@abot-ai/runtime 1.7.0 → 1.8.1

package/dist/src/computer-access/collection-consent.d.ts

@@ -0,0 +1,9 @@
+export type CollectionConsent = Readonly<{
+    accepted: boolean;
+    acceptedAt?: string;
+}>;
+/** Installation data, shared across environments and independent of app versions or pairing. */
+export declare function readCollectionConsent(rootDir: string): CollectionConsent;
+/** Acknowledgment records awareness only; it does not change activity permissions or start collection. */
+export declare function acceptCollectionConsent(rootDir: string): Promise<CollectionConsent>;
+export declare function requireCollectionConsent(rootDir: string): void;

package/dist/src/computer-access/collection-consent.js

@@ -0,0 +1,47 @@
+import { join } from "node:path";
+import { ensurePrivateRuntimeDirectory } from "../runtime/local-host/private-directory.js";
+import { hostStateDirectory, readHostPrivateJson, writeHostPrivateJson, } from "./companion/private-store.js";
+function isSavedCollectionConsent(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    if (record.version !== 1)
+        return false;
+    if (typeof record.acceptedAt !== "string")
+        return false;
+    return Number.isFinite(Date.parse(record.acceptedAt));
+}
+function collectionConsentPath(rootDir) {
+    return join(hostStateDirectory(rootDir), "collection-consent.json");
+}
+/** Installation data, shared across environments and independent of app versions or pairing. */
+export function readCollectionConsent(rootDir) {
+    let record;
+    try {
+        record = readHostPrivateJson(collectionConsentPath(rootDir));
+    }
+    catch (error) {
+        // A malformed record never authorizes collection. Filesystem safety errors remain visible.
+        if (error instanceof SyntaxError)
+            return { accepted: false };
+        throw error;
+    }
+    if (!isSavedCollectionConsent(record))
+        return { accepted: false };
+    return { accepted: true, acceptedAt: record.acceptedAt };
+}
+/** Acknowledgment records awareness only; it does not change activity permissions or start collection. */
+export async function acceptCollectionConsent(rootDir) {
+    await ensurePrivateRuntimeDirectory(hostStateDirectory(rootDir));
+    const existing = readCollectionConsent(rootDir);
+    if (existing.accepted)
+        return existing;
+    const acceptedAt = new Date().toISOString();
+    writeHostPrivateJson(collectionConsentPath(rootDir), { version: 1, acceptedAt });
+    return { accepted: true, acceptedAt };
+}
+export function requireCollectionConsent(rootDir) {
+    if (readCollectionConsent(rootDir).accepted)
+        return;
+    throw new Error("collection_consent_required");
+}

package/dist/src/computer-access/command-output-capture.d.ts

@@ -10,8 +10,12 @@ export type SystemOutputReceipt = Readonly<{
     stdoutSha256?: string;
     stderrSha256?: string;
 }>;
-/** One synchronous command capture; no resumable-process or cursor state. */
-export declare function createSystemOutputCapture(root: string, retentionMs: number): Promise<{
+type OutputStreams = {
+    stdout: string;
+    stderr: string;
+};
+/** Private backpressured capture. No read is admitted before complete checks. */
+export declare function createSystemOutputCapture(root: string, retentionMs: number, redact: (text: string) => string): Promise<{
     capture: Readonly<{
         attach(stdout: Readable, stderr: Readable, onFailure: () => void): void;
         end(): void;
@@ -27,11 +31,18 @@ export declare function createSystemOutputCapture(root: string, retentionMs: num
         stderrSha256?: string;
     }> | undefined;
     readonly failure: string | undefined;
+    readonly failureKind: "storage" | "security" | undefined;
+    readonly processResult: Readonly<{
+        exitCode: number | null;
+        stdout: string;
+        stderr: string;
+        status: "completed" | "timeout" | "aborted" | "spawn_failed" | "output_failed";
+        outputTruncated: boolean;
+        spawnedProcess?: import("./contracts.js").SystemSpawnObservation;
+    }> | undefined;
     retain(): void;
     release(): void;
     read(stream: "stdout" | "stderr", offset: number, length: number): Promise<Buffer>;
-    finish(result?: SystemProcessResult, materialize?: boolean): Promise<{
-        stdout: string;
-        stderr: string;
-    }>;
+    finish(result?: SystemProcessResult, materialize?: boolean): Promise<OutputStreams>;
 }>;
+export {};

