maka-agent 0.2.0-dev.3.20260830 → 0.2.0-dev.5.20260830

package/dist/cli-core.js

@@ -435,6 +435,7 @@ export async function runMakaCli(argv = process.argv.slice(2), options = RELEASE
                 expectedTarget: command.expectedTarget,
                 ...(command.meshId !== undefined ? { meshId: command.meshId } : {}),
                 ...(command.peerId ? { peerId: command.peerId } : {}),
+                ...(command.displayName !== undefined ? { displayName: command.displayName } : {}),
             });
         }
         case 'runtime-host-service-update': {

package/dist/eval-bundle-path.js

@@ -23,7 +23,7 @@ export function configureInstalledEvalBundle(environment = process.env, packageR
     if (Object.hasOwn(environment, MAKA_EVAL_BUNDLE_ENV))
         return;
     try {
-        if (!statSync(resolve(packageRoot, 'packages/eval')).isDirectory())
+        if (!statSync(resolve(packageRoot, 'node_modules/@maka/eval')).isDirectory())
             return;
     }
     catch {

package/dist/pi-tui-runner.js

@@ -870,6 +870,7 @@ export async function runMakaPiTui(input) {
     // in place after `/setup` saves so newly configured models are immediately
     // available — the single source the picker and connection/model lookups read.
     let modelChoices = input.modelChoices;
+    let connectionIdentities = input.connectionIdentities;
     // Monotonic attempt id: each setup submit captures one, and any transition
     // that abandons the in-flight attempt (back, re-pick, close) increments it so
     // a late verify/save settlement cannot clobber a newer attempt.
@@ -1142,7 +1143,7 @@ export async function runMakaPiTui(input) {
         model = summary.model;
         connectionId = summary.llmConnectionId;
         connectionSlug = summary.llmConnectionSlug;
-        const identityNotice = sessionConnectionIdentityNotice(summary, input.connectionIdentities, input.locale ?? 'en');
+        const identityNotice = sessionConnectionIdentityNotice(summary, connectionIdentities, input.locale ?? 'en');
         if (announceIdentity && identityNotice && identityNotice !== connectionIdentityNotice) {
             state.entries.push({ kind: 'notice', level: 'error', text: identityNotice });
         }
@@ -1832,6 +1833,7 @@ export async function runMakaPiTui(input) {
             // attempt must not overwrite choices refreshed by a newer save.
             if (result.refresh.kind === 'ok') {
                 modelChoices = result.refresh.modelChoices;
+                connectionIdentities = result.refresh.connectionIdentities;
             }
             if (input.firstRun) {
                 beginClose();

