maka-agent 0.2.0-dev.12.20260901 → 0.2.0-dev.14.20260902

package/node_modules/@maka/runtime-host/dist/operator/access-management-frame.js

@@ -22,7 +22,8 @@ export const RUNTIME_HOST_ACCESS_MANAGEMENT_ERROR_CODE_MAX_BYTES = 128;
 export const RUNTIME_HOST_ACCESS_MANAGEMENT_ERROR_MESSAGE_MAX_BYTES = 2 * 1024;
 const FRAME_MAX_BYTES = 768 * 1024;
 const CREDENTIAL_MAX_BYTES = 8 * 1024;
-const ACCESS_ACTIONS = ['list', 'prepare', 'revoke'];
+const CONNECTION_CODE_MAX_BYTES = 64 * 1024;
+const ACCESS_ACTIONS = ['list', 'prepare', 'revoke', 'connection-code'];
 const boundedString = (maxBytes) => z
     .string()
     .min(1)
@@ -69,6 +70,14 @@ const ACCESS_MANAGEMENT_FRAME_SCHEMA = z.union([
         credentials: z.array(CREDENTIAL_METADATA_SCHEMA),
     })
         .strict(),
+    z
+        .object({
+        schemaVersion: z.literal(1),
+        kind: z.literal('result'),
+        action: z.literal('connection-code'),
+        connectionCode: boundedString(CONNECTION_CODE_MAX_BYTES),
+    })
+        .strict(),
     z
         .object({
         schemaVersion: z.literal(1),

package/node_modules/@maka/runtime-host/dist/peer-mesh/node.js

@@ -33,6 +33,7 @@ const ROUTE_PAGE_SIZE = 8;
 const RECONCILE_CONCURRENCY = 4;
 const RECONCILE_DEADLINE_MS = 60 * 1_000;
 const RECONCILE_INTERVAL_MS = 30 * 1_000;
+const LOCAL_ROUTE_OBSERVATION_INTERVAL_MS = 1_000;
 export async function openPeerMeshNode(input) {
     const store = await openPeerMeshStateStore(input.dataRoot, input.peer.identity().peerId);
     const node = new PeerMeshNodeImpl({ ...input, store });
@@ -50,6 +51,7 @@ class PeerMeshNodeImpl {
     #peer;
     #endpointKind;
     #now;
+    #onBackgroundReconcileError;
     #activeControlStreams = new Set();
     #lifetime = new AbortController();
     #admissionTail = Promise.resolve();
@@ -64,6 +66,7 @@ class PeerMeshNodeImpl {
         this.#peer = input.peer;
         this.#endpointKind = input.endpointKind;
         this.#now = input.now ?? Date.now;
+        this.#onBackgroundReconcileError = input.onBackgroundReconcileError;
     }
     async initialize() {
         for (const route of this.#store.read().routes)
@@ -559,9 +562,11 @@ class PeerMeshNodeImpl {
         const visible = stored.meshes.some((mesh) => isActiveMembership(mesh, localPeerId) && mesh.roster.roster.members.includes(peerId));
         if (!visible)
             return;
-        if (stored.routes.some(({ route }) => route.peerId === peerId && route.expiresAt > this.#now())) {
-            return;
-        }
+        // A signed route can remain within its TTL after a peer restarted or
+        // rotated Relay reservations. Every connection establishment therefore
+        // asks the Mesh control plane for its newest record. Callers with a
+        // self-contained invitation run this reconciliation in parallel with the
+        // first dial; callers without usable routes wait for it.
         await this.reconcile(signal);
     }
     reconcile(signal) {
@@ -621,11 +626,47 @@ class PeerMeshNodeImpl {
         return this.#store.close();
     }
     async #runReconciliation(signal) {
+        let failureReported = false;
         while (!signal.aborted) {
-            await this.reconcile(signal).catch(() => undefined);
-            await delay(RECONCILE_INTERVAL_MS, undefined, { signal }).catch(() => undefined);
+            try {
+                await this.reconcile(signal);
+                failureReported = false;
+            }
+            catch (error) {
