maka-agent 0.2.0-dev.24.20260907 → 0.2.0-dev.26.20260909

package/node_modules/@maka/storage/dist/session-bundle-manifest.js

@@ -17,6 +17,7 @@
  * under the License.
  */
 import { isNonEmptyUnicodeString, isSha256Digest, SESSION_BUNDLE_ARCHIVE_FORMAT, SESSION_BUNDLE_CANONICALIZATION_VERSION, SESSION_BUNDLE_CODEC_NAME, SESSION_BUNDLE_CODEC_VERSION, SESSION_BUNDLE_COMPRESSION_FORMAT, SESSION_BUNDLE_COMPRESSION_LEVEL, SESSION_BUNDLE_SCHEMA_VERSION, SESSION_BUNDLE_STATE_IDENTITY_PATH, SESSION_BUNDLE_STATE_PATH, SESSION_BUNDLE_WORKSPACE_PATH, SessionBundleFileError, } from './session-bundle-contract.js';
+import { stableJsonStringify } from '@maka/core/canonical-json';
 const MANIFEST_KEYS = ['codec', 'envelope', 'payload', 'schemaVersion', 'stateIdentity'];
 const CODEC_KEYS = [
     'archive',
@@ -167,25 +168,12 @@ function decodePayload(value) {
     };
 }
 function canonicalJson(value) {
-    if (value === null)
-        return 'null';
-    if (typeof value === 'string')
-        return JSON.stringify(value);
-    if (typeof value === 'number') {
-        if (!Number.isFinite(value))
-            throw invalidManifest();
-        return JSON.stringify(value);
+    try {
+        return stableJsonStringify(value);
     }
-    if (typeof value === 'boolean')
-        return value ? 'true' : 'false';
-    if (Array.isArray(value))
-        return `[${value.map((item) => canonicalJson(item)).join(',')}]`;
-    if (!isRecord(value))
+    catch {
         throw invalidManifest();
-    return `{${Object.keys(value)
-        .sort()
-        .map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`)
-        .join(',')}}`;
+    }
 }
 function hasExactKeys(value, expected) {
     const actual = Object.keys(value);

package/node_modules/@maka/storage/dist/session-bundle-policy.js

@@ -25,6 +25,7 @@ import { withArtifactWriterLock } from './artifact-writer-lock.js';
 import { withOfflineContextSnapshot, copyContextSnapshot, validateContextSnapshot, planContextSnapshotFiles, } from './context-offload-snapshot.js';
 import { CONTEXT_OFFLOAD_DATABASE_NAME, CONTEXT_OFFLOAD_VALUES_DIRECTORY_NAME, } from './sqlite-context-offload-store.js';
 import { acquireOperationalStateDatabase, OPERATIONAL_STATE_DATABASE_NAME, } from './operational-state-store.js';
+import { isSafeStorageId } from './storage-id.js';
 export const SESSION_BUNDLE_STATE_ENTRIES = [
     'artifacts',
     OPERATIONAL_STATE_DATABASE_NAME,
@@ -325,7 +326,7 @@ function assertRootsSeparate(left, right, allowSame) {
     }
 }
 function assertSafeSessionId(sessionId) {
-    if (!/^[A-Za-z0-9_-]{1,128}$/.test(sessionId)) {
+    if (!isSafeStorageId(sessionId)) {
         throw new SessionBundleExportError('invalid_root', `Invalid session id: ${sessionId}`);
     }
 }

package/node_modules/@maka/storage/dist/session-copy-cleanup.js

@@ -19,6 +19,7 @@
 import { randomUUID } from 'node:crypto';
 import { acquireOperationalStateDatabase, } from './operational-state-store.js';
 import { isProcessLifetimeOwnerReference, } from './process-lifetime-owner.js';
+import { isSafeStorageId } from './storage-id.js';
 export function createSessionCopyCleanupAuthority(input) {
     return new SessionCopyCleanupAuthorityImpl(new SqliteSessionCopyCleanupStore(input.workspaceRoot, input.databaseOptions), input.removeSession, input.resumeSessionCopy, input.processId ?? randomUUID(), input.isOwnerProcessActive, input.processLifetimeOwner);
 }
@@ -392,7 +393,7 @@ function normalizeSessionId(value) {
     if (typeof value !== 'string')
         throw new Error('Invalid Session copy id');
     const normalized = value.trim();
-    if (!/^[A-Za-z0-9_-]{1,128}$/.test(normalized)) {
+    if (!isSafeStorageId(normalized)) {
         throw new Error('Invalid Session copy id');
     }
     return normalized;

