maka-agent 0.2.0-dev.14.20260902 → 0.2.0-dev.16.20260903

package/node_modules/@maka/runtime-host/dist/server/workhub-coordination-coordinator.js

@@ -21,7 +21,7 @@ import { mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { normalizeMessageContent } from '@maka/core/events';
-import { WORKHUB_COORDINATION_SESSION_ID, WORKHUB_COORDINATION_SESSION_ROLE, WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION, isWorkHubCoordinationSession, isWorkHubCoordinationSessionId, } from '@maka/core/session';
+import { WORKHUB_COORDINATION_SESSION_ID, WORKHUB_COORDINATION_SESSION_ROLE, WORKHUB_COORDINATION_REPLACEMENT_SCHEMA_VERSION, WORKHUB_COORDINATION_STOP_SCHEMA_VERSION, isWorkHubCoordinationSession, isWorkHubCoordinationSessionId, } from '@maka/core/session';
 import { WORKHUB_COORDINATION_SUMMARY_MAX_BYTES, WORKHUB_COORDINATION_TEXT_MAX_BYTES, } from '../protocol/index.js';
 import { SessionOperationFailure } from './session-catalog-coordinator.js';
 import { WorkHubActionEffectFailure, WorkHubActionGateFailure, WorkHubCoordinationActionGate, } from './workhub-coordination-action-gate.js';
@@ -58,9 +58,11 @@ export class HostWorkHubCoordinationCoordinator {
     #resolveCreateTarget;
     #requestDrain;
     #actionGate;
+    #readDelegationRetirement;
     constructor(options) {
         this.#coordinationCwd = join(options.stateRoot, COORDINATION_CWD_DIRECTORY);
         this.#stores = options.stores;
+        this.#readDelegationRetirement = options.sessionActions.readDelegationRetirement;
         this.#admission = options.admission;
         this.#continuity = options.continuity;
         this.#executions = options.executions;
@@ -68,10 +70,21 @@ export class HostWorkHubCoordinationCoordinator {
         this.#requestDrain = options.requestDrain;
         this.#actionGate = new WorkHubCoordinationActionGate({
             listSessions: () => this.#stores.listHeaders(),
+            // The global action owner is committed under the same Coordination
+            // admission that serializes every durable Coordination fact, so a
+            // concurrent action cannot slip between the claim and the fact it owns.
+            claimAction: (claim) => this.#admission.run(WORKHUB_COORDINATION_SESSION_ID, () => this.#stores.claimWorkHubAction(claim)),
+            // Read without the admission lease: it is a durable point lookup by
+            // primary key, and the claim it finds was committed under that lease.
+            readActionClaim: (actionId) => this.#stores.readWorkHubActionClaim(actionId),
+            probeTargetRemoval: async (sessionId) => (await this.#stores.probeSessionRemoval(sessionId)).kind,
             readAssignment: (actionId) => this.#stores.readWorkHubAssignment(actionId),
+            listActiveAssignments: () => this.#listActiveAssignments(),
             readReplacement: (delegationId) => this.#stores.readWorkHubReplacement(delegationId),
             readReplacementAbort: (delegationId) => this.#stores.readWorkHubReplacementAbort(delegationId),
             readSupersession: (delegationId) => this.#stores.readWorkHubSupersession(delegationId),
+            readStopRequest: (delegationId) => this.#stores.readWorkHubStopRequest(delegationId),
+            readStopResolution: (delegationId) => this.#stores.readWorkHubStopResolution(delegationId),
             answer: async (input, context) => {
                 const outcome = await this.#answer({ turnId: input.turnId, text: input.text }, context);
                 if (!outcome.ok) {
@@ -91,13 +104,15 @@ export class HostWorkHubCoordinationCoordinator {
             assign: options.sessionActions.assign,
             prepareReplacement: (input) => this.#prepareReplacement(input),
             abortReplacement: (input) => this.#abortReplacement(input),
+            prepareStop: (input) => this.#prepareStop(input),
+            resolveStop: (input) => this.#resolveStop(input),
             readDelegationRetirement: options.sessionActions.readDelegationRetirement,
             retireDelegation: options.sessionActions.retireDelegation,
         });
     }
     #prepareReplacement(input) {
-        const suffix = workHubReplacementIdentitySuffix(input.replacesDelegationId);
-        return this.#commitReplacementFact({
+        const suffix = workHubDestructiveClaimIdentitySuffix(input.replacesDelegationId);
+        return this.#commitCoordinationFact({
             read: () => this.#stores.readWorkHubReplacement(input.replacesDelegationId),
             build: (existing) => ({
                 type: 'workhub_coordination',
@@ -121,6 +136,13 @@ export class HostWorkHubCoordinationCoordinator {
             }),
             conflictMessage: 'WorkHub action identity belongs to a different replacement',
             beforeAppend: async () => {
+                const stopRequest = await this.#stores.readWorkHubStopRequest(input.replacesDelegationId);
+                if (stopRequest) {
+                    const resolution = await this.#stores.readWorkHubStopResolution(input.replacesDelegationId);
+                    if (resolution?.outcome !== 'not_owned') {
+                        throw new WorkHubActionGateFailure('action_conflict', 'WorkHub delegation already has a stop claim');
+                    }
+                }
                 const header = await this.#stores.readHeaderSnapshot(WORKHUB_COORDINATION_SESSION_ID);
                 if (!validCoordinationHeader(header)) {
                     throw new WorkHubActionEffectFailure('operation_conflict', 'WorkHub Coordination Session identity is unavailable');
@@ -129,10 +151,105 @@ export class HostWorkHubCoordinationCoordinator {
             unknownOutcomeMessage: 'WorkHub replacement intent outcome is unknown',
         });
     }
+    async #prepareStop(input) {
+        const suffix = workHubDestructiveClaimIdentitySuffix(input.stopsDelegationId);
+        return this.#commitCoordinationFact({
+            // Only the two Sessions this stop can change: the one whose delegation
+            // ends, and the Coordination Session that records it. Holding a lane for
+            // every Session with an active delegation would serialize unrelated
+            // delegation traffic behind one stop, and the proof below needs no lane
+            // it does not already hold.
+            admissionSessionIds: [WORKHUB_COORDINATION_SESSION_ID, input.targetSessionId],
+            read: () => this.#stores.readWorkHubStopRequest(input.stopsDelegationId),
+            build: (existing) => ({
+                type: 'workhub_coordination',
+                id: `whq_${suffix}`,
+                turnId: input.actionId,
+                ts: existing?.ts ?? Date.now(),
+                schemaVersion: WORKHUB_COORDINATION_STOP_SCHEMA_VERSION,
+                kind: 'delegation_stop_requested',
+                actionId: input.actionId,
+                actionFingerprint: input.actionFingerprint,
+                coordinationTurnId: input.actionId,