package/dist/runtime-host-cli.js

@@ -752,17 +752,28 @@ function parseServicePeerMeshCommand(argv) {
         action !== 'leave' &&
         action !== 'close' &&
         action !== 'reconcile' &&
-        action !== 'transit') {
+        action !== 'transit' &&
+        action !== 'rename' &&
+        action !== 'rename-mesh') {
         return error(action
             ? `Unexpected runtime-host service mesh command: ${action}`
-            : 'runtime-host service mesh requires status, create, invite, join, remove, leave, close, reconcile, or transit');
+            : 'runtime-host service mesh requires status, create, invite, join, remove, leave, close, reconcile, transit, rename, or rename-mesh');
     }
     let meshId;
     let peerId;
+    let displayName;
+    let clientDataRoot;
     const options = parseManagedServiceOptions(argv.slice(1), {
         allowConfiguration: false,
         allowFramed: true,
         valueOptions: {
+            '--client-data-root': (value) => {
+                if (clientDataRoot !== undefined)
+                    return error('Duplicate --client-data-root');
+                if (!isSafeAbsolutePath(value))
+                    return error('--client-data-root must be an absolute path');
+                clientDataRoot = value;
+            },
             '--mesh': (value) => {
                 if (meshId !== undefined)
                     return error('Duplicate --mesh');
@@ -777,6 +788,14 @@ function parseServicePeerMeshCommand(argv) {
                     return error('--peer requires a valid Peer ID');
                 peerId = value;
             },
+            '--name': (value) => {
+                if (displayName !== undefined)
+                    return error('Duplicate --name');
+                if (!value.trim() || value.trim().length > 80) {
+                    return error('--name requires a display name of at most 80 characters');
+                }
+                displayName = value.trim();
+            },
         },
         flagOptions: {
             '--off': () => {
@@ -784,6 +803,11 @@ function parseServicePeerMeshCommand(argv) {
                     return error('mesh transit accepts either --mesh or --off');
                 meshId = null;
             },
+            '--clear-name': () => {
+                if (displayName !== undefined)
+                    return error('mesh rename accepts --name or --clear-name');
+                displayName = null;
+            },
         },
     });
     if ('kind' in options)
@@ -791,7 +815,11 @@ function parseServicePeerMeshCommand(argv) {
     if (!options.managedRootId || !options.operatorDeploymentId || !options.expectedTarget) {
         return error('runtime-host service mesh requires --managed-root-id, --operator-deployment-id, and an expected target');
     }
-    const needsMesh = action === 'invite' || action === 'remove' || action === 'leave' || action === 'close';
+    const needsMesh = action === 'invite' ||
+        action === 'remove' ||
+        action === 'leave' ||
+        action === 'close' ||
+        action === 'rename-mesh';
     if (needsMesh && typeof meshId !== 'string') {
         return error(`runtime-host service mesh ${action} requires --mesh`);
     }
@@ -809,6 +837,11 @@ function parseServicePeerMeshCommand(argv) {
     if (action === 'transit' && meshId === undefined) {
         return error('runtime-host service mesh transit requires --mesh or --off');
     }
+    if ((action === 'rename' || action === 'rename-mesh') !== (displayName !== undefined)) {
+        return error(action === 'rename'
+            ? 'runtime-host service mesh rename requires --name or --clear-name'
+            : '--name and --clear-name are only valid with mesh rename or rename-mesh');
+    }
     return {
         kind: 'runtime-host-service-peer-mesh',
         action,
@@ -819,6 +852,7 @@ function parseServicePeerMeshCommand(argv) {
         expectedTarget: options.expectedTarget,
         ...(meshId !== undefined ? { meshId } : {}),
         ...(peerId ? { peerId } : {}),
+        ...(displayName !== undefined ? { displayName } : {}),
     };
 }
 function parseUpdatePolicy(value) {

package/dist/runtime-host-onboarding.js

@@ -50,12 +50,14 @@ export function createRuntimeHostOnboardingSurface(connection) {
                     return result;
                 }
                 try {
+                    const catalog = await readRuntimeHostConnectionCatalog(connection);
                     return {
                         kind: 'ok',
                         connection: result.connection,
                         refresh: {
                             kind: 'ok',
-                            modelChoices: projectRuntimeHostModelChoices(await readRuntimeHostConnectionCatalog(connection)),
+                            modelChoices: projectRuntimeHostModelChoices(catalog),
+                            connectionIdentities: projectRuntimeHostConnectionIdentities(catalog),
                         },
                     };
                 }
@@ -108,6 +110,13 @@ export function projectRuntimeHostModelChoices(catalog) {
     }
     return choices;
 }
+export function projectRuntimeHostConnectionIdentities(catalog) {
+    return catalog.connections.map((connection) => ({
+        connectionId: connection.connectionId,
+        connectionSlug: connection.slug,
+        enabled: connection.enabled,
+    }));
+}
 export function projectProviders(catalog) {
     const entries = [];
     for (const provider of listApiKeyOnboardableProviders()) {

package/dist/runtime-host-peer-mesh-management-command.js

@@ -139,6 +139,23 @@ async function executePeerMeshAction(connection, options, invitation) {
                     meshId: requiredOption(options.meshId, 'Mesh ID'),
                 }),
             };
+        case 'rename':
+            return {
+                kind: 'result',
+                action: 'rename',
+                result: await request('peer.mesh.display-name.set', {
+                    displayName: requiredOption(options.displayName, 'Display name'),
+                }),
+            };
+        case 'rename-mesh':
+            return {
+                kind: 'result',
+                action: 'rename-mesh',
+                result: await request('peer.mesh.rename', {
+                    meshId: requiredMeshId(options.meshId),
+                    displayName: requiredOption(options.displayName, 'Display name'),
+                }),
+            };
     }
 }
 function requiredOption(value, label) {

