maka-agent 0.2.0-dev.14.20260902 → 0.2.0-dev.16.20260903

package/dist/runtime-host-openrc-service.js

@@ -0,0 +1,469 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { lstat, mkdir, open, readFile, readdir, realpath, stat } from 'node:fs/promises';
+import { homedir, userInfo } from 'node:os';
+import { dirname, isAbsolute, join } from 'node:path';
+import { RUNTIME_HOST_SERVICE_LOG_MAX_BYTES, } from '@maka/runtime-host/operator';
+import { resolveXdgConfigHome } from '@maka/storage/workspace-root';
+import { readStableBoundedFile } from '@maka/storage/stable-storage';
+import { formatRuntimeHostServiceLogs, removeRuntimeHostServiceFile, RuntimeHostServiceManagerError, writeRuntimeHostServiceFile, } from './runtime-host-service-manager.js';
+import { RUNTIME_HOST_UPDATE_INITIAL_DELAY_SECONDS, RUNTIME_HOST_UPDATE_INTERVAL_SECONDS, RUNTIME_HOST_UPDATE_RANDOM_DELAY_SECONDS, } from './runtime-host-service-launch.js';
+import { runRuntimeHostServiceManagerCommand, } from './runtime-host-service-manager-process.js';
+import { assertRuntimeHostProviderDefinition, } from './runtime-host-lifecycle-provider.js';
+export function createOpenRcRuntimeHostLifecycleProvider(serviceId, provider, options = {}) {
+    assertServiceId(serviceId);
+    const env = options.env ?? process.env;
+    const homeDir = options.homeDir ?? homedir();
+    const paths = options.paths ?? defaultPaths(provider, serviceId, env, homeDir);
+    const run = options.runCommand ?? defaultRunOpenRcCommand;
+    const host = createContext(provider, serviceId, '', 'host', paths, run);
+    const update = createContext(provider, serviceId, '-update', 'update', paths, run);
+    const updateCommandPath = join(paths.artifactDirectory, 'update');
+    const uid = options.uid ?? process.getuid?.();
+    const preflight = async () => {
+        if (provider === 'openrc_system' && uid !== 0) {
+            throw unavailable('OpenRC system services require an explicit root session; sudo is not used');
+        }
+        if (provider === 'openrc_user') {
+            const runtimeDirectory = env.XDG_RUNTIME_DIR;
+            if (!runtimeDirectory || !isAbsolute(runtimeDirectory)) {
+                throw unavailable('OpenRC user services require an absolute XDG_RUNTIME_DIR');
+            }
+            const runtime = await stat(runtimeDirectory).catch(() => undefined);
+            if (!runtime?.isDirectory()) {
+                throw unavailable('OpenRC user services require an active XDG_RUNTIME_DIR');
+            }
+            if (!(await detectOpenRcUserSessionActivation(currentUsername()))) {
+                throw unavailable('OpenRC user services are not configured for automatic session or boot activation; use an on-demand Runtime Host');
+            }
+        }
+        await requireProbe(run, 'supervise-daemon', ['--help'], false);
+        await requireProbe(run, 'rc-service', ['--help'], false);
+        const runlevel = await requireProbe(run, 'rc-status', [...scopeArgs(provider), '--runlevel']);
+        if (runlevel.stdout.trim() !== 'default') {
+            throw unavailable('The OpenRC default runlevel is not active');
+        }
+        await requireProbe(run, 'rc-update', [...scopeArgs(provider), 'show', 'default']);
+    };
+    return {
+        supervisor: {
+            provider,
+            preflight,
+            converge: (definition) => convergeOpenRcService(host, definition),
+            verify: (definition) => verifyOpenRcService(host, definition),
+            status: () => readOpenRcSupervisorStatus(host),
+            activate: () => startOpenRcService(host),
+            retire: () => stopOpenRcService(host),
+            logs: () => readOpenRcLogs(host),
+            uninstall: () => uninstallOpenRcService(host),
+        },
+        reconciliationTrigger: {
+            provider: 'openrc_supervised_loop',
+            converge: (definition) => convergeOpenRcService(update, definition, updateCommandPath),
+            verify: (definition) => verifyOpenRcService(update, definition, updateCommandPath),
+            status: async () => {
+                const observed = await readOpenRcStatus(update);