+                stopsActionId: input.stopsActionId,
+                stopsDelegationId: input.stopsDelegationId,
+                targetSessionId: input.targetSessionId,
+                targetMessageId: input.targetMessageId,
+                targetSessionName: input.targetSessionName,
+                userText: input.userText,
+            }),
+            conflictMessage: 'WorkHub delegation already has a different stop claim',
+            beforeAppend: async () => {
+                const [replacement, supersession, messages] = await Promise.all([
+                    this.#stores.readWorkHubReplacement(input.stopsDelegationId),
+                    this.#stores.readWorkHubSupersession(input.stopsDelegationId),
+                    this.#stores.readMessagesSnapshot(WORKHUB_COORDINATION_SESSION_ID),
+                ]);
+                if (replacement || supersession) {
+                    throw new WorkHubActionGateFailure('action_conflict', 'WorkHub delegation is already being replaced');
+                }
+                const activeAssignments = activeWorkHubAssignments(messages);
+                // Held lanes make this the last moment the one-target proof can change.
+                // It is proved from opaque delegation identity, so a concurrent rename
+                // is harmless while a concurrent delegation to the same Session is not.
+                const targetActive = activeAssignments.filter((assignment) => assignment.targetSessionId === input.targetSessionId);
+                const source = targetActive.find((assignment) => assignment.actionId === input.stopsActionId &&
+                    assignment.delegationId === input.stopsDelegationId);
+                if (!source) {
+                    throw new WorkHubActionGateFailure('action_conflict', 'WorkHub stop target does not identify one active durable delegation');
+                }
+                // A delegation whose work already finished stays linked but competes
+                // for nothing; only work that could still be stopped makes the target
+                // ambiguous.
+                for (const competitor of targetActive) {
+                    if (competitor.delegationId === source.delegationId)
+                        continue;
+                    if ((await this.#readDelegationRetirement(competitor)) !== 'retired') {
+                        throw new WorkHubActionGateFailure('action_conflict', 'WorkHub stop target does not identify one active durable delegation');
+                    }
+                }
+            },
+            unknownOutcomeMessage: 'WorkHub stop request outcome is unknown',
+        });
+    }
+    async #listActiveAssignments() {
+        return activeWorkHubAssignments(await this.#stores.readMessagesSnapshot(WORKHUB_COORDINATION_SESSION_ID));
+    }
+    #resolveStop(input) {
+        const request = input.request;
+        const suffix = workHubDestructiveClaimIdentitySuffix(request.stopsDelegationId);
+        return this.#commitCoordinationFact({
+            read: () => this.#stores.readWorkHubStopResolution(request.stopsDelegationId),
+            build: (existing) => ({
+                type: 'workhub_coordination',
+                id: `whz_${suffix}`,
+                turnId: request.actionId,
+                ts: existing?.ts ?? Date.now(),
+                schemaVersion: WORKHUB_COORDINATION_STOP_SCHEMA_VERSION,
+                kind: 'delegation_stop_resolved',
+                actionId: request.actionId,
+                actionFingerprint: request.actionFingerprint,
+                coordinationTurnId: request.coordinationTurnId,
+                stopsActionId: request.stopsActionId,
+                stopsDelegationId: request.stopsDelegationId,
+                targetSessionId: request.targetSessionId,
+                outcome: input.outcome,
+                ...(input.targetTurnId ? { targetTurnId: input.targetTurnId } : {}),
+            }),
+            conflictMessage: 'WorkHub stop already has a different resolution',
+            beforeAppend: async () => {
+                const durable = await this.#stores.readWorkHubStopRequest(request.stopsDelegationId);
+                if (!durable || !isDeepStrictEqual(durable, request)) {
+                    throw new WorkHubActionGateFailure('action_conflict', 'WorkHub stop request identity changed');
+                }
+            },
+            unknownOutcomeMessage: 'WorkHub stop resolution outcome is unknown',
+        });
+    }
     #abortReplacement(input) {
         const replacement = input.replacement;
-        const suffix = workHubReplacementIdentitySuffix(replacement.replacesDelegationId);
-        return this.#commitReplacementFact({
+        const suffix = workHubDestructiveClaimIdentitySuffix(replacement.replacesDelegationId);
+        return this.#commitCoordinationFact({
             read: () => this.#stores.readWorkHubReplacementAbort(replacement.replacesDelegationId),
             build: (existing) => ({
                 type: 'workhub_coordination',
@@ -159,8 +276,8 @@ export class HostWorkHubCoordinationCoordinator {
             unknownOutcomeMessage: 'WorkHub replacement abort outcome is unknown',
         });
     }
-    #commitReplacementFact(options) {
-        return this.#admission.run(WORKHUB_COORDINATION_SESSION_ID, async (lease) => {
+    #commitCoordinationFact(options) {
+        return this.#admission.runMany(options.admissionSessionIds ?? [WORKHUB_COORDINATION_SESSION_ID], async (lease) => {
             const existing = await options.read();
             const requested = options.build(existing);
             if (existing) {
@@ -445,7 +562,28 @@ function validCoordinationHeader(header) {
 function digest(value) {
     return `sha256:${createHash('sha256').update(JSON.stringify(value)).digest('hex')}`;
 }
-function workHubReplacementIdentitySuffix(delegationId) {
+function activeWorkHubAssignments(messages) {
+    const terminalDelegationIds = new Set();
+    const assignments = [];
+    for (const message of messages) {
+        if (message.type !== 'workhub_coordination')
+            continue;
+        if (message.kind === 'delegation_assigned') {
+            assignments.push(message);
+        }
+        else if (message.kind === 'delegation_superseded') {
+            terminalDelegationIds.add(message.supersededDelegationId);
+        }
+        else if (message.kind === 'delegation_replacement_aborted') {
+            terminalDelegationIds.add(message.abortedDelegationId);
+        }
+        else if (message.kind === 'delegation_stop_resolved' && message.outcome !== 'not_owned') {
+            terminalDelegationIds.add(message.stopsDelegationId);
+        }
+    }
+    return assignments.filter(({ delegationId }) => !terminalDelegationIds.has(delegationId));
+}
+function workHubDestructiveClaimIdentitySuffix(delegationId) {
     return createHash('sha256').update(delegationId, 'utf8').digest('hex').slice(0, 48);
 }
 function coordinationSummaryMessageId(turnId, kind) {