package/dist/runtime-host-setup-command.js

@@ -22,7 +22,7 @@ import { join, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { truncateUtf8 } from '@maka/core/diagnostic-log';
 import { generalizedErrorMessage } from '@maka/core/redaction';
-import { activateRuntimeHostManagedDeployment, connectRemoteRuntimeHost, ensureRuntimeHostPeerIdentity, } from '@maka/runtime-host/client';
+import { activateRuntimeHostManagedDeployment, connectRemoteRuntimeHost, ensureRuntimeHostPeerIdentity, RuntimeHostOperationError, } from '@maka/runtime-host/client';
 import { RuntimeHostManagedDeploymentError as RuntimeHostDeploymentAuthorityError, encodeRuntimeHostSetupFrame, isSha512PackageIntegrity, resolveRuntimeHostManagedDeployment, RUNTIME_HOST_SETUP_ERROR_CODE_MAX_BYTES, RUNTIME_HOST_SETUP_ERROR_MESSAGE_MAX_BYTES, } from '@maka/runtime-host/operator';
 import { INTERACTIVE_RUNTIME_HOST_COMPOSITION_ID, RUNTIME_HOST_PROTOCOL_VERSION, } from '@maka/runtime-host/protocol';
 import { prepareRuntimeHostAccessCredential, replaceRuntimeHostAccessCredential, revokeRuntimeHostAccessCredential, RuntimeHostAccessUnavailableError, } from './runtime-host-access-command.js';
@@ -34,7 +34,7 @@ import { repairStorageRootAfterRemount, resolveStorageRoot } from '@maka/storage
 import { createPlatformRuntimeHostServiceBackend, discoverRuntimeHostLifecycleProvider, resolveRuntimeHostLifecycleProvider, } from './runtime-host-service-management-command.js';
 import { allocateRuntimeHostLoopbackPort, allocateRuntimeHostPeerPort, effectiveRuntimeHostProjectDirectoryRoots, manageRuntimeHostService, readRuntimeHostManagedServiceConfig, removeRuntimeHostServiceFile, resolveRuntimeHostManagedServiceConfigPath, resolveRuntimeHostManagedServiceId, resolveRuntimeHostManagedProjectDirectoryRoots, RuntimeHostServiceManagerError, withRuntimeHostManagedServiceDeploymentLock, withRuntimeHostManagedServiceLifecycleLock, } from './runtime-host-service-manager.js';
 import { expandWildcardListenAddresses } from './runtime-host-peer-management-command.js';
-import { canDiscardRuntimeHostLifecycleDesiredArtifacts, replaceRuntimeHostLifecycle, resolveRecoverableRuntimeHostManagedDeployment, RUNTIME_HOST_READY_TIMEOUT_MS, } from './runtime-host-lifecycle-transaction.js';
+import { canDiscardRuntimeHostLifecycleDesiredArtifacts, replaceRuntimeHostLifecycle, resolveRecoverableRuntimeHostManagedDeployment, RUNTIME_HOST_READY_TIMEOUT_MS, RuntimeHostLifecycleTransactionError, } from './runtime-host-lifecycle-transaction.js';
 import { resolveRuntimeHostManagedPeerKeyPath, resolveRuntimeHostPeerNativePath, } from './runtime-host-peer-artifact.js';
 import { activateRuntimeHostManagedDeploymentWithReconciliation } from './runtime-host-activation-command.js';
 const SETUP_LOCK_TIMEOUT_MS = 5 * 60_000;
@@ -192,12 +192,13 @@ async function runRuntimeHostSupervisedSetupLocked(options, deps, emit) {
         await assertLegacyArtifactsAbsent(legacyBackend);
     if (legacyToMigrate)
         await assertCompatibleExistingVersion(legacyStatus, options.version);
-    if (current && current.launch.package.version !== options.version) {
+    if (current && current.launch.package.version !== options.version && !options.updateExisting) {
         throw new RuntimeHostSetupError('version_change_requires_update', `Runtime Host ${current.launch.package.version} is already installed; changing to ${options.version} requires the update workflow`);
     }
     const resolvedPackage = await resolveRuntimeHostSetupPackage(options, deps);
     const { candidate } = resolvedPackage;
-    if (current && !sameExactPackage(current, candidate)) {
+    const packageChanged = current !== undefined && !sameExactPackage(current, candidate);
+    if (current && packageChanged && !options.updateExisting) {
         throw new RuntimeHostSetupError('version_change_requires_update', `Runtime Host ${current.launch.package.version} is already installed; changing its exact package requires the update workflow`);
     }
     const lifecycleOffer = current?.lifecycle.mode === 'supervised'
@@ -214,14 +215,16 @@ async function runRuntimeHostSupervisedSetupLocked(options, deps, emit) {
             sourcePackageRoot: packageRoot,
             version: candidate.version,
             packageIntegrity: candidate.integrity,
+            ...(current ? { deploymentRoot: current.deploymentRoot } : {}),
         });
         let committed = false;
         try {
             const desired = await prepareSupervisedDeploymentConfig(options, deps, capability, deployment.cliPath, deployment.root, candidate, current, legacyToMigrate, lifecycleOffer);
-            if (current && !sameDesiredManagedDeployment(current, desired)) {
-                if (current.lifecycle.mode === 'supervised') {
