AbstractRuntime 0.9.0__tar.gz → 0.9.1__tar.gz

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to AbstractRuntime will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.9.1] - 2026-10-08
+
+### Security
+
+- `browser_probe`: a local target (path or `file://` URL) now carries the run's `_sandbox` stamp, the same scope the commands get. AbstractCore 2.25.1 serves the page from a loopback origin limited to that scope instead of `file://`, so a page cannot load refused files as subresources. Needs AbstractCore 2.25.1 (an older `browser_probe` refuses the unknown argument and runs nothing). Test: `tests/test_browser_probe_target_walling.py`.
+
+### Fixed
+
+- `stream_voice(...)` is never a wait. It used to start the child run parked on `WAIT_EVENT abstractcore.voice.tts.stream:<uuid>` for the whole stream: hosts folded that waiting record into the CALLER'S run (a Read aloud during a live turn read as "Waiting for an event"), and a host that died mid-stream left the child waiting forever. Now nothing durable exists while audio streams; when the stream ends (done, error, cancel or the consumer closing it) the child run is created already COMPLETED with the outcome. Its id is allocated up front: `runtime_start` carries it as `child_run_id` (schema `abstractruntime.tts_stream.start.v2`, no `wait_key`), as does the trace metadata. A stream cut by a crash leaves no run.
+- `AbstractCoreRunFacade.close_interrupted_voice_stream(child_run_id, *, reason)` finishes a legacy streamed-speech wait left by an older process (completed, `errors[0] = {"code": "interrupted", "message": reason}`); `is_interrupted_voice_stream_wait(waiting)` and `LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX` recognise one (exported from `integrations.abstractcore`). AbstractGateway calls it at startup.
+
+### Changed
+
+- Requires AbstractCore 2.25.1 or newer (`abstractcore>=2.25.1` in the base install and the `[apple]`/`[gpu]` extras): the Linux command sandbox reaches an allowed folder inside a refused one, and `browser_probe` accepts the run's `_sandbox` stamp.
+
 ## [0.9.0] - 2026-10-05
 
 ### Added

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: AbstractRuntime
-Version: 0.9.0
+Version: 0.9.1
 Summary: AbstractRuntime: a durable graph runner designed to pair with AbstractCore.
 Project-URL: AbstractCore (website), https://www.abstractcore.ai/
 Project-URL: AbstractRuntime (GitHub), https://github.com/lpalbou/abstractruntime
@@ -20,7 +20,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Requires-Python: >=3.10
-Requires-Dist: abstractcore>=2.25.0
+Requires-Dist: abstractcore>=2.25.1
 Requires-Dist: abstractmemory>=0.3.0
 Requires-Dist: abstractsemantics>=0.0.5
 Requires-Dist: anyio<5.0.0,>=4.12.1
@@ -35,14 +35,14 @@ Requires-Dist: reportlab<5.0.0,>=4.0.0
 Requires-Dist: restrictedpython>=7.0
 Requires-Dist: unstructured[docx,odt,pptx,rtf,xlsx]<0.19.0,>=0.18.32
 Provides-Extra: apple
-Requires-Dist: abstractcore[apple]>=2.25.0; extra == 'apple'
+Requires-Dist: abstractcore[apple]>=2.25.1; extra == 'apple'
 Requires-Dist: setuptools<82.0.0,>=80.10.2; extra == 'apple'
 Provides-Extra: docs
 Requires-Dist: mkdocs-material>=9.0.0; extra == 'docs'
 Requires-Dist: mkdocs>=1.6.0; extra == 'docs'
 Requires-Dist: pymdown-extensions>=10.0; extra == 'docs'
 Provides-Extra: gpu
-Requires-Dist: abstractcore[gpu]>=2.25.0; extra == 'gpu'
+Requires-Dist: abstractcore[gpu]>=2.25.1; extra == 'gpu'
 Requires-Dist: setuptools<82.0.0,>=77.0.3; extra == 'gpu'
 Provides-Extra: test
 Requires-Dist: aiosmtpd<2.0.0,>=1.4.4; extra == 'test'

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/docs/integrations/abstractcore.md

