, join5(directory, "receipt.json"));
+      } catch {
+        storageFailure ??= "receipt_write_failed", receipt = { ...receipt, complete: !1 };
+      }
+      return admitted = receipt.complete, !admitted || !materialize || !protectedBytes ? { stdout: "", stderr: "" } : { stdout: protectedBytes.stdout.toString("utf8"), stderr: protectedBytes.stderr.toString("utf8") };
+    } finally {
+      protectedBytes?.stdout.fill(0), protectedBytes?.stderr.fill(0), retained || activeSystemCaptures.delete(directory);
+    }
+  }
   return {
     capture,
     get receipt() {
       return receipt;
     },
     get failure() {
-      return failure;
+      return failure();
+    },
+    get failureKind() {
+      return storageFailure ? "storage" : securityFailure ? "security" : void 0;
+    },
+    get processResult() {
+      return processResult;
     },
     retain() {
       retained = !0, activeSystemCaptures.add(directory);
@@ -4268,61 +4461,35 @@ async function createSystemOutputCapture(root, retentionMs) {
       retained = !1, activeSystemCaptures.delete(directory);
     },
     async read(stream, offset, length) {
-      let path = streams.find((entry) => entry.name === stream).path, file = await open(path, "r");
+      if (!admitted) throw new Error("system_output_unavailable");
+      if (!isAdmittedOutputRead(stream, offset, length, receipt)) throw new Error("system_output_reference_invalid");
+      let file = await open(paths[stream], "r");
       try {
-        let bytes = Buffer.alloc(length), { bytesRead } = await file.read(bytes, 0, length, offset);
+        let size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes, bytes = Buffer.alloc(Math.min(length, size - offset)), { bytesRead } = await file.read(bytes, 0, bytes.length, offset);
         return bytes.subarray(0, bytesRead);
       } finally {
         await file.close();
       }
     },
-    async finish(result, materialize = !0) {
-      capture.end();
-      try {
-        await Promise.all(streams.map(({ completion }) => completion));
-        let sizes = await Promise.all(streams.map(async ({ path }) => {
-          try {
-            return (await stat3(path)).size;
-          } catch {
-            return failure ??= "read_failed", 0;
-          }
-        })), stdout2 = "", stderr = "";
-        if (!failure && materialize)
-          try {
-            [stdout2, stderr] = await Promise.all(streams.map(({ path }) => readFile4(path, "utf8")));
-          } catch {
-            failure = "read_failed";
-          }
-        let completedAt = Date.now();
-        receipt = {
-          id,
-          stdoutBytes: sizes[0],
-          stderrBytes: sizes[1],
-          completedAt: new Date(completedAt).toISOString(),
-          retentionMs,
-          complete: !failure,
-          ...materialize ? {} : { stdoutSha256: streams[0].hash.digest("hex"), stderrSha256: streams[1].hash.digest("hex") }
-        };
-        try {
-          let temporary = join5(directory, "receipt.tmp");
-          await writeFile2(temporary, JSON.stringify({
-            kind: "system_command_output_v1",
-            ...receipt,
-            processStatus: result?.status,
-            exitCode: result?.exitCode,
-            spawnedProcess: result?.spawnedProcess,
-            ...failure ? { storageFailure: failure } : {}
-          }), { flag: "wx", mode: 384, flush: !0 }), await rename2(temporary, join5(directory, "receipt.json"));
-        } catch {
-          failure ??= "receipt_write_failed", receipt = { ...receipt, complete: !1 };
-        }
-        return { stdout: stdout2, stderr };
-      } finally {
-        retained || activeSystemCaptures.delete(directory);
-      }
+    finish(result, materialize = !0) {
+      return finishing ??= finish(result, materialize), finishing;
     }
   };
 }
+function hasOutputProtection(value) {
+  return typeof value == "function";
+}
+function hasProtectedIdentity(value) {
+  return typeof value == "string";
+}
+function isOutputStorageFailure(error) {
+  return error instanceof CapturedOutputProtectionError && error.reason === "output_storage_failed";
+}
+function isAdmittedOutputRead(stream, offset, length, receipt) {
+  if (stream !== "stdout" && stream !== "stderr" || !Number.isSafeInteger(offset) || offset < 0 || !Number.isSafeInteger(length) || length < 0) return !1;
+  let size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes;
+  return offset <= size;
+}
 
 // src/computer-access/companion/command-output-protocol.ts
 var SYSTEM_OUTPUT_CAPABILITY = "system_command_output_v1", SYSTEM_OUTPUT_CHUNK_BYTES = 64 * 1024;
@@ -4350,6 +4517,133 @@ function readSystemOutputTransfer(value) {
   };
 }
 
+// src/computer-access/security/secret-text.ts
+var REDACTED = "[REDACTED]", CREDENTIAL_KEY_SOURCE = String.raw`(?:[A-Za-z][A-Za-z0-9_-]*\.)*(?:[A-Za-z][A-Za-z0-9]*[-_])*(?:password|passwd|pwd|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|client[_ -]?secret|secret[_ -]?access[_ -]?key|recovery[_ -]?code)`, credentialIndicator = new RegExp(
+  String.raw`(?<![\p{L}\p{N}_.-])(?:-{1,2})?(?:${CREDENTIAL_KEY_SOURCE}|(?:proxy-)?authorization)[\s"'\\]*[:=]`,
+  "iu"
+);
+function detectionText(input) {
+  return input.replace(
+    /%([0-7][0-9a-f])/giu,
+    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
+  ).replace(
+    /\\(?:u00|x|U000000)([0-7][0-9a-fA-F])/gu,
+    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
+  );
+}
+function hasPrivateKeyIndicator(text) {
+  return /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/u.test(text);
+}
+function hasUrlCredentials(text) {
+  return /\b[a-z][a-z0-9+.-]*(?::|%3a)(?:\/|%2f){2}[^\s/?#<>]*(?:@|%40)/iu.test(text);
+}
+function hasAuthorizationCredentials(text) {
+  for (let match of text.matchAll(
+    /\b(Bearer|Basic)[ \t]+([A-Za-z0-9._~+/-]+={0,2})/giu
+  )) {
+    if (match[1].toLowerCase() === "bearer") return !0;
+    let value = match[2];
+    if (/^[A-Za-z0-9+/]+={0,2}$/u.test(value) && !(value.length < 8) && Buffer.from(value, "base64").toString("utf8").includes(":"))
+      return !0;
+  }
+  return !1;
+}
+function isAwsAccessKeyValue(value, atEnd) {
+  return /^[A-Z0-9]{16}$/u.test(value) ? !0 : atEnd ? /^[A-Z0-9]{4,15}$/u.test(value) : !1;
+}
+function isRecognizedProviderToken(prefix, value, atEnd) {
+  if (prefix === "AKIA" || prefix === "ASIA")
+    return isAwsAccessKeyValue(value, atEnd);
+  if (value.length >= 20) return !0;
+  let partialMinimum = prefix === "sk-" ? 8 : 1;
+  return atEnd && value.length >= partialMinimum;
+}
+function hasProviderToken(text) {
+  let provider = /\b(sk-(?:proj-|svcacct-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|ASIA)([A-Za-z0-9_-]+)/gu;
+  for (let match of text.matchAll(provider)) {
+    let atEnd = match.index + match[0].length === text.length;
+    if (isRecognizedProviderToken(match[1], match[2], atEnd)) return !0;
+  }
+  return !1;
+}
+function compactJoseSegmentCount(header) {
+  try {
+    let value = JSON.parse(
+      Buffer.from(header, "base64url").toString("utf8")
+    );
+    if (typeof value != "object" || value === null || Array.isArray(value))
+      return;
+    let fields = value;
+    return typeof fields.alg != "string" ? void 0 : typeof fields.enc == "string" ? 5 : 3;
+  } catch {
+    return;
+  }
+}
+function hasCompactJoseToken(text) {
+  let jose = /\b([A-Za-z0-9_-]+)(?:\.[A-Za-z0-9_-]*)+/gu;
+  for (let match of text.matchAll(jose)) {
+    let parts = match[0].split("."), capturedAtEnd = match.index + match[0].length === text.length;
+    for (let index = 0; index < parts.length - 1; index += 1) {
+      let expected = compactJoseSegmentCount(parts[index]);
+      if (expected !== void 0 && !(expected === 3 && parts[index + 1] === "") && (parts.length - index >= expected || capturedAtEnd))
+        return !0;
+    }
+  }
+  return !1;
+}
+function hasSecretIndicator(text) {
+  return credentialIndicator.test(text) || hasPrivateKeyIndicator(text) || hasUrlCredentials(text) || hasAuthorizationCredentials(text) || hasProviderToken(text) ? !0 : hasCompactJoseToken(text);
+}
+function redactSecretText(input) {
+  return hasSecretIndicator(input) || hasSecretIndicator(detectionText(input)) ? REDACTED : input;
+}
+
+// src/computer-access/security/system-results.ts
+var INCOMPLETE_STREAM = "[UNAVAILABLE: incomplete output cannot be scanned for secrets]", SENSITIVE_TARGET = "Target unavailable because its shell identity contains sensitive text.";
+function protectApplication(application) {
+  if (redactSecretText(application.id) === application.id)
+    return { ...application, name: redactSecretText(application.name) };
+}
+function protectCatalog(catalog) {
+  let applications = catalog.applications.flatMap((application) => {
+    let protectedApplication = protectApplication(application);
+    return protectedApplication ? [protectedApplication] : [];
+  });
+  return {
+    ...catalog,
+    applications,
+    complete: catalog.complete && applications.length === catalog.applications.length,
+    scope: { ...catalog.scope, roots: catalog.scope.roots.map(redactSecretText) }
+  };
+}
+function protectTargets(observation) {
+  return {
+    ...observation,
+    host: { ...observation.host, kernelRelease: redactSecretText(observation.host.kernelRelease) },
+    targets: observation.targets.map((target) => target.available ? redactSecretText(target.shell) !== target.shell ? { id: target.id, available: !1, reason: SENSITIVE_TARGET } : target : { ...target, reason: redactSecretText(target.reason) })
+  };
+}
+function protectProcess(result) {
+  return {
+    ...result,
+    stdout: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stdout),
+    stderr: result.outputTruncated ? INCOMPLETE_STREAM : redactSecretText(result.stderr),
+    ...result.spawnedProcess ? {
+      spawnedProcess: {
+        ...result.spawnedProcess,
+        executable: redactSecretText(result.spawnedProcess.executable)
+      }
+    } : {}
+  };
+}
+var systemResultProtection = Object.freeze({
+  protectTargets,
+  protectCatalog,
+  protectProcess,
+  protectApplication,
+  protectMessage: redactSecretText
+});
+
 // src/computer-access/companion/command-output.ts
 var CompanionCommandOutput = class {
   constructor(stateDir) {
@@ -4390,10 +4684,10 @@ var CompanionCommandOutput = class {
     }), captured, handlers = createSystemHandlers(void 0, void 0, () => ({
       run: async (input) => {
         if (input.abortSignal?.aborted) return runSystemProcess(input);
-        captured = await createSystemOutputCapture(join6(this.stateDir, "command-output"), retentionMs), captured.retain();
+        captured = await createSystemOutputCapture(join6(this.stateDir, "command-output"), retentionMs, redactSecretText), captured.retain();
         try {
           let result = await runSystemProcess(input, captured.capture);
-          return await captured.finish(result, !1), { ...result, outputTruncated: !!captured.failure };
+          return await captured.finish(result, !1), { ...captured.processResult, outputTruncated: !!captured.failure };
         } catch (error) {
           throw await captured.finish(void 0, !1), captured.release(), error;
         }
@@ -4402,13 +4696,16 @@ var CompanionCommandOutput = class {
         let receipt = buildSystemProcessResult(target, result, "command_process_completion");
         if (!captured?.receipt) return receipt;
         let data = { ...receipt.data, outputCapture: captured.receipt };
-        if (captured.failure)
-          return captured.release(), failureResult({
-            errorCode: "system_output_storage_failed",
-            message: "Command output storage failed after dispatch; inspect the process receipt before another action.",
-            data: { ...data, storageFailure: captured.failure },
+        if (captured.failure) {
+          captured.release();
+          let errorCode2 = captured.failureKind === "security" ? "system_output_protection_failed" : "system_output_storage_failed";
+          return failureResult({
+            errorCode: errorCode2,
+            message: "Command output could not be admitted after dispatch; inspect the process receipt before another action. The command was not replayed.",
+            data: { ...data, ...captured.failureKind === "security" ? { securityFailure: captured.failure } : { storageFailure: captured.failure } },
             ...result.exitCode !== null ? { exitCode: result.exitCode } : {}
           });
+        }
         if (this.closed || context?.abortSignal?.aborted)
           return captured.release(), { ...receipt, data };
         let transfer = readSystemOutputTransfer({ kind: SYSTEM_OUTPUT_CAPABILITY, ...captured.receipt });
@@ -4421,8 +4718,16 @@ Streams retained for exact transfer.`,
           data: { ...data, outputTransfer: transfer }
         };
       }
-    })), { outputRetentionMs: _retention, ...command } = params;
-    return handlers.system_command(command, context);
+    }), systemResultProtection), { outputRetentionMs: _retention, ...command } = params;
+    try {
+      return await handlers.system_command(command, context);
+    } finally {
+      this.hasRegisteredTransfer(captured) || captured?.release();
+    }
+  }
+  hasRegisteredTransfer(capture) {
+    let id = capture?.receipt?.id;
+    return id ? this.captures.get(id) === capture : !1;
   }
   async read(params) {
     if (!isHostIdentifier(params.captureId)) throw new Error("system_output_reference_invalid");
@@ -4439,6 +4744,9 @@ Streams retained for exact transfer.`,
   }
 };
 
