maka-agent 0.2.0-dev.30.20260912 → 0.2.0-dev.31.20260913

package/node_modules/@maka/runtime/dist/ripgrep-guidance.js

@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/**
+ * Grep's only engine is ripgrep, and nothing ships it (#5167). These builders
+ * keep the missing-ripgrep copy identical on the local executor and the
+ * filesystem worker, so the model and the user learn the same fix whichever
+ * path ran the search. Both paths look ripgrep up again on the next attempt —
+ * the local executor on every call, the worker whenever the copy it knew is
+ * missing, gone or replaced — so the recovery is always "install it where the
+ * Host runs, then retry", never a restart. The Windows sandbox refusal
+ * deliberately stays in the worker: that is a capability limit of the
+ * AppContainer, not a missing dependency.
+ *
+ * The copy reaches the model as tool output, so it names a place without
+ * naming the machine. A WSL distribution is an identifier Maka already keeps
+ * for its Hosts; a hostname is personal (a default macOS name carries its
+ * owner's name) and Maka otherwise shows it only as a device name in Desktop,
+ * which already says which Host is active.
+ */
+const RIPGREP_INSTALL_URL = 'https://github.com/BurntSushi/ripgrep#installation';
+export function currentRipgrepEnvironment(env = process.env) {
+    const distribution = env.WSL_DISTRO_NAME?.trim();
+    return distribution ? { kind: 'wsl', name: distribution } : undefined;
+}
+/** The worker receives its environment as a launch argument: its own environment block is scrubbed. */
+export function formatRipgrepEnvironmentArg(environment) {
+    return `${environment.kind}:${environment.name}`;
+}
+export function parseRipgrepEnvironmentArg(value) {
+    const match = value ? /^wsl:(.+)$/u.exec(value) : null;
+    return match ? { kind: 'wsl', name: match[1] } : undefined;
+}
+function installLocation(environment) {
+    return environment
+        ? `the WSL distribution "${environment.name}"`
+        : 'the machine this Maka Host runs on (for a remote Host, that server rather than this computer)';
+}
+function installInstructions(environment, platform) {
+    const command = platform === 'darwin'
+        ? '`brew install ripgrep`'
+        : platform === 'win32'
+            ? '`winget install BurntSushi.ripgrep.MSVC`'
+            : 'your package manager (for example `apt install ripgrep`)';
+    return `Install it on ${installLocation(environment)} with ${command}, or see ${RIPGREP_INSTALL_URL}, then retry.`;
+}
+/** The local executor looks `rg` up on PATH at every call. */
+export function ripgrepMissingOnPathMessage(environment, platform = process.platform) {
+    return `Grep requires ripgrep (\`rg\`), and it was not found on PATH. ${installInstructions(environment, platform)}`;
+}
+/** The worker was launched without a usable ripgrep; its next launch looks again. */
+export function ripgrepMissingMessage(environment, platform = process.platform) {
+    return `Grep requires ripgrep (\`rg\`), and no usable copy was found. ${installInstructions(environment, platform)}`;
+}
+/** The executable the worker was launched with is gone (e.g. a package upgrade removed it). */
+export function ripgrepVanishedMessage(executable, environment) {
+    return `Grep could not start ripgrep at ${executable}; it was moved or removed, for example by a package upgrade. Reinstall it on ${installLocation(environment)} if needed, then retry.`;
+}
+/** Local-executor twin of the worker protocol's `grep_unavailable` error. */
+export class RipgrepUnavailableError extends Error {
+    code = 'grep_unavailable';
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'RipgrepUnavailableError';
+    }
+}

