maka-agent 0.2.0-dev.12.20260901 → 0.2.0-dev.14.20260902

package/node_modules/@maka/runtime-host/dist/server/execution-composition.js

@@ -19,7 +19,7 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { MAX_READ_IMAGE_BYTES } from '@maka/core/attachments';
 import { messageContentDigest, normalizeMessageContent } from '@maka/core/events';
-import { describeChatConfigurationReason, NO_REAL_CONNECTION_CODE, } from '@maka/core/connection-error-copy';
+import { NO_REAL_CONNECTION_CODE } from '@maka/core/connection-error-copy';
 import { generalizedErrorMessage } from '@maka/core/redaction';
 import { emptyPlanSessionState } from '@maka/core/plan';
 import { isDeepResearchSession, WORKHUB_COORDINATION_SESSION_ID, WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION, } from '@maka/core/session';
@@ -42,8 +42,9 @@ import { SessionActivityRegistry } from '@maka/runtime/goal-turn-lifecycle';
 import { ShellRunProcessManager } from '@maka/runtime/shell-run-manager';
 import { resolveShellPlan, resolveTurnShellPlan, validateShellPreference, } from '@maka/runtime/shell-detect';
 import { createAgentGraphControlStore } from '@maka/storage/agent-graph-control-store';
-import { createArtifactAttachmentResourceReader, createReadImageSnapshotter, } from '@maka/storage/artifact-stores';
-import { isSessionNotFoundError, SessionMetadataConflictError, } from '@maka/storage/execution-stores';
+import { createArtifactAttachmentResourceReader } from '@maka/storage/artifact-stores';
+import { createReadImageSnapshotStore } from '@maka/storage/read-image-snapshot-store';
+import { isSessionNotFoundError } from '@maka/storage/execution-stores';
 import { createExternalSessionAdapterRegistry } from '@maka/storage/external-sessions';
 import { createGitWorktreeChildExecutor } from '@maka/storage/git-worktree-child-executor';
 import { runWithStorageRootLease } from '@maka/storage/root-authority';
@@ -121,22 +122,23 @@ import { createHostWebSearchService, createHostWebSearchToolFromService, resolve
 import { createHostWebFetchService, createHostWebFetchToolFromService } from './web-fetch-tool.js';
 import { createHostExecutionArtifactServices } from './execution-artifacts.js';
 import { createRuntimeHostWorkspaceExecutionComposition, RuntimeHostWorkspaceExecutionError, } from './workspace-execution-composition.js';
-const CONTEXT_OFFLOAD_READER_LIMITS = Object.freeze({
+const GIBIBYTE = 1024 * 1024 * 1024;
+const CONTEXT_OFFLOAD_LIMITS = Object.freeze({
     ownerMaxBytes: Object.freeze({
         read_image_snapshot: MAX_READ_IMAGE_BYTES,
         tool_result_archive: 0,
     }),
-    // This expand slice opens only the reader path. Zero quotas make accidental
-    // non-empty puts fail closed until the writer/lifecycle cutover lands.
-    sessionLogicalBytes: 0,
-    workspacePhysicalBytes: 0,
+    // Read images are bounded individually and logically per Session. Physical
+    // bytes are content-addressed across Sessions and bounded per workspace.
+    sessionLogicalBytes: GIBIBYTE,
+    workspacePhysicalBytes: 20 * GIBIBYTE,
 });
 export function runtimeHostFilesystemWorkerRuntime(versions) {
     return versions.electron ? 'electron' : 'node';
 }
 export async function createExecutionRuntimeHostComposition(context, options = {}, dependencies = {}) {
     const storage = await openStorageWriterComposition(context.owner.lease, {
-        contextOffloadLimits: CONTEXT_OFFLOAD_READER_LIMITS,
+        contextOffloadLimits: CONTEXT_OFFLOAD_LIMITS,
         afterRuntimePolicyOpened: async (stores) => {
             if (options.bootstrapRuntimePolicy !== false) {
                 await ensureBootstrapRuntimePolicy({
@@ -148,7 +150,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         },
     });
     if (storage.contextOffloadUnavailable) {
-        console.error(`[runtime-host] optional context-offload reader could not be opened: ${generalizedErrorMessage(storage.contextOffloadUnavailable.cause)}`);
+        console.error(`[runtime-host] optional context-offload Store could not be opened: ${generalizedErrorMessage(storage.contextOffloadUnavailable.cause)}`);
     }
     const stores = storage.execution;
     let graphControlStore;
@@ -180,6 +182,25 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         const openedContextOffloadReader = openedContextOffloadStore
             ? createInteractiveContextOffloadReader(openedContextOffloadStore)
             : undefined;
+        const contextOffloadAuthority = openedContextOffloadStore
