maka-agent 0.2.0-dev.23.20260906 → 0.2.0-dev.25.20260908

package/dist/tui-copy-catalog.js

@@ -17,6 +17,195 @@
  * under the License.
  */
 export const TUI_COPY_RESOURCES = {
+    todo: {
+        en: {
+            title: 'Current Todo',
+            markedComplete: 'marked complete',
+            open: '/todo to view',
+            usage: 'Usage: /todo',
+            progress: 'Todo',
+            unavailable: 'Todo unavailable',
+            empty: 'No Todo items',
+            loading: 'Loading Todo…',
+            hint: '↑↓/PgUp/PgDn scroll · Home/End · Esc close',
+        },
+        'zh-CN': {
+            title: '当前待办',
+            markedComplete: '标记完成',
+            open: '/todo 查看',
+            usage: '用法：/todo',
+            progress: '待办',
+            unavailable: '待办不可用',
+            empty: '暂无待办',
+            loading: '正在加载待办…',
+            hint: '↑↓/PgUp/PgDn 滚动 · Home/End · Esc 关闭',
+        },
+        'zh-TW': {
+            title: '目前待辦',
+            markedComplete: '標記完成',
+            open: '/todo 查看',
+            usage: '用法：/todo',
+            progress: '待辦',
+            unavailable: '待辦不可用',
+            empty: '沒有待辦',
+            loading: '正在載入待辦…',
+            hint: '↑↓/PgUp/PgDn 捲動 · Home/End · Esc 關閉',
+        },
+    },
+    'transcript-reader': {
+        en: {
+            title: 'DETAILED TRANSCRIPT',
+            scope: 'loaded history',
+            hint: 'Esc/Ctrl+O close · Ctrl+E details · / search · ↑↓/PgUp/PgDn · Home/End',
+            matches: 'matches in displayed text',
+            back: 'return',
+        },
+        'zh-CN': {
+            title: '详细记录',
+            scope: '已加载历史',
+            hint: 'Esc/Ctrl+O 返回 · Ctrl+E 详情 · / 搜索 · ↑↓/PgUp/PgDn · Home/End',
+            matches: '处匹配（当前显示内容）',
+            back: '回到原位置',
+        },
+        'zh-TW': {
+            title: '詳細記錄',
+            scope: '已載入歷史',
+            hint: 'Esc/Ctrl+O 返回 · Ctrl+E 詳情 · / 搜尋 · ↑↓/PgUp/PgDn · Home/End',
+            matches: '處符合（目前顯示內容）',
+            back: '回到原位置',
+        },
+    },
+    'host-owner': {
+        en: {
+            unavailable: 'Runtime Host owner controls are unavailable.',
+            usage: 'Usage: /host [status|stop|restart] or /update [latest|next|version]',
+            pickerTitle: 'Runtime Host owner action',
+            cancel: 'Cancel',
+            cancelDescription: 'Keep this Host and its work running',
+            safe: 'Safe handoff',
+            safeDescription: 'Continue only at a verified safe boundary',
+            interrupt: 'Interrupt active work',
+            interruptDescription: 'May stop work from every attached Surface',
+            pending: 'A Host owner action is already pending.',
+            disconnected: 'The TUI has already disconnected.',
+            foreign: 'This TUI is attached to another Host. Run its owner controls on that Host; /exit only disconnects.',
+            notOwner: 'This npm-global installation does not own the local Host. Use its actual operator; /exit only disconnects.',
+            hostChanged: 'The local Host changed or requires its managed-service operator.',
+            actionSummary: '{action}: {name}',