package/node_modules/@maka/storage/dist/session-store.js

@@ -351,9 +351,9 @@ class SqliteSessionStore {
         // pre-cutover session sees its imported rows.
         return projectHeaderSnapshot(await this.metadata.read(sessionId));
     }
-    async readCatalogRecord(sessionId) {
+    async readCatalogRecord(sessionId, roleScope = 'ordinary') {
         await this.ensureCatalogProjectionReadable();
-        const record = await this.metadata.readCatalogRecord(sessionId);
+        const record = await this.metadata.readCatalogRecord(sessionId, roleScope);
         return {
             ...projectHeaderSnapshot(record),
             activityAt: record.activityAt,
@@ -372,6 +372,18 @@ class SqliteSessionStore {
         await this.ensureReady();
         return this.metadata.readTranscriptHighWater(sessionId);
     }
+    async readCoordinationTranscriptIndexState() {
+        await this.ensureReady();
+        return this.metadata.readCoordinationTranscriptIndexState();
+    }
+    async appendCoordinationTranscriptIndex(records) {
+        await this.ensureReady();
+        return this.metadata.appendCoordinationTranscriptIndex(records);
+    }
+    async readCoordinationTranscriptIndex(request) {
+        await this.ensureReady();
+        return this.metadata.readCoordinationTranscriptIndex(request);
+    }
     async listTurnsSnapshot(sessionId) {
         return deriveTurnRecords(await this.readMessagesSnapshot(sessionId));
     }

package/node_modules/@maka/storage/dist/settings-store.js

@@ -16,10 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { mkdir, readFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { createDefaultSettings, mergeSettings, normalizeSettings } from '@maka/core/settings';
 import { sanitizeOnboardingMilestones } from '@maka/core/onboarding';
+import { writeAtomicFile } from './atomic-file-write.js';
 export function createSettingsStore(workspaceRoot) {
     return new FileSettingsStore(workspaceRoot);
 }
@@ -133,10 +134,13 @@ class FileSettingsStore {
         return result;
     }
     async write(settings) {
+        // SettingsStore does not own the workspace directory's permission policy:
+        // sibling stores such as MCP config may independently harden the same root.
+        // Keep both directory creation and the historical umask-derived file mode.
         await mkdir(dirname(this.settingsPath), { recursive: true });
-        const tempPath = `${this.settingsPath}.${process.pid}.${Date.now()}.tmp`;
-        await writeFile(tempPath, JSON.stringify(settings, null, 2) + '\n', 'utf8');
-        await rename(tempPath, this.settingsPath);
+        await writeAtomicFile(this.settingsPath, JSON.stringify(settings, null, 2) + '\n', {
+            fileMode: 0o666 & ~process.umask(),
+        });
     }
     withQueue(operation) {
         const next = this.queue.then(operation, operation);

package/node_modules/@maka/storage/dist/sqlite-artifact-metadata.js

@@ -82,6 +82,17 @@ class SqliteArtifactMetadataRepository {
             .prepare('SELECT 1 FROM artifact_records WHERE relative_path = ?')
             .get(relativePath));
     }
+    readRelativePathsByCaseFoldedArtifactIds(artifactIds) {
+        this.assertOpen();
+        if (artifactIds.length === 0)
+            return [];
+        const placeholders = artifactIds.map(() => '?').join(', ');
+        const rows = this.#lease.database
+            .prepare(`SELECT relative_path FROM artifact_records
+          WHERE artifact_id COLLATE NOCASE IN (${placeholders})`)
+            .all(...artifactIds);
+        return rows.map((row) => row.relative_path);
+    }
     forgetUpgradeOrphanPaths(relativePaths) {
         this.assertOpen();
         this.#lease.transaction('write', () => {