package/dist/src/computer-access/command-output-capture.js

@@ -1,14 +1,18 @@
 import { createHash, randomUUID } from "node:crypto";
 import { once } from "node:events";
 import { createWriteStream } from "node:fs";
-import { mkdir, open, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { mkdir, open, rename, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { finished } from "node:stream/promises";
 import { SystemOperationError } from "./contracts.js";
+import { CapturedOutputProtectionError, discardCapturedOutput, protectCapturedOutput } from "./command-output-protection.js";
 import { activeSystemCaptures, scheduleSystemOutputCleanup } from "./command-output-retention.js";
+const STREAMS = ["stdout", "stderr"];
 const OUTPUT_IO_CHUNK_BYTES = 64 * 1024;
-/** One synchronous command capture; no resumable-process or cursor state. */
-export async function createSystemOutputCapture(root, retentionMs) {
+/** Private backpressured capture. No read is admitted before complete checks. */
+export async function createSystemOutputCapture(root, retentionMs, redact) {
+    if (!hasOutputProtection(redact))
+        throw new SystemOperationError("system_output_protection_failed", "Command output protection is unavailable. The command was not dispatched.");
     const id = randomUUID();
     const directory = join(root, id);
     activeSystemCaptures.add(directory);
@@ -19,19 +23,19 @@ export async function createSystemOutputCapture(root, retentionMs) {
         activeSystemCaptures.delete(directory);
         throw new SystemOperationError("system_output_storage_failed", "Output storage could not be prepared. The command was not dispatched.");
     }
-    let failure;
+    let storageFailure, securityFailure;
     let stop;
-    let ended = false;
-    let retained = false;
+    let ended = false, retained = false, admitted = false;
+    let receipt;
+    let processResult;
+    let finishing;
     const sources = [];
-    const streams = ["stdout", "stderr"].map((name) => {
-        const path = join(directory, name + ".bytes");
-        const sink = createWriteStream(path, { flags: "wx", mode: 0o600, highWaterMark: OUTPUT_IO_CHUNK_BYTES, flush: true });
-        const completion = finished(sink).catch(() => {
-            failure ??= "write_failed";
-            stop?.();
-        });
-        return { name, path, sink, completion, hash: createHash("sha256") };
+    const completeStreams = new Set();
+    const paths = { stdout: join(directory, "stdout.bytes"), stderr: join(directory, "stderr.bytes") };
+    const streams = STREAMS.map((name) => {
+        const sink = createWriteStream(paths[name], { flags: "wx", mode: 0o600, highWaterMark: OUTPUT_IO_CHUNK_BYTES, flush: true });
+        const completion = finished(sink).catch(() => { storageFailure ??= "write_failed"; stop?.(); });
+        return { sink, completion };
     });
     try {
         await Promise.all(streams.map(({ sink }) => once(sink, "open")));
@@ -45,21 +49,30 @@ export async function createSystemOutputCapture(root, retentionMs) {
         throw new SystemOperationError("system_output_storage_failed", "Output files could not be opened. The command was not dispatched.");
     }
     scheduleSystemOutputCleanup(root, retentionMs);
+    const failure = () => storageFailure ?? securityFailure;
     const capture = {
         attach(stdout, stderr, onFailure) {
+            if (!canAttachCapture()) {
+                securityFailure ??= "output_protection_failed";
+                onFailure();
+                return;
+            }
             stop = onFailure;
             sources.push(stdout, stderr);
-            stdout.on("data", (bytes) => streams[0].hash.update(bytes));
-            stderr.on("data", (bytes) => streams[1].hash.update(bytes));
-            stdout.pipe(streams[0].sink);
-            stderr.pipe(streams[1].sink);
-            if (failure)
+            for (const [index, source] of sources.entries()) {
+                source.once("end", () => completeStreams.add(STREAMS[index]));
+                source.once("error", () => { securityFailure ??= "output_incomplete"; stop?.(); });
+                source.pipe(streams[index].sink);
+            }
+            if (failure())
                 onFailure();
         },
         end() {