+            action_stop: 'Stop',
+            action_restart: 'Restart',
+            action_update: 'Update',
+            owner: 'Owner: {owner}',
+            root: 'Root: {root}',
+            epoch: 'Epoch: {epoch}',
+            composition: 'Composition: {composition} ({revision})',
+            activity: 'Connections: {connections}; operations: {operations}; residencies: {residencies}',
+            unknownActivity: 'Activity is unknown. Other Surfaces and autonomous tasks may be affected.',
+            updateSafeOnly: 'Update supports safe handoff only.',
+            invalidTarget: 'Update target must be latest, next, or an exact release version.',
+            updateRequiresSafe: 'TUI update uses safe handoff only. Stop active work explicitly before updating.',
+            installationChanged: 'The npm-global installation changed. Reopen Maka before retrying.',
+            ownerChanged: 'The local Host installation owner changed. Reopen Maka before retrying.',
+            retirementHostChanged: 'The Host changed before owner retirement; no replacement was interrupted.',
+            activityChanged: 'Host activity changed after confirmation. Reopen Maka and confirm the new work before retrying.',
+            stillActive: 'The Host still has active work. Reopen Maka and retry /host {action}; interruption requires a new confirmation.',
+            restartFailed: 'Host restart did not complete: {detail}',
+            status: '{name}: {state}',
+            state_starting: 'Starting',
+            state_containing: 'Containing',
+            state_recovering: 'Recovering',
+            state_ready: 'Ready',
+            state_draining: 'Draining',
+            localOwnerHint: 'Owner controls require this npm-global installation to own the Host. /exit only disconnects.',
+            attachedOwnerHint: 'Attached Host: lifecycle changes require its operator. /exit only disconnects.',
+        },
+        'zh-CN': {
+            unavailable: 'Runtime Host 所有者控制不可用。',
+            usage: '用法：/host [status|stop|restart] 或 /update [latest|next|version]',
+            pickerTitle: 'Runtime Host 所有者操作',
+            cancel: '取消',
+            cancelDescription: '保持此 Host 及其任务运行',
+            safe: '安全交接',
+            safeDescription: '仅在已验证的安全边界继续',
+            interrupt: '中断活动任务',
+            interruptDescription: '可能停止所有已连接界面的任务',
+            pending: '已有 Host 所有者操作等待执行。',
+            disconnected: 'TUI 已断开连接。',
+            foreign: '此 TUI 连接的是其他 Host。请在该 Host 上使用其所有者控制；/exit 仅断开连接。',
+            notOwner: '此 npm-global 安装不是本地 Host 的所有者。请使用实际所有者的控制工具；/exit 仅断开连接。',
+            hostChanged: '本地 Host 已变更，或需要由其托管服务控制工具操作。',
+            actionSummary: '{action}：{name}',
+            action_stop: '停止',
+            action_restart: '重启',
+            action_update: '更新',
+            owner: '所有者：{owner}',
+            root: '根标识：{root}',
+            epoch: '实例标识：{epoch}',
+            composition: '运行组成：{composition}（{revision}）',
+            activity: '连接数：{connections}；操作数：{operations}；常驻任务：{residencies}',
+            unknownActivity: '活动状态未知。其他界面和自主任务可能受到影响。',
+            updateSafeOnly: '更新仅支持安全交接。',