package/node_modules/@maka/runtime/dist/runtime-event-read-model.js

@@ -25,6 +25,7 @@ import { isPartialRuntimeEvent, isTerminalRuntimeEvent, isTerminalRuntimeEventSt
 import { decodePersistedToolResultContent } from '@maka/core/tool-result-record-schema';
 const SETTLED_SANDBOX_BOUNDARY_STATUSES = SANDBOX_BOUNDARY_REQUEST_STATUSES.filter((status) => status !== 'pending');
 import { isArchivedToolResultPlaceholder } from './tool-result-archive.js';
+import { truncateToolOutput } from './tool-output.js';
 /**
  * Whether a diagnostic means the projection may have lost user-visible content.
  *
@@ -94,7 +95,54 @@ const UNCLAIMED_RUNTIME_EVENT_DIAGNOSTIC_CODES = [
 export function isUnclaimedRuntimeEventDiagnostic(diagnostic) {
     return UNCLAIMED_RUNTIME_EVENT_DIAGNOSTIC_CODES.includes(diagnostic.code);
 }
+/**
+ * Keep a completed local terminal result useful but bounded in transcript views.
+ * The durable RuntimeEvent remains untouched and the marker names its retained
+ * result, so readers can fetch the full output without repeating the command.
+ */
+export function projectTranscriptToolResult(event, content) {
+    if (content.kind !== 'terminal' ||
+        content.output.mode !== 'pipes' ||
+        !hasLocalTerminalModelProjection(event)) {
+        return content;
+    }
+    const recoveryHint = `Read ${JSON.stringify({
+        path: `maka://runtime/tool-results/${encodeURIComponent(event.id)}`,
+    })} for the retained output; follow next to continue.`;
+    const options = { maxBytes: 1024, maxLines: 20, direction: 'tail', recoveryHint };
+    const stdout = truncateToolOutput(content.output.stdout, options);
+    const stderr = truncateToolOutput(content.output.stderr, options);
+    if (!stdout.truncated && !stderr.truncated)
+        return content;
+    return {
+        ...content,
+        output: {
+            ...content.output,
+            stdout: stdout.content,
+            stderr: stderr.content,
+            stdoutTruncated: content.output.stdoutTruncated || stdout.truncated,
+            stderrTruncated: content.output.stderrTruncated || stderr.truncated,
+        },
+    };
+}
+function hasLocalTerminalModelProjection(event) {
+    const content = event.content;
+    if (content?.kind !== 'function_response' || content.providerExecuted)
+        return false;
+    const projection = content.modelProjection;
+    return (projection?.kind === 'json' &&
+        projection.value !== null &&
+        typeof projection.value === 'object' &&
+        'kind' in projection.value &&
+        projection.value.kind === 'terminal');
+}
 export function projectRuntimeEventsToStoredMessages(events, options) {
+    const projector = createRuntimeEventStoredMessageProjector(options);
+    for (const event of events)
+        projector.push(event);
+    return projector.finish();
+}
+export function createRuntimeEventStoredMessageProjector(options) {
     const state = {
         invocations: normalizeInvocations(options.invocations),
         diagnostics: [],
@@ -102,6 +150,8 @@ export function projectRuntimeEventsToStoredMessages(events, options) {
         permissionRequestById: new Map(),
         thinkingByMessageId: new Map(),
         contentOrderByMessageId: new Map(),
+        ...(options.projectToolResult ? { projectToolResult: options.projectToolResult } : {}),
+        sourceOrder: -1,
     };
     const messages = [];
     /**
@@ -112,19 +162,48 @@ export function projectRuntimeEventsToStoredMessages(events, options) {
      * handled are exactly that event's rows. A durable reader numbers its pages
      * from this, which is why it is recorded here rather than rediscovered.
      */
-    const sourceEventIds = [];
-    let reading;
-    const attributeEmitted = () => {
-        while (sourceEventIds.length < messages.length)
-            sourceEventIds.push(reading.id);
+    const messageSources = [];
+    const diagnosticSources = [];
+    const deferredPermissionAcceptances = [];
+    const permissionRequestIds = new Set();
+    let nextSourceOrder = 0;
+    let finished;
+    const attributeEmitted = (event, sourceOrder, firstSourcePosition) => {
+        let sourcePosition = firstSourcePosition;
+        while (messageSources.length < messages.length) {
+            const message = messages[messageSources.length];
+            messageSources.push({
+                eventId: event.id,
+                sourceOrder,
+                sourcePosition,
+                emittedOrder: messageSources.length,
+            });