package/node_modules/@maka/runtime-host/dist/transport/peer-native.js

@@ -69,6 +69,7 @@ export function startRuntimeHostPeerEndpoint(input) {
     try {
         const endpoint = loadNativeModule(input.nativePath).startPeerEndpoint({
             keyPath: input.keyPath,
+            ...(input.relayAnchorPath ? { relayAnchorPath: input.relayAnchorPath } : {}),
             ...(input.expectedPeerId ? { expectedPeerId: input.expectedPeerId } : {}),
             ...(input.listenAddresses ? { listenAddresses: input.listenAddresses } : {}),
             ...(input.coordinationRelays ? { coordinationRelays: input.coordinationRelays } : {}),
@@ -281,20 +282,24 @@ function isPeerNativeEndpoint(value) {
         value !== null &&
         'peerId' in value &&
         isPeerId(value.peerId) &&
-        'listenAddresses' in value &&
-        Array.isArray(value.listenAddresses) &&
-        value.listenAddresses.every((address) => typeof address === 'string') &&
-        'activeCoordinationRelays' in value &&
-        Array.isArray(value.activeCoordinationRelays) &&
-        value.activeCoordinationRelays.every((address) => typeof address === 'string') &&
+        'reachabilitySnapshot' in value &&
+        isPeerReachabilitySnapshot(value.reachabilitySnapshot) &&
+        'connectivitySnapshot' in value &&
+        isPeerConnectivitySnapshot(value.connectivitySnapshot) &&
         'transitSnapshot' in value &&
         isPeerTransitSnapshot(value.transitSnapshot) &&
         'connect' in value &&
         typeof value.connect === 'function' &&
         'connectMeshControl' in value &&
         typeof value.connectMeshControl === 'function' &&
+        'updateConnect' in value &&
+        typeof value.updateConnect === 'function' &&
         'configureTransit' in value &&
         typeof value.configureTransit === 'function' &&
+        'watchReachability' in value &&
+        typeof value.watchReachability === 'function' &&
+        'watchConnectivity' in value &&
+        typeof value.watchConnectivity === 'function' &&
         'cancelConnect' in value &&
         typeof value.cancelConnect === 'function' &&
         'accept' in value &&
@@ -304,6 +309,27 @@ function isPeerNativeEndpoint(value) {
         'close' in value &&
         typeof value.close === 'function');
 }
+function isPeerConnectivitySnapshot(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'generation' in value &&
+        isCount(value.generation) &&
+        'connectedPeerIds' in value &&
+        Array.isArray(value.connectedPeerIds) &&
+        value.connectedPeerIds.every((peerId) => typeof peerId === 'string'));
+}
+function isPeerReachabilitySnapshot(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'generation' in value &&
+        isCount(value.generation) &&
+        'listenAddresses' in value &&
+        Array.isArray(value.listenAddresses) &&
+        value.listenAddresses.every((address) => typeof address === 'string') &&
+        'activeCoordinationRelays' in value &&
+        Array.isArray(value.activeCoordinationRelays) &&
+        value.activeCoordinationRelays.every((address) => typeof address === 'string'));
+}
 function isPeerTransitSnapshot(value) {
     return (typeof value === 'object' &&
         value !== null &&