@@ -506,6 +506,7 @@ Lists accept a JSON array, a JSON array pasted as a string, or newline-separated
 - Child runs (subworkflows and agent delegation) inherit the workspace vars unless they set their own; VisualFlow file and document nodes (`read_file`, `write_file`, `read_pdf`, `write_pdf`, `write_docx`, `write_chart`) apply the same scope.
 - **Nesting (most specific row wins).** For a path P (symlinks resolved), the candidates are `workspace_root` (read & write), `workspace_allowed_paths` (not under `workspace_only`) and `workspace_ignored_paths`. The longest candidate that contains P decides: a refused entry refuses, the root or an allowed entry allows; a tie between a refused entry and an allowed one (or the root) at the same path refuses; no candidate falls back to the access mode (`all_except_ignored` allows, the others refuse). The host's built-in protection is absolute: under a `workspace_builtin_deny_prefixes` entry and not under a `workspace_builtin_allow` entry is refused whatever the rows say. So refusing `/Users/me` and allowing `/Users/me/project` makes the project reachable and the rest of `/Users/me` refused; a refused folder inside an allowed one refuses that subtree. AbstractGateway applies the same rule when it validates and computes a run's workspaces.
 - **Command sandbox.** `execute_command`, `shell_exec` (the whole persistent session), `local_helper_start` and AbstractAgent's `execute_python` (0.3.18 or newer) start in the workspace and run inside an OS sandbox built from the SAME scope (`sandbox_stamp(scope)`, stamped on every call as the hidden `_sandbox` argument; a model- or payload-supplied value is always replaced). AbstractCore (`abstractcore.tools.sandbox`) applies it: macOS `sandbox-exec`, Linux `bwrap`, or Linux Landlock for "Deny everything, allow listed workspaces". Mapping: `all_except_ignored` → "Allow everything, refuse listed workspaces" (`any_except_denied`), otherwise "Deny everything, allow listed workspaces" (`allowed_only`); a `"/"` read-only root → read-only default; each allowed workspace with its mode; refused paths and the built-in protection as they are. The command string is never parsed — `cd ..`, absolute paths, `$(…)`, symlinks and scripts are stopped by the kernel. With no sandbox on the host, or an AbstractCore without `abstractcore.tools.sandbox`, the command is refused with one sentence and the run continues. The entity exec tool runs inside a sandbox limited to the entity's workspace and its whitelisted mounts. The tool result carries `sandbox: {kind, …}` and a `Sandbox: …` line; the stamp rides the tool call in the run's evidence. Hosts set the host policy (the scrubbed environment commands start from, and whether unsandboxed commands are allowed on a host with no sandbox) once at boot through `abstractruntime.integrations.abstractcore.command_sandbox_host` (`configure_host`, `host_policy`, `host_sandbox_kind`), never by importing AbstractCore.
+- **Browser probe.** A local `browser_probe` target (a path or a `file://` URL) is walled like `read_file`'s path and carries the same `_sandbox` stamp: AbstractCore 2.25.1 serves the page to the browser from a loopback origin that answers only for files this scope can read (never `file://`). Remote `http(s)://` targets carry no stamp.
 
 ## Prompt-cache control plane and durable blocs
 
@@ -1048,8 +1049,14 @@ Public durable entry points:
 These helpers create child runs under an existing parent run and execute the real
 `LLM_CALL`, `TOOL_CALLS`, or stream finalization through Runtime rather than
 doing external work in host/controller code. `stream_voice(...)` yields TTS
-stream events for progressive playback and completes the child run with the
-final audio artifact when the stream succeeds.
+stream events for progressive playback; it is never a wait: nothing durable
+exists while audio streams, and when the stream ends (done, error, cancel or
+the consumer closing it) the child run is created already completed with the
+outcome (the final audio artifact on success). The child's id is announced up
+front in the `runtime_start` event (`child_run_id`). A host that finds a
+streamed-speech wait left by a runtime before this behaviour
+(`is_interrupted_voice_stream_wait`) closes it with
+`close_interrupted_voice_stream(child_run_id, reason=...)`.
 
 Example:
 