+// src/computer-access/companion/secret-protection-protocol.ts
+var HOST_SECRET_PROTECTION_CAPABILITY = "host_secret_protection_v1";
+
 // src/computer-access/companion/native-permissions.ts
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
@@ -4771,7 +5079,7 @@ async function sendWindowsNotification(notification, signal, run2 = runNotificat
 
 // src/computer-access/companion/notification-macos.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { readFile as readFile5, unlink as unlink2, writeFile as writeFile3 } from "node:fs/promises";
+import { readFile as readFile5, unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
 import { join as join8 } from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
 function renderMacNotificationApplet(stateDir) {
@@ -4858,7 +5166,7 @@ async function sendMacNotification(notification, locations, signal, run2 = runNo
     "pending",
     randomUUID3() + ".json"
   ), resultFile = file + ".result";
-  await writeFile3(
+  await writeFile4(
     file,
     JSON.stringify({ ...notification, expiresAt: Date.now() + 15e3 }),
     { flag: "wx", mode: 384 }
@@ -5073,14 +5381,14 @@ import {
   open as open2,
   readFile as readFile7,
   rename as rename3,
-  rm as rm3,
-  writeFile as writeFile5
+  rm as rm4,
+  writeFile as writeFile6
 } from "node:fs/promises";
 import { dirname as dirname3, isAbsolute as isAbsolute2, join as join12 } from "node:path";
 
 // src/computer-access/companion/notification-directory.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { mkdir as mkdir2, rm as rm2, symlink, unlink as unlink3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir2, rm as rm3, symlink, unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
 import { basename as basename3, dirname as dirname2, join as join10 } from "node:path";
 
 // src/computer-access/companion/notification-directory-ownership.ts
@@ -5094,9 +5402,9 @@ function renderNotificationLinkOwner(directory, backing) {
   });
 }
 async function readNotificationOwnerFile(path) {
-  let stat4 = await lstat2(path);
-  if (!stat4.isFile()) throw new Error("notification_directory_not_owned");
-  if (stat4.size > 4096) throw new Error("notification_directory_not_owned");
+  let stat3 = await lstat2(path);
+  if (!stat3.isFile()) throw new Error("notification_directory_not_owned");
+  if (stat3.size > 4096) throw new Error("notification_directory_not_owned");
   return readFile6(path, "utf8");
 }
 async function assertNotificationDirectoryMarker(directory) {
@@ -5119,21 +5427,21 @@ function hasSameNotificationFileIdentity(left, right) {
   return left.dev !== right.dev ? !1 : left.ino === right.ino;
 }
 async function readOwnedNotificationPath(directory) {
-  let stat4 = await lstat2(directory, { bigint: !0 }).catch(
+  let stat3 = await lstat2(directory, { bigint: !0 }).catch(
     (error) => {
       if (error.code !== "ENOENT")
         throw error;
     }
   );
-  if (!stat4) return;
-  if (stat4.isDirectory())
+  if (!stat3) return;
+  if (stat3.isDirectory())
     return await assertNotificationDirectoryMarker(directory), {
       directory,
       backing: directory,
-      aliasIdentity: stat4,
-      backingIdentity: stat4
+      aliasIdentity: stat3,
+      backingIdentity: stat3
     };
-  if (!stat4.isSymbolicLink())
+  if (!stat3.isSymbolicLink())
     throw new Error("notification_directory_not_owned");
   let target = await readlink(directory);
   if (!isNotificationBackingName(directory, target))
@@ -5148,12 +5456,12 @@ async function readOwnedNotificationPath(directory) {
   if (!hasBoundNotificationLinkOwner(record, directory, target))
     throw new Error("notification_directory_not_owned");
   let currentAlias = await lstat2(directory, { bigint: !0 });
-  if (!hasSameNotificationFileIdentity(stat4, currentAlias))
+  if (!hasSameNotificationFileIdentity(stat3, currentAlias))
     throw new Error("notification_directory_changed");
   return {
     directory,
     backing,
-    aliasIdentity: stat4,
+    aliasIdentity: stat3,
     backingIdentity,
     linkTarget: target
   };
@@ -5229,11 +5537,11 @@ async function ensureOwnedNotificationDirectory(locations, run2 = runNotificatio
   await mkdir2(staged, { mode: 448 });
   let retainBacking = !1;
   try {
-    await writeFile4(join10(staged, ".owner"), NOTIFICATION_OWNER_MARKER, {
+    await writeFile5(join10(staged, ".owner"), NOTIFICATION_OWNER_MARKER, {
       flag: "wx",
       mode: 384,
       flush: !0
-    }), requiresNotificationDirectoryLink() && await writeFile4(
+    }), requiresNotificationDirectoryLink() && await writeFile5(
       join10(staged, ".owner-link"),
       renderNotificationLinkOwner(directory, staged),
       {
@@ -5247,17 +5555,17 @@ async function ensureOwnedNotificationDirectory(locations, run2 = runNotificatio
       run2
     );
   } finally {
-    retainBacking || await rm2(staged, { recursive: !0, force: !0 });
+    retainBacking || await rm3(staged, { recursive: !0, force: !0 });
   }
 }
 async function removeOwnedNotificationDirectory(locations) {
   let owner = await readOwnedNotificationDirectory(locations);
   if (owner) {
     if (await assertNotificationOwnershipUnchanged(owner), owner.linkTarget === void 0) {
-      await rm2(owner.directory, { recursive: !0 });
+      await rm3(owner.directory, { recursive: !0 });
       return;
     }
-    await unlink3(owner.directory), await assertNotificationBackingUnchanged(owner), await rm2(owner.backing, { recursive: !0 });
+    await unlink3(owner.directory), await assertNotificationBackingUnchanged(owner), await rm3(owner.backing, { recursive: !0 });
   }
 }
 