package/node_modules/@maka/runtime-host/package.json

@@ -9,6 +9,7 @@
     "./protocol": "./dist/protocol/index.js",
     "./client": "./dist/client/index.js",
     "./webrtc-stun-policy": "./dist/webrtc-stun-policy.js",
+    "./peer-reachability": "./dist/peer-reachability/index.js",
     "./peer-mesh": "./dist/peer-mesh/index.js",
     "./operator": "./dist/operator/index.js",
     "./operator/update-package-evidence": "./dist/operator/update-package-evidence.js",

package/node_modules/@maka/storage/dist/agent-run-store.js

@@ -1249,8 +1249,10 @@ function assertRootTurnAdmissionContract(admission) {
     if (admission.skillInvocation && execution.kind !== 'external_message') {
         throw new Error('Invalid root turn admission contract: Skill invocation requires external message execution');
     }
-    if (admission.authorization && execution.kind !== 'external_message') {
-        throw new Error('Invalid root turn admission contract: authorization proof requires external message execution');
+    if (admission.authorization &&
+        execution.kind !== 'external_message' &&
+        execution.kind !== 'regenerate') {
+        throw new Error('Invalid root turn admission contract: authorization proof requires external message or regenerate execution');
     }
     if (execution.kind === 'claimed_agent_graph_intent') {
         if (execution.claim.targetSessionId !== admission.sessionId ||
@@ -1410,12 +1412,23 @@ function normalizeRootExecutionDescriptor(value) {
         return Object.freeze({ kind: 'context_compact' });
     }
     if (value.kind === 'scheduled_task') {
-        if (!hasExactKeys(value, ['kind', 'scheduledTaskId']) ||
+        if (!hasExactKeys(value, [
+            'kind',
+            'scheduledTaskId',
+            ...(Object.hasOwn(value, 'executionFingerprint') ? ['executionFingerprint'] : []),
+        ]) ||
             typeof value.scheduledTaskId !== 'string' ||
-            !isSafeId(value.scheduledTaskId)) {
+            !isSafeId(value.scheduledTaskId) ||
+            (value.executionFingerprint !== undefined && !isSha256Digest(value.executionFingerprint))) {
             throw new Error('Invalid root execution descriptor');
         }
-        return Object.freeze({ kind: 'scheduled_task', scheduledTaskId: value.scheduledTaskId });
+        return Object.freeze({
+            kind: 'scheduled_task',
+            scheduledTaskId: value.scheduledTaskId,
+            ...(value.executionFingerprint !== undefined
+                ? { executionFingerprint: value.executionFingerprint }
+                : {}),
+        });
     }
     if (value.kind === 'automation' || value.kind === 'legacy_automation') {
         if (!hasExactKeys(value, ['kind', 'automationId']) ||