+            ? openedContextOffloadStore
+            : storage.contextOffloadUnavailable
+                ? {
+                    copyReferences: async () => {
+                        throw new Error('Context-offload Store is unavailable during Session copy', {
+                            cause: storage.contextOffloadUnavailable?.cause,
+                        });
+                    },
+                    retireSession: async (_sessionId) => {
+                        throw new Error('Context-offload Store is unavailable during Session retirement', {
+                            cause: storage.contextOffloadUnavailable?.cause,
+                        });
+                    },
+                    collectGarbage: async () => {
+                        throw new Error('Context-offload Store is unavailable during context garbage collection', { cause: storage.contextOffloadUnavailable?.cause });
+                    },
+                }
+                : undefined;
         const openedUsageStores = storage.usage;
         const openedShellRunStore = storage.shellRuns;
         const worktreeChildExecutor = createGitWorktreeChildExecutor({
@@ -194,7 +215,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         // product's existing answer for these rows: this task came from the retired
         // local simulation, configure a real model and start a new one.
         backends.register('fake', () => {
-            throw new Error(`${NO_REAL_CONNECTION_CODE}:fake_backend: ${describeChatConfigurationReason('fake_backend')}`);
+            throw new Error(`${NO_REAL_CONNECTION_CODE}:fake_backend: Runtime Host cannot send on a retired local-simulation connection; configure a real model and start a new task`);
         });
         const runtimePolicyActivation = new RuntimePolicyActivationGate();
         const runtimePolicy = new HostRuntimePolicyCoordinator(runtimePolicyStores, runtimePolicyActivation, applyRuntimePolicyMutationEffects, async (input) => {
@@ -270,7 +291,18 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             }),
             backgroundTasks: runtimeResources,
             ptyControls: runtimeResources,
-            snapshotImage: createReadImageSnapshotter(openedArtifactStore),
+            ...(openedContextOffloadStore
+                ? {
+                    snapshotImage: async (input) => createReadImageSnapshotStore(openedContextOffloadStore, input.sessionId).snapshot({
+                        ownerId: input.ownerId,
+                        bytes: input.bytes,
+                        mimeType: input.mimeType,
+                    }),
+                    releaseImageSnapshot: async (input) => {
+                        await openedContextOffloadStore.releaseReference(input);
+                    },
+                }
+                : {}),
             ...(sandboxManager ? { sandboxManager } : {}),
             ...(filesystemWorker ? { filesystemWorker } : {}),
         };
@@ -1215,6 +1247,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             stores,
             artifacts: openedArtifactStore,
             sessionTodo: sessionTodoStore,
+            ...(contextOffloadAuthority ? { contextOffload: contextOffloadAuthority } : {}),
             manager,
             admission: sessionAdmission,
             continuity: continuityCoordinator,
@@ -1239,18 +1272,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             continuity: continuityCoordinator,
             artifacts: openedArtifactStore,
             sessionTodo: sessionTodoStore,
-            assertNoContextOffloadReferences: async (sessionIds) => {
-                if (!openedContextOffloadStore) {
-                    throw new Error('Context-offload reader is unavailable during Session removal', {
-                        cause: storage.contextOffloadUnavailable?.cause,
-                    });
-                }
-                for (const sessionId of sessionIds) {
-                    if ((await openedContextOffloadStore.usage(sessionId)).references > 0) {
-                        throw new SessionMetadataConflictError('Session removal does not support Session context references yet');
-                    }
-                }
-            },
+            ...(contextOffloadAuthority ? { contextOffload: contextOffloadAuthority } : {}),
             purgeOperationalState: async (sessionId) => {
                 await stores.purgeConversationOperationalState(sessionId);
                 await openedPlanStore.purgeSessionState(sessionId);