@@ -5288,13 +5596,13 @@ function isBundleExecutableName(value) {
   return typeof value != "string" || value.length === 0 || value === "." || value === ".." ? !1 : !/[\\/\u0000-\u001f\u007f]/.test(value);
 }
 async function assertBundleDirectory(path) {
-  let stat4 = await lstat3(path);
-  if (!stat4.isDirectory() || stat4.isSymbolicLink())
+  let stat3 = await lstat3(path);
+  if (!stat3.isDirectory() || stat3.isSymbolicLink())
     throw new Error("notification_bundle_directory_invalid");
 }
 async function assertBundleFile(path) {
-  let stat4 = await lstat3(path);
-  if (!stat4.isFile() || stat4.isSymbolicLink())
+  let stat3 = await lstat3(path);
+  if (!stat3.isFile() || stat3.isSymbolicLink())
     throw new Error("notification_bundle_file_invalid");
 }
 async function readBundleMetadata(app, run2, signal) {
@@ -5374,12 +5682,12 @@ function renderLinuxNotificationDesktop(runtimeUrl) {
 `);
 }
 async function assertLinuxDesktopOwnership(path) {
-  let stat4 = await lstat4(path).catch((error) => {
+  let stat3 = await lstat4(path).catch((error) => {
     if (error.code !== "ENOENT")
       throw error;
   });
-  if (!stat4) return !1;
-  if (!stat4.isFile() || stat4.isSymbolicLink())
+  if (!stat3) return !1;
+  if (!stat3.isFile() || stat3.isSymbolicLink())
     throw new Error("notification_registration_not_owned");
   if (!(await readFile7(path, "utf8")).includes("# " + NOTIFICATION_OWNER_MARKER))
     throw new Error("notification_registration_not_owned");
@@ -5399,9 +5707,9 @@ async function stopMacNotificationApp(locations, run2) {
 }
 async function installMacNotificationApp(locations, run2) {
   let directory = notificationInstallDirectory(locations), source = join12(directory, "notification-helper.js"), temporary = join12(directory, "ABot.next.app"), app = macNotificationAppPath(locations);
-  await writeFile5(source, renderMacNotificationApplet(locations.stateDir), {
+  await writeFile6(source, renderMacNotificationApplet(locations.stateDir), {
     mode: 384
-  }), await rm3(temporary, { recursive: !0, force: !0 }), await run2({
+  }), await rm4(temporary, { recursive: !0, force: !0 }), await run2({
     file: "/usr/bin/osacompile",
     args: ["-l", "JavaScript", "-s", "-o", temporary, source],
     timeoutMs: 3e4
@@ -5416,19 +5724,19 @@ async function installMacNotificationApp(locations, run2) {
       temporary
     ],
     timeoutMs: 3e4
-  }), await stopMacNotificationApp(locations, run2), await rm3(app, { recursive: !0, force: !0 }), await rename3(temporary, app), await run2({
+  }), await stopMacNotificationApp(locations, run2), await rm4(app, { recursive: !0, force: !0 }), await rename3(temporary, app), await run2({
     file: "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister",
     args: ["-f", app]
   });
 }
 async function installDesktopNotificationIdentity(startup, runtimeUrl, run2 = runNotificationProcess) {
   let locations = notificationLocationsFromStartup(startup), directory = notificationInstallDirectory(locations);
-  await ensureOwnedNotificationDirectory(locations, run2), await rm3(join12(directory, ".ready"), { force: !0 }), await mkdir3(join12(directory, "pending"), { recursive: !0, mode: 448 }), await registerDesktopNotificationIdentity(
+  await ensureOwnedNotificationDirectory(locations, run2), await rm4(join12(directory, ".ready"), { force: !0 }), await mkdir3(join12(directory, "pending"), { recursive: !0, mode: 448 }), await registerDesktopNotificationIdentity(
     startup.platform,
     locations,
     runtimeUrl,
     run2
-  ), await writeFile5(join12(directory, ".ready"), startup.platform, { mode: 384 });
+  ), await writeFile6(join12(directory, ".ready"), startup.platform, { mode: 384 });
 }
 async function registerDesktopNotificationIdentity(platform, locations, runtimeUrl, run2) {
   if (platform === "win32") {
@@ -5450,12 +5758,12 @@ async function registerDesktopNotificationIdentity(platform, locations, runtimeU
   throw new Error("notification_platform_unsupported");
 }
 async function uninstallMacNotificationApp(locations, run2) {
-  let app = macNotificationAppPath(locations), stat4 = await lstat4(app).catch((error) => {
+  let app = macNotificationAppPath(locations), stat3 = await lstat4(app).catch((error) => {
     if (error.code !== "ENOENT")
       throw error;
   });
-  if (stat4) {
-    if (!stat4.isDirectory() || stat4.isSymbolicLink())
+  if (stat3) {
+    if (!stat3.isDirectory() || stat3.isSymbolicLink())
       throw new Error("notification_registration_not_owned");
     await stopMacNotificationApp(locations, run2), await run2({
       file: "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister",
@@ -5488,7 +5796,7 @@ async function installLinuxNotificationIdentity(locations, runtimeUrl, run2) {
   try {
     await file.writeFile(content).finally(() => file.close()), await assertLinuxDesktopOwnership(path), await rename3(temporary, path);
   } finally {
-    await rm3(temporary, { force: !0 });
+    await rm4(temporary, { force: !0 });
   }
 }
 async function uninstallDesktopNotificationIdentity(startup, run2 = runNotificationProcess) {
@@ -5502,7 +5810,7 @@ async function uninstallDesktopNotificationIdentity(startup, run2 = runNotificat
       input: JSON.stringify({ action: "uninstall" })
     }), startup.platform === "darwin" && await uninstallMacNotificationApp(locations, run2), startup.platform === "linux") {
       let path = linuxNotificationDesktopPath(locations);
-      await assertLinuxDesktopOwnership(path) && await rm3(path);
+      await assertLinuxDesktopOwnership(path) && await rm4(path);
     }
     await removeOwnedNotificationDirectory(locations);
   }
@@ -5587,7 +5895,7 @@ function createNotificationSession(platform, runtimeUrl, ready, renderer, probe)
         } catch (error) {
           return failureResult({
             errorCode: hasUnknownNotificationOutcome(error) ? "notification_outcome_unknown" : "notification_native_failed",
-            message: error instanceof Error ? error.message.slice(0, 1e3) : "Desktop notification submission failed."
+            message: error instanceof Error ? redactSecretText(error.message).slice(0, 1e3) : "Desktop notification submission failed."
           });
         }
       }
@@ -5616,7 +5924,7 @@ async function createNativeNotificationSession(platform, runtimeUrl, locations =
         linux.close(), platform === "macos" && session.ready && await stopMacNotificationApp(locations, runNotificationProcess).catch(
           (error) => {
             console.warn(
-              "Desktop notification helper could not stop: " + (error instanceof Error ? error.message : String(error))
+              "Desktop notification helper could not stop: " + redactSecretText(error instanceof Error ? error.message : String(error))
             );
           }
         );
@@ -6864,18 +7172,14 @@ function readUnixNativeResult(value, platform) {
 