             if (ended)
                 return;
             ended = true;
+            if (!hasCompleteStreams())
+                securityFailure ??= "output_incomplete";
             for (const source of sources) {
                 source.unpipe();
                 source.destroy();
@@ -69,68 +82,121 @@ export async function createSystemOutputCapture(root, retentionMs) {
                     sink.end();
         },
     };
-    let receipt;
+    function canAttachCapture() { return sources.length === 0 && !ended; }
+    function hasCompleteStreams() { return completeStreams.size === 2; }
+    function protectProcess(result) {
+        if (!result)
+            return;
+        let spawnedProcess = result.spawnedProcess;
+        if (spawnedProcess) {
+            let executable = "[REDACTED]";
+            try {
+                executable = redact(spawnedProcess.executable);
+                if (!hasProtectedIdentity(executable))
+                    throw new Error("output_protection_failed");
+            }
+            catch {
+                securityFailure ??= "output_protection_failed";
+                executable = "[REDACTED]";
+            }
+            spawnedProcess = { ...spawnedProcess, executable };
+        }
+        processResult = { exitCode: result.exitCode, status: result.status, outputTruncated: result.outputTruncated,
+            stdout: "", stderr: "", ...(spawnedProcess ? { spawnedProcess } : {}) };
+    }
+    async function finish(result, materialize = true) {
+        capture.end();
+        await Promise.all(streams.map(({ completion }) => completion));
+        protectProcess(result);
+        let protectedBytes;
+        try {
+            if (!failure()) {
+                try {
+                    protectedBytes = await protectCapturedOutput(paths, redact);
+                }
+                catch (error) {
+                    if (isOutputStorageFailure(error))
+                        storageFailure ??= "write_failed";
+                    else
+                        securityFailure ??= "output_protection_failed";
+                }
+            }
+            if (failure() && !await discardCapturedOutput(paths))
+                storageFailure = "capture_purge_failed";
+            receipt = { id, stdoutBytes: protectedBytes?.stdout.length ?? 0, stderrBytes: protectedBytes?.stderr.length ?? 0,
+                completedAt: new Date().toISOString(), retentionMs, complete: !failure(), ...(!materialize && protectedBytes ? {
+                    stdoutSha256: createHash("sha256").update(protectedBytes.stdout).digest("hex"),
+                    stderrSha256: createHash("sha256").update(protectedBytes.stderr).digest("hex"),
+                } : {}) };
+            try {
+                const temporary = join(directory, "receipt.tmp");
+                await writeFile(temporary, JSON.stringify({ kind: "system_command_output_v1", ...receipt,
+                    processStatus: processResult?.status, exitCode: processResult?.exitCode, spawnedProcess: processResult?.spawnedProcess,
+                    ...(securityFailure ? { securityFailure } : {}), ...(storageFailure ? { storageFailure } : {}) }), { flag: "wx", mode: 0o600, flush: true });
+                await rename(temporary, join(directory, "receipt.json"));
+            }
+            catch {
+                storageFailure ??= "receipt_write_failed";
+                receipt = { ...receipt, complete: false };
+            }
+            admitted = receipt.complete;
+            if (!admitted || !materialize || !protectedBytes)
+                return { stdout: "", stderr: "" };
+            return { stdout: protectedBytes.stdout.toString("utf8"), stderr: protectedBytes.stderr.toString("utf8") };
+        }
+        finally {
+            protectedBytes?.stdout.fill(0);
+            protectedBytes?.stderr.fill(0);
+            if (!retained)
+                activeSystemCaptures.delete(directory);
+        }
+    }
     return {
         capture,
         get receipt() { return receipt; },
-        get failure() { return failure; },
+        get failure() { return failure(); },
+        get failureKind() {
+            if (storageFailure)
+                return "storage";
+            return securityFailure ? "security" : undefined;
