@abot-ai/runtime 1.7.0 → 1.8.1

package/plugins/system/README.md

@@ -9,18 +9,40 @@ configuration. Ask and Full retain exact-action approvals; Full+ retains its nor
 approval policy. OS accessibility, screen-recording and portal permissions still
 apply. An available shell or connected companion does not prove desktop readiness.
 
+## Command working directory
+
+On native Windows, `system_command.cwd` accepts the same logical paths as
+`filesystem`: `.` and ordinary relative paths use the request's agent-work root;
+`workspace/...` uses the configured workspace. The request-bound resolver checks
+these roots and resolves the full directory before exact-action approval. Approval,
+activity and execution use that same captured absolute path. Absolute paths retain
+their existing target-OS meaning and may be outside those roots.
+
+The request root is also retained across approval resume, even if the configured
+agent-work root changes. The adapter does not rewrite the command or choose a tool
+or execution strategy. Linux/macOS, WSL interop and Companion targeting retain the
+existing absolute-cwd contract; no guest-to-host directory mapping is performed.
+
 ## Local command output
 
-Local `system_command` execution, including Windows through WSL interop, writes
-stdout and stderr to private files under the plugin state directory. Capture
-uses bounded stream buffers with disk backpressure. The completed observation is
-then loaded for delivery; full text is still materialized in memory at that point.
-The existing SDK context-text contract lets the Runtime admit or compact that
-text using its normal model-context budget. Small-result text is unchanged.
+Local `system_command` execution, including Windows through WSL interop, captures
+stdout and stderr to private files under the plugin state directory. Temporary raw
+disk storage is allowed inside this boundary. Once both streams reach natural EOF,
+SYSTEM's independent secret detector checks their full text before any output read
+or delivery. Suspected streams are replaced with `[REDACTED]`. An incomplete check,
+invalid UTF-8 or scanner failure withholds output, attempts to remove raw stream
+files and retains a safe process receipt.
+
+There is no new total-output quota or truncation. Checking and final delivery still
+materialize text in memory. The existing SDK context-text contract lets the Runtime
+admit or compact the checked text using its normal model-context budget; even the
+compaction model receives only checked text. Small clean results are unchanged.
 
 `extensions["ai.abot.runtime"].settings.defaults.outputRetentionMs` in the plugin's
 `plugin.json` controls retention; the default is seven days after capture completes. Cleanup protects active captures and removes expired
-captures during plugin initialization and periodic maintenance. Reads do not renew
+captures during plugin initialization and periodic maintenance, including raw
+leftovers after a crash or interrupted cleanup. Removal is ordinary file cleanup,
+not guaranteed forensic erasure. Reads do not renew
 retention. Completed captures keep the retention recorded at creation across
 Companion reconnects and later configuration changes. Each capture has an opaque
 ID, byte counts and a saved process receipt;
@@ -33,13 +55,17 @@ external descendants are not assumed terminated. Delivery failures retain the
 capture receipt, recorded helper PID, process status and exit code when available.
 This does not grant a new model-facing operation for reading retained captures.
 
-Application launch, target probes and desktop images retain their existing behavior.
+Application/target descriptions and launch results are checked before excerpts.
+Sensitive actionable catalog identities are withheld instead of replaced by a
+fabricated executable identifier. Input receipts retain their mechanical meaning.
 
 ## Companion command output
 
-Updated companions advertise `system_command_output_v1`. SYSTEM then uses private
+Updated companions advertise `host_secret_protection_v1` and
+`system_command_output_v1`. SYSTEM then uses private
 capture/read/close operations over the existing connection: the Companion stores
-both streams in its private state directory using the same capture implementation,
+checked streams in its private state directory using its own detector with the
+capture implementation,
 returns the process receipt, and serves 64 KiB byte chunks. SYSTEM verifies the
 capture ID, stream, offset, byte count and SHA-256 before delivering text through
 the existing context-text contract. UTF-8 characters may cross chunk boundaries.
@@ -48,9 +74,10 @@ The model receives one tool result; transport chunks do not invoke a model.
 Output references belong to the authenticated Companion connection. Transfers
 protect their captures from expiry until closed or disconnected; the configured
 SYSTEM retention then continues on disk. A failed transfer preserves the command
-receipt and never repeats execution. Old companions keep their existing bounded
-command path. This transfer does not add model-facing tools or change screenshot
-handling, and final text delivery still materializes the streams in memory.
+receipt and never repeats execution. Companions missing protection or complete
+command capture fail before dispatch with an upgrade-required result; there is no
+unprotected legacy fallback. This transfer adds no model-facing tool, and final
+text delivery still materializes the streams in memory.
 