package/node_modules/@maka/storage/dist/codex-session-adapter.js

@@ -260,6 +260,7 @@ function convertCodexRollout(text, expectedSessionId, fallbackName, fallbackCwd)
                     const text = codexCompletedItemText(item);
                     if (text.length === 0)
                         continue;
+                    const providerOptions = codexAssistantProviderOptions(item);
                     messages.push({
                         type: 'assistant',
                         id: stringField(item, 'id') ??
@@ -267,6 +268,7 @@ function convertCodexRollout(text, expectedSessionId, fallbackName, fallbackCwd)
                         turnId: ensureTurnId(record.line),
                         ts: timestampFor(record),
                         text,
+                        ...(providerOptions !== undefined ? { providerOptions } : {}),
                         modelId: activeModel,
                         contentOrder: ['text'],
                     });
@@ -313,12 +315,14 @@ function convertCodexRollout(text, expectedSessionId, fallbackName, fallbackCwd)
                 const text = stringField(payload, 'message');
                 if (!text)
                     continue;
+                const providerOptions = codexAssistantProviderOptions(payload);
                 messages.push({
                     type: 'assistant',
                     id: generatedCodexId(expectedSessionId, 'assistant', record.line),
                     turnId: ensureTurnId(record.line),
                     ts: timestampFor(record),
                     text,
+                    ...(providerOptions !== undefined ? { providerOptions } : {}),
                     modelId: activeModel,
                     contentOrder: ['text'],
                 });
@@ -698,6 +702,16 @@ function stringField(record, field) {
     const value = record?.[field];
     return typeof value === 'string' && value.length > 0 ? value : undefined;
 }
+function codexAssistantProviderOptions(record) {
+    const phase = record?.phase;
+    if (phase !== 'commentary' && phase !== 'final_answer')
+        return undefined;
+    return {
+        openai: {
+            phase,
+        },
+    };
+}
 function isSafeCodexSessionId(value) {
     return typeof value === 'string' && CODEX_SESSION_ID_PATTERN.test(value);
 }

package/node_modules/@maka/storage/dist/execution-stores.js

@@ -127,6 +127,10 @@ async function createExecutionStoresForWrite(lease, kind, extension) {
             readWorkHubReplacement: (delegationId) => run(() => sessionStore.readWorkHubReplacement(delegationId)),
             readWorkHubReplacementAbort: (delegationId) => run(() => sessionStore.readWorkHubReplacementAbort(delegationId)),
             readWorkHubSupersession: (delegationId) => run(() => sessionStore.readWorkHubSupersession(delegationId)),
+            readWorkHubStopRequest: (delegationId) => run(() => sessionStore.readWorkHubStopRequest(delegationId)),
+            readWorkHubStopResolution: (delegationId) => run(() => sessionStore.readWorkHubStopResolution(delegationId)),
+            claimWorkHubAction: (claim) => run(() => sessionStore.claimWorkHubAction(claim)),
+            readWorkHubActionClaim: (actionId) => run(() => sessionStore.readWorkHubActionClaim(actionId)),
             discardStableConversationCopy: (sessionId, requestFingerprint) => run(() => sessionStore.discardStableConversationCopy(sessionId, requestFingerprint)),
             createSubagent: (input, initialBoundary) => run(() => sessionStore.createSubagent(input, initialBoundary)),
             createAgentGraphOperator: (input, request, expectedRevision, initialBoundary) => run(() => sessionStore.createAgentGraphOperator(input, request, expectedRevision, initialBoundary)),
@@ -162,6 +166,7 @@ async function createExecutionStoresForWrite(lease, kind, extension) {
             commitMessageAdmission: (admission) => run(() => sessionStore.commitMessageAdmission(admission)),
             readMessageAdmission: (sessionId, messageId) => run(() => sessionStore.readMessageAdmission(sessionId, messageId)),
             hasCancelledMessageAdmission: (sessionId, messageId) => run(() => sessionStore.hasCancelledMessageAdmission(sessionId, messageId)),
+            claimMessageAdmissionCancellation: (sessionId, messageId, claimId) => run(() => sessionStore.claimMessageAdmissionCancellation(sessionId, messageId, claimId)),
             listMessageAdmissions: (sessionId) => run(() => sessionStore.listMessageAdmissions(sessionId)),
             markMessagesHandedOff: (input) => run(() => sessionStore.markMessagesHandedOff(input)),
             updateMessageAdmission: (admission) => run(() => sessionStore.updateMessageAdmission(admission)),

package/node_modules/@maka/storage/dist/interaction-store.js

@@ -19,7 +19,7 @@
 import { resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { clientCapabilityScopeIdentity, decodeClientCapabilitySessionGrant, decodeClientCapabilitySessionGrantKey, } from '@maka/core/client-capability-grant';
-import { decodeInteractionCanonicalOutcome, decodeInteractionRequest, interactionCanonicalOutcomesEquivalent, isInteractionCanonicalOutcomeValidForRequest, projectInteractionQuestionRequest, } from '@maka/core/interaction';
+import { decodeInteractionCanonicalOutcome, decodeInteractionRequest, interactionCanonicalOutcomesEquivalent, isInteractionCanonicalOutcomeValidForRequest, projectInteractionFormRequest, projectInteractionQuestionRequest, } from '@maka/core/interaction';
 import { assertStorageRootLease, runWithStorageRootLease, StorageRootAuthorityError, } from './root-authority.js';
 import { acquireOperationalStateDatabase, } from './operational-state-store.js';
 const SAFE_ID = /^[A-Za-z0-9_-]{1,128}$/;
@@ -420,6 +420,18 @@ function normalizeRequest(value, source) {
                 decodeFailure(source, 'Interaction question request is not canonical safe text');
             request = canonical;
         }
+        else if (request.kind === 'form') {
+            const canonical = projectInteractionFormRequest({
+                toolUseId: request.toolUseId,
+                message: request.message,
+                requester: request.requester,
+                fields: request.fields,
+            });
+            if (!isDeepStrictEqual(request, canonical)) {
+                decodeFailure(source, 'Interaction form request is not canonical');
+            }
+            request = canonical;
+        }
     }
     catch (error) {
         if (error instanceof InteractionStoreError)

package/node_modules/@maka/storage/dist/runtime-policy/connection-catalog-document.js

