maka-agent 0.2.0-dev.10.20260831 → 0.2.0-dev.11.20260831

package/LICENSE

@@ -261,6 +261,53 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+Sigstore dependency patch
+
+Source: https://www.npmjs.com/package/@sigstore/core/v/4.0.1
+Repository: https://github.com/sigstore/sigstore-js/tree/main/packages/core
+Version: 4.0.1
+Dependency patch: patches/@sigstore+core+4.0.1.patch
+Copyright 2023 The Sigstore Authors
+License: Apache-2.0
+
+Maka redistributes a source patch that selects the signature digest in
+@sigstore/core. The patch modifies Apache-2.0 source and is covered by the
+Apache License, Version 2.0 reproduced above.
+
+TUF metadata models dependency patch
+
+Source: https://www.npmjs.com/package/@tufjs/models/v/5.0.0
+Repository: https://github.com/theupdateframework/tuf-js/tree/main/packages/models
+Version: 5.0.0
+Dependency patch: patches/@tufjs+models+5.0.0.patch
+Copyright (c) 2022 GitHub and the TUF Contributors
+License: MIT
+
+Maka redistributes a source patch that selects the signature digest in
+@tufjs/models. The following MIT License applies to that material:
+
+MIT License
+
+Copyright (c) 2022 GitHub and the TUF Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
 node-pty dependency patch
 