 ## Shared connection
 
@@ -137,9 +164,18 @@ request. Metadata remains within the ordinary tool-result budgets. A companion s
 64 KiB private chunks through the existing bounded local protocol; bytes never enter
 model-visible JSON output.
 
+Before frame/media retention, each owner checks desktop/window/accessibility text
+and diagnostic fields. Suspected text is masked and its associated image is
+withheld; input that already occurred retains its dispatch receipt. Ordinary
+images remain available. Pixel-only content is not inspected: OCR and additional
+installation dependencies are deferred. Version 1 is best-effort known-indicator
+protection, not a guarantee that an admitted image or text is free of secrets.
+
 The Runtime stores images in request-owned memory, projects them only to consumers
-of the original tool evidence, excludes them from history/provider traces, and
-disposes buffers and registered resources at request end or abort. A non-vision
+of the original tool evidence, and excludes them from history/provider traces.
+Approval-wait continuation snapshots may persist request-owned image bytes; the
+owner's checks therefore precede media admission, not merely model projection.
+Buffers and registered resources are disposed at request end or abort. A non-vision
 model receives an explicit image-input limitation and can still use available text
 observations. Companion frames are erased after transfer, replacement or close;
 abandoned native sessions have a bounded idle expiry and close on disconnection.

package/plugins/system/plugin.json

@@ -2,8 +2,12 @@
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "system",
   "version": "1.0.0",
-  "description": "System commands, applications and structured observation/control of existing user desktops across native and locally connected OS targets.",
+  "description": "Run OS commands, discover and launch apps, inspect and control desktops.",
   "extensions": {
+    "ai.abot.compatibility": {
+      "version": 1,
+      "runtimePlatforms": ["linux", "darwin", "win32"]
+    },
     "ai.abot.runtime": {
       "version": 1,
       "entrypoint": "./src/index.cjs",
@@ -81,7 +85,7 @@
           ],
           "operations": {
             "run_system_command": {
-              "summary": "Run a shell command on an available OS target with absolute cwd in its namespace. The complete command, including inline file content, is limited to 4096 characters. File payload tools support larger bodies in the runtime-host namespace. Can read exposed application/browser text via native accessibility APIs, including signed-in pages. Verify the document and text. Capability references are not commands; exit zero is not effect evidence.",
+              "summary": "Run a shell command in the selected OS. cwd must be absolute; native Windows also accepts agent-work-relative paths and workspace/. The entire command is limited to 4096 characters; use file payload tools for larger bodies. Native accessibility APIs can read exposed app/browser text, including signed-in pages; verify the document and text. Capability references are not commands; exit zero is not effect evidence.",
               "input": {
                 "type": "object",
                 "additionalProperties": false,

package/plugins/system/skills/system_actions/SKILL.md

@@ -16,7 +16,7 @@ When this catalog is insufficient, continue bounded, task-relevant inspection wi
 
 ## Execute the user's task
 
-system_command executes general system commands using Bash for Linux/macOS or PowerShell for Windows. Supply an absolute cwd in the target OS namespace; it may be outside the project. Commands can inspect or manage applications, processes, services, installations, settings, network and files for the user's task. They run with actual host identity; elevated=true requests the supported native privilege path. Linux needs existing noninteractive sudo authorization, macOS uses its native administrator dialog, and Windows needs an authorized elevated host. Never fabricate credentials or bypass an OS authorization prompt.
+system_command executes general system commands using Bash for Linux/macOS or PowerShell for Windows. Supply an absolute cwd in the target OS namespace; it may be outside the project. On native Windows only, cwd also accepts the runtime filesystem namespace: `.` and relative paths start at the request agent-work root, and `workspace/...` selects the configured workspace. The adapter resolves that directory before approval. WSL interop and Companion still require an absolute target-OS path; no cross-OS path mapping is implied. Commands can inspect or manage applications, processes, services, installations, settings, network and files for the user's task. They run with actual host identity; elevated=true requests the supported native privilege path. Linux needs existing noninteractive sudo authorization, macOS uses its native administrator dialog, and Windows needs an authorized elevated host. Never fabricate credentials or bypass an OS authorization prompt.
 