package/node_modules/@maka/runtime-host/dist/server/execution-service.js

@@ -55,6 +55,9 @@ export async function startExecutionRuntimeHostService(options, dependencies = {
                     ...options.peer,
                     dataRoot: options.peer.meshDataRoot,
                     endpointKind: 'host',
+                    onBackgroundReconcileError: (error) => {
+                        console.error('[runtime-host] Peer Mesh background synchronization failed:', error);
+                    },
                 });
             }
             catch (error) {
@@ -109,7 +112,7 @@ export async function startExecutionRuntimeHostService(options, dependencies = {
         throw error;
     }
 }
-function attachPeerOwnerCleanup(listeners, owner) {
+export function attachPeerOwnerCleanup(listeners, owner) {
     return {
         ...listeners,
         cleanup: async () => {

package/node_modules/@maka/runtime-host/dist/server/host-kernel.js

@@ -569,6 +569,7 @@ export class RuntimeHostKernel {
         return outcome;
     }
     #statusSnapshot() {
+        const peer = this.peerListeners[0];
         return {
             hostEpoch: this.hostEpoch,
             compositionId: this.compositionDescriptor.id,
@@ -577,6 +578,15 @@ export class RuntimeHostKernel {
             connections: this.#acceptedTransports.size,
             activeOperations: this.#activeOperations,
             activeResidencies: this.#residencies.activeCount,
+            ...(peer
+                ? {
+                    peerEndpoint: {
+                        peerId: peer.peerId,
+                        routeHints: peer.listenAddresses,
+                        coordinationRelays: peer.coordinationRelays,
+                    },
+                }
+                : {}),
         };
     }
     #activitySnapshot() {
@@ -588,6 +598,11 @@ export class RuntimeHostKernel {
         };
     }
     #hasUpgradeBlockingActivity() {
+        // The request's own accepted transport is expected. Any other live
+        // connection arrived after discovery or remained attached and therefore
+        // requires explicit interruption authority before retirement.
+        if (this.#acceptedTransports.size > 1)
+            return true;
         if (this.#activeCommandOperations > 1)
             return true;
         return this.#residencies.snapshot().some(({ label }) => label !== 'process-retention');

package/node_modules/@maka/runtime-host/dist/server/listener-set.js

@@ -51,16 +51,20 @@ export async function startRuntimeHostAuthenticatedListenerSet(input, options) {
 }
 export function createRuntimeHostListenerSet(local, additional = []) {
     const listeners = Object.freeze([local, ...additional]);
+    const peerListeners = Object.freeze(additional.filter(isRuntimeHostPeerListener).map((listener) => Object.freeze({
+        peerId: listener.peerId,
+        listenAddresses: Object.freeze([...listener.listenAddresses]),
+        get coordinationRelays() {
+            return Object.freeze([...listener.coordinationRelays]);
+        },
+    })));
     return {
         listeners,
         localEndpoint: local.endpoint,
         websocketEndpoints: Object.freeze(additional
             .filter((listener) => listener.kind === 'websocket')
             .map((listener) => listener.endpoint)),
-        peerListeners: Object.freeze(additional.filter(isRuntimeHostPeerListener).map((listener) => Object.freeze({
-            peerId: listener.peerId,
-            listenAddresses: Object.freeze([...listener.listenAddresses]),
-        }))),
+        peerListeners,
         closeAdmission: () => settleListeners(listeners, (listener) => listener.closeAdmission()),
         cleanup: () => settleListeners([...listeners].reverse(), (listener) => listener.cleanup()),
     };