 Source: https://www.npmjs.com/package/node-pty/v/1.2.0-beta.15

package/dist/pi-tui-mcp-status.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { Editor, Key, matchesKey, truncateToWidth, visibleWidth, } from '@earendil-works/pi-tui';
+import { Editor, Input, Key, matchesKey, truncateToWidth, visibleWidth, } from '@earendil-works/pi-tui';
 import { defineUiMessageCatalog, formatUiMessage, resolveUiMessageCatalog, } from '@maka/core/ui-locale';
 import { normalizeMcpConfig } from '@maka/storage/mcp-config-store';
 import { ansi, editorTheme } from './tui-ansi.js';
@@ -24,7 +24,7 @@ import { TUI_COPY_RESOURCES } from './tui-copy-catalog.js';
 const CHROME_ROWS = 2;
 const MCP_STATUS_COPY = resolveUiMessageCatalog(defineUiMessageCatalog()(TUI_COPY_RESOURCES['mcp-status']));
 /** One in-frame state machine for status, editing, confirmation, and errors.
- * Raw config values live only in the editor and are cleared on every exit;
+ * Raw config values live only in the input component and are cleared on every exit;
  * no management result is written into the conversation transcript. */
 export class McpManagementOverlay {
     input;
@@ -100,6 +100,10 @@ export class McpManagementOverlay {
         else if (this.phase.kind === 'confirm_remove' && matchesKey(data, 'y')) {
             void this.runAction({ kind: 'remove', serverId: this.phase.serverId });
         }
+        else if (this.phase.kind === 'confirm_remove_publication_credential' &&
+            matchesKey(data, 'y')) {
+            void this.runAction({ kind: 'remove_publication_credential' });
+        }
     }
     render(width) {
         const safeWidth = Math.max(1, width);
@@ -127,7 +131,8 @@ export class McpManagementOverlay {
         return this.input.surface;
     }
     handleListInput(data) {
-        const servers = this.input.surface?.snapshot().servers ?? [];
+        const snapshot = this.input.surface?.snapshot();
+        const servers = snapshot?.servers ?? [];
         if (matchesKey(data, Key.up)) {
             this.selected = clamp(this.selected - 1, 0, servers.length - 1);
         }
@@ -146,6 +151,16 @@ export class McpManagementOverlay {
             this.selected = Math.max(0, servers.length - 1);
         else if (matchesKey(data, 'a') && this.management())
             this.phase = { kind: 'add_choice' };
+        else if (matchesKey(data, 'p') &&
+            this.management() &&
+            snapshot?.canManagePublicationCredential) {
+            this.startInput('publication_credential');
+        }
+        else if (matchesKey(data, 'x') &&
+            this.management() &&
+            snapshot?.canManagePublicationCredential) {
+            this.phase = { kind: 'confirm_remove_publication_credential' };
+        }
         else {
             const server = servers[this.selected];
             if (!server || !this.management())
@@ -218,7 +233,10 @@ export class McpManagementOverlay {
         this.clearEditor();
         this.notice = undefined;
         this.phase = { kind: 'input', input, draft, serverId, revision };
-        this.editor = new Editor(this.input.tui, editorTheme(), { paddingX: 0 });
+        this.editor =
+            input === 'publication_credential'
+                ? new MaskedTextInput()
+                : new Editor(this.input.tui, editorTheme(), { paddingX: 0 });
         this.editor.onSubmit = (submitted) => this.submitInput(submitted);
         this.editor.setText(value);
         this.editor.focused = true;
@@ -290,6 +308,12 @@ export class McpManagementOverlay {
                     config,
                 });
             }
+            else if (phase.input === 'publication_credential') {
+                if (!trimmed)
+                    throw new Error();
+                this.clearEditor();
+                void this.runAction({ kind: 'set_publication_credential', credential: trimmed });
+            }
             else {
                 const preview = this.management()?.previewImport(value);
                 if (!preview || preview.status !== 'ready')
@@ -376,6 +400,17 @@ export class McpManagementOverlay {
                 confirmCopy(this.input.locale),
             ];
         }
+        if (this.phase.kind === 'confirm_remove_publication_credential') {
+            return [
+                heading(this.input.locale, 'Remove the remote provider credential?', '删除远程 Provider 凭据？'),
+                '',
+                this.input.locale === 'zh'
+                    ? '这会停止向所选 Runtime Host 发布 MCP 工具。'
+                    : 'This stops publishing MCP tools to the selected Runtime Host.',
+                '',
+                confirmCopy(this.input.locale),
+            ];
+        }
         if (this.phase.kind === 'busy')
             return [ansi.yellow(this.phase.label)];
         const lines = [publicationLine(snapshot, this.input.locale)];
@@ -421,7 +456,9 @@ export class McpManagementOverlay {
             return copy.back;
         if (!this.management())
             return copy.readOnly;
-        return copy.manage;
+        return this.input.surface?.snapshot().canManagePublicationCredential
+            ? copy.managePublication
+            : copy.manage;
     }
     backToList(clearNotice = true) {
         if (this.phase.kind === 'confirm_import') {
@@ -481,6 +518,40 @@ export class McpManagementOverlay {
         return Math.max(0, this.documentRows - this.bodyRows);
     }
 }
+class MaskedTextInput {
+    #input = new Input();
+    onSubmit;
+    onChange;
+    constructor() {
+        this.#input.onSubmit = (value) => this.onSubmit?.(value);
+    }
+    get focused() {
+        return this.#input.focused;
+    }
+    set focused(value) {
+        this.#input.focused = value;
+    }
+    setText(value) {
+        this.#input.setValue(value);
+    }
+    handleInput(data) {
+        this.#input.handleInput(data);
+        this.onChange?.(this.#input.getValue());
+    }
+    invalidate() {
+        this.#input.invalidate();
+    }
+    render(width) {
+        const value = this.#input.getValue();
+        this.#input.setValue('•'.repeat(value.length));
+        try {
+            return this.#input.render(width);
+        }
+        finally {
+            this.#input.setValue(value);
+        }
+    }
+}
 function normalizeOneServer(serverId, source) {
     const value = JSON.parse(source);
     return normalizeMcpConfig({ version: 3, mcpServers: { [serverId]: value } }).mcpServers[serverId];
@@ -573,6 +644,7 @@ function copy(locale, key) {
         closed: 'The MCP controller is closed.',
         'invalid-config': 'The server configuration is invalid.',
         'credential-cleanup-failed': 'Stored credentials could not be removed; the configuration was not changed.',
+        'publication-credential-failed': 'The provider credential could not be stored or applied.',
         'persist-failed': 'The configuration could not be saved.',
         'manager-failed': 'The MCP connection action failed.',
         turn_active: 'MCP cannot be changed while a turn or another control action is running.',
@@ -595,6 +667,7 @@ function copy(locale, key) {
         closed: 'MCP 控制器已关闭。',
         'invalid-config': '服务器配置无效。',
         'credential-cleanup-failed': '无法删除旧凭据，配置未修改。',
+        'publication-credential-failed': '无法保存或应用 Provider 凭据。',
         'persist-failed': '无法保存配置。',
         'manager-failed': 'MCP 连接操作失败。',
         turn_active: 'Turn 或其他控制操作运行期间不能修改 MCP。',
@@ -649,6 +722,7 @@ function inputLabel(kind, locale) {
         headers: ['Request headers', '请求头'],
         edit: ['Edit server JSON', '编辑服务器 JSON'],
         import: ['Paste MCP JSON', '粘贴 MCP JSON'],
+        publication_credential: ['Provider credential', 'Provider 凭据'],
     };
     return labels[kind][locale === 'zh' ? 1 : 0];
 }
@@ -660,6 +734,11 @@ function inputHint(kind, locale) {
         return `JSON string map, ${optional}`;
     if (kind === 'cwd')
         return optional;
+    if (kind === 'publication_credential') {
+        return locale === 'zh'
+            ? '仅保存到本机凭据存储；不会写入 profile、参数或对话 · Enter 提交 · Esc 返回'
+            : 'Stored only in the local credential store; never written to profiles, arguments, or chat · Enter submit · Esc back';
+    }
     return locale === 'zh' ? 'Enter 提交 · Esc 返回' : 'Enter submit · Esc back';
 }
 function configurationLine(state, locale) {