+            sourcePosition += 1;
+            options.onMessage?.(message, event.id);
+        }
+        return sourcePosition;
     };
-    for (const event of events) {
-        attributeEmitted();
-        reading = event;
+    const attributeDiagnostics = (sourceOrder, firstSourcePosition) => {
+        let sourcePosition = firstSourcePosition;
+        while (diagnosticSources.length < state.diagnostics.length) {
+            diagnosticSources.push({
+                sourceOrder,
+                sourcePosition,
+                emittedOrder: diagnosticSources.length,
+            });
+            sourcePosition += 1;
+        }
+        return sourcePosition;
+    };
+    const projectEvent = (event, sourceOrder) => {
+        let nextMessagePosition = 0;
+        let nextDiagnosticPosition = 0;
+        state.sourceOrder = sourceOrder;
         recordStepContentOrder(event, state);
         if (isPartialRuntimeEvent(event)) {
             diagnostic(state, event, 'partial_skipped', 'partial RuntimeEvent skipped');
-            continue;
+            attributeDiagnostics(sourceOrder, nextDiagnosticPosition);
+            return;
         }
         let projected = false;
         const content = event.content;
@@ -197,7 +276,17 @@ export function projectRuntimeEventsToStoredMessages(events, options) {
             projected = true;
         }
         if (event.actions?.permissionAnswerAccepted) {
-            projectCanonicalPermissionOutcome(event, state, messages, options.canonicalPermissionOutcomes);
+            nextMessagePosition = attributeEmitted(event, sourceOrder, nextMessagePosition);
+            nextDiagnosticPosition = attributeDiagnostics(sourceOrder, nextDiagnosticPosition);
+            const requestId = event.actions.permissionAnswerAccepted.requestId;
+            permissionRequestIds.add(requestId);
+            deferredPermissionAcceptances.push({
+                event: permissionAcceptanceProjectionEvent(event),
+                ledgerRequest: state.permissionRequestById.get(requestId),
+                sourceOrder,
+                messagePosition: nextMessagePosition++,
+                diagnosticPosition: nextDiagnosticPosition++,
+            });
             projected = true;
         }
         if (event.actions?.permissionClosureAccepted) {
@@ -284,14 +373,74 @@ export function projectRuntimeEventsToStoredMessages(events, options) {
                 diagnostic(state, event, 'unsupported_event', 'RuntimeEvent shape is not supported by the legacy read-model projection');
             }
         }
-    }
-    for (const pendingItems of state.thinkingByMessageId.values()) {
-        for (const pending of pendingItems) {
-            diagnostic(state, pending.event, 'unsupported_event', 'thinking content has no assistant text row with a matching message id');
+        attributeEmitted(event, sourceOrder, nextMessagePosition);
+        attributeDiagnostics(sourceOrder, nextDiagnosticPosition);
+    };
+    const push = (event) => {
+        if (finished)
+            throw new Error('RuntimeEvent StoredMessage projector is already finished');
+        const sourceOrder = nextSourceOrder++;
+        projectEvent(options.active ? settledPresentationEvent(event) : event, sourceOrder);
+    };
+    const finish = () => {
+        if (finished)
+            return finished;
+        for (const acceptance of deferredPermissionAcceptances) {
+            const before = messages.length;
+            projectCanonicalPermissionOutcome(acceptance.event, state, messages, options.canonicalPermissionOutcomes, acceptance.ledgerRequest);
+            if (messages.length > before) {
+                attributeEmitted(acceptance.event, acceptance.sourceOrder, acceptance.messagePosition);
+            }
+            attributeDiagnostics(acceptance.sourceOrder, acceptance.diagnosticPosition);
         }
-    }
-    attributeEmitted();
-    return { messages, diagnostics: state.diagnostics, sourceEventIds };
+        if (options.active) {
+            for (const pendingItems of [...state.thinkingByMessageId.values()]) {
+                const pending = pendingItems.at(-1);
+                if (pending)
+                    projectEvent(emptyAssistantText(pending.event), pending.sourceOrder);
+            }
+        }
+        const orderedDiagnostics = state.diagnostics
+            .map((diagnostic, index) => ({ diagnostic, source: diagnosticSources[index] }))
+            .sort((left, right) => left.source.sourceOrder - right.source.sourceOrder ||