package/node_modules/@maka/runtime-host/dist/server/network-proxy-coordinator.js

@@ -29,7 +29,6 @@ export class HostNetworkProxyCoordinator {
         try {
             const resolved = await this.policy.resolveNetworkProxyExecution({
                 ...(input.networkProxy ? { networkProxy: input.networkProxy } : {}),
-                ...(input.password ? { secretOverride: input.password } : {}),
             });
             if (resolved.kind === 'credential_not_configured') {
                 return {

package/node_modules/@maka/runtime-host/dist/server/peer-listener.js

@@ -66,6 +66,9 @@ class RuntimeHostPeerListener {
             .serveApplication((stream) => this.#acceptStream(stream), this.#serveLifetime.signal)
             .catch(captureFailure);
     }
+    get coordinationRelays() {
+        return this.#client.identity().coordinationRelays;
+    }
     closeAdmission() {
         this.#closeAdmissionTask ??= (async () => {
             this.#admitting = false;

package/node_modules/@maka/runtime-host/dist/server/runtime-policy-coordinator.js

@@ -29,6 +29,7 @@ export class HostRuntimePolicyCoordinator {
     handlers = {
         'runtime.policy.query': () => this.#queryPolicy(),
         'runtime.policy.mutate': (input) => this.#mutatePolicy(input),
+        'runtime.policy.network-proxy.update': (input) => this.#updateNetworkProxy(input),
         'connection.catalog.query': (input) => this.#queryCatalog(input),
         'connection.catalog.create': (input) => this.#createConnection(input),
         'connection.catalog.update': (input) => this.#updateConnection(input),
@@ -65,6 +66,27 @@ export class HostRuntimePolicyCoordinator {
             return projectPolicyMutation(await this.#stores.runtimePolicy.mutate(input));
         });
     }
+    async #updateNetworkProxy(input) {
+        return this.#storeMutation(async () => {
+            try {
+                await this.validateMutation({
+                    expectedRevision: input.expectedPolicyRevision,
+                    operation: { kind: 'set_network_proxy', value: input.networkProxy },
+                });
+            }
+            catch (error) {
+                throw new RuntimePolicyStoreError('invalid_policy_input', 'Network proxy update failed Host validation', { cause: error });
+            }
+            const result = await this.#stores.operations.updateNetworkProxy(input);
+            return result.kind === 'committed'
+                ? {
+                    kind: 'committed',
+                    revision: result.snapshot.revision,
+                    credentialStatus: result.credentialStatus,
+                }
+                : result;
+        });
+    }
     async #queryCatalog(input) {
         const stored = await this.#storeQuery(() => this.#stores.connectionCatalog.getSnapshot());
         if (!stored.ok)
@@ -143,7 +165,9 @@ export class HostRuntimePolicyCoordinator {
     async #setCredential(input) {
         return this.#storeMutation(async () => {
             const result = await this.#stores.credentialVault.set(input);
-            if (result.kind === 'connection_not_found' || result.kind === 'credential_stale') {
+            if (result.kind === 'connection_not_found' ||
+                result.kind === 'connection_stale' ||
+                result.kind === 'credential_stale') {
                 return result;
             }
             const status = result.snapshot.entries.find((entry) => sameLocator(entry.locator, input.locator));
@@ -156,6 +180,9 @@ export class HostRuntimePolicyCoordinator {
     async #deleteCredential(input) {
         return this.#storeMutation(async () => {
             const result = await this.#stores.credentialVault.delete(input);
+            if (result.kind === 'connection_stale') {
+                throw invariantFailure('Credential deletion returned an impossible connection conflict');
+            }
             if (result.kind === 'connection_not_found' || result.kind === 'credential_stale') {
                 return result;
             }

package/node_modules/@maka/runtime-host/dist/server/session-retirement-coordinator.js