@@ -18,7 +18,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
-import { CONNECTION_CATALOG_MAX_CONNECTIONS, decodeCanonicalConnectionCatalogEntry, decodeConnectionSlug, decodeConnectionTarget, decodeConnectionTestSummary, decodeProviderType, decodeRuntimePolicyEntityId, normalizeConnectionCatalogEntryUpdateForProvider, normalizeConnectionModelDiscoveryResult, normalizeCreateCatalogConnectionInput, normalizeRemoveCatalogConnectionInput, normalizeSetDefaultConnectionTargetInput, normalizeUpdateCatalogConnectionInput, } from '@maka/core/runtime-policy';
+import { CONNECTION_CATALOG_MAX_CONNECTIONS, decodeCanonicalConnectionCatalogEntry, decodeConnectionName, decodeConnectionSlug, decodeConnectionTarget, decodeConnectionTestSummary, decodeProviderType, decodeRuntimePolicyEntityId, normalizeConnectionCatalogEntryUpdateForProvider, normalizeConnectionModelDiscoveryResult, normalizeCreateCatalogConnectionInput, normalizeRemoveCatalogConnectionInput, normalizeSetDefaultConnectionTargetInput, normalizeUpdateCatalogConnectionInput, } from '@maka/core/runtime-policy';
 import { PROVIDER_REGISTRY, reconcileConnectionAfterModelFetch } from '@maka/core/llm-connections';
 import { modelIdAliasesForProvider } from '@maka/core/model-metadata';
 import { isRetiredProvider } from '@maka/core/provider-registry';
@@ -354,10 +354,11 @@ export class ConnectionCatalogDocumentOwner {
         const { lastTest: _lastTest, ...discoveredWithoutLastTest } = discovered;
         return this.writePatchedResult(root, current, index, testBasisChanged ? discoveredWithoutLastTest : discovered, defaultTarget);
     }
-    prepareOnboardingUpsert(current, rawConnectionId, rawSlug, rawProviderType, rawBaseUrl, rawEnabledModelIds, rawResult, invalidateLastTest) {
+    prepareOnboardingUpsert(current, rawConnectionId, rawSlug, rawProviderType, rawName, rawBaseUrl, rawEnabledModelIds, rawResult, invalidateLastTest) {
         const connectionId = decodeConnectionInput(() => decodeRuntimePolicyEntityId(rawConnectionId));
         const slug = decodeConnectionInput(() => decodeConnectionSlug(rawSlug));
         const providerType = decodeConnectionInput(() => decodeProviderType(rawProviderType));
+        const requestedName = rawName === null ? null : decodeConnectionInput(() => decodeConnectionName(rawName));
         const definition = PROVIDER_REGISTRY[providerType];
         // Identity first: the intent's connectionId names the connection being
         // edited, whatever slug it lives under — a relay created in Desktop under
@@ -389,7 +390,9 @@ export class ConnectionCatalogDocumentOwner {
         // existing override or the registry default (blank-reuse, like the key).
         const effectiveBaseUrl = rawBaseUrl ?? previous?.baseUrl ?? definition.baseUrl;
         const changes = decodeConnectionInput(() => normalizeConnectionCatalogEntryUpdateForProvider({
-            name: previous?.name ?? definition.label,
+            // An edit keeps the stored name; a create takes the caller's choice
+            // when the wizard collected one, else the provider label.
+            name: previous?.name ?? requestedName ?? definition.label,
             ...(effectiveBaseUrl ? { baseUrl: effectiveBaseUrl } : {}),
             enabled: true,
             enabledModelIds: rawEnabledModelIds,
@@ -427,6 +430,9 @@ export class ConnectionCatalogDocumentOwner {
         const { relayModelProfiles: _staleProfiles, ...baseWithoutProfiles } = base;
         const finalized = {
             ...baseWithoutProfiles,
+            // `changes.name` carries the edit-preserving / create-requested / provider
+            // -label resolution — `base` alone would keep the provider label forever.
+            name: changes.name,
             ...(relayModelProfiles ? { relayModelProfiles } : {}),
             ...(changes.baseUrl !== undefined ? { baseUrl: changes.baseUrl } : {}),
             revision: previous ? nextRevision(previous.revision) : 1,