+            invalidTarget: '更新目标必须为 latest、next 或确切的发布版本。',
+            updateRequiresSafe: 'TUI 更新仅使用安全交接。更新前请先显式停止活动任务。',
+            installationChanged: 'npm-global 安装已变更。请重新打开 Maka 后重试。',
+            ownerChanged: '本地 Host 的安装所有者已变更。请重新打开 Maka 后重试。',
+            retirementHostChanged: '停止旧实例前 Host 已变更；未中断替代实例。',
+            activityChanged: '确认后 Host 活动已变更。请重新打开 Maka，确认新的任务后重试。',
+            stillActive: 'Host 仍有活动任务。请重新打开 Maka 并重试 /host {action}；中断需要重新确认。',
+            restartFailed: 'Host 重启未完成：{detail}',
+            status: '{name}：{state}',
+            state_starting: '启动中',
+            state_containing: '故障隔离中',
+            state_recovering: '恢复中',
+            state_ready: '就绪',
+            state_draining: '排空中',
+            localOwnerHint: '仅当此 npm-global 安装拥有该 Host 时才能使用所有者控制。/exit 仅断开连接。',
+            attachedOwnerHint: '已连接的 Host：生命周期变更需由其所有者操作。/exit 仅断开连接。',
+        },
+        'zh-TW': {
+            unavailable: 'Runtime Host 擁有者控制無法使用。',
+            usage: '用法：/host [status|stop|restart] 或 /update [latest|next|version]',
+            pickerTitle: 'Runtime Host 擁有者操作',
+            cancel: '取消',
+            cancelDescription: '保持此 Host 及其工作執行',
+            safe: '安全交接',
+            safeDescription: '僅在已驗證的安全邊界繼續',
+            interrupt: '中斷進行中的工作',
+            interruptDescription: '可能停止所有已連線介面的工作',
+            pending: '已有 Host 擁有者操作等待執行。',
+            disconnected: 'TUI 已中斷連線。',
+            foreign: '此 TUI 連線的是其他 Host。請在該 Host 上使用其擁有者控制；/exit 僅中斷連線。',
+            notOwner: '此 npm-global 安裝不是本機 Host 的擁有者。請使用實際擁有者的控制工具；/exit 僅中斷連線。',
+            hostChanged: '本機 Host 已變更，或需要由其託管服務控制工具操作。',
+            actionSummary: '{action}：{name}',
+            action_stop: '停止',
+            action_restart: '重新啟動',
+            action_update: '更新',
+            owner: '擁有者：{owner}',
+            root: '根識別碼：{root}',
+            epoch: '執行個體識別碼：{epoch}',
+            composition: '執行組成：{composition}（{revision}）',
+            activity: '連線數：{connections}；操作數：{operations}；常駐工作：{residencies}',
+            unknownActivity: '活動狀態未知。其他介面和自主工作可能受到影響。',
+            updateSafeOnly: '更新僅支援安全交接。',
+            invalidTarget: '更新目標必須為 latest、next 或確切的發行版本。',
+            updateRequiresSafe: 'TUI 更新僅使用安全交接。更新前請先明確停止進行中的工作。',
+            installationChanged: 'npm-global 安裝已變更。請重新開啟 Maka 後重試。',
+            ownerChanged: '本機 Host 的安裝擁有者已變更。請重新開啟 Maka 後重試。',
+            retirementHostChanged: '停止舊執行個體前 Host 已變更；未中斷替代執行個體。',
+            activityChanged: '確認後 Host 活動已變更。請重新開啟 Maka，確認新的工作後重試。',
+            stillActive: 'Host 仍有進行中的工作。請重新開啟 Maka 並重試 /host {action}；中斷需要重新確認。',
+            restartFailed: 'Host 重新啟動未完成：{detail}',
+            status: '{name}：{state}',
+            state_starting: '啟動中',
+            state_containing: '故障隔離中',
+            state_recovering: '復原中',
+            state_ready: '就緒',
+            state_draining: '排空中',
+            localOwnerHint: '僅當此 npm-global 安裝擁有該 Host 時才能使用擁有者控制。/exit 僅中斷連線。',
+            attachedOwnerHint: '已連線的 Host：生命週期變更需由其擁有者操作。/exit 僅中斷連線。',
+        },
+    },
     copy: {
         en: {