package/node_modules/@maka/storage/dist/sqlite-runtime-store.js

@@ -1360,8 +1360,7 @@ export class SqliteRuntimeStore {
         });
     }
     registerWorkspaceBaselineAuthorityWriter() {
-        const readWorkspaceHead = this.readWorkspaceHead.bind(this);
-        registerWorkspaceBaselineAuthorityWriterInternal(this, (input, rootId) => this.#commitWorkspaceBaseline(input, rootId), (input, rootId) => this.#commitWorkspaceSuccessor(input, rootId), (input, rootId) => this.#commitManagedMutationTerminal(input, rootId), (rootId) => this.#bindWorkspaceStorageRoot(rootId), readWorkspaceHead, (workspaceInstanceId) => this.#readActiveManagedMutation(workspaceInstanceId));
+        registerWorkspaceBaselineAuthorityWriterInternal(this, (input, rootId) => this.#commitWorkspaceBaseline(input, rootId), (input, rootId) => this.#commitWorkspaceSuccessor(input, rootId), (input, rootId) => this.#commitManagedMutationTerminal(input, rootId), (rootId) => this.#bindWorkspaceStorageRoot(rootId), (workspaceInstanceId) => this.#readActiveManagedMutation(workspaceInstanceId));
     }
     async #readActiveManagedMutation(workspaceInstanceId) {
         return this.readTransaction(() => {

package/node_modules/@maka/storage/dist/sqlite-session-metadata-schema.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-export const SQLITE_SESSION_METADATA_SCHEMA_VERSION = 38;
+export const SQLITE_SESSION_METADATA_SCHEMA_VERSION = 39;
 export const SQLITE_SESSION_MESSAGE_CHUNK_BYTES = 64 * 1024;
 export const SQLITE_SESSION_MESSAGE_CHUNK_MARKER = '{"$maka":"session-message-chunks-v1"}';
 export const SQLITE_AGENT_GRAPH_CONTROL_TABLES = [
@@ -32,6 +32,17 @@ export const SQLITE_AGENT_GRAPH_CONTROL_TABLES = [
     'agent_graph_supervisor_wake_attempts',
 ];
 const MIGRATIONS = new Map([
+    [
+        39,
+        `
+    CREATE TABLE IF NOT EXISTS coordination_transcript_index (
+      sequence INTEGER PRIMARY KEY,
+      source TEXT NOT NULL CHECK (source IN ('legacy', 'runtime')),
+      source_sequence INTEGER NOT NULL CHECK (source_sequence >= 0),
+      UNIQUE (source, source_sequence)
+    );
+  `,
+    ],
     [
         1,
         `