+                if (!signal.aborted && !failureReported) {
+                    failureReported = true;
+                    try {
+                        this.#onBackgroundReconcileError?.(error);
+                    }
+                    catch {
+                        // Diagnostics cannot control Peer Mesh reconciliation.
+                    }
+                }
+            }
+            await this.#waitForReconciliationTrigger(signal).catch(() => undefined);
         }
     }
+    async #waitForReconciliationTrigger(signal) {
+        let remainingMs = RECONCILE_INTERVAL_MS;
+        while (!signal.aborted && remainingMs > 0) {
+            const waitMs = Math.min(LOCAL_ROUTE_OBSERVATION_INTERVAL_MS, remainingMs);
+            await delay(waitMs, undefined, { signal });
+            if (this.#localRouteRequiresRefresh())
+                return;
+            remainingMs -= waitMs;
+        }
+    }
+    #localRouteRequiresRefresh() {
+        const identity = this.#peer.identity();
+        const current = this.#store.read();
+        if (!current.meshes.some((state) => isActiveMembership(state, identity.peerId))) {
+            return false;
+        }
+        const existing = current.routes
+            .filter(({ route }) => route.peerId === identity.peerId)
+            .sort((left, right) => right.route.sequence - left.route.sequence)[0];
+        return !isCurrentLocalRoute(existing, identity, current, this.#endpointKind, this.#now());
+    }
     async #reconcile(signal) {
         const lifetimeSignal = signal
             ? AbortSignal.any([signal, this.#lifetime.signal])
@@ -811,13 +852,7 @@ class PeerMeshNodeImpl {
             const existing = current.routes
                 .filter(({ route }) => route.peerId === identity.peerId)
                 .sort((left, right) => right.route.sequence - left.route.sequence)[0];
-            if (existing &&
-                existing.route.expiresAt > now + ROUTE_REFRESH_LEAD_MS &&
-                sameAddresses(existing.route.routeHints, identity.listenAddresses) &&
-                sameAddresses(existing.route.coordinationRelays, identity.coordinationRelays) &&
-                existing.route.endpointKind === this.#endpointKind &&
-                existing.route.displayName === (current.displayName ?? undefined) &&
-                existing.route.transitMeshId === current.transitMeshId) {
+            if (isCurrentLocalRoute(existing, identity, current, this.#endpointKind, now)) {
                 return { state: current, result: existing };
             }
             const route = await this.#signLocalRoute(current);
@@ -1519,6 +1554,15 @@ function responseRoutes(state, routes, knownRoutes, now) {
 function sameAddresses(left, right) {
     return left.length === right.length && left.every((address, index) => address === right[index]);
 }
+function isCurrentLocalRoute(existing, identity, current, endpointKind, now) {
+    return Boolean(existing &&
+        existing.route.expiresAt > now + ROUTE_REFRESH_LEAD_MS &&
+        sameAddresses(existing.route.routeHints, identity.listenAddresses) &&
+        sameAddresses(existing.route.coordinationRelays, identity.coordinationRelays) &&
+        existing.route.endpointKind === endpointKind &&
+        existing.route.displayName === (current.displayName ?? undefined) &&
+        existing.route.transitMeshId === current.transitMeshId);
+}
 function mergeAddresses(primary, fallback) {
     return Object.freeze([...new Set([...primary, ...fallback])].slice(0, 32));
 }