+                return { installed: observed.installed, active: observed.active };
+            },
+            activate: () => startOpenRcService(update),
+            logs: () => readOpenRcLogs(update),
+            uninstall: () => uninstallOpenRcService(update, updateCommandPath),
+        },
+    };
+}
+function renderOpenRcReconciliationLoop(definition) {
+    assertRuntimeHostProviderDefinition(definition);
+    const command = definition.command.map(quoteShellWord).join(' ');
+    return [
+        '#!/bin/sh',
+        'umask 077',
+        `initial_delay=${String(RUNTIME_HOST_UPDATE_INITIAL_DELAY_SECONDS)}`,
+        `random_delay=${String(RUNTIME_HOST_UPDATE_RANDOM_DELAY_SECONDS)}`,
+        "now=$(date +%s 2>/dev/null || printf '0')",
+        'sleep "$((initial_delay + now % (random_delay + 1)))"',
+        'while :; do',
+        `  ${command} || :`,
+        `  sleep ${String(RUNTIME_HOST_UPDATE_INTERVAL_SECONDS)}`,
+        'done',
+        '',
+    ].join('\n');
+}
+function renderOpenRcService(context, definition, periodicCommandPath) {
+    const command = periodicCommandPath ? '/bin/sh' : definition.command[0];
+    const commandArguments = periodicCommandPath
+        ? [periodicCommandPath]
+        : definition.command.slice(1);
+    return [
+        '#!/sbin/openrc-run',
+        `description=${quoteShellWord(context.name)}`,
+        'supervisor=supervise-daemon',
+        `command=${quoteDoubleQuotedShellValue(quoteShellWord(command))}`,
+        `command_args=${quoteDoubleQuotedShellValue(commandArguments.map(quoteShellWord).join(' '))}`,
+        `output_log=${quoteDoubleQuotedShellValue(quoteShellWord(context.stdoutPath))}`,
+        `error_log=${quoteDoubleQuotedShellValue(quoteShellWord(context.stderrPath))}`,
+        'retry=TERM/20/KILL/5',
+        'respawn_delay=2',
+        'respawn_max=0',
+        '',
+    ].join('\n');
+}
+async function convergeOpenRcService(context, definition, periodicCommandPath) {
+    assertRuntimeHostProviderDefinition(definition);
+    await stopOpenRcService(context);
+    await mkdir(dirname(context.stdoutPath), { recursive: true, mode: 0o700 });
+    await writeRuntimeHostServiceFile(context.servicePath, renderOpenRcService(context, definition, periodicCommandPath), 0o700);
+    if (periodicCommandPath) {
+        await writeRuntimeHostServiceFile(periodicCommandPath, renderOpenRcReconciliationLoop(definition), 0o700);
+    }
+    await requireOpenRc(context, 'rc-update', [...scopeArgs(context.provider), 'add', context.name, 'default'], 'Enabling the Runtime Host OpenRC service failed');
+}
+async function verifyOpenRcService(context, definition, periodicCommandPath) {
+    assertRuntimeHostProviderDefinition(definition);
+    const expectedService = renderOpenRcService(context, definition, periodicCommandPath);
+    const [service, enabled] = await Promise.all([
+        readManagedFile(context.servicePath, expectedService),
+        isEnabled(context),
+    ]);
+    const expectedCommand = periodicCommandPath
+        ? renderOpenRcReconciliationLoop(definition)
+        : undefined;
+    const command = expectedCommand
+        ? await readManagedFile(periodicCommandPath, expectedCommand)
+        : undefined;
+    if (service !== expectedService || command !== expectedCommand || !enabled) {
+        throw new RuntimeHostServiceManagerError('target_mismatch', `The ${context.provider} service does not match its managed deployment`);
+    }
+}
+async function readOpenRcSupervisorStatus(context) {
+    const observed = await readOpenRcStatus(context);
+    return { provider: context.provider, ...observed };
+}
+async function readOpenRcStatus(context) {
+    const installed = await isRegularFile(context.servicePath);
+    const enabled = await isEnabled(context);
+    if (!installed) {
+        return {
+            installed: false,
+            enabled,
+            active: false,
+            state: 'not_installed',
+            pid: null,
+            lastExitCode: null,
+        };
+    }
+    let result;
+    try {
+        result = await context.run('rc-service', [
+            ...scopeArgs(context.provider),