package/dist/runtime-host-cli-context.js

@@ -124,6 +124,10 @@ export async function connectRuntimeHostCli(input, overrides = {}) {
             connection: liveConnection,
             catalog: await deps.readConnectionCatalog(liveConnection),
             profile,
+            clientInstanceId,
+            ...(resolvedProfile.profileIncarnationId
+                ? { profileIncarnationId: resolvedProfile.profileIncarnationId }
+                : {}),
             close: async () => {
                 try {
                     await liveConnection.close();

package/dist/runtime-host-tui-context.js

@@ -28,6 +28,7 @@ import { connectRuntimeHostCli, readHostChatDefaultPermissionMode, resolveRuntim
 import { createRuntimeHostMakaSessionDriver, } from './runtime-host-session-driver.js';
 import { createRuntimeHostOnboardingSurface, projectRuntimeHostConnectionIdentities, projectRuntimeHostModelChoices, } from './runtime-host-onboarding.js';
 import { createTuiMcpController, } from './tui-mcp-control.js';
+import { createRemoteTuiMcpPublicationTarget } from './tui-mcp-remote-publication.js';
 export async function createRuntimeHostTuiContext(input) {
     const connected = await connectRuntimeHostCli({
         clientDataRoot: input.clientDataRoot,
@@ -70,7 +71,7 @@ export async function createRuntimeHostTuiContext(input) {
         };
         const driver = createRuntimeHostMakaSessionDriver(driverInput);
         await driver.recoverSideConversations();
-        if (!runtimeHostProfileUsesHostWorkspace(connected.profile.kind)) {
+        if (connected.profile.kind === 'local') {
             if (!isRuntimeHostReconnectingConnection(connection)) {
                 throw new Error('Local Runtime Host TUI connection is not reconnectable');
             }
@@ -79,6 +80,20 @@ export async function createRuntimeHostTuiContext(input) {
                 connection,
             });
         }
+        else if (connected.profile.kind === 'remote') {
+            if (!connected.profileIncarnationId) {
+                throw new Error('Remote Runtime Host profile incarnation is unavailable');
+            }
+            mcp = createTuiMcpController({
+                workspaceRoot: input.rootPath,
+                connection: createRemoteTuiMcpPublicationTarget({
+                    clientDataRoot: input.clientDataRoot,
+                    profile: connected.profile,
+                    profileIncarnationId: connected.profileIncarnationId,
+                    ownerClientInstanceId: connected.clientInstanceId,
+                }),
+            });
+        }
         const modelContextWindow = selectedTarget.connection?.models.find((model) => model.id === selectedTarget.model)?.contextWindow;
         return {
             connection,

package/dist/tui-copy-catalog.js

@@ -24,6 +24,7 @@ export const TUI_COPY_RESOURCES = {
                 back: 'Esc back',
                 readOnly: '↑/↓ scroll · q/Esc close',
                 manage: 'a Add · Enter Edit · Space Enable/disable · t Test · r Reconnect · d Remove · Esc Close',
+                managePublication: 'a Add · Enter Edit · Space Enable/disable · t Test · r Reconnect · d Remove · p Set provider credential · x Remove credential · Esc Close',
             },
             unavailableTitle: 'This TUI is not connected to a local MCP control plane.',
             unavailableDetail: 'Client MCP tool association for remote Runtime Hosts is planned for a later release.',
@@ -33,6 +34,10 @@ export const TUI_COPY_RESOURCES = {
             publication: {
                 waiting: 'waiting to publish',
                 host_unavailable: 'Runtime Host reconnecting',
+                credential_required: 'provider credential required',
+                credential_rejected: 'provider credential rejected',
+                provider_conflict: 'provider active in another TUI',
+                target_mismatch: 'provider target mismatch',
                 publishing: 'publishing',
                 published: 'published',
                 not_published: 'not published',
@@ -56,6 +61,7 @@ export const TUI_COPY_RESOURCES = {
                 back: 'Esc 返回',
                 readOnly: '↑/↓ 滚动 · q/Esc 关闭',
                 manage: 'a 添加 · Enter 编辑 · Space 启用/停用 · t 测试 · r 重连 · d 删除 · Esc 关闭',
+                managePublication: 'a 添加 · Enter 编辑 · Space 启用/停用 · t 测试 · r 重连 · d 删除 · p 设置 Provider 凭据 · x 删除凭据 · Esc 关闭',
             },
             unavailableTitle: '当前 TUI 未连接本地 MCP 控制面。',
             unavailableDetail: '远程 Runtime Host 的客户端 MCP 工具关联将在后续版本提供。',
@@ -65,6 +71,10 @@ export const TUI_COPY_RESOURCES = {
             publication: {
                 waiting: '等待发布',
                 host_unavailable: 'Runtime Host 重连中',
+                credential_required: '需要 Provider 凭据',
+                credential_rejected: 'Provider 凭据已被拒绝',
+                provider_conflict: 'Provider 已在另一个 TUI 中运行',
+                target_mismatch: 'Provider 目标不匹配',
                 publishing: '正在发布',
                 published: '已发布',
                 not_published: '未发布',