-                    throw new RuntimeHostSetupError('configuration_changed', 'Change an existing supervised Runtime Host through its explicit configure or update workflow');
-                }
+            if (current &&
+                !sameDesiredManagedDeployment(current, desired) &&
+                !options.updateExisting &&
+                current.lifecycle.mode === 'supervised') {
+                throw new RuntimeHostSetupError('configuration_changed', 'Change an existing supervised Runtime Host through its explicit configure or update workflow');
             }
             emit({ kind: 'progress', phase: 'installing_service' });
             if (legacyToMigrate) {
@@ -233,9 +236,11 @@ async function runRuntimeHostSupervisedSetupLocked(options, deps, emit) {
                 operation: legacyToMigrate
                     ? 'legacy_migration'
                     : current
-                        ? isDeepStrictEqual(current.lifecycle, desired.lifecycle)
-                            ? 'configure'
-                            : 'lifecycle_change'
+                        ? packageChanged
+                            ? 'update'
+                            : isDeepStrictEqual(current.lifecycle, desired.lifecycle)
+                                ? 'configure'
+                                : 'lifecycle_change'
                         : 'install',
                 ...(current ? { current } : {}),
                 desired,
@@ -247,6 +252,7 @@ async function runRuntimeHostSupervisedSetupLocked(options, deps, emit) {
                             .then(() => undefined),
                     }
                     : {}),
+                allowInterruptActiveTasks: Boolean(current && packageChanged && options.updateExisting),
                 deps: lifecycleDeps,
             });
             if (replacement.kind === 'active_tasks') {
@@ -286,8 +292,13 @@ async function runRuntimeHostSupervisedSetupLocked(options, deps, emit) {
             };
         }
         catch (error) {
-            if (!current && !committed && canDiscardRuntimeHostLifecycleDesiredArtifacts(error)) {
-                await removeRuntimeHostManagedDeployment(deployment.root, capability.rootId).catch(() => undefined);
+            if (!committed && canDiscardRuntimeHostLifecycleDesiredArtifacts(error)) {
+                if (current && packageChanged) {
+                    await deployment.rollback().catch(() => undefined);
+                }
+                else if (!current) {
+                    await removeRuntimeHostManagedDeployment(deployment.root, capability.rootId).catch(() => undefined);
+                }
             }
             throw error;
         }
@@ -552,6 +563,7 @@ async function runRuntimeHostOnDemandSetupLocked(options, deps, emit) {
                     activateDesired: async () => {
                         await deps.activateDesired({ rootId: capability.rootId });
                     },
+                    allowInterruptActiveTasks: Boolean(current && packageChanged && options.updateExisting),
                     deps: lifecycleDeps,
                 });
                 if (replacement.kind === 'active_tasks') {
@@ -700,7 +712,7 @@ async function pairAndVerifyRuntimeHostSetup(options, target, deps, emit) {
                 break;
             }
             catch (error) {
-                if (!(error instanceof RuntimeHostAccessUnavailableError) || Date.now() >= deadline) {
+                if (!isTransientPairingAvailabilityError(error) || Date.now() >= deadline) {
                     throw error;
                 }
                 await new Promise((resolveWait) => setTimeout(resolveWait, Math.min(PAIRING_AVAILABILITY_POLL_MS, deadline - Date.now())));
@@ -757,6 +769,11 @@ async function pairAndVerifyRuntimeHostSetup(options, target, deps, emit) {
         throw error;
     }
 }
+function isTransientPairingAvailabilityError(error) {
+    return (error instanceof RuntimeHostAccessUnavailableError ||
+        (error instanceof RuntimeHostOperationError &&
+            (error.code === 'host_not_ready' || error.code === 'host_draining')));
+}
 async function assertCompatibleExistingVersion(status, version) {
     if (!status.service.config) {
         if (!status.service.installed)
@@ -828,7 +845,8 @@ function setupFailure(error) {
         error instanceof RuntimeHostManagedDeploymentError ||
         error instanceof RuntimeHostDeploymentAuthorityError ||
         error instanceof RuntimeHostUpdateDiscoveryError ||
-        error instanceof RuntimeHostUpdatePackageError) {
+        error instanceof RuntimeHostUpdatePackageError ||
+        error instanceof RuntimeHostLifecycleTransactionError) {
         code = error.code;
         message = error.message;
     }