+            context.name,
+            'status',
+        ]);
+    }
+    catch (error) {
+        throw unavailable('Unable to query the OpenRC service manager', error);
+    }
+    const active = result.exitCode === 0;
+    return {
+        installed,
+        enabled,
+        active,
+        state: result.exitCode === 0
+            ? 'running'
+            : result.exitCode === 8 || result.exitCode === 4
+                ? 'starting'
+                : result.exitCode === 3 || result.exitCode === 16
+                    ? 'stopped'
+                    : 'failed',
+        pid: active ? await readOpenRcPid(context.pidPath) : null,
+        lastExitCode: null,
+    };
+}
+async function startOpenRcService(context) {
+    if (!(await isRegularFile(context.servicePath)))
+        return;
+    const status = await readOpenRcStatus(context);
+    if (status.active)
+        return;
+    await requireOpenRc(context, 'rc-service', [...scopeArgs(context.provider), context.name, 'start'], 'Starting the Runtime Host OpenRC service failed');
+}
+async function stopOpenRcService(context) {
+    if (!(await isRegularFile(context.servicePath)))
+        return;
+    const status = await readOpenRcStatus(context);
+    if (status.state === 'stopped')
+        return;
+    await requireOpenRc(context, 'rc-service', [...scopeArgs(context.provider), context.name, 'stop'], 'Stopping the Runtime Host OpenRC service failed');
+}
+async function uninstallOpenRcService(context, periodicCommandPath) {
+    await stopOpenRcService(context);
+    if (await pathExists(context.runlevelPath)) {
+        await requireOpenRc(context, 'rc-update', [...scopeArgs(context.provider), 'del', context.name, 'default'], 'Disabling the Runtime Host OpenRC service failed');
+    }
+    await Promise.all([
+        removeRuntimeHostServiceFile(context.servicePath, 'OpenRC service'),
+        ...(periodicCommandPath
+            ? [removeRuntimeHostServiceFile(periodicCommandPath, 'OpenRC command')]
+            : []),
+    ]);
+    const status = await readOpenRcStatus(context);
+    if (status.installed ||
+        status.enabled ||
+        status.active ||
+        (await pathExists(context.runlevelPath))) {
+        throw new RuntimeHostServiceManagerError('uninstall_incomplete', 'The Runtime Host OpenRC service still has managed state');
+    }
+}
+async function readOpenRcLogs(context) {
+    const [stdout, stderr] = await Promise.all([
+        readLogTail(context.stdoutPath),
+        readLogTail(context.stderrPath),
+    ]);
+    return formatRuntimeHostServiceLogs([
+        { label: 'stdout', logs: stdout },
+        { label: 'stderr', logs: stderr },
+    ]);
+}
+function createContext(provider, serviceId, suffix, artifact, paths, run) {
+    const name = `maka-runtime-host-${serviceId}${suffix}`;
+    return {
+        provider,
+        name,
+        servicePath: join(paths.initDirectory, name),
+        runlevelPath: join(paths.runlevelDirectory, name),
+        ...(paths.stateDirectory
+            ? { pidPath: join(paths.stateDirectory, 'options', name, 'child_pid') }
+            : {}),
+        stdoutPath: join(paths.logDirectory, `${artifact}.stdout.log`),
+        stderrPath: join(paths.logDirectory, `${artifact}.stderr.log`),
+        run,
+    };
+}
+function defaultPaths(provider, serviceId, env, homeDir) {
+    if (provider === 'openrc_system') {
+        return {
+            initDirectory: '/etc/init.d',
+            runlevelDirectory: '/etc/runlevels/default',
+            artifactDirectory: join('/etc/maka/runtime-host', serviceId),
+            logDirectory: join('/var/log/maka/runtime-host', serviceId),
+            stateDirectory: '/run/openrc',
+        };
+    }
+    const config = resolveXdgConfigHome(env, homeDir);
+    const stateHome = env.XDG_STATE_HOME && isAbsolute(env.XDG_STATE_HOME)
+        ? env.XDG_STATE_HOME
+        : join(homeDir, '.local', 'state');
+    const runtime = env.XDG_RUNTIME_DIR;
+    return {
+        initDirectory: join(config, 'rc', 'init.d'),
+        runlevelDirectory: join(config, 'rc', 'runlevels', 'default'),
+        artifactDirectory: join(config, 'maka', 'runtime-host', serviceId, 'openrc'),