package/node_modules/@maka/runtime-host/dist/peer-mesh/owner.js

@@ -57,6 +57,9 @@ export async function openRuntimeHostPeerMeshOwner(input) {
             dataRoot: join(input.dataRoot, client.identity().peerId),
             peer: client,
             endpointKind: input.endpointKind,
+            ...(input.onBackgroundReconcileError
+                ? { onBackgroundReconcileError: input.onBackgroundReconcileError }
+                : {}),
         });
         resolverMesh = mesh;
     }

package/node_modules/@maka/runtime-host/dist/protocol/configuration.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { decodeCredentialLocator, REQUEST_HEADERS_MAX_BYTES, } from '@maka/core/runtime-policy';
+import { decodeCredentialLocator, decodeConnectionCredentialTarget, decodeConnectionVersionBasis, normalizeNetworkProxyCredentialTarget, REQUEST_HEADERS_MAX_BYTES, } from '@maka/core/runtime-policy';
 import { requireEncodedByteLimit, requireExactRecord, requireShapedRecord, requireUtf8String, } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
@@ -39,17 +39,41 @@ export const CONFIGURATION_OPERATION_SPECS = {
     }),
 };
 function decodeConfigurationCredentialExportInput(value) {
-    const input = requireExactRecord(value, 'configuration credential export input', ['locator']);
-    return { locator: decodeLocator(input.locator) };
+    const input = requireShapedRecord(value, 'configuration credential export input', ['locator'], ['expectedConnection']);
+    const locator = decodeLocator(input.locator);
+    const expectedConnection = input.expectedConnection === undefined
+        ? undefined
+        : decodeDomainValue(() => decodeConnectionCredentialTarget(input.expectedConnection));
+    if (expectedConnection && locator.scope !== 'connection') {
+        throw invalidProtocolFrame('Only connection credential exports accept a target basis');
+    }
+    return {
+        locator,
+        ...(expectedConnection === undefined ? {} : { expectedConnection }),
+    };
 }
 function decodeConfigurationCredentialExportResult(value) {
-    const result = requireExactRecord(value, 'configuration credential export result', [
-        'credential',
-    ]);
-    if (result.credential === null)
-        return { credential: null };
-    const entry = requireShapedRecord(result.credential, 'exported configuration credential', ['locator', 'secretBase64'], []);
+    const result = requireShapedRecord(value, 'configuration credential export result', ['credential'], ['connectionStale']);
+    const connectionStale = result.connectionStale === undefined
+        ? undefined
+        : decodeConnectionStale(result.connectionStale);
+    if (connectionStale && result.credential !== null) {
+        throw invalidProtocolFrame('A stale connection export must not include credential material');
+    }
+    if (result.credential === null) {
+        return {
+            credential: null,
+            ...(connectionStale === undefined ? {} : { connectionStale }),
+        };
+    }
+    const entry = requireShapedRecord(result.credential, 'exported configuration credential', ['locator', 'secretBase64'], ['proxyTarget']);
     const locator = decodeLocator(entry.locator);
+    const proxyTarget = entry.proxyTarget === undefined
+        ? undefined
+        : decodeDomainValue(() => normalizeNetworkProxyCredentialTarget(entry.proxyTarget));
+    if (proxyTarget && locator.scope !== 'network_proxy') {
+        throw invalidProtocolFrame('Only proxy credentials may carry a proxy target');
+    }
     const maxBytes = locator.scope === 'connection' && locator.kind === 'request_headers'
         ? REQUEST_HEADERS_MAX_BYTES
         : CREDENTIAL_SECRET_MAX_BYTES;
@@ -57,11 +81,33 @@ function decodeConfigurationCredentialExportResult(value) {
         credential: {
             locator,
             secretBase64: decodeCredentialSecretBase64(entry.secretBase64, maxBytes),
+            ...(proxyTarget === undefined ? {} : { proxyTarget }),
         },
+        ...(connectionStale === undefined ? {} : { connectionStale }),
     };
     requireEncodedByteLimit(decoded, 'configuration credential export result', RESULT_MAX_BYTES);
     return decoded;
 }
+function decodeConnectionStale(value) {
+    const stale = requireExactRecord(value, 'configuration credential stale connection', [
+        'expected',
+        'actual',
+    ]);
+    return {
+        expected: decodeDomainValue(() => decodeConnectionVersionBasis(stale.expected)),
+        actual: stale.actual === null
+            ? null
+            : decodeDomainValue(() => decodeConnectionVersionBasis(stale.actual)),
+    };
+}
+function decodeDomainValue(decode) {
+    try {
+        return decode();
+    }
+    catch {
+        throw invalidProtocolFrame('Invalid configuration credential connection basis');
+    }
+}
 function decodeCredentialSecretBase64(value, maxBytes) {
     const encoded = requireUtf8String(value, 'exported configuration credential secret', Math.ceil(maxBytes / 3) * 4);
     const decoded = Buffer.from(encoded, 'base64');