package/dist/runtime-host-systemd-service.js

@@ -127,7 +127,7 @@ export function createSystemdUserRuntimeHostService(serviceId, options) {
             await runLifecycleAction(context, 'restart');
             await ensureSystemdUpdateSchedulerStartedIfInstalled(scheduler);
         },
-        retire: () => runLifecycleAction(context, 'stop'),
+        retire: () => retireSystemdSupervisor(context),
         logs: async () => {
             const readJournal = async (unitName) => {
                 const result = await runJournalctl([
@@ -220,7 +220,7 @@ export function createSystemdUserRuntimeHostLifecycleProvider(serviceId, options
                 await context.runSystemctl(['reset-failed', context.unitName]);
                 await runLifecycleAction(context, 'start');
             },
-            retire: () => runLifecycleAction(context, 'stop'),
+            retire: () => retireSystemdSupervisor(context),
             logs: () => readJournal(context.unitName),
             uninstall: () => uninstallSystemdSupervisor(context),
         },
@@ -507,7 +507,7 @@ async function stopSystemdManagedDeployment(service, scheduler) {
         errors.push(error);
     }
     try {
-        await runLifecycleAction(service, 'stop');
+        await retireSystemdSupervisor(service);
     }
     catch (error) {
         errors.push(error);
@@ -516,6 +516,12 @@ async function stopSystemdManagedDeployment(service, scheduler) {
         throw new RuntimeHostServiceManagerError('service_manager_operation_failed', 'Unable to stop the Runtime Host managed deployment', { cause: new AggregateError(errors) });
     }
 }
+async function retireSystemdSupervisor(context) {
+    const status = await readSystemdStatus(context);
+    if (!isSystemdUnitRunning(status))
+        return;
+    await runLifecycleAction(context, 'stop');
+}
 async function removeSystemdUpdateScheduler(context) {
     const timerStatus = await readSystemdStatus(context.timer);
     await stopSystemdUpdateScheduler(context);