+            left.source.sourcePosition - right.source.sourcePosition ||
+            left.source.emittedOrder - right.source.emittedOrder);
+        state.diagnostics.splice(0, state.diagnostics.length, ...orderedDiagnostics.map(({ diagnostic }) => diagnostic));
+        if (!options.active) {
+            for (const pendingItems of state.thinkingByMessageId.values()) {
+                for (const pending of pendingItems) {
+                    diagnostic(state, pending.event, 'unsupported_event', 'thinking content has no assistant text row with a matching message id');
+                }
+            }
+        }
+        const ordered = messages
+            .map((message, index) => ({ message, source: messageSources[index] }))
+            .sort((left, right) => left.source.sourceOrder - right.source.sourceOrder ||
+            left.source.sourcePosition - right.source.sourcePosition ||
+            left.source.emittedOrder - right.source.emittedOrder);
+        finished = {
+            messages: ordered.map(({ message }) => message),
+            diagnostics: state.diagnostics,
+            sourceEventIds: ordered.map(({ source }) => source.eventId),
+        };
+        deferredPermissionAcceptances.length = 0;
+        messageSources.length = 0;
+        diagnosticSources.length = 0;
+        state.invocations.clear();
+        state.toolNameByUseId.clear();
+        state.permissionRequestById.clear();
+        state.thinkingByMessageId.clear();
+        state.contentOrderByMessageId.clear();
+        state.projectToolResult = undefined;
+        return finished;
+    };
+    return {
+        push,
+        finish,
+        get permissionRequestIds() {
+            return [...permissionRequestIds];
+        },
+    };
 }
 /**
  * A running invocation's events as the transcript should show them right now.
@@ -564,6 +713,7 @@ function projectThinking(event, state, messages) {
         event,
         messageId,
         text: event.content.text,
+        sourceOrder: state.sourceOrder,
         ...(event.content.signature !== undefined ? { signature: event.content.signature } : {}),
         ...(event.content.providerOptions !== undefined
             ? { providerOptions: structuredClone(event.content.providerOptions) }
@@ -669,7 +819,7 @@ function projectFunctionResponse(event, state, messages) {
     }
     if (event.content.name)
         state.toolNameByUseId.set(toolUseId, event.content.name);
-    const resultContent = archivedPlaceholder
+    const decodedResult = archivedPlaceholder
         ? {
             kind: 'archived_tool_result',
             status: 'not_loaded',
@@ -687,6 +837,9 @@ function projectFunctionResponse(event, state, messages) {
             reason: archivedPlaceholder.reason,
         }
         : normalizedResult;
+    const resultContent = state.projectToolResult
+        ? state.projectToolResult(event, decodedResult)
+        : decodedResult;
     messages.push({
         type: 'tool_result',
         id: stableMessageId(event, state, 'tool_result'),
@@ -766,11 +919,10 @@ function projectPermissionDecision(event, state, messages) {
     });
     return true;
 }
-function projectCanonicalPermissionOutcome(event, state, messages, outcomes) {
+function projectCanonicalPermissionOutcome(event, state, messages, outcomes, ledgerRequest) {
     const accepted = event.actions?.permissionAnswerAccepted;
     if (!accepted)
         return;
-    const ledgerRequest = state.permissionRequestById.get(accepted.requestId);
     const canonical = outcomes?.get(accepted.requestId);
     const toolUseId = event.refs?.toolCallId;
     if (!canonical || !toolUseId) {
@@ -807,6 +959,21 @@ function projectCanonicalPermissionOutcome(event, state, messages, outcomes) {
         ...(ledgerRequest?.hint !== undefined ? { hint: ledgerRequest.hint } : {}),
     });
 }
+function permissionAcceptanceProjectionEvent(event) {
+    return {
+        id: event.id,
+        sessionId: event.sessionId,
+        invocationId: event.invocationId,
+        runId: event.runId,
+        turnId: event.turnId,
+        ts: event.ts,
+        partial: event.partial,
+        role: event.role,
+        author: event.author,
+        actions: { permissionAnswerAccepted: event.actions.permissionAnswerAccepted },
+        ...(event.refs?.toolCallId ? { refs: { toolCallId: event.refs.toolCallId } } : {}),
+    };
+}
 function projectTokenUsage(event, state, messages) {
     const usage = event.actions?.tokenUsage;
     if (!usage)