package/node_modules/@maka/runtime-host/dist/protocol/host-status.js

@@ -19,9 +19,17 @@
 import { invalidProtocolFrame } from './errors.js';
 import { requireCount, requireEncodedByteLimit, requireExactRecord, requireId, requireRecord, requireString, requireUtf8String, } from './codec.js';
 import { defineOperation } from './operation-spec.js';
+export function isHostActivityIdle(activity) {
+    return (activity.connections === 0 &&
+        activity.activeOperations === 0 &&
+        activity.residencies.length === 0);
+}
 export const HOST_DIAGNOSTICS_RESULT_MAX_BYTES = 72 * 1024;
 export const HOST_DIAGNOSTIC_LOG_MAX_ENTRIES = 256;
 export const HOST_DIAGNOSTIC_LOG_MAX_ENTRY_BYTES = 10 * 1024;
+const HOST_PEER_ID_MAX_BYTES = 160;
+const HOST_PEER_ADDRESS_MAX_BYTES = 2 * 1024;
+const HOST_PEER_ROUTE_MAX = 16;
 export const HOST_BOOTSTRAP_OPERATION_SPECS = {
     'host.status': defineOperation({
         mode: 'query',
@@ -45,11 +53,22 @@ export const HOST_BOOTSTRAP_OPERATION_SPECS = {
         decodeOutput: decodeHostUpgradePrepareResult,
     }),
 };
+function decodePeerAddresses(value, label) {
+    if (!Array.isArray(value) || value.length > HOST_PEER_ROUTE_MAX) {
+        throw invalidProtocolFrame(`Invalid ${label}`);
+    }
+    const addresses = value.map((address) => requireString(address, label, HOST_PEER_ADDRESS_MAX_BYTES));
+    if (new Set(addresses).size !== addresses.length) {
+        throw invalidProtocolFrame(`Duplicate ${label}`);
+    }
+    return Object.freeze(addresses);
+}
 function decodeEmptyHostInput(value, label) {
     requireExactRecord(value, label, []);
     return {};
 }
 function decodeHostStatusResult(value) {
+    const valueRecord = requireRecord(value, 'host.status result');
     const record = requireExactRecord(value, 'host.status result', [
         'hostEpoch',
         'compositionId',
@@ -58,11 +77,13 @@ function decodeHostStatusResult(value) {
         'connections',
         'activeOperations',
         'activeResidencies',
+        ...(valueRecord.peerEndpoint === undefined ? [] : ['peerEndpoint']),
     ]);
     return decodeHostStatusFields(record);
 }
 function decodeHostDiagnosticsResult(value) {
     requireEncodedByteLimit(value, 'host.diagnostics.query result', HOST_DIAGNOSTICS_RESULT_MAX_BYTES);
+    const valueRecord = requireRecord(value, 'host.diagnostics.query result');
     const record = requireExactRecord(value, 'host.diagnostics.query result', [
         'hostEpoch',
         'compositionId',
@@ -71,6 +92,7 @@ function decodeHostDiagnosticsResult(value) {
         'connections',
         'activeOperations',
         'activeResidencies',
+        ...(valueRecord.peerEndpoint === undefined ? [] : ['peerEndpoint']),
         'compositionModules',
         'residencies',
         'protocolVersion',
@@ -177,6 +199,21 @@ function decodeHostStatusFields(record) {
         connections: requireCount(record.connections, 'connections'),
         activeOperations: requireCount(record.activeOperations, 'activeOperations'),
         activeResidencies: requireCount(record.activeResidencies, 'activeResidencies'),
+        ...(record.peerEndpoint === undefined
+            ? {}
+            : { peerEndpoint: decodeHostPeerEndpoint(record.peerEndpoint) }),
+    };
+}
+function decodeHostPeerEndpoint(value) {
+    const record = requireExactRecord(value, 'Runtime Host peer endpoint', [
+        'peerId',
+        'routeHints',
+        'coordinationRelays',
+    ]);
+    return {
+        peerId: requireString(record.peerId, 'Runtime Host peer id', HOST_PEER_ID_MAX_BYTES),
+        routeHints: decodePeerAddresses(record.routeHints, 'Runtime Host peer route hints'),
+        coordinationRelays: decodePeerAddresses(record.coordinationRelays, 'Runtime Host peer coordination relays'),
     };
 }
 function requirePlatform(value) {

package/node_modules/@maka/runtime-host/dist/protocol/index.js

@@ -61,7 +61,23 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 90;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 96;
+// 96: Read image tool results may carry durable `session_context` refs.
+// 95: Catalog entries carry `describedByMetadata`, so a client asks the
+// Host-resolved entry — not its own bundled table — whether a model needs a
+// hand-written capability declaration. The field is required, so a newer Host's
+// entry fails an older client's strict decoder, and an older Host's entry
+// (lacking it) fails a newer client's.
+// 94: A failed Turn snapshot no longer carries contextBudgetExhaustedDetail; the
+// retired outcome reads as context_overflow at the ledger boundary, and an older
+// Host still sending the field fails a newer client's closed snapshot decode.
+// 93: Configuration credential transfer binds proxy destinations and
+// Connection credentials to exact Host-owned targets before secret access.
+// Proxy policy and credentials commit through one recoverable Host command;
+// older peers can split the writes and violate the shared credential basis.
+// 92: Owners can query their complete pending Session Turn-request inbox.
+// 91: Host status publishes the live Direct peer endpoint so newly issued
+// connection invitations do not preserve stale startup routes.
 // 90: `session.create.mode` accepts the Bot session mode. A Host that predates
 // it rejects the value as an invalid Session start mode.
 // 89: The Host refreshes its models.dev catalog at startup and announces the