 // src/computer-access/computer/unix-native-process.ts
 function createUnixNativeProcess(options) {
-  let child, pending, closed = !1, failedReason, buffer = Buffer.alloc(0), queue = Promise.resolve(), lastResult;
+  let child, pending, closed = !1, failedReason, buffer = Buffer.alloc(0), queue = Promise.resolve(), lastDesktop;
   function interruptedResult(reason) {
     let dispatch = pending?.request.operation === "act" ? pending.dispatch ?? {
       status: "unknown",
       requestedInputCount: 1,
       reason
     } : void 0, result = unavailableUnixDesktop(options.platform, reason, dispatch);
-    return lastResult ? {
-      ...result,
-      desktop: { ...lastResult.desktop, available: !1, reason },
-      windows: lastResult.windows
-    } : result;
+    return lastDesktop ? { ...result, desktop: { ...result.desktop, ...lastDesktop } } : result;
   }
   function terminate(reason) {
     failedReason = reason, pending?.finish(interruptedResult(reason));
@@ -6884,7 +7188,7 @@ function createUnixNativeProcess(options) {
       let hardStop = setTimeout(() => retiring.kill("SIGKILL"), 3e3);
       hardStop.unref(), retiring.once("exit", () => clearTimeout(hardStop));
     }
-    child = void 0, buffer = Buffer.alloc(0);
+    child = void 0, buffer.fill(0), buffer = Buffer.alloc(0);
   }
   function receiveLine(line) {
     let value = JSON.parse(line);
@@ -6899,7 +7203,17 @@ function createUnixNativeProcess(options) {
     }
     if (message.type !== "result") throw new Error("native_protocol_invalid");
     let result = readUnixNativeResult(message.result, options.platform);
-    lastResult = result, pending.finish(result);
+    lastDesktop = {
+      binding: result.desktop.binding,
+      bounds: {
+        x: result.desktop.bounds.x,
+        y: result.desktop.bounds.y,
+        width: result.desktop.bounds.width,
+        height: result.desktop.bounds.height
+      },
+      coordinateSpace: result.desktop.coordinateSpace,
+      targetingGuarantee: result.desktop.targetingGuarantee
+    }, pending.finish(result);
   }
   function ensureHelper() {
     child || (child = (options.spawnProcess ?? spawn5)(options.file, [...options.args], {
@@ -6907,14 +7221,15 @@ function createUnixNativeProcess(options) {
       windowsHide: !0
     }), child.stdin.on("error", () => terminate("computer_native_pipe_failed")), child.stderr.resume(), child.stdout.on("data", (chunk) => {
       if (closed || failedReason) return;
-      if (buffer = Buffer.concat([buffer, chunk]), buffer.length > NATIVE_JSON_LIMIT) {
+      let previous = buffer;
+      if (buffer = Buffer.concat([previous, chunk]), previous.fill(0), buffer.length > NATIVE_JSON_LIMIT) {
         terminate("computer_native_result_limit");
         return;
       }
       let boundary = buffer.indexOf(10);
       for (; boundary >= 0; ) {
-        let line = buffer.subarray(0, boundary).toString("utf8");
-        buffer = buffer.subarray(boundary + 1);
+        let received = buffer, line = received.subarray(0, boundary).toString("utf8");
+        buffer = Buffer.from(received.subarray(boundary + 1)), received.fill(0);
         try {
           receiveLine(line);
         } catch {
@@ -8950,6 +9265,127 @@ function waitForDesktopTurn(previous, signal) {
   })) : previous;
 }
 
+// src/computer-access/security/desktop-result.ts
+function rectangle(value) {
+  return { x: value.x, y: value.y, width: value.width, height: value.height };
+}
+function projectDesktopFields(result, text) {
+  let capability = (value) => ({
+    supported: value.supported,
+    available: value.available,
+    ...value.reason === void 0 ? {} : { reason: text(value.reason) }
+  }), desktop = result.desktop;
+  return {
+    desktop: {
+      platform: desktop.platform,
+      binding: desktop.binding,
+      name: text(desktop.name),
+      available: desktop.available,
+      ...desktop.reason === void 0 ? {} : { reason: text(desktop.reason) },
+      bounds: rectangle(desktop.bounds),
+      ...desktop.coordinateSpace === void 0 ? {} : { coordinateSpace: desktop.coordinateSpace },
+      capabilities: {
+        capture: capability(desktop.capabilities.capture),
+        accessibility: capability(desktop.capabilities.accessibility),
+        input: capability(desktop.capabilities.input),
+        windows: capability(desktop.capabilities.windows)
+      },
+      targetingGuarantee: desktop.targetingGuarantee
+    },
+    windows: result.windows.map((window) => ({
+      binding: window.binding,
+      title: text(window.title),
+      ...window.application === void 0 ? {} : { application: text(window.application) },
+      bounds: rectangle(window.bounds),
+      focused: window.focused
+    })),
+    ...result.focusedWindow === void 0 ? {} : { focusedWindow: result.focusedWindow },
+    ...result.observation ? {
+      observation: {
+        capturedAt: text(result.observation.capturedAt),
+        region: rectangle(result.observation.region),
+        imageWidth: result.observation.imageWidth,
+        imageHeight: result.observation.imageHeight,
+        accessibility: result.observation.accessibility.map((node) => ({
+          role: text(node.role),
+          ...node.name === void 0 ? {} : { name: text(node.name) },
+          ...node.value === void 0 ? {} : { value: text(node.value) },
+          ...node.bounds === void 0 ? {} : { bounds: rectangle(node.bounds) },
+          ...node.focused === void 0 ? {} : { focused: node.focused }
+        })),
+        accessibilityTruncated: result.observation.accessibilityTruncated
+      }
+    } : {},
+    ...result.dispatch ? {
+      dispatch: {
+        status: result.dispatch.status,
+        requestedInputCount: result.dispatch.requestedInputCount,
+        ...result.dispatch.acceptedInputCount === void 0 ? {} : { acceptedInputCount: result.dispatch.acceptedInputCount },
+        ...result.dispatch.reason === void 0 ? {} : { reason: text(result.dispatch.reason) }
+      }
+    } : {},
+    ...result.error ? {
+      error: {
+        code: text(result.error.code),
+        message: text(result.error.message)
+      }
+    } : {}
+  };
+}
+function protectDesktopResult(result, scan = redactSecretText) {
+  let suspected = !1;
+  try {
+    let protectedResult = projectDesktopFields(result, (input) => {
+      let output = scan(input);
+      if (typeof output != "string")
+        throw new Error("desktop_text_scan_failed");
+      return suspected ||= output !== input, output;
+    });
+    return suspected ? (result.image?.bytes.fill(0), {
+      ...protectedResult,
+      ...result.image && !protectedResult.error ? {
+        error: {
+          code: "computer_image_secret_blocked",
+          message: "Image withheld because desktop text contained a suspected secret. The dispatch receipt is unchanged."
+        }
+      } : {}
+    }) : {
+      ...protectedResult,
+      ...result.image ? {
+        image: {
+          mimeType: result.image.mimeType,
+          bytes: result.image.bytes
+        }
+      } : {}
+    };
+  } catch {
+    result.image?.bytes.fill(0);
+    let safe = projectDesktopFields(result, () => "[REDACTED]");
+    return {
+      desktop: {
+        ...safe.desktop,
+        reason: "Desktop content withheld because its protection check failed."
+      },
+      windows: [],
+      ...safe.focusedWindow === void 0 ? {} : { focusedWindow: safe.focusedWindow },
+      ...safe.dispatch ? { dispatch: safe.dispatch } : {},
+      error: {
+        code: "computer_observation_protection_failed",
+        message: "Desktop content withheld because its protection check failed. The dispatch receipt is unchanged."
+      }
+    };
+  }
+}
+
+// src/computer-access/security/observed-error.ts
+function protectObservedError(error, fallback) {
+  try {
+    return redactSecretText(error instanceof Error ? error.message : fallback);
+  } catch {
+    return "Observed error details withheld because the protection check failed.";
+  }
+}
+
 // src/computer-access/computer/companion-sessions.ts
 var CompanionComputerSessions = class {
   constructor(platform, createBackend = createNativeComputerBackend, resolveTarget = resolveSystemTarget) {
@@ -8973,7 +9409,10 @@ var CompanionComputerSessions = class {
       } catch (error) {
         return failureResult({
           errorCode: "computer_native_operation_failed",
-          message: error instanceof Error ? error.message : "The computer operation failed; observe before retrying."
+          message: protectObservedError(
+            error,
+            "The computer operation failed; observe before retrying."
+          )
         });
       }
     };
@@ -9033,12 +9472,13 @@ var CompanionComputerSessions = class {
       async () => {
         let session = await this.acquire(id);
         this.eraseFrame(session);
-        let result = await session.backend.execute(request, signal), { image, ...metadata } = result;
+        let result = await session.backend.execute(request, signal), { image: rawImage, ...rawMetadata } = result;
         try {
-          readNativeComputerResult(metadata);
+          readNativeComputerResult(rawMetadata);
         } catch (error) {
-          throw image?.bytes.fill(0), error;
+          throw rawImage?.bytes.fill(0), error;
         }
+        let { image, ...metadata } = protectDesktopResult(result);
         if (!image)
           return successResult({
             output: "Native desktop observation.",
@@ -9117,96 +9557,45 @@ import { existsSync as existsSync2 } from "node:fs";
 // src/computer-access/companion/observation-filter.ts
 import { createHash as createHash3, createHmac, randomBytes, randomUUID as randomUUID8 } from "node:crypto";
 