package/node_modules/@maka/runtime/dist/runtime-read-model.js

@@ -18,7 +18,7 @@
  */
 import { deriveTurnRecords } from '@maka/core/session';
 import { isSessionInlineInvocation } from '@maka/core/runtime-invocation';
-import { activePresentationRuntimeEvents, classifyRuntimeEventTerminalFact, isHardRuntimeEventReadModelDiagnostic, projectRuntimeEventsToStoredMessages, } from './runtime-event-read-model.js';
+import { activePresentationRuntimeEvents, classifyRuntimeEventTerminalFact, isHardRuntimeEventReadModelDiagnostic, projectRuntimeEventsToStoredMessages, projectTranscriptToolResult, } from './runtime-event-read-model.js';
 import { buildRuntimeEventModelReplayPlan, } from './model-history.js';
 const CANONICAL_PERMISSION_READ_CONCURRENCY = 8;
 export class RuntimeReadModelError extends Error {
@@ -116,6 +116,7 @@ export class RuntimeReadModel {
         const projected = projectRuntimeEventsToStoredMessages(input.events, {
             invocations: input.invocations,
             canonicalPermissionOutcomes: canonicalPermissionRead.outcomes,
+            projectToolResult: projectTranscriptToolResult,
         });
         const diagnostics = [
             ...input.diagnostics,

package/node_modules/@maka/runtime/dist/sandbox/linux-profile-path.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { closeSync, constants, fstatSync, lstatSync, openSync } from 'node:fs';
+import { closeSync, constants, fstatSync, lstatSync, openSync, readlinkSync } from 'node:fs';
 export function pinExistingLinuxProfilePath(input) {
     const existing = (() => {
         try {
@@ -43,6 +43,12 @@ export function pinExistingLinuxProfilePath(input) {
         closeSync(sourceFd);
     };
     try {
+        // O_NOFOLLOW only protects the last component. Check the kernel's path for
+        // the opened object too, so a replaced ancestor cannot redirect an approved
+        // canonical path. Checking the original pathname again would race anew.
+        if (process.platform === 'linux' && readlinkSync(`/proc/self/fd/${sourceFd}`) !== input.path) {
+            throw new Error(`Approved sandbox path changed before pinning: ${input.path}`);
+        }
         const metadata = fstatSync(sourceFd, { bigint: true });
         if (metadata.dev !== BigInt(existing.dev) ||
             metadata.ino !== BigInt(existing.ino) ||