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/llms-full.txt

@@ -2480,6 +2480,7 @@ Lists accept a JSON array, a JSON array pasted as a string, or newline-separated
 - Child runs (subworkflows and agent delegation) inherit the workspace vars unless they set their own; VisualFlow file and document nodes (`read_file`, `write_file`, `read_pdf`, `write_pdf`, `write_docx`, `write_chart`) apply the same scope.
 - **Nesting (most specific row wins).** For a path P (symlinks resolved), the candidates are `workspace_root` (read & write), `workspace_allowed_paths` (not under `workspace_only`) and `workspace_ignored_paths`. The longest candidate that contains P decides: a refused entry refuses, the root or an allowed entry allows; a tie between a refused entry and an allowed one (or the root) at the same path refuses; no candidate falls back to the access mode (`all_except_ignored` allows, the others refuse). The host's built-in protection is absolute: under a `workspace_builtin_deny_prefixes` entry and not under a `workspace_builtin_allow` entry is refused whatever the rows say. So refusing `/Users/me` and allowing `/Users/me/project` makes the project reachable and the rest of `/Users/me` refused; a refused folder inside an allowed one refuses that subtree. AbstractGateway applies the same rule when it validates and computes a run's workspaces.
 - **Command sandbox.** `execute_command`, `shell_exec` (the whole persistent session), `local_helper_start` and AbstractAgent's `execute_python` (0.3.18 or newer) start in the workspace and run inside an OS sandbox built from the SAME scope (`sandbox_stamp(scope)`, stamped on every call as the hidden `_sandbox` argument; a model- or payload-supplied value is always replaced). AbstractCore (`abstractcore.tools.sandbox`) applies it: macOS `sandbox-exec`, Linux `bwrap`, or Linux Landlock for "Deny everything, allow listed workspaces". Mapping: `all_except_ignored` → "Allow everything, refuse listed workspaces" (`any_except_denied`), otherwise "Deny everything, allow listed workspaces" (`allowed_only`); a `"/"` read-only root → read-only default; each allowed workspace with its mode; refused paths and the built-in protection as they are. The command string is never parsed — `cd ..`, absolute paths, `$(…)`, symlinks and scripts are stopped by the kernel. With no sandbox on the host, or an AbstractCore without `abstractcore.tools.sandbox`, the command is refused with one sentence and the run continues. The entity exec tool runs inside a sandbox limited to the entity's workspace and its whitelisted mounts. The tool result carries `sandbox: {kind, …}` and a `Sandbox: …` line; the stamp rides the tool call in the run's evidence. Hosts set the host policy (the scrubbed environment commands start from, and whether unsandboxed commands are allowed on a host with no sandbox) once at boot through `abstractruntime.integrations.abstractcore.command_sandbox_host` (`configure_host`, `host_policy`, `host_sandbox_kind`), never by importing AbstractCore.
+- **Browser probe.** A local `browser_probe` target (a path or a `file://` URL) is walled like `read_file`'s path and carries the same `_sandbox` stamp: AbstractCore 2.25.1 serves the page to the browser from a loopback origin that answers only for files this scope can read (never `file://`). Remote `http(s)://` targets carry no stamp.
 
 ## Prompt-cache control plane and durable blocs
 
@@ -3022,8 +3023,14 @@ Public durable entry points:
 These helpers create child runs under an existing parent run and execute the real
 `LLM_CALL`, `TOOL_CALLS`, or stream finalization through Runtime rather than
 doing external work in host/controller code. `stream_voice(...)` yields TTS
-stream events for progressive playback and completes the child run with the
-final audio artifact when the stream succeeds.
+stream events for progressive playback; it is never a wait: nothing durable
+exists while audio streams, and when the stream ends (done, error, cancel or
+the consumer closing it) the child run is created already completed with the
+outcome (the final audio artifact on success). The child's id is announced up
+front in the `runtime_start` event (`child_run_id`). A host that finds a
+streamed-speech wait left by a runtime before this behaviour
+(`is_interrupted_voice_stream_wait`) closes it with
+`close_interrupted_voice_stream(child_run_id, reason=...)`.
 
 Example:
 

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/llms.txt

@@ -3,7 +3,7 @@
 > Durable workflow runtime (interrupt → checkpoint → resume) with an append-only execution ledger.
 
 - Python: 3.10+ (see `pyproject.toml`)
-- Version: 0.9.0
+- Version: 0.9.1
 - Ecosystem: [AbstractFramework](https://github.com/lpalbou/AbstractFramework) umbrella, integrates with [AbstractCore](https://github.com/lpalbou/abstractcore)
 - Hard invariant: `RunState.vars` must be JSON-serializable (`src/abstractruntime/core/models.py`)
 - Current AbstractCore baseline: base `abstractruntime` requires AbstractCore 2.24.0 or newer with its light install (remote providers, tools and the MCP worker, media routing); `abstractruntime[apple]` and `abstractruntime[gpu]` require AbstractCore's `apple` and `gpu` settings (`pyproject.toml`)

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "AbstractRuntime"
-version = "0.9.0"
+version = "0.9.1"
 description = "AbstractRuntime: a durable graph runner designed to pair with AbstractCore."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -53,7 +53,9 @@ dependencies = [
   # plugins) without selecting local inference engines. 2.19.2 floors
   # abstractvision>=0.3.33, whose resident loads report `loaded_new` and whose
   # unload frees the pipeline (the resident media path relies on both).
-  "abstractcore>=2.25.0",
+  # 2.25.1: the Linux bwrap profile binds an allowed child of a refused folder,
+  # and browser_probe takes the _sandbox stamp (scoped loopback origin).
+  "abstractcore>=2.25.1",
   "openai<3.0.0,>=1.109.1",
   "httpx<1.0.0,>=0.28.1",
   "anyio<5.0.0,>=4.12.1",
@@ -70,12 +72,12 @@ dependencies = [
 