-// src/computer-access/companion/observation-redaction.ts
-var REDACTED = "[REDACTED]", CREDENTIAL_KEY_SOURCE = String.raw`(?:[A-Za-z][A-Za-z0-9_-]*\.)*(?:[A-Za-z][A-Za-z0-9]*[-_])*(?:password|passwd|pwd|api[_ -]?key|access[_ -]?token|refresh[_ -]?token|client[_ -]?secret|secret[_ -]?access[_ -]?key|recovery[_ -]?code)`, credentialIndicator = new RegExp(
-  String.raw`(?<![\p{L}\p{N}_.-])(?:-{1,2})?(?:${CREDENTIAL_KEY_SOURCE}|(?:proxy-)?authorization)[\s"'\\]*[:=]`,
-  "iu"
-);
-function detectionText(input) {
-  return input.replace(
-    /%([0-7][0-9a-f])/giu,
-    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
-  ).replace(
-    /\\(?:u00|x|U000000)([0-7][0-9a-fA-F])/gu,
-    (_, hex) => String.fromCharCode(Number.parseInt(hex, 16))
+// src/shared/passive-observation-self-exclusion.ts
+var OWN_WEB_UI_TITLES = ["ABot Runtime — Workspace", "ABot Runtime"], BROWSER_WINDOW_NAMES = [
+  "Mozilla Firefox",
+  "Mozilla Firefox (Private Browsing)",
+  "Google Chrome",
+  "Chromium",
+  "Microsoft Edge",
+  "Brave",
+  "Safari"
+], BROWSER_WINDOW_SUFFIXES = BROWSER_WINDOW_NAMES.flatMap((browser) => [
+  ` — ${browser}`,
+  ` - ${browser}`
+]);
+function isOwnWebUiWindowTitle(title) {
+  if (typeof title != "string") return !1;
+  if (OWN_WEB_UI_TITLES.includes(title)) return !0;
+  let suffix = BROWSER_WINDOW_SUFFIXES.find(
+    (candidate) => title.endsWith(candidate)
   );
+  return suffix ? OWN_WEB_UI_TITLES.includes(title.slice(0, -suffix.length)) : !1;
 }
-function hasPrivateKeyIndicator(text) {
-  return /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----/u.test(text);
-}
-function hasUrlCredentials(text) {
-  return /\b[a-z][a-z0-9+.-]*(?::|%3a)(?:\/|%2f){2}[^\s/?#<>]*(?:@|%40)/iu.test(text);
-}
-function hasAuthorizationCredentials(text) {
-  for (let match of text.matchAll(
-    /\b(Bearer|Basic)[ \t]+([A-Za-z0-9._~+/-]+={0,2})/giu
-  )) {
-    if (match[1].toLowerCase() === "bearer") return !0;
-    let value = match[2];
-    if (/^[A-Za-z0-9+/]+={0,2}$/u.test(value) && !(value.length < 8) && Buffer.from(value, "base64").toString("utf8").includes(":"))
-      return !0;
-  }
-  return !1;
-}
-function isAwsAccessKeyValue(value, atEnd) {
-  return /^[A-Z0-9]{16}$/u.test(value) ? !0 : atEnd ? /^[A-Z0-9]{4,15}$/u.test(value) : !1;
-}
-function isRecognizedProviderToken(prefix, value, atEnd) {
-  if (prefix === "AKIA" || prefix === "ASIA")
-    return isAwsAccessKeyValue(value, atEnd);
-  if (value.length >= 20) return !0;
-  let partialMinimum = prefix === "sk-" ? 8 : 1;
-  return atEnd && value.length >= partialMinimum;
-}
-function hasProviderToken(text) {
-  let provider = /\b(sk-(?:proj-|svcacct-)?|gh[pousr]_|github_pat_|xox[baprs]-|AKIA|ASIA)([A-Za-z0-9_-]+)/gu;
-  for (let match of text.matchAll(provider)) {
-    let atEnd = match.index + match[0].length === text.length;
-    if (isRecognizedProviderToken(match[1], match[2], atEnd)) return !0;
-  }
-  return !1;
-}
-function compactJoseSegmentCount(header) {
-  try {
-    let value = JSON.parse(
-      Buffer.from(header, "base64url").toString("utf8")
-    );
-    if (typeof value != "object" || value === null || Array.isArray(value))
-      return;
-    let fields = value;
-    return typeof fields.alg != "string" ? void 0 : typeof fields.enc == "string" ? 5 : 3;
-  } catch {
-    return;
-  }
-}
-function hasCompactJoseToken(text) {
-  let jose = /\b([A-Za-z0-9_-]+)(?:\.[A-Za-z0-9_-]*)+/gu;
-  for (let match of text.matchAll(jose)) {
-    let parts = match[0].split("."), capturedAtEnd = match.index + match[0].length === text.length;
-    for (let index = 0; index < parts.length - 1; index += 1) {
-      let expected = compactJoseSegmentCount(parts[index]);
-      if (expected !== void 0 && !(expected === 3 && parts[index + 1] === "") && (parts.length - index >= expected || capturedAtEnd))
-        return !0;
-    }
-  }
-  return !1;
+function isOwnObservationApplication(app) {
+  return app.toLowerCase() === "abot";
 }
-function hasSecretIndicator(text) {
-  return credentialIndicator.test(text) || hasPrivateKeyIndicator(text) || hasUrlCredentials(text) || hasAuthorizationCredentials(text) || hasProviderToken(text) ? !0 : hasCompactJoseToken(text);
-}
-function redactObservationText(input) {
-  return hasSecretIndicator(input) || hasSecretIndicator(detectionText(input)) ? REDACTED : input;
+function isOwnApplicationObservation(source) {
+  return isOwnObservationApplication(source.app) ? !0 : isOwnWebUiWindowTitle(source.title);
 }
+
+// src/computer-access/companion/observation-redaction.ts
 function redactObservationSource(source, sourceKey) {
   let redacted = {
-    app: redactObservationText(source.app).slice(0, 128),
-    windowId: redactObservationText(source.windowId).slice(0, 256),
+    app: redactSecretText(source.app).slice(0, 128),
+    windowId: redactSecretText(source.windowId).slice(0, 256),
     ...source.processId === void 0 ? {} : { processId: source.processId },
     ...source.documentId === void 0 ? {} : {
-      documentId: redactObservationText(source.documentId).slice(0, 4096)
+      documentId: redactSecretText(source.documentId).slice(0, 4096)
     },
-    ...source.title === void 0 ? {} : { title: redactObservationText(source.title).slice(0, 4096) },
-    ...source.url === void 0 ? {} : { url: redactObservationText(source.url).slice(0, 4096) }
+    ...source.title === void 0 ? {} : { title: redactSecretText(source.title).slice(0, 4096) },
+    ...source.url === void 0 ? {} : { url: redactSecretText(source.url).slice(0, 4096) }
   };
   return [
     "app",
@@ -9267,26 +9656,6 @@ function isPassiveCollectorEvent(value) {
 }
 