             copiedLast: 'Sent the last reply to the terminal via OSC 52 · {count, plural, one {# char} other {# chars}} — it reaches the clipboard only if your terminal (and tmux, if used) allows OSC 52 writes.',
@@ -435,6 +624,11 @@ export const TUI_COPY_RESOURCES = {
             modelSearchHint: 'Search models / providers / connections · ↑↓ select · Enter confirm · Esc cancel',
             searchLabel: 'Search',
             noMatchingModels: 'No matching models',
+            resumeSessionTitle: 'Resume Session',
+            sessionScopeCurrent: 'Current',
+            sessionScopeAll: 'All',
+            sessionSearchHint: 'Search name / id / path / model / connection · Tab scope · ↑↓ select · Enter open · Esc close',
+            noMatchingSessions: 'No matching sessions',
             selectPickerHint: '↑↓ select · Enter confirm · Esc close',
             providerConfigured: 'configured',
             addAccount: 'add account',
@@ -525,6 +719,11 @@ export const TUI_COPY_RESOURCES = {
             modelSearchHint: '搜索模型 / 服务商 / 连接 · ↑↓ 选择 · Enter 确认 · Esc 取消',
             searchLabel: '搜索',
             noMatchingModels: '没有匹配的模型',
+            resumeSessionTitle: '恢复会话',
+            sessionScopeCurrent: '当前目录',
+            sessionScopeAll: '全部',
+            sessionSearchHint: '搜索名称 / ID / 路径 / 模型 / 连接 · Tab 切换范围 · ↑↓ 选择 · Enter 打开 · Esc 关闭',
+            noMatchingSessions: '没有匹配的会话',
             selectPickerHint: '↑↓ 选择 · Enter 确认 · Esc 关闭',
             providerConfigured: '已设置',
             addAccount: '添加账号',
@@ -614,6 +813,11 @@ export const TUI_COPY_RESOURCES = {
             modelSearchHint: '搜尋模型 / 服務商 / 連線 · ↑↓ 選擇 · Enter 確認 · Esc 取消',
             searchLabel: '搜尋',
             noMatchingModels: '沒有符合的模型',
+            resumeSessionTitle: '恢復會話',
+            sessionScopeCurrent: '目前目錄',
+            sessionScopeAll: '全部',
+            sessionSearchHint: '搜尋名稱 / ID / 路徑 / 模型 / 連線 · Tab 切換範圍 · ↑↓ 選取 · Enter 開啟 · Esc 關閉',
+            noMatchingSessions: '沒有符合的會話',
             selectPickerHint: '↑↓ 選擇 · Enter 確認 · Esc 關閉',
             providerConfigured: '已設定',
             addAccount: '新增帳號',
@@ -711,7 +915,9 @@ export const TUI_COPY_RESOURCES = {
                 compact: 'Compact session context',
                 context: 'Show latest request context usage',
                 copy: 'Copy the last reply (or /copy all) to the clipboard',
-                exit: 'Exit Maka',
+                exit: 'Disconnect this TUI; leave the attached Host running',
+                host: 'Inspect the Host or stop/restart its local owner',
+                update: 'Update the npm-global CLI and its local Host',
                 goal: 'Show autonomous goal status',
                 graph: 'Show, enable, disable, or run one Graph turn',
                 help: 'Show commands and keybindings',
@@ -730,6 +936,7 @@ export const TUI_COPY_RESOURCES = {
                 skill: 'Invoke a skill (or type /skill:<name> inline)',
                 swarm: 'Show, enable, disable, or run one Swarm turn',
                 thinking: 'Set thinking level',
+                todo: 'Show the current session Todo list',
                 transcript: 'Browse the full transcript inside Maka',
             },
             help: {