 [project.optional-dependencies]
 apple = [
-  "abstractcore[apple]>=2.25.0",
+  "abstractcore[apple]>=2.25.1",
   "setuptools<82.0.0,>=80.10.2",
 ]
 
 gpu = [
-  "abstractcore[gpu]>=2.25.0",
+  "abstractcore[gpu]>=2.25.1",
   # vLLM 0.9-0.19 caps setuptools below 80; 77.0.3 is still a modern floor.
   "setuptools<82.0.0,>=77.0.3",
 ]

abstractruntime-0.9.1/release-notes.md

@@ -0,0 +1,12 @@
+### Security
+
+- `browser_probe`: a local target (path or `file://` URL) now carries the run's `_sandbox` stamp, the same scope the commands get. AbstractCore 2.25.1 serves the page from a loopback origin limited to that scope instead of `file://`, so a page cannot load refused files as subresources. Needs AbstractCore 2.25.1 (an older `browser_probe` refuses the unknown argument and runs nothing). Test: `tests/test_browser_probe_target_walling.py`.
+
+### Fixed
+
+- `stream_voice(...)` is never a wait. It used to start the child run parked on `WAIT_EVENT abstractcore.voice.tts.stream:<uuid>` for the whole stream: hosts folded that waiting record into the CALLER'S run (a Read aloud during a live turn read as "Waiting for an event"), and a host that died mid-stream left the child waiting forever. Now nothing durable exists while audio streams; when the stream ends (done, error, cancel or the consumer closing it) the child run is created already COMPLETED with the outcome. Its id is allocated up front: `runtime_start` carries it as `child_run_id` (schema `abstractruntime.tts_stream.start.v2`, no `wait_key`), as does the trace metadata. A stream cut by a crash leaves no run.
+- `AbstractCoreRunFacade.close_interrupted_voice_stream(child_run_id, *, reason)` finishes a legacy streamed-speech wait left by an older process (completed, `errors[0] = {"code": "interrupted", "message": reason}`); `is_interrupted_voice_stream_wait(waiting)` and `LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX` recognise one (exported from `integrations.abstractcore`). AbstractGateway calls it at startup.
+
+### Changed
+
+- Requires AbstractCore 2.25.1 or newer (`abstractcore>=2.25.1` in the base install and the `[apple]`/`[gpu]` extras): the Linux command sandbox reaches an allowed folder inside a refused one, and `browser_probe` accepts the run's `_sandbox` stamp.

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/src/abstractruntime/integrations/abstractcore/__init__.py

@@ -46,8 +46,10 @@ from .discovery_facade import (
     get_abstractcore_discovery_facade,
 )
 from .run_facade import (
+    LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX,
     AbstractCoreRunFacade,
     get_abstractcore_run_facade,
+    is_interrupted_voice_stream_wait,
 )
 from .telegram_facade import (
     TelegramTdlibNotAvailable,
@@ -108,6 +110,8 @@ __all__ = [
     "ResponseFormatError",
     "get_global_telegram_client",
     "get_abstractcore_run_facade",
+    "is_interrupted_voice_stream_wait",
+    "LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX",
     "create_local_runtime",
     "create_remote_runtime",
     "create_hybrid_runtime",

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/src/abstractruntime/integrations/abstractcore/run_facade.py

@@ -191,30 +191,26 @@ def _build_tool_calls_resume_workflow(
     )
 
 
-def _build_stream_wait_workflow(
-    *,
-    workflow_id: str,
-    wait_key: str,
-    payload: Dict[str, Any],
-    result_key: str,
-) -> WorkflowSpec:
-    def wait(run: RunState, ctx: Any) -> StepPlan:
-        _ = run, ctx
-        return StepPlan(
-            node_id="wait",
-            effect=Effect(
-                type=EffectType.WAIT_EVENT,
-                payload={
-                    "wait_key": wait_key,
-                    "resume_to_node": "done",
-                    "prompt": "Streaming voice synthesis is running.",
-                    "allow_free_text": False,
-                    "details": copy.deepcopy(payload),
-                },
-                result_key=result_key,
-            ),
-            next_node="done",
-        )
+# Legacy (runtimes before R13.1): the streamed-speech child run waited on this
+# key prefix for the whole stream. No new run waits on it; hosts finish the
+# ones a dead process left behind (`close_interrupted_voice_stream`).
+LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX = "abstractcore.voice.tts.stream:"
+
+
+def is_interrupted_voice_stream_wait(waiting: Any) -> bool:
+    """True for a legacy streamed-speech wait (by key prefix or the stream's details mode)."""
+
+    key = str(getattr(waiting, "wait_key", "") or "")
+    details = getattr(waiting, "details", None)
+    mode = details.get("mode") if isinstance(details, dict) else None
+    return key.startswith(LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX) or mode == "abstractcore_voice_stream"
+
+
+def _build_stream_record_workflow(*, workflow_id: str, result_key: str) -> WorkflowSpec:
+    """One node that completes with ``vars[result_key]`` (the stream's outcome).
+
+    Also the resume target for a legacy stream wait (its resume node was
+    ``done``)."""
 