+        logDirectory: join(stateHome, 'maka', 'runtime-host', serviceId),
+        ...(runtime && isAbsolute(runtime) ? { stateDirectory: join(runtime, 'openrc') } : {}),
+    };
+}
+function scopeArgs(provider) {
+    return provider === 'openrc_user' ? ['--user'] : [];
+}
+async function requireProbe(run, command, args, requireSuccess = true) {
+    let result;
+    try {
+        result = await run(command, args);
+    }
+    catch (error) {
+        throw unavailable(`${command} is unavailable`, error);
+    }
+    if (requireSuccess && result.exitCode !== 0) {
+        throw unavailable(`${command} is unavailable${commandDetail(result)}`);
+    }
+    return result;
+}
+async function requireOpenRc(context, command, args, message) {
+    let result;
+    try {
+        result = await context.run(command, args);
+    }
+    catch (error) {
+        throw unavailable(message, error);
+    }
+    if (result.exitCode !== 0) {
+        throw new RuntimeHostServiceManagerError('service_manager_operation_failed', `${message}${commandDetail(result)}`);
+    }
+}
+function commandDetail(result) {
+    const detail = result.stderr.trim() || result.stdout.trim();
+    return detail ? `: ${detail}` : '';
+}
+async function isEnabled(context) {
+    try {
+        const [target, service] = await Promise.all([
+            realpath(context.runlevelPath),
+            realpath(context.servicePath),
+        ]);
+        return target === service;
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+}
+async function isRegularFile(path) {
+    try {
+        return (await lstat(path)).isFile();
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+}
+async function pathExists(path) {
+    try {
+        await lstat(path);
+        return true;
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return false;
+        throw error;
+    }
+}
+async function readManagedFile(path, expected) {
+    return readStableBoundedFile({
+        path,
+        maxBytes: Buffer.byteLength(expected),
+        invalidFile: () => new RuntimeHostServiceManagerError('target_mismatch', 'A managed OpenRC artifact is not a stable regular file'),
+    })
+        .then((bytes) => {
+        try {
+            return new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch {
+            throw new RuntimeHostServiceManagerError('target_mismatch', 'A managed OpenRC artifact is not valid UTF-8');
+        }
+    })
+        .catch((error) => {
+        if (isNodeError(error, 'ENOENT'))
+            return null;
+        throw error;
+    });
+}
+async function readOpenRcPid(path) {
+    if (!path)
+        return null;
+    try {
+        const value = (await readStableBoundedFile({
+            path,
+            maxBytes: 32,
+            invalidFile: () => new Error('Invalid OpenRC process state'),
+        }))
+            .toString('utf8')
+            .trim();
+        const pid = Number(value);
+        return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return null;
+        return null;
+    }
+}
+async function readLogTail(path) {
+    let file;
+    try {
+        file = await open(path, 'r');
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT'))
+            return '';
+        throw error;
+    }
+    try {
+        const size = (await file.stat()).size;
+        const length = Math.min(size, Math.floor(RUNTIME_HOST_SERVICE_LOG_MAX_BYTES / 2));
+        if (length === 0)
+            return '';
+        const buffer = Buffer.alloc(length);
+        await file.read(buffer, 0, length, size - length);
+        return buffer.toString('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+async function detectOpenRcUserSessionActivation(username) {
+    if (username) {
+        try {
+            const [configured, template] = await Promise.all([
+                realpath(join('/etc/runlevels/default', `user.${username}`)),
+                realpath('/etc/init.d/user'),
+            ]);
+            if (configured === template)
+                return true;
+        }
+        catch (error) {
+            if (!isNodeError(error, 'ENOENT'))
+                throw error;
+        }