package/node_modules/@maka/storage/dist/runtime-policy/coordinator.js

@@ -18,7 +18,7 @@
  */
 import { randomUUID } from 'node:crypto';
 import { isDeepStrictEqual } from 'node:util';
-import { CONNECTION_CATALOG_MAX_CONNECTIONS, decodeConnectionModelId, connectionCredentialTarget, decodeConnectionCredentialTarget, decodeConnectionSlug, decodeProviderType, decodeRuntimePolicyEntityId, decodeCredentialLocator, normalizeDeleteCredentialInput, normalizeRemoveCatalogConnectionInput, normalizeRequestHeaderUpdates, normalizeRequestHeaders, normalizeSetCredentialInput, parseRequestHeaders, serializeRequestHeaders, RequestCustomizationValidationError, normalizeCredentialSecret, normalizeCatalogConnectionBaseUrl, normalizeNetworkProxyUpdate, networkProxyCredentialTarget, } from '@maka/core/runtime-policy';
+import { CONNECTION_CATALOG_MAX_CONNECTIONS, decodeConnectionModelId, connectionCredentialTarget, decodeConnectionCredentialTarget, decodeConnectionName, decodeConnectionSlug, decodeProviderType, decodeRuntimePolicyEntityId, decodeCredentialLocator, normalizeDeleteCredentialInput, normalizeRemoveCatalogConnectionInput, normalizeRequestHeaderUpdates, normalizeRequestHeaders, normalizeSetCredentialInput, parseRequestHeaders, serializeRequestHeaders, RequestCustomizationValidationError, normalizeCredentialSecret, normalizeCatalogConnectionBaseUrl, normalizeNetworkProxyUpdate, networkProxyCredentialTarget, } from '@maka/core/runtime-policy';
 import { applyModelFactOverridesToConnection, applyModelFactOverridesToCatalogSnapshot, } from '@maka/core/model-facts';
 import { deriveProviderAuthContract } from '@maka/core/provider-auth';
 import { isRetiredProvider } from '@maka/core/provider-registry';
@@ -794,13 +794,21 @@ export class RuntimePolicyCoordinator {
             const requestedTarget = input.target;
             if (requestedTarget.kind === 'create') {
                 const providerType = decodeConnectionInput(() => decodeProviderType(requestedTarget.providerType));
+                const requestedSlug = requestedTarget.slug === undefined
+                    ? null
+                    : decodeConnectionInput(() => decodeConnectionSlug(requestedTarget.slug));
                 target = {
                     kind: 'create',
                     candidate: {
                         connectionId: randomUUID(),
-                        slug: deriveConnectionSlug(providerType, catalog.connections.map((connection) => connection.slug)),
+                        slug: requestedSlug ??
+                            deriveConnectionSlug(providerType, catalog.connections.map((connection) => connection.slug)),
                         providerType,
                     },
+                    slugRequested: requestedSlug !== null,
+                    name: requestedTarget.name === undefined
+                        ? null
+                        : decodeConnectionInput(() => decodeConnectionName(requestedTarget.name)),
                 };
             }
             else if (requestedTarget.kind === 'existing') {
@@ -822,16 +830,22 @@ export class RuntimePolicyCoordinator {
                 throw codecError('invalid_connection_input', 'Unknown connection onboarding target');
             }
             const providerType = target.candidate.providerType;
-            // Onboarding guards the api_key credential slot; a provider whose auth
-            // never uses one has no business here (the Host gates on the same
-            // predicate, this keeps the storage API honest on its own).
-            if (!providerAuthSupportsApiKey(providerType)) {
+            // Onboarding may adopt either an API key or canonical serialized OAuth
+            // material. Providers without a connection credential slot have no
+            // business here (the Host applies the same gate before discovery).
+            if (!providerAuthSupportsApiKey(providerType) &&
+                PROVIDER_REGISTRY[providerType].authKind !== 'oauth_token') {
                 return deepFreeze({ kind: 'provider_unsupported' });
             }
             if (target.kind === 'create' &&
                 catalog.connections.length >= CONNECTION_CATALOG_MAX_CONNECTIONS) {
                 return deepFreeze({ kind: 'catalog_full' });
             }
+            if (target.kind === 'create' &&
+                target.slugRequested &&
+                catalog.connections.some((connection) => connection.slug === target.candidate.slug)) {
+                return deepFreeze({ kind: 'slug_taken' });
+            }
             const baseUrl = input.baseUrl === null
                 ? null
                 : (decodeConnectionInput(() => normalizeCatalogConnectionBaseUrl(input.baseUrl, providerType)) ?? null);
@@ -910,6 +924,9 @@ export class RuntimePolicyCoordinator {
                 if (checked.kind === 'catalog_full') {
                     return deepFreeze({ kind: 'catalog_full' });
                 }
+                if (checked.kind === 'slug_taken') {
+                    return deepFreeze({ kind: 'slug_taken' });
+                }
                 return deepFreeze(checked.kind === 'target_missing'
                     ? { kind: 'target_missing' }
                     : { kind: 'superseded', changed: checked.changed });