     def done(run: RunState, ctx: Any) -> StepPlan:
         _ = ctx
@@ -225,8 +221,8 @@ def _build_stream_wait_workflow(
 
     return WorkflowSpec(
         workflow_id=workflow_id,
-        entry_node="wait",
-        nodes={"wait": wait, "done": done},
+        entry_node="done",
+        nodes={"done": done},
     )
 
 
@@ -572,7 +568,19 @@ class AbstractCoreRunFacade:
         params: Optional[Dict[str, Any]] = None,
         child_vars: Optional[Dict[str, Any]] = None,
     ):
-        """Create a durable child run and yield Runtime-owned TTS stream events."""
+        """Yield Runtime-owned TTS stream events; record a durable child run when the stream ends.
+
+        The stream is NOT a wait (R13.1, 2026-10-04). It used to start a child
+        run parked on ``WAIT_EVENT abstractcore.voice.tts.stream:<uuid>`` for
+        the whole stream: clients folded that waiting record into the parent
+        run (a Read aloud during a live turn showed "Waiting for an event"),
+        and a gateway restart mid-stream left the child WAITING forever with
+        nothing able to resume it. Now nothing durable exists while audio is
+        produced; when the stream ends (done, error, cancel or disconnect) the
+        child run is created already COMPLETED with the outcome — the id is
+        allocated up front and announced in the ``runtime_start`` event and
+        the trace metadata. A crash mid-stream leaves no run behind.
+        """
 
         client = getattr(self._runtime, "_abstractcore_llm_client", None)
         stream_fn = getattr(client, "stream_tts", None)
@@ -584,40 +592,39 @@ class AbstractCoreRunFacade:
         if isinstance(output, dict):
             spec.update(copy.deepcopy(output))
         stream_params = copy.deepcopy(params) if isinstance(params, dict) else {}
-        wait_key = f"abstractcore.voice.tts.stream:{uuid.uuid4()}"
         result_key = _RESULT_KEY
-        payload = {
-            "mode": "abstractcore_voice_stream",
-            "text": str(text or ""),
-            "output": copy.deepcopy(spec),
-            "params": copy.deepcopy(stream_params),
-        }
-        workflow = _build_stream_wait_workflow(
+        child_run_id = str(uuid.uuid4())
+        workflow = _build_stream_record_workflow(
             workflow_id=f"{_workflow_id_for_output(spec)}_stream",
-            wait_key=wait_key,
-            payload=payload,
             result_key=result_key,
         )
-        child_run_id = self._runtime.start(
-            workflow=workflow,
-            vars=_build_child_vars(parent=parent, child_vars=child_vars),
-            actor_id=parent.actor_id,
-            session_id=parent.session_id,
-            parent_run_id=parent.run_id,
-        )
-        child = self._tick(workflow=workflow, run_id=child_run_id)
-        if child.status != RunStatus.WAITING or child.waiting is None:
-            raise ValueError("Runtime failed to initialize streaming voice child run.")
+        recorded: Dict[str, Any] = {"state": None}
+
+        def _record(final_result: Dict[str, Any]) -> RunState:
+            if recorded["state"] is not None:
+                return recorded["state"]
+            record_vars = _build_child_vars(parent=parent, child_vars=child_vars)
+            record_vars[result_key] = copy.deepcopy(final_result)
+            started = self._runtime.start(
+                workflow=workflow,
+                vars=record_vars,
+                actor_id=parent.actor_id,
+                session_id=parent.session_id,
+                parent_run_id=parent.run_id,
+                run_id=child_run_id,
+            )
+            recorded["state"] = self._tick(workflow=workflow, run_id=started)
+            return recorded["state"]
 
         cancel_event = threading.Event()
         trace_metadata = dict(stream_params.get("trace_metadata") or {}) if isinstance(stream_params.get("trace_metadata"), dict) else {}
-        trace_metadata.setdefault("run_id", child.run_id)
+        trace_metadata.setdefault("run_id", child_run_id)
         trace_metadata.setdefault("parent_run_id", parent.run_id)
         if parent.session_id is not None:
             trace_metadata.setdefault("session_id", parent.session_id)
         if parent.actor_id is not None:
             trace_metadata.setdefault("actor_id", parent.actor_id)
-        trace_metadata.setdefault("workflow_id", child.workflow_id)
+        trace_metadata.setdefault("workflow_id", workflow.workflow_id)
         stream_params["trace_metadata"] = trace_metadata
         stream_params["output"] = copy.deepcopy(spec)
         stream_params["cancel_event"] = cancel_event
@@ -649,82 +656,43 @@ class AbstractCoreRunFacade:
                 "metadata": {"streaming": True, "terminal_event": copy.deepcopy(event)},
             }
 