+        },
+        get processResult() { return processResult; },
         retain() { retained = true; activeSystemCaptures.add(directory); },
         release() { retained = false; activeSystemCaptures.delete(directory); },
         async read(stream, offset, length) {
-            const path = streams.find((entry) => entry.name === stream).path;
-            const file = await open(path, "r");
+            if (!admitted)
+                throw new Error("system_output_unavailable");
+            if (!isAdmittedOutputRead(stream, offset, length, receipt))
+                throw new Error("system_output_reference_invalid");
+            const file = await open(paths[stream], "r");
             try {
-                const bytes = Buffer.alloc(length);
-                const { bytesRead } = await file.read(bytes, 0, length, offset);
+                const size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes;
+                const bytes = Buffer.alloc(Math.min(length, size - offset));
+                const { bytesRead } = await file.read(bytes, 0, bytes.length, offset);
                 return bytes.subarray(0, bytesRead);
             }
             finally {
                 await file.close();
             }
         },
-        async finish(result, materialize = true) {
-            capture.end();
-            try {
-                await Promise.all(streams.map(({ completion }) => completion));
-                const sizes = await Promise.all(streams.map(async ({ path }) => {
-                    try {
-                        return (await stat(path)).size;
-                    }
-                    catch {
-                        failure ??= "read_failed";
-                        return 0;
-                    }
-                }));
-                let stdout = "", stderr = "";
-                if (!failure && materialize) {
-                    try {
-                        [stdout, stderr] = await Promise.all(streams.map(({ path }) => readFile(path, "utf8")));
-                    }
-                    catch {
-                        failure = "read_failed";
-                    }
-                }
-                const completedAt = Date.now();
-                receipt = { id, stdoutBytes: sizes[0], stderrBytes: sizes[1],
-                    completedAt: new Date(completedAt).toISOString(), retentionMs, complete: !failure,
-                    ...(!materialize ? { stdoutSha256: streams[0].hash.digest("hex"), stderrSha256: streams[1].hash.digest("hex") } : {}) };
-                try {
-                    const temporary = join(directory, "receipt.tmp");
-                    await writeFile(temporary, JSON.stringify({ kind: "system_command_output_v1", ...receipt,
-                        processStatus: result?.status, exitCode: result?.exitCode, spawnedProcess: result?.spawnedProcess,
-                        ...(failure ? { storageFailure: failure } : {}) }), { flag: "wx", mode: 0o600, flush: true });
-                    await rename(temporary, join(directory, "receipt.json"));
-                }
-                catch {
-                    failure ??= "receipt_write_failed";
-                    receipt = { ...receipt, complete: false };
-                }
-                return { stdout, stderr };
-            }
-            finally {
-                if (!retained)
-                    activeSystemCaptures.delete(directory);
-            }
+        finish(result, materialize = true) {
+            finishing ??= finish(result, materialize);
+            return finishing;
         },
     };
 }
+function hasOutputProtection(value) { return typeof value === "function"; }
+function hasProtectedIdentity(value) { return typeof value === "string"; }
+function isOutputStorageFailure(error) {
+    return error instanceof CapturedOutputProtectionError && error.reason === "output_storage_failed";
+}
+function isAdmittedOutputRead(stream, offset, length, receipt) {
+    if (stream !== "stdout" && stream !== "stderr")
+        return false;
+    if (!Number.isSafeInteger(offset) || offset < 0)
+        return false;
+    if (!Number.isSafeInteger(length) || length < 0)
+        return false;
+    const size = stream === "stdout" ? receipt.stdoutBytes : receipt.stderrBytes;
+    return offset <= size;
+}