+    }
+    let entries;
+    try {
+        entries = await readdir('/etc/pam.d', { withFileTypes: true });
+    }
+    catch (error) {
+        if (isNodeError(error, 'ENOENT') || isNodeError(error, 'EACCES'))
+            return false;
+        throw error;
+    }
+    for (const entry of entries.slice(0, 256)) {
+        if (!entry.isFile())
+            continue;
+        const contents = await readFile(join('/etc/pam.d', entry.name), 'utf8').catch(() => '');
+        if (/^[^#\n]*\bpam_openrc\.so\b/mu.test(contents))
+            return true;
+    }
+    return false;
+}
+function quoteShellWord(value) {
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function quoteDoubleQuotedShellValue(value) {
+    return `"${value.replace(/[\\"$`]/gu, '\\$&')}"`;
+}
+function currentUsername() {
+    try {
+        return userInfo().username;
+    }
+    catch {
+        return undefined;
+    }
+}
+function unavailable(message, cause) {
+    return new RuntimeHostServiceManagerError('service_manager_unavailable', message, cause === undefined ? undefined : { cause });
+}
+async function defaultRunOpenRcCommand(command, args) {
+    return runRuntimeHostServiceManagerCommand(command, args);
+}
+function assertServiceId(serviceId) {
+    if (!/^[a-f0-9]{64}$/u.test(serviceId))
+        throw new TypeError('Invalid Runtime Host service ID');
+}
+function isNodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}

package/dist/runtime-host-run-command.js

@@ -304,7 +304,9 @@ class RuntimeHostRunRuntime {
             if (next.done)
                 break;
             const event = next.value;
-            if (event.type === 'user_question_request' || event.type === 'sandbox_boundary_request') {
+            if (event.type === 'user_question_request' ||
+                event.type === 'form_request' ||
+                event.type === 'sandbox_boundary_request') {
                 continue;
             }
             active.outcome.accept(observationFromSessionEvent(event));
@@ -656,7 +658,9 @@ class NonInteractiveInteractionController {
         await this.#stop(pending);
         throw new Error(pending.request.kind === 'question'
             ? 'interactive user questions are unavailable in non-interactive mode'
-            : 'interactive permission requests are unavailable in non-interactive mode');
+            : pending.request.kind === 'form'
+                ? 'interactive user forms are unavailable in non-interactive mode'
+                : 'interactive permission requests are unavailable in non-interactive mode');
     }
     #fail(error) {
         if (this.#failure)

package/dist/runtime-host-service-command.js

@@ -62,7 +62,7 @@ export async function runRuntimeHostServiceCli(options) {
                     process.stdout.write(`Runtime Host WebSocket is ready at ${endpoint}\n`);
                 }
                 for (const peer of host.peerListeners) {
-                    process.stdout.write(`Runtime Host direct peer is ready as ${peer.peerId} at ${peer.listenAddresses.join(', ')}\n`);
+                    process.stdout.write(`Runtime Host direct peer is ready as ${peer.reachability.lease.peerId} at ${peer.reachability.lease.directRoutes.join(', ')}\n`);
                 }
             },
         });
@@ -99,8 +99,8 @@ export function createRuntimeHostServiceReadyEvent(host) {
             }),
             ...host.peerListeners.map((peer) => ({
                 kind: 'libp2p_direct',
-                peerId: peer.peerId,
-                listenAddresses: peer.listenAddresses,
+                peerId: peer.reachability.lease.peerId,
+                listenAddresses: peer.reachability.lease.directRoutes,
             })),
         ],
     };

package/dist/runtime-host-service-management-command.js

@@ -24,6 +24,7 @@ import { cleanupRuntimeHostManagedDeployment, effectiveRuntimeHostProjectDirecto
 import { createLaunchAgentRuntimeHostService } from './runtime-host-launch-agent-service.js';
 import { createLaunchAgentRuntimeHostLifecycleProvider } from './runtime-host-launch-agent-service.js';
 import { createSystemdUserRuntimeHostLifecycleProvider, createSystemdUserRuntimeHostService, } from './runtime-host-systemd-service.js';