 Use system_launch with the exact application identity returned by the target catalog; it revalidates that identity before dispatch. A catalog identity is not a raw executable path. There is no brand-specific application allowlist. Documented native invocations and further application control use system_command. Linux and Windows catalog identities do not define generic raw arguments; use the application's actual command interface when arguments are needed.
 

package/plugins/system/source/command-working-directory.ts

@@ -0,0 +1,47 @@
+import { win32 } from "node:path";
+import type {
+  RuntimeToolPathResolver,
+  ToolCall,
+  ToolCallAdapter,
+} from "../../../src/plugin-sdk/index.js";
+import type { SystemTargetSnapshot } from "./request-target-snapshot.js";
+
+/** Resolve before exact-action approval; execution consumes the captured absolute cwd. */
+export function createSystemCommandPathAdapter(
+  adapter: ToolCallAdapter | undefined,
+  snapshot: SystemTargetSnapshot,
+  resolver: RuntimeToolPathResolver | undefined,
+): ToolCallAdapter | undefined {
+  if (!resolver) return adapter;
+  return {
+    ...adapter,
+    normalizeCall(input) {
+      const call = adapter?.normalizeCall?.(input) ?? input;
+      if (!hasNativeWindowsRelativeDirectory(call, snapshot)) return call;
+      const directory = resolver.resolve(call.params.cwd, {
+        requirePath: true,
+        allowedLocations: ["agent_work", "workspace"],
+      });
+      return {
+        ...call,
+        params: { ...call.params, cwd: directory.absolutePath },
+      };
+    },
+  };
+}
+
+function hasNativeWindowsRelativeDirectory(
+  call: ToolCall,
+  snapshot: SystemTargetSnapshot,
+): boolean {
+  if (call.tool !== "system_command") return false;
+  if (call.params.target !== "windows") return false;
+  if (typeof call.params.cwd !== "string") return false;
+  if (win32.isAbsolute(call.params.cwd.trim())) return false;
+  const route = snapshot.find((entry) => {
+    if (entry.kind !== "native") return false;
+    if (entry.target.id !== "windows") return false;
+    return entry.target.transport === "native";
+  });
+  return route !== undefined;
+}

package/plugins/system/source/computer/handlers.ts

@@ -5,10 +5,14 @@ import {
   type ToolImplementation,
 } from "../../../../src/plugin-sdk/index.js";
 import { SystemOperationError } from "../../../../src/plugin-sdk/computer-access.js";
-import { computerFields, readPhysicalRectangle } from "../../../../src/plugin-sdk/computer-access.js";
+import {
+  computerFields,
+  readPhysicalRectangle,
+} from "../../../../src/plugin-sdk/computer-access.js";
 import { readPublicComputerAction } from "./public-action.js";
 import { withDesktopQueue } from "../../../../src/plugin-sdk/computer-access.js";
 import { serializeComputerDesktops } from "./observation-output.js";
+import { protectObservedError } from "../security/observed-error.js";
 import {
   describeDesktop,
   projectComputerResult,
@@ -53,10 +57,10 @@ export function createComputerHandlers(
             error instanceof SystemOperationError
               ? error.code
               : "computer_operation_interrupted",
-          message:
-            error instanceof Error
-              ? error.message
-              : "Computer operation interrupted; effects may be partial. Observe before another action.",
+          message: protectObservedError(
+            error,
+            "Computer operation interrupted; effects may be partial. Observe before another action.",
+          ),
         });
       }
     };
@@ -79,10 +83,10 @@ export function createComputerHandlers(
               return {
                 ...computerRouteLabel(entry),
                 available: false,
-                reason:
-                  error instanceof Error
-                    ? error.message
-                    : "Desktop inspection failed.",
+                reason: protectObservedError(
+                  error,
+                  "Desktop inspection failed.",
+                ),
               };
             }
           },

package/plugins/system/source/computer/observation-result.ts

@@ -10,6 +10,7 @@ import {
   type RequestComputer,
 } from "./request-computers.js";
 import { serializeComputerObservation } from "./observation-output.js";
+import { protectObservedError } from "../security/observed-error.js";
 