 // src/computer-access/companion/observation-filter.ts
-var OWN_WEB_UI_TITLES = ["ABot Runtime — Workspace", "ABot Runtime"], BROWSER_WINDOW_NAMES = [
-  "Mozilla Firefox",
-  "Mozilla Firefox (Private Browsing)",
-  "Google Chrome",
-  "Chromium",
-  "Microsoft Edge",
-  "Brave",
-  "Safari"
-], BROWSER_WINDOW_SUFFIXES = BROWSER_WINDOW_NAMES.flatMap((browser) => [
-  ` — ${browser}`,
-  ` - ${browser}`
-]);
-function isOwnWebUiWindowTitle(title) {
-  if (typeof title != "string") return !1;
-  if (OWN_WEB_UI_TITLES.includes(title)) return !0;
-  let suffix = BROWSER_WINDOW_SUFFIXES.find(
-    (candidate) => title.endsWith(candidate)
-  );
-  return suffix ? OWN_WEB_UI_TITLES.includes(title.slice(0, -suffix.length)) : !1;
-}
 function hasBoundedSourceMetadata(source) {
   if (!isObservationOwner(source.app) || typeof source.windowId != "string" || source.windowId.length === 0 || source.windowId.length > 256) return !1;
   for (let field of ["documentId", "title", "url"])
@@ -9322,7 +9691,7 @@ var ObservationFilter = class {
   accept(value) {
     if (isPassiveCollectorEvent(value) && value.type === "status") {
       value.state === "paused" && (this.lastSource = void 0);
-      let reason = value.reason === void 0 ? void 0 : redactObservationText(value.reason).slice(0, 512), identity = JSON.stringify([value.state, reason]);
+      let reason = value.reason === void 0 ? void 0 : redactSecretText(value.reason).slice(0, 512), identity = JSON.stringify([value.state, reason]);
       return identity === this.lastStatus ? void 0 : (this.lastStatus = identity, {
         type: "status",
         state: value.state,
@@ -9340,7 +9709,7 @@ var ObservationFilter = class {
       url: value.source.url
     };
     if (!hasBoundedSourceMetadata(rawSource)) return;
-    if (isOwnWebUiWindowTitle(rawSource.title)) {
+    if (isOwnApplicationObservation(rawSource)) {
       this.lastSource = void 0;
       return;
     }
@@ -9359,11 +9728,11 @@ var ObservationFilter = class {
         rawSource.title,
         rawSource.url
       ])
-    ).digest("hex"), source = redactObservationSource(rawSource, sourceKey), content = redactObservationText(value.content).replace(/\r\n?/gu, `
+    ).digest("hex"), source = redactObservationSource(rawSource, sourceKey), content = redactSecretText(value.content).replace(/\r\n?/gu, `
 `).replace(/[ \t]+\n/gu, `
 `).trim(), fingerprint = createHash3("sha256").update(content).digest("hex"), previous = this.fingerprints.get(sourceKey), duplicate = previous?.fingerprint === fingerprint;
     if (duplicate && this.lastSource === sourceKey) return;
-    let truncated = content.length > OBSERVATION_CONTENT_LIMIT, coverageReason = typeof value.coverageReason == "string" ? redactObservationText(value.coverageReason).slice(0, 512) : void 0;
+    let truncated = content.length > OBSERVATION_CONTENT_LIMIT, coverageReason = typeof value.coverageReason == "string" ? redactSecretText(value.coverageReason).slice(0, 512) : void 0;
     truncated && (coverageReason = "content_limit");
     let observation = {
       id: randomUUID8(),
@@ -10038,8 +10407,10 @@ function desktopCollectorCommand(platform) {
     return { file: "python3", args: ["-u", "-c", LINUX_OBSERVATION_SCRIPT] };
 }
 function startDesktopCollector(options) {
-  let command = desktopCollectorCommand(options.platform ?? process.platform), child, closed = !1, received = Buffer.alloc(0), terminalStatus = !1, filter = new ObservationFilter(options.excludedApplications), close = () => {
-    if (closed = !0, !!child?.pid) {
+  let command = desktopCollectorCommand(options.platform ?? process.platform), child, closed = !1, stopped = !1, confirmStopped = () => {
+    stopped || (stopped = !0, options.onStopped?.());
+  }, received = Buffer.alloc(0), terminalStatus = !1, filter = new ObservationFilter(options.excludedApplications), close = () => {
+    if (closed = !0, !(stopped || !child?.pid)) {
       if (process.platform !== "win32") {
         try {
           process.kill(-child.pid, "SIGTERM");
@@ -10056,7 +10427,7 @@ function startDesktopCollector(options) {
       type: "status",
       state: "unavailable",
       reason: "platform_unsupported"
-    }), { close };
+    }), confirmStopped(), { close };
   if (process.platform === "darwin")
     try {
       let developerDirectory = execFileSync("/usr/bin/xcode-select", ["-p"], {
@@ -10070,17 +10441,23 @@ function startDesktopCollector(options) {
         type: "status",
         state: "unavailable",
         reason: "macos_swift_tools_unavailable"
-      }), { close };
+      }), confirmStopped(), { close };
     }
-  return options.onEvent({ type: "status", state: "starting" }), child = (options.spawnProcess ?? spawn6)(command.file, command.args, {
-    windowsHide: !0,
-    detached: process.platform !== "win32",
-    stdio: ["pipe", "pipe", "pipe"],
-    env: {
-      ...process.env,
-      ABOT_OBSERVATION_EXCLUSIONS: JSON.stringify(options.excludedApplications)
-    }
-  }), child.stdin?.on("error", () => {
+  options.onEvent({ type: "status", state: "starting" });
+  try {
+    child = (options.spawnProcess ?? spawn6)(command.file, command.args, {
+      windowsHide: !0,
+      detached: process.platform !== "win32",
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        ABOT_OBSERVATION_EXCLUSIONS: JSON.stringify(options.excludedApplications)
+      }
+    });
+  } catch {
+    return options.onEvent({ type: "status", state: "failed", reason: "collector_start_failed" }), closed = !0, confirmStopped(), { close };
+  }
+  return child.stdin?.on("error", () => {
   }), child.stdin?.end(command.input), child.stderr?.resume(), child.stdout?.on("data", (chunk) => {
     if (closed) return;
     if (received = Buffer.concat([received, chunk]), received.length > OBSERVATION_WIRE_LIMIT * 2) {
@@ -10109,17 +10486,26 @@ function startDesktopCollector(options) {
       received = received.subarray(boundary + 1), boundary = received.indexOf(10);
     }
   }), child.once("error", () => {
-    closed || (options.onEvent({
-      type: "status",
-      state: "unavailable",
-      reason: "collector_dependency_unavailable"
-    }), close());
+    try {
+      if (closed) return;
+      options.onEvent({
+        type: "status",
+        state: "unavailable",
+        reason: "collector_dependency_unavailable"
+      }), close();
+    } finally {
+      child?.pid || confirmStopped();
+    }
   }), child.once("exit", (code) => {
-    closed || (terminalStatus || options.onEvent({
-      type: "status",
-      state: "unavailable",
-      reason: code === 0 ? "collector_stopped" : "collector_start_failed"
-    }), close());
+    try {
+      !closed && !terminalStatus && options.onEvent({
+        type: "status",
+        state: "unavailable",
+        reason: code === 0 ? "collector_stopped" : "collector_start_failed"
+      });
+    } finally {
+      closed = !0, confirmStopped();
+    }
   }), { close };
 }
 
@@ -10298,7 +10684,7 @@ async function connectNativeHost(options) {
   options.signal.aborted && (await ownedNotifications?.close(), options.signal.throwIfAborted());
   let commandOutput = options.commandOutputStateDir && !options.handlers ? new CompanionCommandOutput(options.commandOutputStateDir) : void 0, handlers = options.handlers ?? {
     ...commandOutput?.handlers(),
-    ...createSystemHandlers(),
+    ...createSystemHandlers(void 0, void 0, void 0, systemResultProtection),
     ...computers.handlers(),
     ...notifications.handlers(),
     ...createNativePermissionHandlers(options.identity.os)
@@ -10393,7 +10779,7 @@ async function connectNativeHost(options) {
         assertNativeOperationTarget(message, options.identity.os);
       } catch (error) {
         if (!(error instanceof NativeOperationInputError)) throw error;
-        sendResult(message.id, operationFailure(error.message, error.code));
+        sendResult(message.id, operationFailure(redactSecretText(error.message), error.code));
         return;
       }
       let handler = handlers[message.operation];
@@ -10447,6 +10833,7 @@ async function connectNativeHost(options) {
         version: 1,
         identity: options.identity,
         capabilities: [
+          ...options.handlers ? [] : [HOST_SECRET_PROTECTION_CAPABILITY],
           OBSERVATION_CAPABILITY,
           COMPUTER_CAPABILITY,
           ...commandOutput ? [SYSTEM_OUTPUT_CAPABILITY] : [],
@@ -10793,8 +11180,23 @@ async function installLockDirectory(lockPath, token, ownerIdentity) {
   }
 }
 
+// src/runtime/adapters/long-term-memory/file-lock/path-observation.ts
+import { lstat as lstat5 } from "node:fs/promises";
+async function observeLockReadFailure(path, error) {
+  if (!isWindowsLockReadDenial(error)) return error;
+  try {
+    await lstat5(path);
+  } catch (observedError) {
+    if (fileSystemErrorCode(observedError) === "ENOENT") return observedError;
+  }
+  return error;
+}
+function isWindowsLockReadDenial(error) {
+  return process.platform !== "win32" ? !1 : fileSystemErrorCode(error) === "EPERM";
+}
+
 // src/runtime/adapters/long-term-memory/file-lock/snapshot.ts
-import { lstat as lstat5, readdir as readdir3 } from "node:fs/promises";
+import { lstat as lstat6, readdir as readdir3 } from "node:fs/promises";
 import { join as join17 } from "node:path";
 
 // src/runtime/adapters/long-term-memory/file-lock/owner-record.ts
@@ -10804,10 +11206,13 @@ import { join as join16 } from "node:path";
 async function readOwnerRecord(lockPath, entryName, expectedToken, directoryModifiedAtMs) {
   let handle;
   try {
+    let ownerPath = join16(lockPath, LEASE_DIRECTORY_NAME, entryName);
     handle = await open4(
-      join16(lockPath, LEASE_DIRECTORY_NAME, entryName),
+      ownerPath,
       constants3.O_RDONLY | constants3.O_NOFOLLOW
-    );
+    ).catch(async (error) => {
+      throw await observeLockReadFailure(ownerPath, error);
+    });
     let before = await handle.stat({ bigint: !0 }), modifiedAtMs = Math.max(
       directoryModifiedAtMs,
       Number(before.mtimeMs)
@@ -10904,8 +11309,8 @@ async function readLockSnapshot(lockPath) {
   let lockEntries;
   try {
     lockEntries = await readdir3(lockPath, { withFileTypes: !0 });
-  } catch (error) {
-    let code = fileSystemErrorCode(error);
+  } catch (readError) {
+    let error = await observeLockReadFailure(lockPath, readError), code = fileSystemErrorCode(error);
     if (code === "ENOENT") return;
     if (code === "ENOTDIR")
       return Object.freeze({ kind: "legacy_file" });
@@ -10923,8 +11328,9 @@ async function readLockSnapshot(lockPath) {
 }
 async function readLockInfo(lockPath) {
   try {
-    return await lstat5(lockPath);
-  } catch (error) {
+    return await lstat6(lockPath);
+  } catch (readError) {
+    let error = await observeLockReadFailure(lockPath, readError);
     if (fileSystemErrorCode(error) === "ENOENT") return;
     throw error;
   }
@@ -10932,10 +11338,11 @@ async function readLockInfo(lockPath) {
 async function readLeaseSnapshot(lockPath, lockModifiedAtMs) {
   let leasePath = join17(lockPath, LEASE_DIRECTORY_NAME), leaseInfo, leaseEntries;
   try {
-    if (leaseInfo = await lstat5(leasePath), !leaseInfo.isDirectory())
+    if (leaseInfo = await lstat6(leasePath), !leaseInfo.isDirectory())
       return invalidLeaseSnapshot(lockModifiedAtMs);
     leaseEntries = await readdir3(leasePath, { withFileTypes: !0 });
-  } catch (error) {
+  } catch (readError) {
+    let error = await observeLockReadFailure(leasePath, readError);
     if (fileSystemErrorCode(error) === "ENOENT")
       return invalidLeaseSnapshot(lockModifiedAtMs);
     throw error;
@@ -11009,7 +11416,7 @@ async function acquireFileLock(lockPath, options) {
       return await installLockDirectory(lockPath, token, options.ownerIdentity), createRelease(lockPath, token, options.releaseMode);
     } catch (error) {
       if (!isLockContention(error)) throw error;
-      if (await removeAbandonedLock(lockPath, processIsAlive)) continue;
+      if (await removeAbandonedLock(lockPath, processIsAlive, deadline, retryDelayMs)) continue;
       if (Date.now() >= deadline)
         throw new Error("long_term_memory_store_lock_timeout");
       await delay3(Math.min(retryDelayMs, Math.max(deadline - Date.now(), 0)));
@@ -11031,10 +11438,19 @@ function createRelease(lockPath, token, releaseMode) {
 function requiresSynchronousRelease(mode) {
   return mode === "synchronous";
 }
-async function removeAbandonedLock(lockPath, processIsAlive) {
-  let snapshot = await readLockSnapshot(lockPath);
+async function removeAbandonedLock(lockPath, processIsAlive, deadline, retryDelayMs) {
+  let snapshot = await readContendedSnapshot(lockPath, deadline, retryDelayMs);
   return snapshot ? snapshot.kind === "legacy_file" || !snapshot.reclaimable || await hasLiveObservedOwner(snapshot, processIsAlive) ? !1 : snapshot.record && snapshot.ownerFileName ? removeObservedOwner(lockPath, snapshot.ownerFileName) : Date.now() - snapshot.modifiedAtMs < 3e4 ? !1 : snapshot.ownerFileName ? removeObservedOwner(lockPath, snapshot.ownerFileName) : removeEmptyLockTree(lockPath, snapshot.hasLeaseDirectory) : !0;
 }
+async function readContendedSnapshot(lockPath, deadline, retryDelayMs) {
+  for (; ; )
+    try {
+      return await readLockSnapshot(lockPath);
+    } catch (error) {
+      if (!isWindowsLockReadDenial(error) || Date.now() >= deadline) throw error;
+      await delay3(Math.min(retryDelayMs, Math.max(deadline - Date.now(), 0)));
+    }
+}
 async function hasLiveObservedOwner(snapshot, processIsAlive) {
   return snapshot.ownerPid === void 0 ? !1 : processIsAlive(snapshot.ownerPid, snapshot.record?.ownerIdentity);
 }
@@ -11054,13 +11470,14 @@ function delay3(milliseconds) {
 }
 