package/dist/runtime-host-tui-context.js

@@ -26,7 +26,7 @@ import { readRuntimeHostAgentGraphEpochs, readRuntimeHostInvocableSkills, readRu
 import { runtimeHostProfileUsesHostWorkspace } from '@maka/runtime-host/profile-kind';
 import { connectRuntimeHostCli, readHostChatDefaultPermissionMode, resolveRuntimeHostCliTarget, } from './runtime-host-cli-context.js';
 import { createRuntimeHostMakaSessionDriver, } from './runtime-host-session-driver.js';
-import { createRuntimeHostOnboardingSurface, projectRuntimeHostModelChoices, } from './runtime-host-onboarding.js';
+import { createRuntimeHostOnboardingSurface, projectRuntimeHostConnectionIdentities, projectRuntimeHostModelChoices, } from './runtime-host-onboarding.js';
 import { createTuiMcpController, } from './tui-mcp-control.js';
 export async function createRuntimeHostTuiContext(input) {
     const connected = await connectRuntimeHostCli({
@@ -88,11 +88,7 @@ export async function createRuntimeHostTuiContext(input) {
             ...(selectedTarget.connectionId === undefined
                 ? {}
                 : { connectionId: selectedTarget.connectionId }),
-            connectionIdentities: catalog.connections.map((entry) => ({
-                connectionId: entry.connectionId,
-                connectionSlug: entry.slug,
-                enabled: entry.enabled,
-            })),
+            connectionIdentities: projectRuntimeHostConnectionIdentities(catalog),
             connectionName: selectedTarget.connection?.name ?? selectedTarget.connectionSlug,
             ...(selectedTarget.connection
                 ? { providerType: selectedTarget.connection.providerType }

package/node_modules/@maka/eval/dist/external-subject.js

@@ -21,7 +21,7 @@ import { join } from 'node:path';
 import { meteringCheckpointMacMatches, readBoundedRegularFile } from './metering-checkpoint.js';
 import { deriveMetering } from './provider-metering.js';
 import { TOOLCHAIN_IDENTITIES, TOOLCHAIN_IDENTITY_ENV, isExternalProfile, verifyToolchainDirectory, } from './toolchain-verification.js';
-const BUNDLED_EXTERNAL_WRAPPER = '/opt/maka-agent/packages/eval/dist/harbor-external-subject.js';
+const BUNDLED_EXTERNAL_WRAPPER = '/opt/maka-agent/node_modules/@maka/eval/dist/harbor-external-subject.js';
 export function createExternalSubjectAdapter() {
     const verifiedToolchains = new Map();
     return {

package/node_modules/@maka/eval/dist/harbor-external-subject.js

@@ -44,7 +44,7 @@ const PROFILE_PREPARERS = {
     codex: async ({ env, home, root, proxyBaseUrl }) => {
         env.OPENAI_API_KEY = 'maka-eval-local';
         env.CODEX_HOME = home;
-        const catalog = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-codex-models.json');
+        const catalog = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-codex-models.json');
         await writeFile(join(home, 'config.toml'), [
             'model_provider = "maka-http"',
             `model_catalog_json = ${JSON.stringify(catalog)}`,
@@ -198,7 +198,7 @@ const PROFILE_PREPARERS = {
         env.DSH_HOME = join(home, 'dsh');
         const profile = join(env.DSH_HOME, 'profiles', DEEPSEEK_HARNESS_PROFILE);
         await mkdir(profile, { recursive: true, mode: 0o700 });
-        const source = rooted(root, '/opt/maka-agent/packages/eval/harbor/deepseek-harness-profile');
+        const source = rooted(root, '/opt/maka-agent/node_modules/@maka/eval/harbor/deepseek-harness-profile');
         for (const file of ['package.json', 'cordis.yml', 'cordis.patch.yml']) {
             await copyFile(join(source, file), join(profile, file));
         }