package/node_modules/@maka/runtime-host/dist/protocol/network-proxy.js

@@ -19,7 +19,6 @@
 import { requireEncodedByteLimit, requireExactRecord, requireShapedRecord, requireUtf8String, } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
 import { defineOperation } from './operation-spec.js';
-const SECRET_MAX_BYTES = 16 * 1024;
 const RESULT_MAX_BYTES = 8 * 1024;
 const ERRORS = [
     'host_not_ready',
@@ -38,16 +37,11 @@ export const NETWORK_PROXY_OPERATION_SPECS = {
     }),
 };
 function decodeNetworkProxyTestInput(value) {
-    const input = requireShapedRecord(value, 'network proxy test input', [], ['networkProxy', 'password', 'url', 'timeoutMs']);
+    const input = requireShapedRecord(value, 'network proxy test input', [], ['networkProxy', 'url', 'timeoutMs']);
     return {
         ...(input.networkProxy === undefined
             ? {}
             : { networkProxy: decodeNetworkProxy(input.networkProxy) }),
-        ...(input.password === undefined
-            ? {}
-            : {
-                password: requireUtf8String(input.password, 'network proxy password', SECRET_MAX_BYTES),
-            }),
         ...(input.url === undefined ? {} : { url: decodeProbeUrl(input.url) }),
         ...(input.timeoutMs === undefined
             ? {}

package/node_modules/@maka/runtime-host/dist/protocol/operations.js

@@ -59,6 +59,7 @@ import { TURN_OPERATION_SPECS } from './turn.js';
 import { USAGE_PRICING_OPERATION_SPECS } from './usage-pricing.js';
 import { WEB_SEARCH_OPERATION_SPECS } from './web-search.js';
 import { WORKHUB_COORDINATION_OPERATION_SPECS } from './workhub-coordination.js';
+export { isHostActivityIdle } from './host-status.js';
 export { ARTIFACT_CURSOR_MAX_BYTES, ARTIFACT_INGEST_CHUNK_MAX_BYTES, ARTIFACT_INGEST_MIME_TYPE_MAX_BYTES, ARTIFACT_MIME_TYPE_MAX_BYTES, ARTIFACT_NAME_MAX_BYTES, ARTIFACT_PAGE_MAX_ITEMS, ARTIFACT_PREVIEW_MAX_BYTES, ARTIFACT_READ_CHUNK_MAX_BYTES, ARTIFACT_RESULT_MAX_BYTES, ARTIFACT_SUMMARY_MAX_BYTES, decodeArtifactDeleteInput, decodeArtifactDeleteResult, decodeArtifactIngestInput, decodeArtifactIngestResult, decodeArtifactQueryInput, decodeArtifactQueryResult, encodeArtifactDeleteResult, encodeArtifactQueryResult, } from './artifact.js';
 export { TURN_FAILURE_MESSAGE_MAX_BYTES, TURN_MESSAGE_CONTENT_MAX_BYTES, TURN_MESSAGE_TEXT_MAX_BYTES, TURN_RESUME_PARK_REASONS, } from './turn.js';
 export * from './connection-effects.js';
@@ -162,6 +163,7 @@ export const REMOTE_OWNER_OPERATION_GRANTS = Object.freeze([
     'queue.entry.update',
     'queue.retract',
     'runtime.policy.mutate',
+    'runtime.policy.network-proxy.update',
     'runtime.policy.query',
     'runtime.resource.controller.acquire',
     'runtime.resource.controller.control',