package/node_modules/@maka/storage/dist/sqlite-session-metadata-store.js

@@ -730,10 +730,12 @@ export class SqliteSessionMetadataStore {
             throw new SessionNotFoundError(sessionId);
         return record;
     }
-    async readCatalogRecord(sessionId) {
+    async readCatalogRecord(sessionId, roleScope = 'ordinary') {
         this.assertOpen();
         assertSafeSessionId(sessionId);
-        const role = sqliteOrdinarySessionRolePredicate();
+        const role = roleScope === 'recoverable'
+            ? sqliteRecoverableSessionRolePredicate()
+            : sqliteOrdinarySessionRolePredicate();
         const row = this.db
             .prepare(`
         SELECT
@@ -1206,7 +1208,11 @@ export class SqliteSessionMetadataStore {
             assignment.id !== `wha_${suffix}` ||
             assignment.targetMessageId !== `whm_${suffix}` ||
             assignment.delegationId !== `whd_${suffix}` ||
-            !messageContentsEqual(admission.content, normalizeMessageContent({ text: assignment.userText })) ||
+            !workHubAssignmentAttachmentsMatchTarget(assignment) ||
+            !messageContentsEqual(admission.content, normalizeMessageContent({
+                text: assignment.delegationText ?? assignment.userText,
+                ...(assignment.targetAttachments ? { attachments: assignment.targetAttachments } : {}),
+            })) ||
             admission.submittedContentDigest !== messageContentDigest(admission.content) ||
             admission.submittedPlacement !== 'current_turn' ||
             admission.placement !== 'current_turn' ||
@@ -1825,6 +1831,45 @@ export class SqliteSessionMetadataStore {
             unique.forEach((messageId, index) => update.run(index, sessionId, messageId));
         });
     }
+    async readCoordinationTranscriptIndexState() {
+        this.assertOpen();
+        return this.db
+            .prepare(`SELECT (SELECT MAX(sequence) FROM coordination_transcript_index) AS highWater,
+      (SELECT MAX(source_sequence) FROM coordination_transcript_index WHERE source = 'legacy') AS legacy,
+      (SELECT MAX(source_sequence) FROM coordination_transcript_index WHERE source = 'runtime') AS runtime`)
+            .get();
+    }
+    async appendCoordinationTranscriptIndex(records) {
+        this.assertOpen();
+        if (records.length > 64)
+            throw new Error('Coordination transcript index batch exceeds limit');
+        this.transaction(() => {
+            let sequence = this.db
+                .prepare('SELECT MAX(sequence) AS value FROM coordination_transcript_index')
+                .get().value ?? -1;
+            const insert = this.db.prepare(`INSERT INTO coordination_transcript_index
+        (sequence, source, source_sequence) VALUES (?, ?, ?)
+        ON CONFLICT(source, source_sequence) DO NOTHING`);
+            for (const record of records) {
+                if (!Number.isSafeInteger(record.sourceSequence) || record.sourceSequence < 0)
+                    throw new Error('Invalid Coordination source sequence');
+                const result = insert.run(sequence + 1, record.source, record.sourceSequence);
+                if (result.changes)
+                    sequence++;
+            }
+        });
+    }
+    async readCoordinationTranscriptIndex(request) {
+        this.assertOpen();
+        if (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 64)
+            throw new Error('Invalid Coordination transcript index limit');
+        const older = request.direction === 'older';
+        return this.db
+            .prepare(`SELECT sequence, source, source_sequence AS sourceSequence
+      FROM coordination_transcript_index WHERE sequence <= ? AND sequence ${older ? '<=' : '>='} ?
+      ORDER BY sequence ${older ? 'DESC' : 'ASC'} LIMIT ?`)
+            .all(request.throughSequence, request.position, request.limit);
+    }
     async readMessages(sessionId) {
         return this.readMessagesWith(sessionId, decodeStoredMessage);
     }
@@ -4566,6 +4611,21 @@ function isWorkHubActionOperation(value) {
         value === 'replace' ||
         value === 'stop');
 }
+function workHubAssignmentAttachmentsMatchTarget(assignment) {
+    const source = assignment.attachments ?? [];
+    const target = assignment.targetAttachments ?? [];
+    return (source.length === target.length &&
+        source.every((attachment, index) => {
+            const copied = target[index];
+            const { ref: sourceRef, ...sourceMetadata } = attachment;
+            const { ref: targetRef, ...targetMetadata } = copied;
+            return (sourceRef.kind === 'session_file' &&
+                sourceRef.sessionId === WORKHUB_COORDINATION_SESSION_ID &&
+                targetRef.kind === 'session_file' &&
+                targetRef.sessionId === assignment.targetSessionId &&
+                isDeepStrictEqual(sourceMetadata, targetMetadata));
+        }));
+}
 function sameWorkHubAssignmentRequest(existing, requested) {
     return isDeepStrictEqual({
         actionId: existing.actionId,
@@ -4574,6 +4634,8 @@ function sameWorkHubAssignmentRequest(existing, requested) {
         targetSessionId: existing.targetSessionId,
         disposition: existing.disposition,
         userText: existing.userText,
+        delegationText: existing.delegationText,
+        attachments: existing.attachments,
         create: existing.create,
         replacesActionId: existing.replacesActionId,
         replacesDelegationId: existing.replacesDelegationId,
@@ -4584,6 +4646,8 @@ function sameWorkHubAssignmentRequest(existing, requested) {
         targetSessionId: requested.targetSessionId,
         disposition: requested.disposition,
         userText: requested.userText,
+        delegationText: requested.delegationText,
+        attachments: requested.attachments,
         create: requested.create,
         replacesActionId: requested.replacesActionId,
         replacesDelegationId: requested.replacesDelegationId,

package/node_modules/@maka/storage/dist/stable-storage.js

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { constants } from 'node:fs';
-import { lstat, open } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open } from 'node:fs/promises';
 import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
 const openStableFile = open;
 const lstatStableFile = lstat;
@@ -74,6 +74,19 @@ export async function syncFile(path) {
         await handle.close();
     }
 }
+/**
+ * Create (or harden) an owner-only directory: recursive mkdir plus a
+ * fail-closed chmod, since mkdir's mode only applies on creation. Callers that
+ * store secrets use this before creating their file or update lock.
+ */
+export async function hardenDirectory(dir, mode = 0o700) {
+    await mkdir(dir, { recursive: true, mode });
+    if (process.platform === 'win32') {
+        await chmod(dir, mode).catch(() => { });
+        return;
+    }
+    await chmod(dir, mode);
+}
 export async function syncDirectoryChain(path, root, beforeSync) {
     const boundary = resolve(root);
     let current = resolve(path);