-        def _resume_cancelled(reason: str) -> None:
-            event = {
-                "type": "cancelled",
-                "ok": False,
-                "cancelled": True,
-                "error": str(reason or "TTS stream was cancelled."),
-                "child_run_id": child.run_id,
-                "run_id": parent.run_id,
-            }
-            try:
-                self._resume(
-                    workflow=workflow,
-                    run_id=child.run_id,
-                    wait_key=wait_key,
-                    payload=_final_result_for_event(event),
-                    max_steps=100,
-                )
-                return
-            except Exception:
-                pass
-            cancel_run = getattr(self._runtime, "cancel_run", None)
-            if callable(cancel_run):
-                try:
-                    cancel_run(child.run_id, reason=str(reason or "TTS stream was cancelled."))
-                except Exception:
-                    pass
+        def _status(state: RunState) -> str:
+            return str(state.status.value if hasattr(state.status, "value") else state.status)
 
         def _events():
             terminal_seen = False
             try:
                 yield {
                     "type": "runtime_start",
-                    "schema": "abstractruntime.tts_stream.start.v1",
+                    "schema": "abstractruntime.tts_stream.start.v2",
                     "ok": True,
                     "run_id": parent.run_id,
-                    "child_run_id": child.run_id,
-                    "wait_key": wait_key,
-                    "durability": "runtime_child_run",
+                    "child_run_id": child_run_id,
+                    "durability": "runtime_child_run_on_completion",
                     "transport": "jsonl",
                     "chunk_format": "wav-segment",
                 }
                 for raw_event in stream:
                     event = dict(raw_event) if isinstance(raw_event, dict) else {"type": "event", "value": str(raw_event)}
-                    event.setdefault("child_run_id", child.run_id)
+                    event.setdefault("child_run_id", child_run_id)
                     event.setdefault("run_id", parent.run_id)
                     event_type = str(event.get("type") or "").strip().lower()
                     if event_type in {"done", "cancelled", "error"}:
                         terminal_seen = True
-                        final_result = _final_result_for_event(event)
-                        final_state = self._resume(
-                            workflow=workflow,
-                            run_id=child.run_id,
-                            wait_key=wait_key,
-                            payload=final_result,
-                            max_steps=100,
-                        )
-                        event["child_run_status"] = str(final_state.status.value if hasattr(final_state.status, "value") else final_state.status)
+                        event["child_run_status"] = _status(_record(_final_result_for_event(event)))
                         yield event
                         return
                     yield event
                 if not terminal_seen:
+                    terminal_seen = True
                     event = {
                         "type": "error",
                         "ok": False,
                         "error": "TTS stream ended without a terminal event.",
-                        "child_run_id": child.run_id,
+                        "child_run_id": child_run_id,
                         "run_id": parent.run_id,
                     }
-                    final_state = self._resume(
-                        workflow=workflow,
-                        run_id=child.run_id,
-                        wait_key=wait_key,
-                        payload=_final_result_for_event(event),
-                        max_steps=100,
-                    )
-                    event["child_run_status"] = str(final_state.status.value if hasattr(final_state.status, "value") else final_state.status)
+                    event["child_run_status"] = _status(_record(_final_result_for_event(event)))
                     yield event
             except GeneratorExit:
                 cancel_event.set()
@@ -735,36 +703,69 @@ class AbstractCoreRunFacade:
                     except Exception:
                         pass
                 if not terminal_seen:
-                    _resume_cancelled("TTS stream disconnected before completion")
+                    try:
+                        _record(
+                            _final_result_for_event(
+                                {
+                                    "type": "cancelled",
+                                    "ok": False,
+                                    "cancelled": True,
+                                    "error": "TTS stream disconnected before completion",
+                                    "child_run_id": child_run_id,
+                                    "run_id": parent.run_id,
+                                }
+                            )
+                        )
+                    except Exception:
+                        pass
                 raise
             except Exception as exc:
                 event = {
                     "type": "error",
                     "ok": False,
                     "error": str(exc),
-                    "child_run_id": child.run_id,
+                    "child_run_id": child_run_id,
                     "run_id": parent.run_id,
                 }
                 try:
-                    final_state = self._resume(
-                        workflow=workflow,
-                        run_id=child.run_id,
-                        wait_key=wait_key,
-                        payload=_final_result_for_event(event),
-                        max_steps=100,
-                    )
-                    event["child_run_status"] = str(final_state.status.value if hasattr(final_state.status, "value") else final_state.status)
+                    event["child_run_status"] = _status(_record(_final_result_for_event(event)))
                 except Exception:
-                    cancel_run = getattr(self._runtime, "cancel_run", None)
-                    if callable(cancel_run):
-                        try:
-                            cancel_run(child.run_id, reason=str(exc))
-                        except Exception:
-                            pass
+                    pass
                 yield event
 