@@ -68,7 +68,7 @@ export class HostSessionRetirementCoordinator {
     #continuity;
     #artifacts;
     #sessionTodo;
-    #assertNoContextOffloadReferences;
+    #contextOffload;
     #purgeOperationalState;
     #purgeAgentGraphState;
     #worktrees;
@@ -95,7 +95,7 @@ export class HostSessionRetirementCoordinator {
         this.#continuity = options.continuity;
         this.#artifacts = options.artifacts;
         this.#sessionTodo = options.sessionTodo;
-        this.#assertNoContextOffloadReferences = options.assertNoContextOffloadReferences;
+        this.#contextOffload = options.contextOffload;
         this.#purgeOperationalState = options.purgeOperationalState;
         this.#purgeAgentGraphState = options.purgeAgentGraphState;
         this.#worktrees = options.worktrees;
@@ -201,7 +201,6 @@ export class HostSessionRetirementCoordinator {
                     if (plan.archive.sessionIds.length > 0) {
                         archiveHandles = await this.#prepareRetirement(plan.archive, 'archive');
                     }
-                    await this.#assertNoContextOffloadReferences?.(plan.remove.sessionIds);
                     const allSessionIds = [...plan.remove.sessionIds, ...plan.archive.sessionIds];
                     await this.#finalizeWorkspacePatches(allSessionIds);
                     await this.#disposeBackends(allSessionIds);
@@ -494,6 +493,7 @@ export class HostSessionRetirementCoordinator {
             purgeSessionSidecars({
                 artifacts: this.#artifacts,
                 sessionTodo: this.#sessionTodo,
+                ...(this.#contextOffload ? { contextOffload: this.#contextOffload } : {}),
                 purgeOperationalState: this.#purgeOperationalState,
             }, sessionId),
             this.#purgeAgentGraphState(sessionId),

package/node_modules/@maka/runtime-host/dist/server/session-revision-coordinator.js