+import { createOpenRcRuntimeHostLifecycleProvider } from './runtime-host-openrc-service.js';
 import { manageRuntimeHostManagedLifecycle } from './runtime-host-managed-lifecycle-manager.js';
 import { acknowledgeRuntimeHostManagedDeploymentCleanup, assertRuntimeHostManagedOperatorDeployment, clearRuntimeHostManagedDeploymentCleanupReceipt, readRuntimeHostManagedDeploymentCleanupReceipt, removeRuntimeHostManagedDeployment, resolveRuntimeHostManagedControlRoot, resolveRuntimeHostManagedDeploymentForCli, } from './runtime-host-managed-deployment.js';
 export async function runManagedRuntimeHostServiceCli(options, overrides = {}) {
@@ -322,25 +323,52 @@ export function createPlatformRuntimeHostServiceBackend(serviceId, clientDataRoo
     throw new RuntimeHostServiceManagerError('unsupported_platform', 'Managed Runtime Host services currently require Linux or macOS');
 }
 export async function discoverRuntimeHostLifecycleProvider(rootId, options = {}) {
-    const selection = selectRuntimeHostLifecycleProvider({
-        platform: options.platform ?? process.platform,
-        environment: options.environment ?? process.env,
+    const platform = options.platform ?? process.platform;
+    const environment = options.environment ?? process.env;
+    if (platform === 'darwin') {
+        const provider = createLaunchAgentRuntimeHostLifecycleProvider(rootId);
+        await provider.supervisor.preflight();
+        return { provider, availability: 'session' };
+    }
+    if (platform !== 'linux') {
+        throw new RuntimeHostServiceManagerError('unsupported_platform', 'Supervised Runtime Host deployments currently require Linux or macOS');
+    }
+    const systemd = createSystemdUserRuntimeHostLifecycleProvider(rootId, {
+        env: environment,
     });
-    const provider = resolveRuntimeHostLifecycleProvider(rootId, selection.provider);
-    await provider.supervisor.preflight();
-    return { provider, availability: selection.availability };
-}
-export function selectRuntimeHostLifecycleProvider(options) {
-    if (options.platform === 'linux') {
+    let systemdError;
+    try {
+        await systemd.supervisor.preflight();
         return {
-            provider: 'systemd_user',
-            availability: isWslEnvironment(options.environment) ? 'environment' : 'machine',
+            provider: systemd,
+            availability: isWslEnvironment(environment) ? 'environment' : 'machine',
         };
     }
-    if (options.platform === 'darwin') {
-        return { provider: 'launch_agent', availability: 'session' };
+    catch (error) {
+        systemdError = error;
+    }
+    const openRcProvider = process.getuid?.() === 0 ? 'openrc_system' : 'openrc_user';
+    const openRc = createOpenRcRuntimeHostLifecycleProvider(rootId, openRcProvider, {
+        env: environment,
+    });
+    try {
+        await openRc.supervisor.preflight();
+        return {
+            provider: openRc,
+            availability: isWslEnvironment(environment)
+                ? 'environment'
+                : openRcProvider === 'openrc_system'
+                    ? 'machine'
+                    : 'session',
+        };
+    }
+    catch (openRcError) {
+        if (systemdError instanceof RuntimeHostServiceManagerError &&
+            systemdError.code === 'linger_disabled') {
+            throw systemdError;
+        }
+        throw new RuntimeHostServiceManagerError('service_manager_unavailable', 'No supervised Linux lifecycle provider is available; configure systemd user lingering or OpenRC activation, or use an on-demand Runtime Host', { cause: new AggregateError([systemdError, openRcError]) });
     }
-    throw new RuntimeHostServiceManagerError('unsupported_platform', 'Supervised Runtime Host deployments currently require Linux or macOS');
 }
 /** Resolves only the provider identity already persisted by the deployment authority. */
 export function resolveRuntimeHostLifecycleProvider(rootId, provider) {
@@ -348,7 +376,7 @@ export function resolveRuntimeHostLifecycleProvider(rootId, provider) {
         return createSystemdUserRuntimeHostLifecycleProvider(rootId, {});