         return _events()
 
+    def close_interrupted_voice_stream(self, child_run_id: str, *, reason: str) -> RunState:
+        """Finish a LEGACY streamed-speech child run left WAITING by a process that died.
+
+        Runtimes before R13.1 parked the stream's child run on
+        ``WAIT_EVENT abstractcore.voice.tts.stream:<uuid>`` while audio
+        streamed; only the process holding the stream could resume it, so a
+        gateway restart mid-stream left it waiting forever. Hosts call this at
+        boot for such runs (``is_interrupted_voice_stream_wait``): the run
+        completes with ``errors[0] = {"code": "interrupted", "message": reason}``
+        and is never waiting again.
+        """
+
+        child = self._runtime.get_state(child_run_id)
+        waiting = child.waiting
+        if child.status != RunStatus.WAITING or waiting is None or not is_interrupted_voice_stream_wait(waiting):
+            raise ValueError(f"Run '{child_run_id}' is not waiting on a streamed-speech event")
+        result_key = str(waiting.result_key or _RESULT_KEY).strip() or _RESULT_KEY
+        workflow = _build_stream_record_workflow(workflow_id=str(child.workflow_id or "voice_stream"), result_key=result_key)
+        return self._resume(
+            workflow=workflow,
+            run_id=child.run_id,
+            wait_key=waiting.wait_key,
+            payload={
+                "content": None,
+                "outputs": {},
+                "errors": [{"message": str(reason or "The speech stream was interrupted."), "code": "interrupted"}],
+                "metadata": {"streaming": True, "interrupted": True},
+            },
+            max_steps=10,
+        )
+
     def generate_music(
         self,
         run_id: str,
@@ -896,7 +897,9 @@ def get_abstractcore_run_facade(runtime: Any) -> AbstractCoreRunFacade:
 
 
 __all__ = [
+    "LEGACY_VOICE_STREAM_WAIT_KEY_PREFIX",
     "AbstractCoreRunFacade",
+    "is_interrupted_voice_stream_wait",
     "get_abstractcore_run_facade",
     "inline_run_active",
 ]

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/src/abstractruntime/integrations/abstractcore/workspace_scoped_tools.py

@@ -1153,8 +1153,15 @@ def _rewrite_tool_arguments(*, tool_name: str, args: Dict[str, Any], scope: Work
                 inner = t[len("file://"):]
                 resolved = resolve_user_path(scope=scope, user_path=inner)
                 out["target"] = f"file://{resolved}"
+                # Round 14: a local page is served to the browser from a loopback origin
+                # limited to the run's scope (never file://), so a page cannot pull refused
+                # files as subresources. The scope is the same stamp the commands get.
+                core_sandbox_module()
+                out[SANDBOX_STAMP_ARG] = sandbox_stamp(scope)
             else:
                 out["target"] = str(resolve_user_path(scope=scope, user_path=t))
+                core_sandbox_module()
+                out[SANDBOX_STAMP_ARG] = sandbox_stamp(scope)
         return out
 
     return out

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/tests/test_browser_probe_target_walling.py

@@ -69,3 +69,18 @@ def test_http_targets_pass_untouched(tmp_path: Path) -> None:
             tool_name="browser_probe", args={"target": url}, scope=scope
         )
         assert out["target"] == url
+
+
+def test_local_targets_carry_the_run_scope_stamp_remote_targets_do_not(tmp_path: Path) -> None:
+    """Round 14 (backlog 1002 item 3): a local page is served from a loopback origin
+    limited to the run's scope; the runtime stamps that scope (the commands' `_sandbox`
+    stamp, built from the same keys the file tools read) on every local target."""
+    from abstractruntime.integrations.abstractcore.workspace_scoped_tools import sandbox_stamp
+
+    scope = _scope(tmp_path)
+    (tmp_path / "ws" / "page.html").write_text("<p>hi</p>", encoding="utf-8")
+    for target in ("page.html", f"file://{tmp_path / 'ws' / 'page.html'}"):
+        out = rewrite_tool_arguments(tool_name="browser_probe", args={"target": target, "_sandbox": {"forged": True}}, scope=scope)
+        assert out["_sandbox"] == sandbox_stamp(scope), target
+    out = rewrite_tool_arguments(tool_name="browser_probe", args={"target": "https://example.org/"}, scope=scope)
+    assert "_sandbox" not in out