package/node_modules/@maka/storage/dist/storage-id.js

@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+const SAFE_STORAGE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+/** Returns whether a value can safely be used as a persisted storage identity. */
+export function isSafeStorageId(value) {
+    return typeof value === 'string' && SAFE_STORAGE_ID_PATTERN.test(value);
+}
+/** Throws a TypeError unless the value is a safe persisted storage identity. */
+export function assertSafeStorageId(value, message = 'Storage identity is invalid') {
+    if (!isSafeStorageId(value))
+        throw new TypeError(message);
+}

package/node_modules/@maka/storage/dist/tool-result-archive-evidence.js

@@ -23,6 +23,12 @@ import { decodeAgentRunEvent } from '@maka/core/agent-run';
 import { MODEL_PROJECTION_TARGET_SQL as TARGET } from './sqlite-core-execution-schema.js';
 const TRANSITIONS = 'core_agent_run_events INDEXED BY core_model_projection_target';
 const KIND = "event_type = 'model_projection_transition_recorded'";
+// SQLite may parse the containing JSON, but only these reconstruction fields
+// cross into JS or count toward the evidence budget. Raw tool bytes never do.
+const EVENT_EVIDENCE = `CASE WHEN json_valid(payload_json) THEN json_extract(payload_json,
+  '$.id', '$.sessionId', '$.runId', '$.invocationId', '$.turnId', '$.ts', '$.partial',
+  '$.author', '$.role', '$.content.kind', '$.content.id', '$.content.name',
+  '$.content.modelProjection', '$.content.providerExecuted') END`;
 /** Reader-first foundation; no archive writer or fallback is activated by opening it. */
 export async function openToolResultArchiveEvidenceReader(lease) {
     await assertStorageRootLease(lease, 'interactive', lease.access);
@@ -51,10 +57,12 @@ export async function openToolResultArchiveEvidenceReader(lease) {
                         const db = database.database;
                         const { sessionId, runtimeEventId } = accepted;
                         const eventSize = db
-                            .prepare('SELECT length(CAST(payload_json AS BLOB)) AS bytes FROM runtime_events WHERE event_id = ? AND session_id = ?')
+                            .prepare(`SELECT length(CAST(${EVENT_EVIDENCE} AS BLOB)) AS bytes FROM runtime_events WHERE event_id = ? AND session_id = ?`)
                             .get(runtimeEventId, sessionId);
                         if (!eventSize)
                             return { ok: false, reason: 'not_found' };
+                        if (eventSize.bytes === null)
+                            return { ok: false, reason: 'corrupt' };
                         // An unscoped unreadable transition prevents proving completeness.
                         if (db
                             .prepare(`SELECT 1 FROM ${TRANSITIONS} WHERE ${KIND} AND session_id = ? AND ${TARGET} IS NULL LIMIT 1`)
@@ -72,11 +80,30 @@ export async function openToolResultArchiveEvidenceReader(lease) {
                         if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > MAX_BYTES)
                             return { ok: false, reason: 'too_large' };
                         const raw = db
-                            .prepare('SELECT payload_json FROM runtime_events WHERE event_id = ? AND session_id = ?')
+                            .prepare(`SELECT ${EVENT_EVIDENCE} AS evidence_json FROM runtime_events WHERE event_id = ? AND session_id = ?`)
                             .get(runtimeEventId, sessionId);
                         let event;
                         try {
-                            event = decodeRuntimeEvent(JSON.parse(String(raw?.payload_json)));
+                            const [id, sessionId, runId, invocationId, turnId, ts, partial, author, role, kind, callId, name, modelProjection, providerExecuted,] = JSON.parse(String(raw?.evidence_json));
+                            event = decodeRuntimeEvent({
+                                id,
+                                sessionId,
+                                runId,
+                                invocationId,
+                                turnId,
+                                ts,
+                                partial,
+                                author,
+                                role,
+                                content: {
+                                    kind,
+                                    id: callId,
+                                    name,
+                                    result: null,
+                                    ...(modelProjection === null ? {} : { modelProjection }),
+                                    ...(providerExecuted === null ? {} : { providerExecuted }),
+                                },
+                            });
                         }
                         catch {
                             return { ok: false, reason: 'corrupt' };
@@ -98,7 +125,7 @@ export async function openToolResultArchiveEvidenceReader(lease) {
                                 return { ok: false, reason: 'corrupt' };
                             transitions.push(transition);
                         }
-                        return { ok: true, event, transitions };
+                        return { ok: true, event, transitions, storedBytes: bytes };
                     });
                 });
             }