@@ -737,7 +944,7 @@ export const TUI_COPY_RESOURCES = {
                 userCommand: '  !<command> — run one shell command visible only to you',
                 keybindingsHeading: 'Keybindings',
                 keybindings: [
-                    '  Ctrl+O — expand or collapse all tool output',
+                    '  Ctrl+O — open detailed transcript (Ctrl+E toggles details inside)',
                     '  Ctrl+T — expand or collapse all thinking in view',
                     '  Scroll the transcript with your terminal or trackpad',
                     '  Enter (during a turn) — steer: inject a message into the running turn',
@@ -762,7 +969,9 @@ export const TUI_COPY_RESOURCES = {
                 compact: '压缩会话上下文',
                 context: '查看最近一次请求的上下文用量',
                 copy: '复制最后一条回复（或 /copy all）到剪贴板',
-                exit: '退出 Maka',
+                exit: '断开此 TUI，保留已连接的 Host',
+                host: '查看 Host 状态或停止、重启本地所有者',
+                update: '更新 npm 全局 CLI 及其本地 Host',
                 goal: '查看自主目标状态',
                 graph: '查看、启用、停用 Graph 模式，或执行一次 Graph 任务',
                 help: '查看命令和快捷键',
@@ -781,6 +990,7 @@ export const TUI_COPY_RESOURCES = {
                 skill: '调用 Skill（也可直接输入 /skill:<name>）',
                 swarm: '查看、启用、停用 Swarm 模式，或执行一次 Swarm 任务',
                 thinking: '设置思考级别',
+                todo: '查看当前会话待办清单',
                 transcript: '在 Maka 内浏览完整对话记录',
             },
             help: {
@@ -788,7 +998,7 @@ export const TUI_COPY_RESOURCES = {
                 userCommand: '  !<command> — 执行一次仅用户可见的 shell 命令',
                 keybindingsHeading: '快捷键',
                 keybindings: [
-                    '  Ctrl+O — 展开或折叠所有工具输出',
+                    '  Ctrl+O — 打开详细记录（其中 Ctrl+E 切换详情）',
                     '  Ctrl+T — 展开或折叠视图中的所有思考块',
                     '  使用终端或触控板滚动对话记录',
                     '  Enter（任务运行中）— 将消息注入当前任务',
@@ -813,7 +1023,9 @@ export const TUI_COPY_RESOURCES = {
                 compact: '壓縮會話上下文',
                 context: '檢視最近一次請求的上下文用量',
                 copy: '複製最後一則回覆（或 /copy all）到剪貼簿',
-                exit: '退出 Maka',
+                exit: '中斷此 TUI，保留已連線的 Host',
+                host: '查看 Host 狀態或停止、重新啟動本機擁有者',
+                update: '更新 npm 全域 CLI 及其本機 Host',
                 goal: '檢視自主目標狀態',
                 graph: '檢視、啟用、停用 Graph 模式，或執行一次 Graph 任務',
                 help: '檢視命令和快捷鍵',
@@ -832,6 +1044,7 @@ export const TUI_COPY_RESOURCES = {
                 skill: '呼叫 Skill（也可直接輸入 /skill:<name>）',
                 swarm: '檢視、啟用、停用 Swarm 模式，或執行一次 Swarm 任務',
                 thinking: '設定思考級別',
+                todo: '檢視目前會話待辦清單',
                 transcript: '在 Maka 內瀏覽完整對話記錄',
             },
             help: {
@@ -839,7 +1052,7 @@ export const TUI_COPY_RESOURCES = {
                 userCommand: '  !<command> — 執行一次僅使用者可見的 shell 命令',
                 keybindingsHeading: '快捷鍵',
                 keybindings: [
-                    '  Ctrl+O — 展開或摺疊所有工具輸出',
+                    '  Ctrl+O — 開啟詳細記錄（其中 Ctrl+E 切換詳情）',
                     '  Ctrl+T — 展開或摺疊檢視中的所有思考區塊',
                     '  使用終端機或觸控板捲動對話記錄',
                     '  Enter（任務執行中）— 將訊息注入目前任務',