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/tests/test_packaging_extras.py

@@ -52,7 +52,7 @@ def test_runtime_base_is_remote_light_with_multimodal_and_mcp_support() -> None:
     assert "abstractcore = [" not in text
     assert "multimodal = [" not in text
     assert "mcp-worker = [" not in text
-    assert '"abstractcore>=2.25.0"' in text
+    assert '"abstractcore>=2.25.1"' in text
     # Only AbstractCore's three install settings: light (no extra), apple, gpu.
     assert re.findall(r'"abstractcore\[([^\]]*)\]', text) == ["apple", "gpu"]
     assert '"openai<3.0.0,>=1.109.1"' in text
@@ -89,8 +89,8 @@ def test_runtime_exposes_only_apple_and_gpu_user_install_profiles() -> None:
     apple_block = _extract_optional_dependency_block(text, key="apple")
     gpu_block = _extract_optional_dependency_block(text, key="gpu")
 
-    assert '"abstractcore[apple]>=2.25.0"' in apple_block
-    assert '"abstractcore[gpu]>=2.25.0"' in gpu_block
+    assert '"abstractcore[apple]>=2.25.1"' in apple_block
+    assert '"abstractcore[gpu]>=2.25.1"' in gpu_block
     assert '"setuptools<82.0.0,>=80.10.2"' in apple_block
     assert '"setuptools<82.0.0,>=77.0.3"' in gpu_block
     assert "pymupdf" not in apple_block.lower()

{abstractruntime-0.9.0 → abstractruntime-0.9.1}/tests/test_r12_workspace_sandbox.py

@@ -66,7 +66,10 @@ def _fresh_host():
 
 @pytest.fixture
 def t(tmp_path, monkeypatch):
-    root = Path(os.path.realpath(tmp_path))
+    return _tree(Path(os.path.realpath(tmp_path)), monkeypatch)
+
+
+def _tree(root: Path, monkeypatch) -> Path:
     for d in ("data/workspaces/session-1", "data/other", "home/.ssh", "home/parent/child", "home/parent/child/deny", "ro", "rw", "refused"):
         (root / d).mkdir(parents=True, exist_ok=True)
     (root / "refused/secret.txt").write_text(MARK)
@@ -283,8 +286,39 @@ def test_e2e_fail_closed_keeps_the_run_going(t, monkeypatch):
     assert MARK not in str(res)
 
 
+@pytest.fixture(params=["temp_root", "user_data_root"])
+def t_anywhere(request, tmp_path, monkeypatch):
+    """The same tree under pytest's temp root (macOS: /private/var/folders or /private/tmp,
+    Linux: /tmp) AND under a user-data root (the real home), so the entity test cannot flip
+    on where TMPDIR points: an unlisted folder must be unreadable in both."""
+    if request.param == "temp_root":
+        yield _tree(Path(os.path.realpath(tmp_path)), monkeypatch)
+        return
+    import pwd
+    import shutil
+    import tempfile
+
+    real_home = Path(pwd.getpwuid(os.getuid()).pw_dir)
+    base = real_home / ".cache" / "abstractruntime-tests"
+    base.mkdir(parents=True, exist_ok=True)
+    root = Path(os.path.realpath(tempfile.mkdtemp(prefix="r12-", dir=str(base))))
+    try:
+        yield _tree(root, monkeypatch)
+    finally:
+        shutil.rmtree(root, ignore_errors=True)
+
+
+def test_macos_allow_list_denies_the_shared_temp_roots():
+    """macOS "Deny everything, allow listed workspaces" denies the shared temp roots too
+    (where pytest's tmp tree and other processes' files live), not only /Users."""
+    roots = core_sandbox._USER_DATA_ROOTS_DARWIN
+    for r in ("/Users", "/Volumes", "/private/var/root", "/private/tmp", "/private/var/folders"):
+        assert r in roots, r
+
+
 @real_sandbox
-def test_e2e_entity_exec_is_sandboxed(t):
+def test_e2e_entity_exec_is_sandboxed(t_anywhere):
+    t = t_anywhere
     from abstractruntime.identity.tools import WorkspaceRoot, _run_execute_command
 
     home = t / "entity"