 export function describeDesktop(
   entry: RequestComputer,
@@ -45,8 +46,7 @@ export async function projectComputerResult(
         );
       media.push(image);
     } catch (error) {
-      imageFailure =
-        error instanceof Error ? error.message : "Image admission failed.";
+      imageFailure = protectObservedError(error, "Image admission failed.");
     } finally {
       result.image.bytes.fill(0);
     }
@@ -57,9 +57,14 @@ export async function projectComputerResult(
     description.observation_ref = undefined;
   }
   const hasPartialInputDispatch = result.dispatch?.status === "partial";
-  const operationError = result.error ?? (hasPartialInputDispatch
-    ? { code: "computer_input_partial", message: "Only part of the input was accepted." }
-    : undefined);
+  const operationError =
+    result.error ??
+    (hasPartialInputDispatch
+      ? {
+          code: "computer_input_partial",
+          message: "Only part of the input was accepted.",
+        }
+      : undefined);
   const data = {
     desktop_ref: entry.ref,
     ...(description.observation_ref

package/plugins/system/source/computer/request-computers.ts

@@ -13,8 +13,12 @@ import { SystemOperationError } from "../../../../src/plugin-sdk/computer-access
 import type { NativeComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
 import { createNativeComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
 import { createCompanionComputerBackend } from "../../../../src/plugin-sdk/computer-access.js";
-import { COMPUTER_CAPABILITY } from "../../../../src/plugin-sdk/computer-access.js";
+import {
+  COMPUTER_CAPABILITY,
+  HOST_SECRET_PROTECTION_CAPABILITY,
+} from "../../../../src/plugin-sdk/computer-access.js";
 import { DesktopBindings } from "./desktop-bindings.js";
+import { protectNativeDesktopBackend } from "../security/desktop-result.js";
 
 export type RequestComputer = {
   ref: string;
@@ -80,7 +84,7 @@ export class RequestComputers {
     if (entry.backend) return entry.backend;
     entry.backend =
       entry.route.kind === "native"
-        ? this.nativeFactory(entry.route.target)
+        ? protectNativeDesktopBackend(this.nativeFactory(entry.route.target))
         : createCompanionComputerBackend(
             this.rootDir,
             entry.route,
@@ -110,7 +114,10 @@ export function computerQueueIdentity(entry: RequestComputer): string {
 }
 function supportsComputerRoute(route: SystemRequestRoute): boolean {
   if (route.kind === "native") return true;
-  return route.capabilities?.includes(COMPUTER_CAPABILITY) === true;
+  return (
+    route.capabilities?.includes(COMPUTER_CAPABILITY) === true &&
+    route.capabilities.includes(HOST_SECRET_PROTECTION_CAPABILITY)
+  );
 }
 
 function restoreComputers(

package/plugins/system/source/computer/request-modules.ts

@@ -1,5 +1,4 @@
 import {
-  failureResult,
   type ToolImplementation,
   type ToolRequestPreparationContext,
   type ToolModuleDeclaration,
@@ -12,17 +11,14 @@ import {
 import type { SystemHostConnection } from "../host-dispatch.js";
 import { createComputerHandlers, COMPUTER_TOOLS } from "./handlers.js";
 import { RequestComputers } from "./request-computers.js";
+import { supportsRuntimeDesktopTools, unboundComputerFailure } from "./runtime-platform.js";
 
 /** Load-time placeholders cannot allocate a desktop outside request ownership. */
 export function unboundComputerHandlers(): Record<string, ToolImplementation> {
   return Object.fromEntries(
     COMPUTER_TOOLS.map((name) => [
       name,
-      async () =>
-        failureResult({
-          errorCode: "computer_request_binding_required",
-          message: "Computer control requires a prepared request.",
-        }),
+      async () => unboundComputerFailure(),
     ]),
   );
 }
@@ -35,6 +31,7 @@ export function prepareComputerModules(
   preparation?: ToolRequestPreparationContext,
 ): readonly ToolModuleDeclaration[] {
   if (modules.length === 0) return [];
+  if (!supportsRuntimeDesktopTools()) return [];
   const computers = new RequestComputers(
     rootDir,
     routes,