@@ -943,6 +960,15 @@ export class RuntimePolicyCoordinator {
         }
         else if (catalog.connections.some((connection) => connection.connectionId === basis.target.candidate.connectionId ||
             connection.slug === basis.target.candidate.slug)) {
+            // A caller-chosen slug losing the race is the caller's to fix, so it
+            // reports distinctly instead of as a generic basis change. A derived
+            // slug colliding still resolves by re-running the wizard, which simply
+            // derives again.
+            if (basis.target.slugRequested &&
+                catalog.connections.some((connection) => connection.slug === basis.target.candidate.slug &&
+                    connection.connectionId !== basis.target.candidate.connectionId)) {
+                return { kind: 'slug_taken' };
+            }
             changed.push('connection');
         }
         else if (catalog.connections.length >= CONNECTION_CATALOG_MAX_CONNECTIONS) {
@@ -974,11 +1000,10 @@ export class RuntimePolicyCoordinator {
         const connectionId = candidate.connectionId;
         let invalidateLastTest = false;
         if (input.suppliedSecret !== null) {
-            const locator = {
-                scope: 'connection',
-                connectionId,
-                kind: 'api_key',
-            };
+            const locator = connectionCredentialLocator(connectionId, PROVIDER_REGISTRY[candidate.providerType].authKind);
+            if (!locator) {
+                throw codecError('invalid_document', 'Onboarding provider has no credential locator');
+            }
             const vault = await this.vault.read(root);
             const credential = findCredential(vault, locator);
             if (credential?.secret !== input.suppliedSecret) {
@@ -1000,11 +1025,15 @@ export class RuntimePolicyCoordinator {
             connectionId,
             slug: candidate.slug,
             providerType: candidate.providerType,
+            name: basis.target.kind === 'create' ? basis.target.name : null,
             baseUrl: basis.baseUrl,
             invalidateLastTest,
         });
-        const catalogPreflight = this.catalog.prepareOnboardingUpsert(catalog, intent.connectionId, intent.slug, intent.providerType, intent.baseUrl, intent.enabledModelIds, intent.discovery, intent.invalidateLastTest);
+        const catalogPreflight = this.catalog.prepareOnboardingUpsert(catalog, intent.connectionId, intent.slug, intent.providerType, intent.name, intent.baseUrl, intent.enabledModelIds, intent.discovery, intent.invalidateLastTest);
         if (catalogPreflight.kind === 'slug_conflict') {
+            if (basis.target.kind === 'create' && basis.target.slugRequested) {
+                return deepFreeze({ kind: 'slug_taken' });
+            }
             return deepFreeze({ kind: 'superseded', changed: ['connection'] });
         }
         if (catalogPreflight.kind === 'catalog_full') {
@@ -1438,7 +1467,7 @@ export class RuntimePolicyCoordinator {
         // Validate the durable identity and final catalog shape before touching
         // the vault. A damaged v2 intent must not rotate a real connection's
         // credential before discovering that its ID/slug pair cannot commit.
-        const prepared = this.catalog.prepareOnboardingUpsert(catalog, intent.connectionId, slug, intent.providerType, intent.baseUrl, intent.enabledModelIds, intent.discovery, intent.invalidateLastTest);
+        const prepared = this.catalog.prepareOnboardingUpsert(catalog, intent.connectionId, slug, intent.providerType, intent.name, intent.baseUrl, intent.enabledModelIds, intent.discovery, intent.invalidateLastTest);
         if (prepared.kind === 'slug_conflict') {
             throw codecError('invalid_document', intent.schemaVersion === 1
                 ? 'Legacy onboarding intent conflicts with the connection id'
@@ -1448,11 +1477,10 @@ export class RuntimePolicyCoordinator {
             throw codecError('invalid_document', 'Onboarding intent exceeds the connection catalog');
         }
         if (intent.suppliedSecret !== null) {
-            const locator = {
-                scope: 'connection',
-                connectionId: intent.connectionId,
-                kind: 'api_key',
-            };
+            const locator = connectionCredentialLocator(intent.connectionId, PROVIDER_REGISTRY[intent.providerType].authKind);
+            if (!locator) {
+                throw codecError('invalid_document', 'Onboarding provider has no credential locator');
+            }
             const vault = await this.vault.read(root);
             const existing = findCredential(vault, locator);
             if (existing?.secret !== intent.suppliedSecret) {
@@ -1696,7 +1724,9 @@ function requiresNetworkProxyCredential(networkProxy) {
     return networkProxy.enabled && networkProxy.authEnabled;
 }
 function isInteractiveOAuthLoginProvider(providerType) {
-    return providerType === 'openai-codex' || providerType === 'xai-oauth';
+    return (providerType === 'openai-codex' ||
+        providerType === 'xai-oauth' ||
+        providerType === 'github-copilot');
 }
 function normalizeInteractiveOAuthLoginInput(input) {
     const attemptId = decodeInteractiveOAuthAttemptId(input?.attemptId, 'invalid_connection_input');