package/node_modules/@maka/runtime-host/dist/protocol/runtime-policy.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { CONNECTION_CATALOG_MAX_CONNECTIONS, CONNECTION_CATALOG_MAX_ENABLED_MODEL_IDS, CONNECTION_CATALOG_MAX_ENTRIES_PER_CONNECTION, CONNECTION_CATALOG_MAX_MODELS_PER_CONNECTION, decodeCanonicalConnectionBaseUrl, decodeModelCatalogEntry, decodeCanonicalRuntimePolicy, decodeConnectionModel, decodeConnectionModelId, decodeConnectionName, decodeConnectionSlug, decodeConnectionTarget, decodeConnectionTestSummary, decodeConnectionVersionBasis, decodeRuntimePolicyEntityId, decodeCredentialLocator, decodeCredentialStatus, decodeCredentialVersionBasis, decodeProviderType, normalizeCreateCatalogConnectionInput, normalizeDeleteCredentialInput, normalizeRemoveCatalogConnectionInput, normalizeOptionalRequestBodyOverlay, normalizeRequestHeaderUpdates, normalizeRuntimePolicyMutation, normalizeSetCredentialInput, normalizeSetDefaultConnectionTargetInput, normalizeUpdateCatalogConnectionInput, REQUEST_HEADERS_MAX_BYTES, RequestCustomizationValidationError, RuntimePolicyDomainDecodeError, } from '@maka/core/runtime-policy';
+import { CONNECTION_CATALOG_MAX_CONNECTIONS, CONNECTION_CATALOG_MAX_ENABLED_MODEL_IDS, CONNECTION_CATALOG_MAX_ENTRIES_PER_CONNECTION, CONNECTION_CATALOG_MAX_MODELS_PER_CONNECTION, decodeCanonicalConnectionBaseUrl, decodeModelCatalogEntry, decodeCanonicalRuntimePolicy, decodeConnectionModel, decodeConnectionModelId, decodeConnectionName, decodeConnectionSlug, decodeConnectionTarget, decodeConnectionTestSummary, decodeConnectionVersionBasis, decodeRuntimePolicyEntityId, decodeCredentialLocator, decodeCredentialStatus, decodeCredentialVersionBasis, decodeProviderType, normalizeCreateCatalogConnectionInput, normalizeDeleteCredentialInput, normalizeRemoveCatalogConnectionInput, normalizeOptionalRequestBodyOverlay, normalizeNetworkProxyUpdate, normalizeNetworkProxyCredentialTarget, normalizeRequestHeaderUpdates, normalizeRuntimePolicyMutation, normalizeSetCredentialInput, normalizeSetDefaultConnectionTargetInput, normalizeUpdateCatalogConnectionInput, REQUEST_HEADERS_MAX_BYTES, RequestCustomizationValidationError, RuntimePolicyDomainDecodeError, } from '@maka/core/runtime-policy';
 import { normalizeRelayModelProfiles } from '@maka/core/model-thinking';
 import { requireExactRecord, requireShapedRecord, requireRecord } from './codec.js';
 import { invalidProtocolFrame } from './errors.js';
@@ -58,6 +58,13 @@ export const RUNTIME_POLICY_OPERATION_SPECS = {
         decodeInput: decodeRuntimePolicyMutation,
         decodeOutput: decodeRuntimePolicyMutationResult,
     }),
+    'runtime.policy.network-proxy.update': defineOperation({
+        mode: 'command',
+        availability: 'ready',
+        errors: MUTATION_ERRORS,
+        decodeInput: decodeRuntimePolicyNetworkProxyUpdate,
+        decodeOutput: decodeRuntimePolicyNetworkProxyUpdateResult,
+    }),
     'connection.catalog.query': defineOperation({
         mode: 'query',
         availability: 'ready',
@@ -158,6 +165,44 @@ function decodeRuntimePolicyMutationResult(value) {
     }
     return revisionConflict(item, 'runtime policy mutation result');
 }
+function decodeRuntimePolicyNetworkProxyUpdate(value) {
+    const input = decodeDomain(() => normalizeNetworkProxyUpdate(value));
+    if (input.credential.kind === 'replace' &&
+        Buffer.byteLength(input.credential.secret, 'utf8') > CREDENTIAL_SECRET_MAX_BYTES) {
+        throw invalidProtocolFrame('Invalid network proxy credential secret');
+    }
+    return input;
+}
+function decodeRuntimePolicyNetworkProxyUpdateResult(value) {
+    const item = requireRecord(value, 'network proxy update result');
+    if (item.kind === 'committed') {
+        const committed = requireExactRecord(item, 'network proxy update committed result', [
+            'kind',
+            'revision',
+            'credentialStatus',
+        ]);
+        return {
+            kind: 'committed',
+            revision: revision(committed.revision, 'runtime policy revision'),
+            credentialStatus: decodeDomain(() => decodeCredentialStatus(committed.credentialStatus)),
+        };
+    }
+    if (item.kind === 'credential_stale')
+        return credentialStale(item);
+    if (item.kind === 'proxy_target_mismatch') {
+        const mismatch = requireExactRecord(item, 'network proxy target mismatch', [
+            'kind',
+            'expected',
+            'actual',
+        ]);
+        return {
+            kind: 'proxy_target_mismatch',
+            expected: decodeDomain(() => normalizeNetworkProxyCredentialTarget(mismatch.expected)),
+            actual: decodeDomain(() => normalizeNetworkProxyCredentialTarget(mismatch.actual)),
+        };
+    }
+    return revisionConflict(item, 'network proxy update result');
+}
 function decodeCatalogQueryInput(value) {
     const item = requireRecord(value, 'connection catalog query input');
     if (item.kind === 'start') {
@@ -497,6 +542,8 @@ function decodeSetCredentialResult(value) {
         requireExactRecord(item, 'credential connection not found result', ['kind']);
         return { kind: 'connection_not_found' };
     }
+    if (item.kind === 'connection_stale')
+        return connectionStale(item);
     return credentialStale(item);
 }
 function decodeDeleteCredentialResult(value) {