package/dist/src/computer-access/command-output-protection.d.ts

@@ -0,0 +1,17 @@
+export type CapturedOutputPaths = Readonly<{
+    stdout: string;
+    stderr: string;
+}>;
+export type ProtectedOutputBytes = Readonly<{
+    stdout: Buffer;
+    stderr: Buffer;
+}>;
+export type OutputProtectionFailure = "output_protection_failed" | "output_storage_failed";
+export declare class CapturedOutputProtectionError extends Error {
+    readonly reason: OutputProtectionFailure;
+    constructor(reason: OutputProtectionFailure);
+}
+/** Check both complete private streams before replacing either source. */
+export declare function protectCapturedOutput(paths: CapturedOutputPaths, redact: (text: string) => string): Promise<ProtectedOutputBytes>;
+/** A failed check makes the private sources unavailable, including later reads. */
+export declare function discardCapturedOutput(paths: CapturedOutputPaths): Promise<boolean>;

package/dist/src/computer-access/command-output-protection.js

@@ -0,0 +1,59 @@
+import { readFile, rm, writeFile } from "node:fs/promises";
+export class CapturedOutputProtectionError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+/** Check both complete private streams before replacing either source. */
+export async function protectCapturedOutput(paths, redact) {
+    let stdout, stderr;
+    try {
+        stdout = await protectStream(paths.stdout, redact);
+        stderr = await protectStream(paths.stderr, redact);
+        const writes = await Promise.allSettled([
+            writeFile(paths.stdout, stdout, { flag: "w", mode: 0o600, flush: true }),
+            writeFile(paths.stderr, stderr, { flag: "w", mode: 0o600, flush: true }),
+        ]);
+        if (hasRejectedOutputWrite(writes))
+            throw new CapturedOutputProtectionError("output_storage_failed");
+        return { stdout, stderr };
+    }
+    catch (error) {
+        stdout?.fill(0);
+        stderr?.fill(0);
+        throw error;
+    }
+}
+async function protectStream(path, redact) {
+    let bytes;
+    try {
+        bytes = await readFile(path);
+    }
+    catch {
+        throw new CapturedOutputProtectionError("output_storage_failed");
+    }
+    try {
+        const text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
+        const protectedText = redact(text);
+        if (!isProtectedOutputText(protectedText))
+            throw new Error("output_protection_failed");
+        return Buffer.from(protectedText, "utf8");
+    }
+    catch {
+        throw new CapturedOutputProtectionError("output_protection_failed");
+    }
+    finally {
+        bytes.fill(0);
+    }
+}
+/** A failed check makes the private sources unavailable, including later reads. */
+export async function discardCapturedOutput(paths) {
+    const removed = await Promise.allSettled(Object.values(paths).map((path) => rm(path, { force: true })));
+    return removed.every((entry) => entry.status === "fulfilled");
+}
+function isProtectedOutputText(value) { return typeof value === "string"; }
+function hasRejectedOutputWrite(writes) {
+    return writes.some((entry) => entry.status === "rejected");
+}

package/dist/src/computer-access/companion/command-output.d.ts

@@ -9,5 +9,6 @@ export declare class CompanionCommandOutput {
     close(): void;
     handlers(): Record<string, ToolImplementation>;
     private command;
+    private hasRegisteredTransfer;
     private read;
 }

package/dist/src/computer-access/companion/command-output.js

@@ -7,6 +7,8 @@ import { runSystemProcess } from "../process-runner.js";
 import { buildSystemProcessResult } from "../process-result.js";
 import { isHostIdentifier } from "./protocol.js";
 import { SYSTEM_OUTPUT_CAPABILITY, SYSTEM_OUTPUT_CHUNK_BYTES, readSystemOutputTransfer } from "./command-output-protocol.js";
+import { redactSecretText } from "../security/secret-text.js";
+import { systemResultProtection } from "../security/system-results.js";
 /** References belong to this authenticated connection; no arbitrary file access. */
 export class CompanionCommandOutput {
     stateDir;
@@ -55,12 +57,12 @@ export class CompanionCommandOutput {
             run: async (input) => {
                 if (input.abortSignal?.aborted)
                     return runSystemProcess(input);
-                captured = await createSystemOutputCapture(join(this.stateDir, "command-output"), retentionMs);
+                captured = await createSystemOutputCapture(join(this.stateDir, "command-output"), retentionMs, redactSecretText);
                 captured.retain();
                 try {
                     const result = await runSystemProcess(input, captured.capture);
                     await captured.finish(result, false);
-                    return { ...result, outputTruncated: Boolean(captured.failure) };
+                    return { ...captured.processResult, outputTruncated: Boolean(captured.failure) };
                 }
                 catch (error) {
                     await captured.finish(undefined, false);
@@ -75,8 +77,11 @@ export class CompanionCommandOutput {
                 const data = { ...receipt.data, outputCapture: captured.receipt };
                 if (captured.failure) {
                     captured.release();
-                    return failureResult({ errorCode: "system_output_storage_failed", message: "Command output storage failed after dispatch; inspect the process receipt before another action.",
-                        data: { ...data, storageFailure: captured.failure }, ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}) });
+                    const errorCode = captured.failureKind === "security" ? "system_output_protection_failed" : "system_output_storage_failed";
+                    return failureResult({ errorCode, message: "Command output could not be admitted after dispatch; inspect the process receipt before another action. The command was not replayed.",
+                        data: { ...data, ...(captured.failureKind === "security"
+                                ? { securityFailure: captured.failure } : { storageFailure: captured.failure }) },
+                        ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}) });
                 }
                 if (this.closed || context?.abortSignal?.aborted) {
                     captured.release();
@@ -87,9 +92,21 @@ export class CompanionCommandOutput {
                 return { ...receipt, output: receipt.output.split("\nSTDOUT excerpt:")[0] + "\nSTDOUT excerpt:\nStreams retained for exact transfer.",
                     data: { ...data, outputTransfer: transfer } };
             },
-        }));
+        }), systemResultProtection);
         const { outputRetentionMs: _retention, ...command } = params;
-        return handlers.system_command(command, context);
+        try {
+            return await handlers.system_command(command, context);
+        }
+        finally {
+            if (!this.hasRegisteredTransfer(captured))
+                captured?.release();
+        }
+    }
+    hasRegisteredTransfer(capture) {
+        const id = capture?.receipt?.id;
+        if (!id)
+            return false;
+        return this.captures.get(id) === capture;
     }
     async read(params) {
         if (!isHostIdentifier(params.captureId))