 // src/runtime/local-host/private-directory.ts
-import { lstat as lstat6, mkdir as mkdir5, mkdtemp, rename as rename5, rmdir as rmdir2 } from "node:fs/promises";
+import { lstat as lstat7, mkdir as mkdir5, mkdtemp, rename as rename5, rmdir as rmdir2 } from "node:fs/promises";
 import { basename as basename4, dirname as dirname4, join as join19 } from "node:path";
 
 // src/runtime/local-host/windows-private-access.ts
 import { execFile as execFile5 } from "node:child_process";
 import { promisify as promisify5 } from "node:util";
 var execute = promisify5(execFile5), privateAccessScript = `
+$env:PSModulePath = "$PSHOME\\Modules"
 $ErrorActionPreference = 'Stop'
 $target = $env:ABOT_LOCAL_HOST_PRIVATE_PATH
 $current = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
@@ -11113,7 +11530,7 @@ async function verifyWindowsPrivateAccess(path, newlyCreatedDirectory = !1) {
 }
 
 // src/runtime/local-host/private-access.ts
-async function assertPrivateRuntimeAccess(path, stat4, errorCode2, newlyCreatedDirectory = !1) {
+async function assertPrivateRuntimeAccess(path, stat3, errorCode2, newlyCreatedDirectory = !1) {
   if (process.platform === "win32")
     try {
       await verifyWindowsPrivateAccess(path, newlyCreatedDirectory);
@@ -11121,19 +11538,19 @@ async function assertPrivateRuntimeAccess(path, stat4, errorCode2, newlyCreatedD
     } catch {
       throw new Error(errorCode2);
     }
-  if ((stat4.mode & 63) !== 0) throw new Error(errorCode2);
-  if (process.getuid?.() !== stat4.uid) throw new Error(errorCode2);
+  if ((stat3.mode & 63) !== 0) throw new Error(errorCode2);
+  if (process.getuid?.() !== stat3.uid) throw new Error(errorCode2);
 }
 
 // src/runtime/local-host/private-directory.ts
 async function ensurePrivateRuntimeDirectory(directory) {
   process.platform === "win32" ? await installWindowsPrivateDirectory(directory) : await mkdir5(directory, { recursive: !0, mode: 448 });
-  let stat4 = await lstat6(directory);
-  if (!stat4.isDirectory() || stat4.isSymbolicLink())
+  let stat3 = await lstat7(directory);
+  if (!stat3.isDirectory() || stat3.isSymbolicLink())
     throw new Error("local_runtime_directory_not_private");
   await assertPrivateRuntimeAccess(
     directory,
-    stat4,
+    stat3,
     "local_runtime_directory_not_private"
   );
 }
@@ -11161,7 +11578,7 @@ async function installWindowsPrivateDirectory(directory) {
 }
 async function hasExistingPath(path) {
   try {
-    return await lstat6(path), !0;
+    return await lstat7(path), !0;
   } catch (error) {
     if (isMissingPath(error)) return !1;
     throw error;
@@ -11177,12 +11594,12 @@ import { join as join25 } from "node:path";
 // src/computer-access/companion/autostart.ts
 import { execFile as execFile6 } from "node:child_process";
 import {
-  lstat as lstat7,
+  lstat as lstat8,
   mkdir as mkdir6,
   readFile as readFile10,
   rename as rename6,
   unlink as unlink5,
-  writeFile as writeFile6
+  writeFile as writeFile7
 } from "node:fs/promises";
 import { dirname as dirname5, join as join20, posix } from "node:path";
 import { promisify as promisify6 } from "node:util";
@@ -11279,12 +11696,12 @@ function errorCode(error) {
   return error && typeof error == "object" && "code" in error ? error.code : void 0;
 }
 async function existingOwnedRegistration(path) {
-  let stat4 = await lstat7(path).catch((error) => {
+  let stat3 = await lstat8(path).catch((error) => {
     if (errorCode(error) !== "ENOENT")
       throw error;
   });
-  if (!stat4) return !1;
-  if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.size > 16384)
+  if (!stat3) return !1;
+  if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.size > 16384)
     throw new Error(
       "Refusing to change an unexpected host startup registration."
     );
@@ -11321,7 +11738,7 @@ async function installNativeAutostart(options) {
   await existingOwnedRegistration(path) && options.platform === "darwin" && await unloadMacRegistration(options), await mkdir6(dirname5(path), { recursive: !0 });
   let temporary = `${path}.${randomUUID10()}.tmp`;
   try {
-    await writeFile6(temporary, renderNativeAutostart(options), {
+    await writeFile7(temporary, renderNativeAutostart(options), {
       encoding: "utf8",
       mode: 384,
       flag: "wx"
@@ -11344,7 +11761,7 @@ async function uninstallNativeAutostart(options) {
 
 // src/computer-access/companion/install-link-registration.ts
 import { execFile as execFile8 } from "node:child_process";
-import { lstat as lstat8, mkdir as mkdir7, readFile as readFile11, rm as rm4, writeFile as writeFile7 } from "node:fs/promises";
+import { lstat as lstat9, mkdir as mkdir7, readFile as readFile11, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
 import { dirname as dirname6, join as join22, posix as posix2 } from "node:path";
 import { promisify as promisify8 } from "node:util";
 