package/node_modules/@maka/runtime-host/dist/protocol/session-collaboration.js

@@ -212,8 +212,10 @@ function decodeCollaborationTurnRequestCreateInput(value) {
     return { intent: decodeSessionTurnRequestIntent(record.intent) };
 }
 function decodeCollaborationTurnRequestQueryInput(value) {
-    const record = requireExactRecord(value, 'collaboration Turn request query', ['sessionId']);
-    return { sessionId: requireEntityId(record.sessionId, 'sessionId') };
+    const record = requireShapedRecord(value, 'collaboration Turn request query', [], ['sessionId']);
+    return record.sessionId === undefined
+        ? {}
+        : { sessionId: requireEntityId(record.sessionId, 'sessionId') };
 }
 function decodeCollaborationTurnRequestQueryResult(value) {
     const record = requireExactRecord(value, 'collaboration Turn request query result', [

package/node_modules/@maka/runtime-host/dist/protocol/turn.js

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { MAX_ATTACHMENT_BYTES, MAX_ATTACHMENT_COUNT } from '@maka/core/attachments';
-import { decodeMessageContent as decodeCanonicalMessageContent, isContextBudgetExhaustedDetail, DIRECTORY_REFERENCE_MAX_COUNT, isCanonicalAttachmentRef, } from '@maka/core/events';
+import { decodeMessageContent as decodeCanonicalMessageContent, DIRECTORY_REFERENCE_MAX_COUNT, isCanonicalAttachmentRef, } from '@maka/core/events';
 import { isOrchestrationMode, isTurnOrchestrationSource, } from '@maka/core/orchestration';
 import { decodeSkillInvocationResult, } from '@maka/core/skill-invocation';
 import { invalidProtocolFrame } from './errors.js';
@@ -449,7 +449,7 @@ export function decodeTurnSnapshot(value) {
         };
     }
     if (status === 'failed') {
-        requireShapedRecord(record, 'failed Turn snapshot', ['sessionId', 'turnId', 'runId', 'status', 'terminalEventId', 'failureClass'], ['failureMessage', 'contextBudgetExhaustedDetail']);
+        requireShapedRecord(record, 'failed Turn snapshot', ['sessionId', 'turnId', 'runId', 'status', 'terminalEventId', 'failureClass'], ['failureMessage']);
         return {
             ...base,
             status,
@@ -460,11 +460,6 @@ export function decodeTurnSnapshot(value) {
                     failureMessage: requireUtf8String(record.failureMessage, 'failureMessage', TURN_FAILURE_MESSAGE_MAX_BYTES, false),
                 }
                 : {}),
-            ...(record.contextBudgetExhaustedDetail !== undefined
-                ? {
-                    contextBudgetExhaustedDetail: requireContextBudgetExhaustedDetail(record.contextBudgetExhaustedDetail),
-                }
-                : {}),
         };
     }
     if (status === 'cancelled') {
@@ -492,11 +487,6 @@ export function decodeTurnSnapshot(value) {
             : {}),
     };
 }
-function requireContextBudgetExhaustedDetail(value) {
-    if (isContextBudgetExhaustedDetail(value))
-        return value;
-    throw invalidProtocolFrame('Invalid context budget exhausted detail');
-}
 export function decodeContextCompactionOutcome(value) {
     const record = requireRecord(value, 'Context compaction outcome');
     const kind = requireString(record.kind, 'kind', 32);

package/node_modules/@maka/runtime-host/dist/server/access-authority.js

@@ -215,10 +215,11 @@ class FileRuntimeHostAccessAuthority {
         const guest = principal.principalKind === 'session_guest';
         return {
             canRequestTurns: guest &&
+                input.sessionId !== undefined &&
                 this.activeSessionGrant(principal.principalId, input.sessionId, 'session_turn_request') !==
                     undefined,
             requests: this.#file.turnAccessRequests.filter((request) => (!guest || request.principalId === principal.principalId) &&
-                request.intent.sessionId === input.sessionId),
+                (input.sessionId === undefined || request.intent.sessionId === input.sessionId)),
         };
     }
     acknowledgeTurnAccessRequest(principalId, input) {

package/node_modules/@maka/runtime-host/dist/server/agent-graph-execution-coordinator.js