package/dist/src/computer-access/companion/install-link-macos.js

@@ -4,7 +4,8 @@ export function renderMacInstallLinkHandler(options) {
     const literal = (value) => JSON.stringify(value);
     return `ObjC.import('Foundation');
 function openDocuments() {}
-function openLocation(url) {
+// JXA dispatches the macOS Get URL (GURL/GURL) AppleEvent to this exact name.
+function GURLGURL(url) {
   var task = $.NSTask.alloc.init;
   task.launchPath = ${literal(options.nodePath)};
   task.arguments = [${literal(options.cliPath)}, 'host', 'open-link', String(url)];

package/dist/src/computer-access/companion/native-notifications.js

@@ -1,4 +1,5 @@
 import { failureResult, successResult, } from "../../plugin-sdk/index.js";
+import { redactSecretText } from "../security/secret-text.js";
 import { readDesktopNotification, } from "./notification-protocol.js";
 import { defaultNotificationLocations, } from "./notification-locations.js";
 import { sendWindowsNotification } from "./notification-windows.js";
@@ -49,7 +50,7 @@ export function createNotificationSession(platform, runtimeUrl, ready, renderer,
                             ? "notification_outcome_unknown"
                             : "notification_native_failed",
                         message: error instanceof Error
-                            ? error.message.slice(0, 1000)
+                            ? redactSecretText(error.message).slice(0, 1000)
                             : "Desktop notification submission failed.",
                     });
                 }
@@ -76,7 +77,7 @@ export async function createNativeNotificationSession(platform, runtimeUrl, loca
             if (platform === "macos" && session.ready)
                 await stopMacNotificationApp(locations, runNotificationProcess).catch((error) => {
                     console.warn("Desktop notification helper could not stop: " +
-                        (error instanceof Error ? error.message : String(error)));
+                        redactSecretText(error instanceof Error ? error.message : String(error)));
                 });
         },
     }, (refreshSignal) => hasDesktopNotificationSupport(platform, locations, runNotificationProcess, refreshSignal));