package/node_modules/@maka/runtime/dist/sandbox/linux-sandbox.js

@@ -17,7 +17,7 @@
  * under the License.
  */
 import { posix } from 'node:path';
-import { readdirSync } from 'node:fs';
+import { fstatSync, readdirSync } from 'node:fs';
 import { detectLinuxSandboxCapability, LINUX_BWRAP_REQUIRED_NAMESPACE_ARGS, } from './linux-capability.js';
 const DEFAULT_READ_ONLY_HOST_PATHS = ['/usr', '/bin', '/sbin', '/lib', '/lib64', '/etc'];
 export class LinuxBubblewrapBackend {
@@ -59,7 +59,12 @@ export class LinuxBubblewrapBackend {
         catch (error) {
             return failure('backend_not_available', `Unable to enumerate protected metadata: ${error instanceof Error ? error.message : String(error)}`, plan.platform, plan.preference);
         }
-        const pinnedFdInputs = command.pathContext.pinnedProfilePaths?.map(({ fd, sourceFd, releaseSource }) => ({
+        const exactReadableRoots = exactProfileRoots(command.profile, 'read');
+        const pinnedFdInputs = command.pathContext.pinnedProfilePaths
+            ?.filter((entry) => !(entry.access === 'read' &&
+            exactReadableRoots.has(entry.path) &&
+            fstatSync(entry.sourceFd).isDirectory()))
+            .map(({ fd, sourceFd, releaseSource }) => ({
             fd,
             sourceFd,
             ...(releaseSource ? { releaseSource } : {}),
@@ -159,9 +164,6 @@ function buildBubblewrapArgvWithRoots(input, roots) {
     if (networkRestricted(command.profile)) {
         argv.push('--unshare-net', '--seccomp', '3');
     }
-    for (const path of DEFAULT_READ_ONLY_HOST_PATHS) {
-        argv.push('--ro-bind-try', path, path);
-    }
     const runtimeWritableRoots = removeNestedRoots((command.pathContext.runtimeWritableRoots ?? []).filter(isUsableRuntimeRoot));
     const unavailableProfilePaths = new Set(command.pathContext.unavailableProfilePaths ?? []);
     const pinnedRuntimeWritableRoots = new Map((command.pathContext.pinnedRuntimeWritableRoots ?? []).map((entry) => [entry.path, entry]));
@@ -219,6 +221,17 @@ function buildBubblewrapArgvWithRoots(input, roots) {
     for (const directory of requiredParentDirectories(mountRoots)) {
         argv.push('--dir', directory);
     }
+    // Materialize exact directory markers before any host bind. Creating them
+    // inside an already-mounted tree could follow concurrently replaced symlinks.
+    const exactReadableDirectories = new Set(profileReadableRoots.filter((root) => {
+        const pinned = pinnedProfilePaths.get(root);
+        return exactReadableRoots.has(root) && pinned && fstatSync(pinned.sourceFd).isDirectory();
+    }));
+    for (const directory of exactReadableDirectories)
+        argv.push('--dir', directory);
+    for (const path of DEFAULT_READ_ONLY_HOST_PATHS) {
+        argv.push('--ro-bind-try', path, path);
+    }
     for (const directory of extraProgramDirectories) {
         argv.push('--ro-bind', directory, directory);
     }
@@ -243,6 +256,8 @@ function buildBubblewrapArgvWithRoots(input, roots) {
         const pinned = pinnedProfilePaths.get(root);
         if (exactReadableRoots.has(root) && !pinned)
             continue;
+        if (exactReadableDirectories.has(root))
+            continue;
         argv.push('--ro-bind', pinned ? `/proc/self/fd/${pinned.fd}` : root, root);
     }
     for (const root of profileWritableRoots) {