@@ -147,8 +147,7 @@ function classifyAgentGraphOutcome(snapshot) {
     if (snapshot.status === 'cancelled')
         return { kind: 'aborted', turnId: snapshot.turnId };
     if (snapshot.status === 'failed') {
-        if (snapshot.failureClass === 'context_overflow' ||
-            snapshot.failureClass === 'context_budget_exhausted') {
+        if (snapshot.failureClass === 'context_overflow') {
             return {
                 kind: 'context_overflow',
                 turnId: snapshot.turnId,

package/node_modules/@maka/runtime-host/dist/server/canonical-turn-snapshot.js

@@ -16,7 +16,6 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { isContextBudgetExhaustedDetail, } from '@maka/core/events';
 import { truncateUtf8 } from '@maka/core/diagnostic-log';
 import { redactSecrets } from '@maka/core/redaction';
 import { classifyTerminalRuntimeLedger } from '@maka/runtime/terminal-run-commit';
@@ -53,7 +52,6 @@ export async function readCanonicalTurnSnapshot(stores, identity, knownRun) {
             const failureMessage = fact.terminalEvent.content?.kind === 'error'
                 ? truncateUtf8(redactSecrets(fact.terminalEvent.content.message), TURN_FAILURE_MESSAGE_MAX_BYTES, '…')
                 : undefined;
-            const contextBudgetExhaustedDetail = readContextBudgetExhaustedDetail(fact.terminalEvent.actions?.stateDelta?.contextBudgetExhaustedDetail);
             return {
                 sessionId,
                 turnId,
@@ -62,7 +60,6 @@ export async function readCanonicalTurnSnapshot(stores, identity, knownRun) {
                 terminalEventId: fact.terminalEvent.id,
                 failureClass: fact.failureClass,
                 ...(failureMessage ? { failureMessage } : {}),
-                ...(contextBudgetExhaustedDetail ? { contextBudgetExhaustedDetail } : {}),
             };
         }
         if (!fact.abortSource)
@@ -87,9 +84,6 @@ export async function readCanonicalTurnSnapshot(stores, identity, knownRun) {
     }
     return { sessionId, turnId, runId, status: run.status };
 }
-function readContextBudgetExhaustedDetail(value) {
-    return isContextBudgetExhaustedDetail(value) ? value : undefined;
-}
 function readContextCompactionOutcome(value) {
     if (!value || typeof value !== 'object')
         return undefined;
@@ -111,9 +105,6 @@ export function worstCaseFailedTurnSnapshot(identity) {
         terminalEventId: 'x'.repeat(128),
         failureClass: '\0'.repeat(128),
         failureMessage: '\0'.repeat(TURN_FAILURE_MESSAGE_MAX_BYTES),
-        // Keep capacity preflight conservative for every protocol-valid failure
-        // detail, including the longest malformed-summary diagnostic.
-        contextBudgetExhaustedDetail: 'malformed_summary_too_small_for_fold',
     };
 }
 async function readRunIfPresent(stores, sessionId, runId) {

package/node_modules/@maka/runtime-host/dist/server/configuration-coordinator.js

@@ -26,11 +26,30 @@ export class HostConfigurationCoordinator {
     }
     async #exportCredentials(input) {
         try {
-            const material = await this.policy.exportCredentialMaterial(input.locator);
+            const exported = input.expectedConnection
+                ? await this.policy.exportCredentialMaterial(input.locator, input.expectedConnection)
+                : {
+                    kind: 'exported',
+                    material: await this.policy.exportCredentialMaterial(input.locator),
+                };
+            if (exported.kind === 'connection_stale') {
+                return {
+                    ok: true,
+                    result: {
+                        credential: null,
+                        connectionStale: {
+                            expected: exported.expected,
+                            actual: exported.actual,
+                        },
+                    },
+                };
+            }
+            const material = exported.material;
             const credential = material
                 ? {
                     locator: material.locator,
                     secretBase64: Buffer.from(material.secret, 'utf8').toString('base64'),
+                    ...(material.proxyTarget === undefined ? {} : { proxyTarget: material.proxyTarget }),
                 }
                 : null;
             return { ok: true, result: { credential } };