package/dist/tui-mcp-control.js

@@ -56,12 +56,17 @@ class TuiMcpControllerImpl {
         initialization: 'loading',
         configuration: 'synchronizing',
         publication: 'waiting',
+        canManagePublicationCredential: false,
         toolCount: 0,
         servers: [],
     });
     constructor(connection, deps) {
         this.#connection = connection;
         this.#deps = deps;
+        this.#snapshot = freezeSnapshot({
+            ...this.#snapshot,
+            canManagePublicationCredential: Boolean(connection.setCredential && connection.removeCredential),
+        });
         this.#disposeManagerChange = deps.manager.onChange(() => {
             try {
                 this.#refreshManagerSnapshot();
@@ -77,7 +82,12 @@ class TuiMcpControllerImpl {
             this.#availability = availability;
             if (availability.kind === 'unavailable') {
                 this.#published = undefined;
-                this.#updateSnapshot({ publication: 'host_unavailable' });
+                this.#updateSnapshot({
+                    publication: availability.reason ?? 'host_unavailable',
+                    ...(availability.reason === 'provider_conflict'
+                        ? { canManagePublicationCredential: false }
+                        : {}),
+                });
             }
             else {
                 this.#updateSnapshot({ publication: 'waiting' });
@@ -160,6 +170,7 @@ class TuiMcpControllerImpl {
             await this.#connection.unregisterClientCapabilities().catch(() => undefined);
         }
         this.#published = undefined;
+        await this.#connection.closePublication?.().catch(() => undefined);
         await managerClosing;
         await this.#initialization.catch(() => undefined);
     }
@@ -189,6 +200,30 @@ class TuiMcpControllerImpl {
     async #executeAction(action) {
         if (this.#closed)
             return { status: 'failed', reason: 'closed' };
+        if (action.kind === 'set_publication_credential') {
+            if (!this.#connection.setCredential) {
+                return { status: 'failed', reason: 'publication-credential-failed' };
+            }
+            try {
+                await this.#connection.setCredential(action.credential);
+                return { status: 'applied', effect: await this.#settlePublication() };
+            }
+            catch {
+                return { status: 'failed', reason: 'publication-credential-failed' };
+            }
+        }
+        if (action.kind === 'remove_publication_credential') {
+            if (!this.#connection.removeCredential) {
+                return { status: 'failed', reason: 'publication-credential-failed' };
+            }
+            try {
+                await this.#connection.removeCredential();
+                return { status: 'applied', effect: 'pending_host' };
+            }
+            catch {
+                return { status: 'failed', reason: 'publication-credential-failed' };
+            }
+        }
         if (action.kind === 'test') {
             try {
                 const test = await this.#deps.manager.test(action.serverId);
@@ -334,10 +369,16 @@ class TuiMcpControllerImpl {
         while (!this.#closed && (this.#publicationTask || this.#publicationRequested)) {
             await this.#publicationTask?.catch(() => undefined);
         }
-        if (this.#snapshot.publication === 'error')
+        if (this.#snapshot.publication === 'error' ||
+            this.#snapshot.publication === 'credential_rejected' ||
+            this.#snapshot.publication === 'provider_conflict' ||
+            this.#snapshot.publication === 'target_mismatch') {
             return 'publication_failed';
-        if (this.#snapshot.publication === 'host_unavailable')
+        }
+        if (this.#snapshot.publication === 'host_unavailable' ||
+            this.#snapshot.publication === 'credential_required') {
             return 'pending_host';
+        }
         return 'published';
     }
     #refreshManagerSnapshot(initialization = this.#snapshot.initialization, configuration = this.#snapshot.configuration) {
@@ -351,6 +392,7 @@ class TuiMcpControllerImpl {
             initialization,
             configuration,
             publication: this.#snapshot.publication,
+            canManagePublicationCredential: this.#snapshot.canManagePublicationCredential,
             toolCount: this.#deps.manager.toolSnapshot().tools.length,
             servers: [...serverIds]
                 .sort((left, right) => left.localeCompare(right))
@@ -383,7 +425,7 @@ class TuiMcpControllerImpl {
     async #publishCurrentSnapshot() {
         const availability = this.#availability;
         if (availability.kind !== 'connected') {
-            this.#updateSnapshot({ publication: 'host_unavailable' });
+            this.#updateSnapshot({ publication: availability.reason ?? 'host_unavailable' });
             return;
         }
         const identity = connectionIdentity(availability);