package/plugins/system/source/computer/runtime-platform.ts

@@ -0,0 +1,18 @@
+import { failureResult } from "../../../../src/plugin-sdk/index.js";
+
+/** Windows desktop images and input await the separate OCR rollout. */
+export function supportsRuntimeDesktopTools(platform: NodeJS.Platform = process.platform): boolean {
+  return platform !== "win32";
+}
+
+export function unboundComputerFailure() {
+  if (!supportsRuntimeDesktopTools())
+    return failureResult({
+      errorCode: "computer_runtime_platform_unsupported",
+      message: "Desktop observation and control are unavailable on Windows Runtime. System commands and applications remain available.",
+    });
+  return failureResult({
+    errorCode: "computer_request_binding_required",
+    message: "Computer control requires a prepared request.",
+  });
+}

package/plugins/system/source/host-dispatch.ts

@@ -1,4 +1,5 @@
 import { executeCompanionCommand, supportsCompanionCommandOutput } from "./companion-command-output.js";
+import { redactSecretText } from "./security/secret-text.js";
 import type { ComputerAccessConnection } from "../../../src/plugin-sdk/computer-access.js";
 import {
   failureResult,
@@ -11,6 +12,7 @@ import {
 } from "../../../src/plugin-sdk/computer-access.js";
 import {
   HOST_OPERATIONS,
+  HOST_SECRET_PROTECTION_CAPABILITY,
   type HostOperation,
 } from "../../../src/plugin-sdk/computer-access.js";
 import { SystemOperationError } from "../../../src/plugin-sdk/computer-access.js";
@@ -69,7 +71,17 @@ function boundOperation(
       const route = requireSystemRequestRoute(input.snapshot, params.target);
       if (route.kind === "native")
         return await input.nativeHandlers[operation]!(params, context);
-      if (operation === "system_command" && supportsCompanionCommandOutput(route))
+      if (!supportsProtectedCompanionResults(route.capabilities))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected system results. The operation was not dispatched.",
+        });
+      if (operation === "system_command" && !supportsCompanionCommandOutput(route))
+        return failureResult({
+          errorCode: "system_companion_protection_upgrade_required",
+          message: "Update Companion to enable protected complete command output. The command was not dispatched.",
+        });
+      if (operation === "system_command")
         return await executeCompanionCommand({ ...input, route, params, context });
       return await input.connection.executeHostOperation(input.rootDir, {
         hostId: route.hostId,
@@ -80,7 +92,7 @@ function boundOperation(
       });
     } catch (error) {
       if (error instanceof SystemOperationError)
-        return failureResult({ errorCode: error.code, message: error.message });
+        return failureResult({ errorCode: error.code, message: redactSecretText(error.message) });
       return failureResult({
         errorCode: "system_execution_route_failed",
         message:
@@ -90,6 +102,10 @@ function boundOperation(
   };
 }
 
+function supportsProtectedCompanionResults(capabilities?: readonly string[]): boolean {
+  return capabilities?.includes(HOST_SECRET_PROTECTION_CAPABILITY) === true;
+}
+
 function hasConnectionControl(params: Record<string, unknown>): boolean {
   if (Object.hasOwn(params, "host_id")) return true;
   if (Object.hasOwn(params, "hostId")) return true;

package/plugins/system/source/index.ts

@@ -1,16 +1,18 @@
 import { defineRuntimePlugin } from "../../../src/plugin-sdk/index.js";
-import { createSystemHandlers } from "../../../src/plugin-sdk/computer-access.js";
+import { createSystemHandlers, observeSystemTargets } from "../../../src/plugin-sdk/computer-access.js";
 import { prepareSystemRequestModules } from "./request-system-modules.js";
 import { createLocalSystemCommandOutput, systemCommandOutputRetentionMs } from "./local-command-output.js";
 import { unboundComputerHandlers } from "./computer/request-modules.js";
+import { systemResultProtection } from "./security/system-results.js";
 