     if (provider === 'launch_agent')
         return createLaunchAgentRuntimeHostLifecycleProvider(rootId);
-    throw new RuntimeHostServiceManagerError('service_manager_unavailable', `The persisted Runtime Host provider ${provider} is unavailable`);
+    return createOpenRcRuntimeHostLifecycleProvider(rootId, provider);
 }
 function isWslEnvironment(environment) {
     return Boolean(environment.WSL_DISTRO_NAME?.trim() || environment.WSL_INTEROP?.trim());

package/dist/runtime-host-session-channel.js

@@ -217,6 +217,9 @@ export class RuntimeHostSessionChannel {
         if (answered.outcome.kind === 'question_answer') {
             this.#emit({ type: 'user_question_answer_ack', ...base });
         }
+        else if (answered.outcome.kind === 'form_answer') {
+            this.#emit({ type: 'form_answer_ack', ...base });
+        }
         else if (answered.outcome.kind === 'sandbox_boundary_decision') {
             this.#emit({
                 type: 'sandbox_boundary_decision_ack',

package/dist/runtime-host-session-driver.js

@@ -415,6 +415,22 @@ class RuntimeHostMakaSessionDriverImpl {
         if (pending)
             this.#channel?.publishInteractionAnswer(answered, pending);
     }
+    async respondToUserForm(response) {
+        const sessionId = this.#requireSession('respond to a user form');
+        const pending = this.#channel?.pendingInteraction(response.requestId);
+        if (pending && pending.request.kind !== 'form') {
+            throw new Error('Interaction is not a form request');
+        }
+        const answered = await this.#request('interaction.answer', {
+            sessionId,
+            interactionId: response.requestId,
+            answer: response.action === 'accept'
+                ? { kind: 'form', action: 'accept', values: response.values }
+                : { kind: 'form', action: response.action },
+        });
+        if (pending)
+            this.#channel?.publishInteractionAnswer(answered, pending);
+    }
     setModel(model, connectionSlug, connectionId) {
         return this.#admit(() => this.#setModel(model, connectionSlug, connectionId));
     }
@@ -639,26 +655,25 @@ class RuntimeHostMakaSessionDriverImpl {
     async openSideConversation() {
         const parentSessionId = this.#requireSession('open a side conversation');
         const messages = await loadCurrentMessages(this.#connection, parentSessionId);
+        // Absent when the parent has no completed turn yet: fork with an empty
+        // context instead of failing, matching the desktop side conversation.
         const sourceTurnId = deriveTurnRecords(messages)
             .reverse()
             .find((turn) => turn.status === 'completed')?.turnId;
-        if (!sourceTurnId) {
-            throw new Error('A side conversation requires at least one completed Turn.');
-        }
         const sideSessionId = this.#newId();
         const cleanup = this.#requireSessionCopyCleanup();
         await cleanup.ownCreation({
             sessionId: sideSessionId,
             kind: 'branch',
             sourceSessionId: parentSessionId,
-            sourceTurnId,
+            ...(sourceTurnId === undefined ? {} : { sourceTurnId }),
             intent: 'side_conversation',
             ownerId: 'tui-side',
         }, () => this.#resumeSessionCopy({
             sessionId: sideSessionId,
             kind: 'branch',
             sourceSessionId: parentSessionId,
-            sourceTurnId,
+            ...(sourceTurnId === undefined ? {} : { sourceTurnId }),
             intent: 'side_conversation',
         }));
         try {
@@ -1111,7 +1126,7 @@ class RuntimeHostMakaSessionDriverImpl {
             const result = await this.#request('session.branch.create', {
                 sourceSessionId: input.sourceSessionId,
                 targetSessionId: input.sessionId,
-                sourceTurnId: input.sourceTurnId,
+                ...(input.sourceTurnId === undefined ? {} : { sourceTurnId: input.sourceTurnId }),
                 expectedSourceRevision: source.revision,
                 ...(input.intent ? { intent: input.intent } : {}),
             });