package/dist/tui-host-owner-copy.js

@@ -0,0 +1,24 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { defineUiMessageCatalog, resolveUiMessageCatalog, } from '@maka/core/ui-locale';
+import { TUI_COPY_RESOURCES } from './tui-copy-catalog.js';
+const HOST_OWNER_COPY = resolveUiMessageCatalog(defineUiMessageCatalog()(TUI_COPY_RESOURCES['host-owner']));
+export function getTuiHostOwnerCopy(locale) {
+    return HOST_OWNER_COPY[locale];
+}

package/node_modules/@maka/core/dist/agent-run.js

@@ -65,6 +65,7 @@ export const AGENT_RUN_EVENT_TYPES = [
     'sandbox_escalation_applied',
     'sandbox_escalation_failed',
     'sandbox_denial_detected',
+    'request_composition_resolved',
     'model_call_attempt_recorded',
     'history_compact_checkpoint_recorded',
     'model_projection_transition_recorded',

package/node_modules/@maka/core/dist/attachments.js

@@ -251,3 +251,6 @@ export function attachmentKindFromMimeType(mimeType, fileName) {
     }
     return 'other';
 }
+export function attachmentIngestBlocked(code) {
+    return new Error(`attachment_ingest:${code}`);
+}

package/node_modules/@maka/core/dist/canonical-json.js

@@ -0,0 +1,27 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Neutral entrypoint for the strict, key-sorted JSON serializer shared by
+ * identity and persistence authorities.
+ *
+ * The implementation remains in `tool-args-identity` so its existing import
+ * path and wire behavior stay compatible while other packages use a domain-
+ * neutral name.
+ */
+export { stableJsonStringify } from './tool-args-identity.js';

package/node_modules/@maka/core/dist/canonical-runtime-event.js

@@ -93,7 +93,9 @@ function omitUndefinedEnvelopeFields(value) {
         }
         if (descriptor.value === undefined)
             continue;
-        Object.defineProperty(result, key, descriptor);
+        // This is our normalization copy. Frozen snapshots constrain their owner,
+        // not this copy; retaining non-configurable flags prevents normalizing it.
+        Object.defineProperty(result, key, { ...descriptor, configurable: true, writable: true });
     }
     return result;
 }

package/node_modules/@maka/core/dist/capabilities.js

@@ -75,6 +75,41 @@ export const CAPABILITY_READINESS_STATES = [
     'degraded',
     'paused',
 ];
+/**
+ * Stable machine codes for capability and OS-permission reasons. Producers
+ * emit these instead of locale-bound prose; presenters own the code→copy map
+ * per locale. Bot capabilities pass their bridge status reasons through as-is
+ * (`rate-limited`, `gateway-closed-4004`, …), so signal `reason` fields stay
+ * `string` — this union types the desktop producers and the presenter maps.
+ */
+export const CAPABILITY_REASON_CODES = [
+    'disabled',
+    'platform_credentials_missing',
+    'macos_tcc_only',
+    'apple_events_tcc_status_unavailable',
+    'cu_artifact_missing',
+    'cu_backend_status',
+    'cu_backend_unavailable',
+    'cu_executor_undistributable',
+    'cu_executor_stopped',
+    'cu_executor_start_failed',
+    'cu_executor_recovering',
+    'cu_executor_ready',
+    'cu_executor_lazy_start',
+    'activity_recorder_partial',
+    'activity_recorder_probe_hint',
+    'memory_partial',
+    'memory_no_probe',
+    'accessibility_status_ambiguous',
+    'screen_recording_status_mac_only',
+    'notifications_status_unreadable_macos',
+    'notifications_status_unreadable',
+    'notifications_unsupported',
+    'permission_probe_failed',
+];
+export function isCapabilityReasonCode(value) {
+    return (typeof value === 'string' && CAPABILITY_REASON_CODES.includes(value));
+}
 export function isOsPermissionState(value) {
     return typeof value === 'string' && OS_PERMISSION_STATES.includes(value);
 }

package/node_modules/@maka/core/dist/computer-use.js

@@ -81,7 +81,6 @@ export function isComputerUseErrorCode(value) {
     return (typeof value === 'string' && COMPUTER_USE_ERROR_CODES.includes(value));
 }
 export const CU_ACTION_TYPES = ['screenshot', 'type', 'key', 'wait'];
-export const COMPUTER_USE_ACTION_TYPES = CU_ACTION_TYPES;
 /**
  * The semantic actions, which name an element rather than a pixel. They are not
  * in `CU_ACTION_TYPES` because they are not `CuAction`s — they are dispatched