 export default defineRuntimePlugin((context) => {
   const output = createLocalSystemCommandOutput(context);
   return {
-    handlers: { ...createSystemHandlers(undefined, undefined, output), ...unboundComputerHandlers() },
+    handlers: { ...createSystemHandlers(undefined, undefined, output, systemResultProtection), ...unboundComputerHandlers() },
     prepareRequest: (modules, preparation) => prepareSystemRequestModules(context.rootDir, modules, {
       outputRetentionMs: systemCommandOutputRetentionMs(context),
-      createNativeHandlers: (resolve) => createSystemHandlers(undefined, resolve, output),
+      observeTargets: async () => systemResultProtection.protectTargets(await observeSystemTargets()),
+      createNativeHandlers: (resolve) => createSystemHandlers(undefined, resolve, output, systemResultProtection),
     }, preparation),
   };
 });

package/plugins/system/source/local-command-output-retention.ts

@@ -0,0 +1,16 @@
+import { scheduleSystemOutputCleanup } from "../../../src/plugin-sdk/computer-access.js";
+import { ensureWindowsOutputDirectory } from "./security/windows-output-directory.js";
+
+/** Retention may traverse only a verified Windows output root, including at plugin load. */
+export function scheduleLocalSystemOutputCleanup(root: string, retentionMs: number): Promise<void> {
+  if (process.platform !== "win32") {
+    scheduleSystemOutputCleanup(root, retentionMs);
+    return Promise.resolve();
+  }
+  return ensureWindowsOutputDirectory(root).then(
+    () => scheduleSystemOutputCleanup(root, retentionMs),
+    () => process.emitWarning("SYSTEM output cleanup skipped because private storage could not be verified.", {
+      code: "SYSTEM_OUTPUT_PRIVATE_STORAGE_UNAVAILABLE",
+    }),
+  );
+}

package/plugins/system/source/local-command-output.ts

@@ -4,7 +4,10 @@ import { deliverPluginTextResult, failureResult, readBoundedInteger, type Runtim
 import { buildSystemProcessResult, runSystemProcess, type SystemCommandOutputFactory,
   type SystemProcessResult, type SystemTarget } from "../../../src/plugin-sdk/computer-access.js";
 import { createSystemOutputCapture, type SystemOutputReceipt } from "../../../src/plugin-sdk/computer-access.js";
-import { DEFAULT_SYSTEM_OUTPUT_RETENTION_MS, scheduleSystemOutputCleanup } from "../../../src/plugin-sdk/computer-access.js";
+import { DEFAULT_SYSTEM_OUTPUT_RETENTION_MS } from "../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./security/secret-text.js";
+import { ensureWindowsOutputDirectory } from "./security/windows-output-directory.js";
+import { scheduleLocalSystemOutputCleanup } from "./local-command-output-retention.js";
 
 type Capture = Awaited<ReturnType<typeof createSystemOutputCapture>>;
 const CONTEXT_STREAMS = Object.freeze(["stdout", "stderr"] as const);
@@ -12,22 +15,24 @@ const CONTEXT_STREAMS = Object.freeze(["stdout", "stderr"] as const);
 export function createLocalSystemCommandOutput(plugin: RuntimePluginLoadContext): SystemCommandOutputFactory {
   const root = join(plugin.stateDir, "command-output");
   const retentionMs = systemCommandOutputRetentionMs(plugin);
-  scheduleSystemOutputCleanup(root, retentionMs);
+  const initialization = scheduleLocalSystemOutputCleanup(root, retentionMs);
   return (context) => {
     let captured: Capture | undefined;
     return {
       async run(input) {
         if (input.abortSignal?.aborted) return runSystemProcess(input);
-        captured = await createSystemOutputCapture(root, retentionMs);
+        await initialization;
+        await ensureWindowsOutputDirectory(root);
+        captured = await createSystemOutputCapture(root, retentionMs, redactSecretText);
         let result: SystemProcessResult;
         try { result = await runSystemProcess(input, captured.capture); }
         catch (error) { await captured.finish(); throw error; }
         const streams = await captured.finish(result);
-        return { ...result, stdout: streams.stdout, stderr: streams.stderr || result.stderr,
+        return { ...captured.processResult!, stdout: streams.stdout, stderr: streams.stderr,
           outputTruncated: Boolean(captured.failure) };
       },
       async present(target, result) {
-        if (captured?.failure) return outputFailure(target, result, context, captured.receipt, captured.failure);
+        if (captured?.failure) return outputFailure(target, result, context, captured.receipt, captured.failure, captured.failureKind);
         const receipt = buildSystemProcessResult(target, result, "command_process_completion");
         const delivered = deliverPluginTextResult({ ...receipt,
           data: { ...receipt.data, ...(captured?.receipt ? { outputCapture: captured.receipt } : {}) } }, CONTEXT_STREAMS, context?.resultBudget);
@@ -40,14 +45,17 @@ export function createLocalSystemCommandOutput(plugin: RuntimePluginLoadContext)
 }
 