@@ -11419,7 +11836,8 @@ function renderMacInstallLinkHandler(options) {
   let literal = (value) => JSON.stringify(value);
   return `ObjC.import('Foundation');
 function openDocuments() {}
-function openLocation(url) {
+// JXA dispatches the macOS Get URL (GURL/GURL) AppleEvent to this exact name.
+function GURLGURL(url) {
   var task = $.NSTask.alloc.init;
   task.launchPath = ${literal(options.nodePath)};
   task.arguments = [${literal(options.cliPath)}, 'host', 'open-link', String(url)];
@@ -11490,12 +11908,12 @@ async function run(options, file, args) {
   });
 }
 async function existingOwnedDirectory(path) {
-  let stat4 = await lstat8(path).catch((error) => {
+  let stat3 = await lstat9(path).catch((error) => {
     if (error.code !== "ENOENT")
       throw error;
   });
-  if (!stat4) return !1;
-  if (!stat4.isDirectory() || stat4.isSymbolicLink())
+  if (!stat3) return !1;
+  if (!stat3.isDirectory() || stat3.isSymbolicLink())
     throw new Error("Installation-link directory is not owned.");
   if (await readFile11(join22(path, ".owner"), "utf8") !== OWNER)
     throw new Error("Installation-link directory is not owned.");
@@ -11515,11 +11933,11 @@ function linuxDesktopPath(options) {
   );
 }
 async function requireOwnedLinuxRegistration(path) {
-  let stat4 = await lstat8(path).catch((error) => {
+  let stat3 = await lstat9(path).catch((error) => {
     if (error.code !== "ENOENT")
       throw error;
   });
-  if (stat4 && (!stat4.isFile() || stat4.isSymbolicLink() || !(await readFile11(path, "utf8")).includes("# " + OWNER)))
+  if (stat3 && (!stat3.isFile() || stat3.isSymbolicLink() || !(await readFile11(path, "utf8")).includes("# " + OWNER)))
     throw new Error("Installation-link desktop registration is not owned.");
 }
 function isAvailableLinuxInstallScheme(handler) {
@@ -11536,12 +11954,12 @@ async function requireAvailableLinuxInstallScheme() {
 }
 async function installCompanionInstallLinks(options) {
   let directory = registrationDirectory(options);
-  if (await existingOwnedDirectory(directory) || (await ensurePrivateRuntimeDirectory(directory), await writeFile7(join22(directory, ".owner"), OWNER, {
+  if (await existingOwnedDirectory(directory) || (await ensurePrivateRuntimeDirectory(directory), await writeFile8(join22(directory, ".owner"), OWNER, {
     flag: "wx",
     mode: 384
   })), options.platform === "win32") {
     let launcher = windowsInstallLinkLauncherPath(options);
-    await writeFile7(launcher, renderWindowsInstallLinkLauncher(options), {
+    await writeFile8(launcher, renderWindowsInstallLinkLauncher(options), {
       mode: 384
     }), await run(options, "powershell.exe", [
       "-NoProfile",
@@ -11556,7 +11974,7 @@ async function installCompanionInstallLinks(options) {
   }
   if (options.platform === "linux") {
     let desktop = linuxDesktopPath(options);
-    await requireOwnedLinuxRegistration(desktop), await requireAvailableLinuxInstallScheme(), await mkdir7(dirname6(desktop), { recursive: !0, mode: 448 }), await writeFile7(desktop, renderLinuxInstallLinkDesktop(options), {
+    await requireOwnedLinuxRegistration(desktop), await requireAvailableLinuxInstallScheme(), await mkdir7(dirname6(desktop), { recursive: !0, mode: 448 }), await writeFile8(desktop, renderLinuxInstallLinkDesktop(options), {
       mode: 384
     }), await run(options, "xdg-mime", [
       "default",
@@ -11568,9 +11986,9 @@ async function installCompanionInstallLinks(options) {
   if (options.platform === "darwin") {
     await requireAvailableMacInstallScheme();
     let source = join22(directory, "handler.js"), app = join22(directory, "ABot Install.app");
-    await writeFile7(source, renderMacInstallLinkHandler(options), {
+    await writeFile8(source, renderMacInstallLinkHandler(options), {
       mode: 384
-    }), await rm4(app, { recursive: !0, force: !0 }), await run(options, "/usr/bin/osacompile", [
+    }), await rm5(app, { recursive: !0, force: !0 }), await run(options, "/usr/bin/osacompile", [
       "-l",
       "JavaScript",
       "-o",
@@ -11614,13 +12032,13 @@ async function uninstallCompanionInstallLinks(options) {
       ).toString("base64")
     ]), options.platform === "linux") {
       let desktop = linuxDesktopPath(options);
-      await requireOwnedLinuxRegistration(desktop), await rm4(desktop, { force: !0 });
+      await requireOwnedLinuxRegistration(desktop), await rm5(desktop, { force: !0 });
     }
     options.platform === "darwin" && await run(
       options,
       "/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister",
       ["-u", join22(directory, "ABot Install.app")]
-    ), await rm4(directory, { recursive: !0 });
+    ), await rm5(directory, { recursive: !0 });
   }
 }
 
@@ -11738,7 +12156,7 @@ async function stopOwnedNativeCompanion(stateDir, overrides = {}) {
 import { execFile as execFile10 } from "node:child_process";
 import { createHash as createHash5, randomUUID as randomUUID11 } from "node:crypto";
 import { constants as constants4 } from "node:fs";
-import { lstat as lstat9, open as open5, rename as rename7, unlink as unlink6 } from "node:fs/promises";
+import { lstat as lstat10, open as open5, rename as rename7, unlink as unlink6 } from "node:fs/promises";
 import { join as join24 } from "node:path";
 import { promisify as promisify10 } from "node:util";
 var executeFile8 = promisify10(execFile10), NATIVE_RUNTIME_INSTALLATION_FAILURE = "The Mac companion runtime could not be prepared safely. The saved pairing was not changed. Check the local Node.js installation and run setup again.";
@@ -11751,14 +12169,14 @@ function isAbsentRuntimePath(error) {
 function hasSameRuntimeIdentity(left, right) {
   return left.dev !== right.dev || left.ino !== right.ino || left.size !== right.size || left.mtimeMs !== right.mtimeMs ? !1 : left.ctimeMs === right.ctimeMs;
 }
-function hasTrustedRuntimeSource(stat4) {
-  return !stat4.isFile() || stat4.isSymbolicLink() || (stat4.mode & 73) === 0 || (stat4.mode & 18) !== 0 ? !1 : stat4.uid === 0 ? !0 : stat4.uid === process.getuid?.();
+function hasTrustedRuntimeSource(stat3) {
+  return !stat3.isFile() || stat3.isSymbolicLink() || (stat3.mode & 73) === 0 || (stat3.mode & 18) !== 0 ? !1 : stat3.uid === 0 ? !0 : stat3.uid === process.getuid?.();
 }
-async function requireManagedRuntimeFile(path, stat4) {
-  if (!stat4.isFile() || stat4.isSymbolicLink() || stat4.nlink !== 1 || (stat4.mode & 511) !== 320) throw runtimeInstallationFailure();
+async function requireManagedRuntimeFile(path, stat3) {
+  if (!stat3.isFile() || stat3.isSymbolicLink() || stat3.nlink !== 1 || (stat3.mode & 511) !== 320) throw runtimeInstallationFailure();
   await assertPrivateRuntimeAccess(
     path,
-    stat4,
+    stat3,
     NATIVE_RUNTIME_INSTALLATION_FAILURE
   );
 }
@@ -11772,21 +12190,21 @@ async function streamRuntimeDigest(handle) {
   return hash.digest("hex");
 }
 async function readRuntimeFile(path, managed) {
-  let stat4 = await lstat9(path).catch((error) => {
+  let stat3 = await lstat10(path).catch((error) => {
     if (!isAbsentRuntimePath(error))
       throw error;
   });
-  if (!stat4) return;
-  if (managed && await requireManagedRuntimeFile(path, stat4), !managed && !hasTrustedRuntimeSource(stat4))
+  if (!stat3) return;
+  if (managed && await requireManagedRuntimeFile(path, stat3), !managed && !hasTrustedRuntimeSource(stat3))
     throw runtimeInstallationFailure();
   let handle = await open5(path, constants4.O_RDONLY | constants4.O_NOFOLLOW);
   try {
-    if (!hasSameRuntimeIdentity(stat4, await handle.stat()))
+    if (!hasSameRuntimeIdentity(stat3, await handle.stat()))
       throw runtimeInstallationFailure();
     let digest = await streamRuntimeDigest(handle);
-    if (!hasSameRuntimeIdentity(stat4, await handle.stat()) || !hasSameRuntimeIdentity(stat4, await lstat9(path)))
+    if (!hasSameRuntimeIdentity(stat3, await handle.stat()) || !hasSameRuntimeIdentity(stat3, await lstat10(path)))
       throw runtimeInstallationFailure();
-    return { stat: stat4, digest };
+    return { stat: stat3, digest };
   } finally {
     await handle.close();
   }
@@ -11844,14 +12262,14 @@ async function requireUnchangedRuntimeTarget(path, expected) {
 }
 async function requireUnchangedRuntimeDirectory(path, expected) {
   await ensurePrivateRuntimeDirectory(path);
-  let current = await lstat9(path);
+  let current = await lstat10(path);
   if (expected.dev !== current.dev || expected.ino !== current.ino) throw runtimeInstallationFailure();
 }
 async function installManagedRuntime(startup, dependencies) {
   await ensurePrivateRuntimeDirectory(startup.stateDir);
-  let stateIdentity = await lstat9(startup.stateDir), directory = join24(startup.stateDir, "runtime");
+  let stateIdentity = await lstat10(startup.stateDir), directory = join24(startup.stateDir, "runtime");
   await ensurePrivateRuntimeDirectory(directory);
-  let directoryIdentity = await lstat9(directory), target = join24(directory, "node"), source = await readRuntimeFile(startup.nodePath, !1);
+  let directoryIdentity = await lstat10(directory), target = join24(directory, "node"), source = await readRuntimeFile(startup.nodePath, !1);
   if (!source) throw runtimeInstallationFailure();
   let existing = await readRuntimeFile(target, !0), expectedVersion = await runtimeVersion(startup.nodePath, dependencies);
   if (existing?.digest === source.digest)
@@ -12042,9 +12460,9 @@ function printHostHelp() {
 function createHostCompanionState() {
   return createNativeHostState(join26(homedir4(), ".abot", "host-companion"), {
     ensureDirectory: ensurePrivateRuntimeDirectory,
-    assertFile: (path, stat4) => assertPrivateRuntimeAccess(
+    assertFile: (path, stat3) => assertPrivateRuntimeAccess(
       path,
-      stat4,
+      stat3,
       "host_companion_state_not_private"
     )
   });