package/node_modules/@maka/core/dist/display-redaction.js

@@ -28,6 +28,24 @@ const PATTERNS = [
         streamingTerminator: /[\s"'<>]/,
         streamingValueGroup: 3,
     },
+    // URL userinfo:  https://user:pass@host  /  https://token@host
+    // Structural — any authority that contains `@` is credential-bearing, so
+    // this does not depend on a provider prefix list. Runs before the query
+    // rule so only the userinfo is replaced and host/path survive.
+    // Character class matches streamingTerminator so a bare `https://host`
+    // cannot swallow later `@` across whitespace/quotes/angle brackets.
+    // Known boundary: punctuation like commas can still join a bare URL to a
+    // later `@`; a proper fix would restrict userinfo to the RFC 3986 set.
+    // http(s) only for now. Streaming cannot recognize userinfo before `@`
+    // arrives (`https://user:pa` stays clear until then); tightening earlier
+    // would eat `https://host:8080/`.
+    {
+        label: 'url userinfo',
+        regex: /(https?:\/\/)([^\s"'<>/?#]*@)/gi,
+        replacement: (m) => `${m[1]}<redacted>@`,
+        streamingTerminator: /[/?#\s"'<>]/,
+        streamingValueGroup: 2,
+    },
     // URL query secrets:  ?key=[redacted]  ?token=[redacted]  ?api_key=[redacted]  &access_token=[redacted]
     // (runs before the api-key-header rule so the URL form isn't mangled.)
     {

package/node_modules/@maka/core/dist/llm-connections.js

@@ -228,6 +228,19 @@ export function reconcileConnectionAfterModelFetch(connection, models, options)
     const previousEnabled = [
         ...new Set(connectionEnabledModelIds(connection).map((id) => supersededModelId(id, live, options?.aliases))),
     ];
+    if (options?.authoritative) {
+        // The first account-scoped fetch replaces the provider fallback guess: no
+        // user chose those bootstrap ids, and every usable model should be offered.
+        // Later refreshes preserve explicit user choices only while they remain in
+        // the account catalog; newly introduced models stay opt-in.
+        const enabledModelIds = connection.hasModelInventory
+            ? previousEnabled.filter((id) => live.has(id))
+            : liveIds;
+        const defaultModel = enabledModelIds.includes(previousDefault)
+            ? previousDefault
+            : (enabledModelIds[0] ?? '');
+        return { defaultModel, enabledModelIds };
+    }
     // Seed a first choice only for a connection that has never had a list to
     // pick from: four providers ship no `fallbackModels`, so for them discovery
     // is the only place a first default can come from.

package/node_modules/@maka/core/dist/model-call-attempt.js

@@ -83,6 +83,7 @@ const MODEL_CALL_ATTEMPT_SHAPE = defineObjectShape()([
 ], [
     'connectionSlug',
     'historyCompactRoute',
+    'requestCompositionId',
     'contextWindow',
     'captureArtifactId',
     'promptComposition',
@@ -294,6 +295,7 @@ export function decodeModelCallAttempt(value) {
         isNonEmptyString(value.runId) &&
         isNonEmptyString(value.turnId) &&
         isNonNegativeInteger(value.step) &&
+        isOptionalString(value.requestCompositionId) &&
         isNonNegativeInteger(value.attempt) &&
         MODEL_CALL_KINDS.includes(value.callKind) &&
         (value.historyCompactRoute === undefined ||

package/node_modules/@maka/core/dist/model-failure.js

@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { defineObjectShape, hasExactShape, isRecord } from './record-schema.js';
+export const MODEL_FAILURE_MESSAGE_MAX_BYTES = 2 * 1024;
+const EXHAUSTED_SHAPE = defineObjectShape()(['decision', 'attempts'], []);
+const DECLINED_SHAPE = defineObjectShape()(['decision', 'because'], []);
+export function isModelRetryDecision(value) {
+    if (!isRecord(value))
+        return false;
+    switch (value.decision) {
+        case 'exhausted':
+            return (hasExactShape(value, EXHAUSTED_SHAPE) &&
+                Number.isSafeInteger(value.attempts) &&
+                Number(value.attempts) > 0);
+        case 'declined':
+            return (hasExactShape(value, DECLINED_SHAPE) &&
+                (value.because === 'side_effects' ||
+                    value.because === 'observable_output' ||
+                    value.because === 'policy' ||
+                    value.because === 'budget'));
+        default:
+            return false;
+    }
+}