@@ -20,7 +20,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { isDeepResearchSession } from '@maka/core/deep-research';
 import { SIDE_CONVERSATION_SESSION_LABEL } from '@maka/core/side-conversation';
 import { isWorkHubCoordinationSessionId, isWorkHubCoordinationSessionTarget, sessionRevisionFamilyId, } from '@maka/core/session';
-import { archivedToolResultContainsLinkedChildReferences, archivedToolResultContainsConversationOwnedReferences, cloneConversationRuntimeLedger, collectConversationCopyLinkedChildReferences, collectConversationCopySessionFileRefs, createConversationCopySlice, prepareConversationRuntimeLedgerCopy, } from '@maka/runtime/conversation-copy';
+import { archivedToolResultContainsLinkedChildReferences, archivedToolResultContainsConversationOwnedReferences, cloneConversationRuntimeLedger, collectConversationCopyLinkedChildReferences, collectConversationCopySessionContextRefIds, collectConversationCopySessionFileRefs, createConversationCopySlice, prepareConversationRuntimeLedgerCopy, } from '@maka/runtime/conversation-copy';
 import { isArchivedToolResultPlaceholder } from '@maka/runtime/context-budget';
 import { decodeModelProjectionTransition, MODEL_PROJECTION_TRANSITION_EVENT_TYPE, } from '@maka/core/model-projection-transition';
 import { authenticateInteractiveArtifactStoreWriter, } from '@maka/storage/artifact-stores';
@@ -52,7 +52,7 @@ export class HostSessionRevisionCoordinator {
         const copies = (await this.#stores.sessionStore.listHeaders()).filter((header) => header.conversationCopy !== undefined);
         for (const header of copies) {
             if (header.conversationCopy.state === 'preparing')
-                await this.#discard(header);
+                await this.#discardDuringRecovery(header);
         }
         const committed = copies.filter((header) => header.conversationCopy.state === 'committed');
         const retained = new Set(committed
@@ -85,10 +85,18 @@ export class HostSessionRevisionCoordinator {
                 await this.options.manager.commitRevisionVersion(header.id);
             }
             else {
-                await this.#discard(header);
+                await this.#discardDuringRecovery(header);
             }
         }
     }
+    async #discardDuringRecovery(header) {
+        try {
+            await this.#discard(header);
+        }
+        catch (error) {
+            console.error(`[runtime-host] conversation copy cleanup deferred during recovery (${header.id}): ${conversationCopyCommitFailureDiagnostic(error)}`);
+        }
+    }
     async #copy(kind, input) {
         if (isWorkHubCoordinationSessionId(input.targetSessionId)) {
             return copyFailure('operation_conflict', 'Target Session identity is reserved for WorkHub coordination');
@@ -315,6 +323,28 @@ export class HostSessionRevisionCoordinator {
                 .filter(({ serializedResult }) => archivedToolResultContainsLinkedChildReferences(serializedResult) ||
                 archivedToolResultContainsConversationOwnedReferences(serializedResult, input.sourceSessionId, linkedReferences.references))
                 .map(({ descriptor, serializedResult }) => [descriptor.artifactId, serializedResult]));
+            const sourceContextRefIds = collectConversationCopySessionContextRefIds({
+                sourceSessionId: input.sourceSessionId,
+                messages: slice.messages,
+                runtimeEvents: plan.runs.flatMap(({ runtimeEvents }) => runtimeEvents),
+                archivedResults: archivePreflight.serializedResults,
+            });
+            if (sourceContextRefIds.length > 0 && !this.options.contextOffload) {
+                throw new Error('Session context copy authority is unavailable');
+            }
+            const contextCopy = sourceContextRefIds.length === 0
+                ? { ok: true, copied: [] }
+                : await this.options.contextOffload.copyReferences({
+                    sourceSessionId: input.sourceSessionId,
+                    targetSessionId: input.targetSessionId,
+                    references: sourceContextRefIds.map((sourceRefId) => ({
+                        sourceRefId,
+                        targetOwner: { kind: 'read_image_snapshot', ownerId: sourceRefId },
+                    })),
+                });
+            if (!contextCopy.ok) {
+                throw new Error(`Session context references could not be copied: ${contextCopy.reason}`);
+            }
             const artifactCopy = await this.#artifacts.copyConversationArtifacts({
                 sourceSessionId: input.sourceSessionId,
                 targetSessionId: input.targetSessionId,
@@ -340,6 +370,7 @@ export class HostSessionRevisionCoordinator {
                 targetSessionId: input.targetSessionId,
                 artifactIds: artifactCopy.artifactIds,
                 relativePaths: artifactCopy.relativePaths,
+                contextRefs: new Map(contextCopy.copied.map(({ sourceRefId, targetRefId }) => [sourceRefId, targetRefId])),
                 linkedChildren: kind === 'side_conversation'
                     ? {
                         mode: 'snapshot',
@@ -544,6 +575,7 @@ export class HostSessionRevisionCoordinator {
         await purgeSessionSidecars({
             artifacts: this.#artifacts,
             sessionTodo: this.#sessionTodo,
+            ...(this.options.contextOffload ? { contextOffload: this.options.contextOffload } : {}),
             purgeOperationalState: (sessionId) => this.#stores.purgeConversationOperationalState(sessionId),
         }, header.id);
         await this.#stores.sessionStore.discardStableConversationCopy(header.id, copy.requestFingerprint);

package/node_modules/@maka/runtime-host/dist/server/session-sidecar-purge.js

@@ -16,10 +16,26 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+const CONTEXT_GARBAGE_BATCH_BLOBS = 64;
+async function retireContextSession(contextOffload, sessionId) {
+    await contextOffload.retireSession(sessionId);
+    for (;;) {
+        const collected = await contextOffload.collectGarbage({
+            olderThan: Number.MAX_SAFE_INTEGER,
+            maxBlobs: CONTEXT_GARBAGE_BATCH_BLOBS,
+            maxBytes: Number.MAX_SAFE_INTEGER,
+        });
+        if (!collected.hasMore)
+            return;
+    }
+}
 export async function purgeSessionSidecars(authority, sessionId) {
     const outcomes = await Promise.allSettled([
         authority.artifacts.purgeSessionArtifacts(sessionId),
         authority.sessionTodo.purgeSessionState(sessionId),
+        ...(authority.contextOffload
+            ? [retireContextSession(authority.contextOffload, sessionId)]
+            : []),
         authority.purgeOperationalState(sessionId),
     ]);
     const failures = outcomes.flatMap((outcome) => outcome.status === 'rejected' ? [outcome.reason] : []);