 function outputFailure(target: SystemTarget, result: SystemProcessResult, context?: ToolExecutionContext,
-  capture?: SystemOutputReceipt, storageFailure?: string): ToolImplementationOutput {
+  capture?: SystemOutputReceipt, captureFailure?: string, failureKind?: "security" | "storage"): ToolImplementationOutput {
+  const failureCode = failureKind === "security" ? "system_output_protection_failed" : "system_output_storage_failed";
   return failureResult({
-    errorCode: storageFailure ? "system_output_storage_failed" : "system_output_delivery_pending",
+    errorCode: captureFailure ? failureCode : "system_output_delivery_pending",
     message: "The command was dispatched. Its output could not be delivered completely; do not repeat the command just to retrieve output. Inspect the process receipt and retained capture.",
     ...(result.exitCode !== null ? { exitCode: result.exitCode } : {}),
     data: { target: target.id, transport: target.transport, processStatus: result.status,
       spawnedProcess: result.spawnedProcess ?? null, exitCode: result.exitCode,
-      outputCapture: capture ?? null, ...(storageFailure ? { storageFailure } : {}),
+      outputCapture: capture ?? null,
+      ...(captureFailure && failureKind === "security" ? { securityFailure: captureFailure } : {}),
+      ...(captureFailure && failureKind !== "security" ? { storageFailure: captureFailure } : {}),
       outputDelivery: "pending", evidenceScope: "command_process_completion", independentOutcomeCheck: "not_performed",
       observationMeta: { kind: "volatile_external", carryPolicy: "never" } },
   }, context?.resultBudget);

package/plugins/system/source/request-system-modules.ts

@@ -1,4 +1,6 @@
+import { createSystemCommandPathAdapter } from "./command-working-directory.js";
 import type {
+  RuntimeToolPathResolver,
   ToolCallAdapter,
   ToolImplementation,
   ToolModuleDeclaration,
@@ -82,7 +84,14 @@ export async function prepareSystemRequestModules(
   return Object.freeze([
     ...modules
       .filter((module) => !isComputerTool(module.definition.name))
-      .map((module) => projectSystemRequestModule(module, snapshot, handlers)),
+      .map((module) =>
+        projectSystemRequestModule(
+          module,
+          snapshot,
+          handlers,
+          preparation?.runtimePathResolver,
+        ),
+      ),
     ...computerModules,
   ]);
 }
@@ -108,6 +117,7 @@ function projectSystemRequestModule(
   module: ToolModuleDeclaration,
   snapshot: SystemTargetSnapshot,
   handlers: Readonly<Record<string, ToolImplementation>>,
+  resolver?: RuntimeToolPathResolver,
 ): ToolModuleDeclaration {
   const targets = Object.freeze(snapshot.map(routeTargetId));
   const availability = ` Available targets for this request: ${targets.join(", ")}.`;
@@ -131,7 +141,7 @@ function projectSystemRequestModule(
     },
     implementation: handlers[module.definition.name]!,
     adapter: {
-      ...module.adapter,
+      ...createSystemCommandPathAdapter(module.adapter, snapshot, resolver),
       executionBinding: systemExecutionBinding(snapshot),
     },
   });

package/plugins/system/source/request-target-snapshot.ts

@@ -10,6 +10,7 @@ import {
   type HostStatus,
 } from "../../../src/plugin-sdk/computer-access.js";
 import type { SystemTargetObservation } from "../../../src/plugin-sdk/computer-access.js";
+import { redactSecretText } from "./security/secret-text.js";
 
 export type SystemRequestRoute = Readonly<
   | { kind: "native"; target: SystemTarget }
@@ -140,7 +141,7 @@ export function systemRouteMetadata(
   return {
     displayTarget: route.target,
     transport: "host_companion",
-    computerName: route.identity.name,
+    computerName: redactSecretText(route.identity.name),
   };
 }