package/node_modules/@maka/storage/dist/workspace-identity.js

@@ -16,12 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { execFile } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { constants as fsConstants } from 'node:fs';
 import { lstat, open, realpath, stat } from 'node:fs/promises';
 import { isAbsolute, join, normalize, parse, resolve } from 'node:path';
-import { promisify } from 'node:util';
+import { execGitText } from './git-exec.js';
 import { hasEnclosingGitEntry } from './git-entry.js';
 import { publishMarkerFile, readBoundedMarkerFile } from './marker-file.js';
 export const WORKSPACE_MARKER_FILE = '.maka-workspace.json';
@@ -29,7 +28,6 @@ export const WORKSPACE_MARKER_SCHEMA_VERSION = 1;
 export const WORKSPACE_IDENTITY_PREFIX = 'workspace:v1:';
 const MAX_WORKSPACE_MARKER_BYTES = 4_096;
 const MAX_GIT_EXCLUDE_BYTES = 1024 * 1024;
-const execFileAsync = promisify(execFile);
 export class WorkspaceIdentityError extends Error {
     code;
     constructor(code, message, options) {
@@ -101,18 +99,7 @@ async function createWorkspaceMarker(snapshot, workspaceId) {
 async function ensureWorkspaceMarkerIgnored(workspacePath) {
     if (!(await hasEnclosingGitEntry(workspacePath)))
         return;
-    const env = { ...process.env, GIT_OPTIONAL_LOCKS: '0' };
-    delete env.GIT_DIR;
-    delete env.GIT_WORK_TREE;
-    delete env.GIT_INDEX_FILE;
-    delete env.GIT_COMMON_DIR;
-    const { stdout } = await execFileAsync('git', ['-C', workspacePath, 'rev-parse', '--path-format=absolute', '--git-path', 'info/exclude'], {
-        env,
-        encoding: 'utf8',
-        maxBuffer: 64 * 1024,
-        timeout: 3_000,
-        windowsHide: true,
-    });
+    const stdout = await execGitText(workspacePath, ['rev-parse', '--path-format=absolute', '--git-path', 'info/exclude'], { maxBuffer: 64 * 1024, timeoutMs: 3_000 });
     const excludePath = stdout.trim();
     if (!isAbsolute(excludePath)) {
         throw new Error(`Git returned a non-absolute exclude path: ${excludePath}`);

package/node_modules/@maka/storage/dist/workspace-version-authority-internal.js

@@ -17,7 +17,7 @@
  * under the License.
  */
 const workspaceBaselineAuthorityWriters = new WeakMap();
-export function registerWorkspaceBaselineAuthorityWriterInternal(store, writer, successorWriter, terminalWriter, bindStorageRoot, readHead, readActiveManagedMutation) {
+export function registerWorkspaceBaselineAuthorityWriterInternal(store, writer, successorWriter, terminalWriter, bindStorageRoot, readActiveManagedMutation) {
     if (workspaceBaselineAuthorityWriters.has(store)) {
         throw new Error('Workspace baseline authority writer is already registered');
     }
@@ -25,7 +25,6 @@ export function registerWorkspaceBaselineAuthorityWriterInternal(store, writer,
         writer,
         successorWriter,
         terminalWriter,
-        readHead,
         readActiveManagedMutation,
         bindStorageRoot,
     });
@@ -36,12 +35,6 @@ export function readActiveManagedMutationInternal(store, workspaceInstanceId) {
         throw new Error('Managed mutation reservation reader is unavailable');
     return registration.readActiveManagedMutation(workspaceInstanceId);
 }
-export function readWorkspaceHeadInternal(store, workspaceId, workspaceEpochId) {
-    const registration = workspaceBaselineAuthorityWriters.get(store);
-    if (!registration)
-        throw new Error('Workspace baseline authority reader is unavailable');
-    return registration.readHead(workspaceId, workspaceEpochId);
-}
 /**
  * Storage-internal authority seam. This module is deliberately absent from the
  * @maka/storage package exports. The schema-9 reader, migration, and projection

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maka-agent",
-  "version": "0.2.0-dev.24.20260907",
+  "version": "0.2.0-dev.26.20260909",
   "description": "Apache Maka (Incubating) developer snapshot; not an Apache release.",
   "license": "Apache-2.0",
   "type": "module",