package/node_modules/@maka/runtime/dist/session-manager.js

@@ -720,10 +720,10 @@ export class SessionManager {
                 : header.permissionMode;
         const narrows = narrowsExecutionAuthority(current, permissionMode);
         if (narrows && this.runtimeKernel.hasActiveRuns(sessionId)) {
-            throw new Error('当前任务正在运行，等结束后再切换沙箱边界。');
+            throw new SessionConfigurationTransitionError('session_busy', 'Execution boundary cannot change while a Turn is running');
         }
         if (header.status === 'waiting_for_user') {
-            throw new Error('当前有沙箱边界请求正在等待确认，处理后再切换。');
+            throw new SessionConfigurationTransitionError('session_busy', 'Execution boundary cannot change while an Interaction is pending');
         }
         const boundary = await this.commitExecutionBoundaryTransition(sessionId, current, permissionMode, async () => () => this.deps.store.setExecutionBoundaryKind(sessionId, kind, { permissionMode }));
         return boundary;
@@ -904,18 +904,18 @@ export class SessionManager {
             throw new PlanConflictError('Linked child Sessions cannot enter Plan mode');
         }
         if (this.runtimeKernel.hasActiveRuns(sessionId)) {
-            throw new Error('当前任务正在运行，等结束后再切换协作模式。');
+            throw new SessionConfigurationTransitionError('session_busy', 'Collaboration mode cannot change while a Turn is running');
         }
         if (previous.status === 'waiting_for_user') {
-            throw new Error('当前有工具调用正在等待确认，处理后再切换协作模式。');
+            throw new SessionConfigurationTransitionError('session_busy', 'Collaboration mode cannot change while an Interaction is pending');
         }
         const planState = await this.requirePlanStore().readState(sessionId);
         if (mode === 'plan' && planState.activeExecutionId) {
-            throw new Error('当前计划仍在执行，结束或中断后才能切换到 Plan Mode。');
+            throw new SessionConfigurationTransitionError('session_busy', 'An active Plan execution prevents entering Plan mode');
         }
         const latestProposal = planState.proposals.find((proposal) => proposal.proposalId === planState.latestProposalId);
         if (mode === 'agent' && latestProposal?.status === 'pending_approval') {
-            throw new Error('当前方案正在等待审批，请明确放弃方案后再退出 Plan Mode。');
+            throw new SessionConfigurationTransitionError('operation_conflict', 'A pending Plan proposal must be resolved before leaving Plan mode');
         }
         const next = await this.deps.store.updateHeader(sessionId, {
             collaborationMode: mode,

package/node_modules/@maka/runtime/dist/session-recap.js

@@ -19,7 +19,7 @@
 import { runtimeEventHasModelVisibleContent } from '@maka/core/runtime-event';
 import { resolveSelectedModelContextWindow } from './context-budget-policy.js';
 import { stableJsonLength } from './context-budget-helpers.js';
-import { groupEventsByTurn } from './model-history.js';
+import { groupEventsByTurn, formatTextWithInlineRefs } from './model-history.js';
 import { HistoryCompactSummarizerError } from './history-compact-error.js';
 import { fitHistoryCompactMessages } from './history-compact-input-fit.js';
 const SESSION_RECAP_TOOL_OUTCOME_MAX_CHARS = 600;
@@ -99,10 +99,14 @@ function projectSessionRecapMessages(events) {
             continue;
         const content = event.content;
         if (content?.kind === 'text' && (event.role === 'user' || event.role === 'model')) {
-            const text = content.text.trim();
-            if (text.length > 0) {
-                messages.push({ role: event.role === 'user' ? 'user' : 'assistant', content: text });
-            }
+            // The gate above already decided visibility through the shared
+            // predicate, which is satisfied by non-empty text or by the structured
+            // carriers — so every event reaching here projects, with its trimmed
+            // text and staged refs rendered by the shared inline-ref formatter.
+            messages.push({
+                role: event.role === 'user' ? 'user' : 'assistant',
+                content: formatTextWithInlineRefs({ ...content, text: content.text.trim() }),
+            });
             continue;
         }
         if (content?.kind !== 'function_response')