package/dist/src/computer-access/companion/native-session.js

@@ -1,6 +1,9 @@
 import WebSocket from "ws";
 import { CompanionCommandOutput } from "./command-output.js";
 import { SYSTEM_OUTPUT_CAPABILITY } from "./command-output-protocol.js";
+import { HOST_SECRET_PROTECTION_CAPABILITY } from "./secret-protection-protocol.js";
+import { systemResultProtection } from "../security/system-results.js";
+import { redactSecretText } from "../security/secret-text.js";
 import { createNativePermissionHandlers } from "./native-permissions.js";
 import { MACOS_PERMISSION_CAPABILITY } from "./permission-protocol.js";
 import { nativeLoopbackSocketOptions } from "./native-loopback-lookup.js";
@@ -47,7 +50,7 @@ export async function connectNativeHost(options) {
         ? new CompanionCommandOutput(options.commandOutputStateDir) : undefined;
     const handlers = options.handlers ?? {
         ...commandOutput?.handlers(),
-        ...createSystemHandlers(),
+        ...createSystemHandlers(undefined, undefined, undefined, systemResultProtection),
         ...computers.handlers(),
         ...notifications.handlers(),
         ...createNativePermissionHandlers(options.identity.os),
@@ -191,7 +194,7 @@ export async function connectNativeHost(options) {
             catch (error) {
                 if (!(error instanceof NativeOperationInputError))
                     throw error;
-                sendResult(message.id, operationFailure(error.message, error.code));
+                sendResult(message.id, operationFailure(redactSecretText(error.message), error.code));
                 return;
             }
             const handler = handlers[message.operation];
@@ -255,6 +258,7 @@ export async function connectNativeHost(options) {
                 version: HOST_PROTOCOL_VERSION,
                 identity: options.identity,
                 capabilities: [
+                    ...(options.handlers ? [] : [HOST_SECRET_PROTECTION_CAPABILITY]),
                     OBSERVATION_CAPABILITY,
                     COMPUTER_CAPABILITY,
                     ...(commandOutput ? [SYSTEM_OUTPUT_CAPABILITY] : []),

package/dist/src/computer-access/companion/observation-filter.js

@@ -1,32 +1,8 @@
 import { createHash, createHmac, randomBytes, randomUUID } from "node:crypto";
 import { isHostRecord } from "./protocol.js";
+import { isOwnApplicationObservation } from "../../shared/passive-observation-self-exclusion.js";
 import { redactObservationSource, redactObservationText, } from "./observation-redaction.js";
 import { isPassiveCollectorEvent, isObservationOwner, OBSERVATION_CONTENT_LIMIT, OBSERVATION_WIRE_LIMIT, } from "./observation-protocol.js";
-// Include the previous title so tabs opened before an update are also excluded.
-const OWN_WEB_UI_TITLES = ["ABot Runtime — Workspace", "ABot Runtime"];
-const BROWSER_WINDOW_NAMES = [
-    "Mozilla Firefox",
-    "Mozilla Firefox (Private Browsing)",
-    "Google Chrome",
-    "Chromium",
-    "Microsoft Edge",
-    "Brave",
-    "Safari",
-];
-const BROWSER_WINDOW_SUFFIXES = BROWSER_WINDOW_NAMES.flatMap((browser) => [
-    ` — ${browser}`,
-    ` - ${browser}`,
-]);
-function isOwnWebUiWindowTitle(title) {
-    if (typeof title !== "string")
-        return false;
-    if (OWN_WEB_UI_TITLES.includes(title))
-        return true;
-    const suffix = BROWSER_WINDOW_SUFFIXES.find((candidate) => title.endsWith(candidate));
-    if (!suffix)
-        return false;
-    return OWN_WEB_UI_TITLES.includes(title.slice(0, -suffix.length));
-}
 function hasBoundedSourceMetadata(source) {
     if (!isObservationOwner(source.app))
         return false;
@@ -111,7 +87,7 @@ export class ObservationFilter {
         };
         if (!hasBoundedSourceMetadata(rawSource))
             return undefined;
-        if (isOwnWebUiWindowTitle(rawSource.title)) {
+        if (isOwnApplicationObservation(rawSource)) {
             this.lastSource = undefined;
             return undefined;
         }

package/dist/src/computer-access/companion/observation-process.d.ts

@@ -11,6 +11,8 @@ export declare function desktopCollectorCommand(platform: string): {
 export declare function startDesktopCollector(options: {
     excludedApplications: readonly string[];
     onEvent(event: PassiveCollectorEvent): void;
+    /** Confirms helper exit or that no helper was created; close alone does not confirm either. */
+    onStopped?(): void;
     platform?: string;
     spawnProcess?: typeof spawn;
 }): DesktopCollector;