package/node_modules/@maka/runtime/dist/sandbox/macos-seatbelt.js

@@ -16,6 +16,8 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { readlinkSync, realpathSync } from 'node:fs';
+import { basename, dirname, resolve } from 'node:path';
 export const MACOS_SEATBELT_EXECUTABLE = '/usr/bin/sandbox-exec';
 export const MACOS_SEATBELT_BASE_POLICY = `(version 1)
 (deny default)
@@ -301,30 +303,87 @@ function resolveRoots(profile, pathContext) {
         writableRoots,
         deniedRoots,
         protectedWritableRoots: profile.fileSystem.protectedMetadata && writableRoots.length > 0
-            ? uniqueRoots([...protectedWritableRoots, ...pathContext.workspaceRoots])
+            ? uniqueRoots([
+                ...protectedWritableRoots,
+                ...pathContext.workspaceRoots.map(resolveRootPath),
+            ])
             : [],
         protectedMetadataNames: profile.fileSystem.protectedMetadata?.names ?? [],
-        runtimeReadableRoots: uniqueRoots(pathContext.runtimeReadableRoots ?? []),
-        executableRoots: uniqueRoots(pathContext.executableRoots ?? []),
+        runtimeReadableRoots: uniqueRoots((pathContext.runtimeReadableRoots ?? []).map(resolveRootPath)),
+        executableRoots: uniqueRoots((pathContext.executableRoots ?? []).map(resolveRootPath)),
     };
 }
 function rootsForEntry(entry, pathContext) {
     if (entry.kind === 'path') {
-        return [{ path: entry.path, match: entry.match ?? 'subtree' }];
+        return [{ path: resolveRootPath(entry.path), match: entry.match ?? 'subtree' }];
     }
     switch (entry.special) {
         case ':root':
-            return [{ path: '/', match: 'subtree' }];
+            return [{ path: resolveRootPath('/'), match: 'subtree' }];
         case ':workspace_roots':
-            return pathContext.workspaceRoots.map((path) => ({ path, match: 'subtree' }));
+            return pathContext.workspaceRoots.map((path) => ({
+                path: resolveRootPath(path),
+                match: 'subtree',
+            }));
         case ':tmpdir':
-            return pathContext.tmpdir ? [{ path: pathContext.tmpdir, match: 'subtree' }] : [];
+            return pathContext.tmpdir
+                ? [{ path: resolveRootPath(pathContext.tmpdir), match: 'subtree' }]
+                : [];
         case ':slash_tmp':
-            return [{ path: pathContext.slashTmp ?? '/tmp', match: 'subtree' }];
+            return [{ path: resolveRootPath(pathContext.slashTmp ?? '/tmp'), match: 'subtree' }];
         case ':minimal':
-            return (pathContext.minimalRoots ?? []).map((path) => ({ path, match: 'subtree' }));
+            return (pathContext.minimalRoots ?? []).map((path) => ({
+                path: resolveRootPath(path),
+                match: 'subtree',
+            }));
     }
 }
+const MAX_DANGLING_SYMLINK_HOPS = 40;
+/**
+ * Seatbelt evaluates kernel-resolved paths, so every root must be emitted in
+ * canonical form. A root may not exist yet (a deny for a file that has not
+ * been created), so canonicalize the deepest existing ancestor and re-append
+ * the missing tail, mirroring `realpathAllowMissing`; an allow and its deny
+ * then stay in the same path space. Any other resolution failure (EACCES,
+ * ELOOP, ...) propagates and fails policy construction: emitting a root in
+ * lexical path space could split an allow from its deny across aliases.
+ */
+function resolveRootPath(path) {
+    let cursor = resolve(path);
+    const missing = [];
+    let hops = 0;
+    while (true) {
+        try {
+            return resolve(realpathSync(cursor), ...missing.reverse());
+        }
+        catch (error) {
+            if (!isMissingPathError(error))
+                throw error;
+            let link = null;
+            try {
+                link = readlinkSync(cursor);
+            }
+            catch {
+                link = null;
+            }
+            if (link !== null) {
+                if (++hops > MAX_DANGLING_SYMLINK_HOPS)
+                    throw new Error(`Root ${JSON.stringify(path)} traverses too many dangling symlinks.`);
+                cursor = resolve(dirname(cursor), link);
+                continue;
+            }
+            const parent = dirname(cursor);
+            if (parent === cursor)
+                throw error;
+            missing.push(basename(cursor));
+            cursor = parent;
+        }
+    }
+}
+function isMissingPathError(error) {
+    const code = error?.code;
+    return code === 'ENOENT' || code === 'ENOTDIR';
+}
 function addUniqueResolvedRoots(target, roots) {
     for (const root of roots) {
         if (!target.some((existing) => existing.path === root.path && existing.match === root.match)) {