package/node_modules/@maka/runtime/dist/shell-exec.js

@@ -30,11 +30,11 @@ import { buildShellSpawnPlan, defaultShellPlan } from './shell-detect.js';
 import { BashTailBuffer } from './bash-tail-buffer.js';
 import { DEFAULT_PROCESS_TERMINATION_GRACE_MS } from './process-tree-terminator.js';
 import { DEFAULT_PROCESS_IO_DRAIN_TIMEOUT_MS, manageChildProcessLifecycle, } from './child-process-lifecycle.js';
-import { OUTPUT_RECOVERY_HINT } from './tool-output.js';
 import { buildSpawnStdio, closeChildFdSources, writeChildFdInputs, } from './child-fd-input.js';
 // Per-stream cap on the output RETAINED for the result (~1MB). This only bounds
-// what is kept to return. The tool layer (truncateToolOutput) trims this further
-// to the model's budget. Shared so both Bash paths retain identically.
+// what is kept to return. The tool layer preserves this result for durable
+// storage; unified result pruning bounds its model projection.
+// Shared so both Bash paths retain identically.
 export const BASH_MAX_RETAINED_CHARS = 1024 * 1024;
 // Per-stream cap on output forwarded LIVE via emitOutput (~1MB). The command is
 // never killed for size and the full recoverable tail is still RETAINED (above),
@@ -47,20 +47,6 @@ export const BASH_MAX_LIVE_EMIT_CHARS = 1024 * 1024;
 // not lost — it still feeds the retained tail and the returned result.
 export const LIVE_OUTPUT_SUPPRESSED_MARKER = '[live output suppressed: too much output to stream live; the command keeps ' +
     'running and its result still contains the most recent output]';
-// Appended to a stream when BashTailBuffer dropped an oversized line that had no
-// newline to truncate at (dropped whole for redaction safety). Without it, a
-// command whose only output was one giant line would look like it produced
-// nothing. Carries no dropped content — just a recoverable notice.
-const UNSAFE_DROP_MARKER = '[a single line larger than the output limit was omitted for safety. ' +
-    OUTPUT_RECOVERY_HINT +
-    ']';
-export function shellTailValueWithUnsafeDropMarker(buf) {
-    const text = buf.value(); // value() trims first, so the drop flag is current after it
-    if (!buf.hasDroppedUnsafe())
-        return text;
-    // Append (not prepend) so a later tail-keeping truncateToolOutput retains it.
-    return text ? `${text}\n${UNSAFE_DROP_MARKER}` : UNSAFE_DROP_MARKER;
-}
 /**
  * Run `command` in a shell, streaming output into a memory-bounded tail. Never
  * kills the command for producing too much output — it keeps only the last
@@ -213,8 +199,8 @@ function runSpawnedProcessWithBoundedTail(program, args, useShellOption, options
                 return;
             settled = true;
             cleanup();
-            const stdout = shellTailValueWithUnsafeDropMarker(stdoutBuf);
-            const stderr = shellTailValueWithUnsafeDropMarker(stderrBuf);
+            const stdout = stdoutBuf.value();
+            const stderr = stderrBuf.value();
             resolvePromise({
                 exitCode: termination
                     ? termination.timedOut
@@ -223,12 +209,8 @@ function runSpawnedProcessWithBoundedTail(program, args, useShellOption, options
                     : (outcome.exitCode ?? (outcome.signal ? 128 : 1)),
                 stdout,
                 stderr,
-                stdoutTruncated: outcome.incompleteOutputs.has('stdout') ||
-                    stdoutChars > stdout.length ||
-                    stdoutBuf.hasDroppedUnsafe(),
-                stderrTruncated: outcome.incompleteOutputs.has('stderr') ||
-                    stderrChars > stderr.length ||
-                    stderrBuf.hasDroppedUnsafe(),
+                stdoutTruncated: outcome.incompleteOutputs.has('stdout') || stdoutChars > stdout.length,
+                stderrTruncated: outcome.incompleteOutputs.has('stderr') || stderrChars > stderr.length,
                 timedOut: !!termination?.timedOut,
                 aborted: !!termination?.aborted,
             });

package/node_modules/@maka/runtime/dist/shell-run-manager.js

@@ -715,7 +715,7 @@ export class ShellRunProcessManager {
             sourceToolCallId: input.sourceToolCallId,
             ...(input.visibility === undefined ? {} : { visibility: input.visibility }),
             cwd: input.cwd,
-            command: redactSecrets(input.command),
+            command: input.command,
             status: 'starting',
             startedAt,
             updatedAt: startedAt,

package/node_modules/@maka/runtime/dist/shell-run-tool-result.js

@@ -43,7 +43,7 @@ export function terminalContent(record) {
         status: terminalResultStatus(record.status),
         ...(record.exitCode !== undefined ? { exitCode: record.exitCode } : {}),
         ...(record.failureMessage !== undefined ? { failureMessage: record.failureMessage } : {}),
-        output: projectShellOutputForModel(record.output),
+        output: record.output,
         ...(sandboxDenialForRecord(record) ? { sandboxDenial: sandboxDenialForRecord(record) } : {}),
     };
 }