package/node_modules/@maka/runtime-host/dist/client/peer-client.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { RuntimeHostPeerError, signRuntimeHostPeerIdentity, startRuntimeHostPeerEndpoint, verifyRuntimeHostPeerIdentity, } from '../transport/peer-native.js';
+import { normalizePeerError, RuntimeHostPeerError, signRuntimeHostPeerIdentity, startRuntimeHostPeerEndpoint, verifyRuntimeHostPeerIdentity, } from '../transport/peer-native.js';
 import { RuntimeHostPermanentReconnectError } from './reconnect-lifecycle.js';
 export function createRuntimeHostPeerClientFromEnvironment(environment = process.env, options = {}) {
     const nativePath = environment.MAKA_RUNTIME_HOST_PEER_NATIVE_PATH;
@@ -86,11 +86,30 @@ class RuntimeHostPeerClientImpl {
         return Object.freeze({ ...this.#requireEndpoint().transitSnapshot });
     }
     configureTransit(input) {
-        return this.#requireEndpoint().configureTransit(input);
+        return this.#requireEndpoint()
+            .configureTransit(input)
+            .catch((error) => {
+            throw normalizePeerError(error);
+        });
     }
     async connect(input, signal) {
+        await this.#prepareRoutes(input, signal);
         return this.#connect(input, signal, 'application');
     }
+    async #prepareRoutes(input, signal) {
+        if (!this.#routeResolver?.prepareRoutes)
+            return;
+        const deadline = AbortSignal.timeout(Math.min(10_000, input.directDeadlineMs));
+        const operationSignal = signal ? AbortSignal.any([signal, deadline]) : deadline;
+        try {
+            await this.#routeResolver.prepareRoutes(input.peerId, operationSignal);
+        }
+        catch {
+            // Route preparation enriches an invitation/profile with fresher Mesh
+            // routes. It must not suppress explicit routes the caller already has.
+            signal?.throwIfAborted();
+        }
+    }
     async connectMeshControl(input, signal) {
         return this.#connect(input, signal, 'mesh-control');
     }
@@ -193,7 +212,7 @@ class RuntimeHostPeerClientImpl {
         }
         catch (error) {
             signal?.throwIfAborted();
-            throw error;
+            throw normalizePeerError(error);
         }
         finally {
             settled = true;

package/node_modules/@maka/runtime-host/dist/operator/peer-mesh-management-frame.js

@@ -30,6 +30,8 @@ const ACTION_SCHEMA = z.enum([
     'close',
     'reconcile',
     'transit',
+    'rename',
+    'rename-mesh',
 ]);
 const FRAME_SCHEMA = z.union([
     z.object({ kind: z.literal('input'), action: z.literal('join') }).strict(),
@@ -93,6 +95,18 @@ function decodeFrame(value) {
                 action: 'transit',
                 result: decodePeerMeshQueryResult(frame.result),
             };
+        case 'rename':
+            return {
+                kind: 'result',
+                action: 'rename',
+                result: decodePeerMeshQueryResult(frame.result),
+            };
+        case 'rename-mesh':
+            return {
+                kind: 'result',
+                action: 'rename-mesh',
+                result: decodePeerMeshQueryResult(frame.result),
+            };
         case 'invite':
             return {
                 kind: 'result',

package/{packages/eval/dist/index.js → node_modules/@maka/runtime-host/dist/peer-mesh/display-name.js}

@@ -16,13 +16,15 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-export * from './attempt-store.js';
-export * from './cli.js';
-export * from './experiment-directory.js';
-export * from './experiment.js';
-export * from './external-subject.js';
-export * from './harness-executor.js';
-export * from './maka-subject.js';
-export * from './result.js';
-export * from './runner.js';
-export * from './spec.js';
+export const PEER_MESH_DISPLAY_NAME_MAX_LENGTH = 80;
+export function canonicalPeerMeshDisplayName(value) {
+    if (typeof value !== 'string')
+        throw new Error('Invalid Peer Mesh display name');
+    const displayName = value.trim();
+    if (displayName.length === 0 ||
+        displayName.length > PEER_MESH_DISPLAY_NAME_MAX_LENGTH ||
+        /[\u0000-\u001f\u007f]/u.test(displayName)) {
+        throw new Error('Invalid Peer Mesh display name');
+    }
+    return displayName;
+}