maka-agent 0.2.0-dev.43.20260919 → 0.2.0-dev.45.20260921

package/LICENSE

@@ -251,9 +251,11 @@ Theme revision: ea888ef33283ea44e37817d36bc8e84a0568bc30
 Copyright (c) 2026 Meta Platforms, Inc.
 License: MIT
 
-Maka includes an ejected adaptation of Astryx ChatReasoning v0.1.9 and generated
-theme artifacts based on Astryx theme-neutral v0.6.1. Maka also redistributes
-`patches/@astryxdesign+core+0.6.1.patch`, which modifies the MIT-licensed Astryx
+Maka includes an ejected adaptation of Astryx ChatReasoning v0.1.9 in
+`packages/ui/src/astryx-chat-reasoning.tsx` and generated theme artifacts in
+`apps/desktop/src/renderer/astryx-theme/`, based on Astryx theme-neutral v0.6.2.
+Maka also redistributes
+`patches/@astryxdesign+core+0.6.2.patch`, which modifies the MIT-licensed Astryx
 core package. The following MIT License applies to that material:
 
 MIT License
@@ -579,7 +581,9 @@ Revision: 8c921b2b3bf13494724ead4f0a814d80c56a7e8b
 Copyright (c) 2025 Cua AI, Inc.
 License: MIT
 
-Maka's agent-cursor renderer and palette include adaptations of this component.
+`apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts` and
+`apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts` include
+adaptations of this component.
 The following MIT License applies to that material:
 
 MIT License
@@ -767,8 +771,10 @@ SOFTWARE.
 
 Desktop renderer vendored source assets
 
-The source archive includes third-party SVG paths and source assets used by the
-desktop renderer. Their file-by-file inventory, immutable upstream revisions,
+The source archive includes third-party SVG paths and source assets from
+Lobe Icons (MIT), LocalAI (MIT), Simple Icons (CC0-1.0), TDesign Icons (MIT),
+MingCute (Apache-2.0), Allogo (MIT), Ant Design Icons (MIT), and Semi Design
+(MIT), used by the desktop renderer. Their file-by-file inventory, immutable upstream revisions,
 copyright notices, and license texts are in:
 
   apps/desktop/src/renderer/public/THIRD_PARTY_LICENSES.txt

package/dist/mcp-capability-provider.js

@@ -76,6 +76,13 @@ export function createMcpCapabilityProvider(manager) {
             return projectMcpResult(await manager.callTool(binding, frame.arguments, {
                 signal: options.signal,
                 requestInteraction: options.requestInteraction,
+                ...(options.progress
+                    ? {
+                        onProgress: (current, total) => {
+                            options.progress?.(current, total);
+                        },
+                    }
+                    : {}),
             }));
         },
     };

package/dist/runtime-host-service-manager.js

@@ -27,7 +27,7 @@ import { truncateUtf8 } from '@maka/core/diagnostic-log';
 import { canonicalProjectDirectoryRootSpec, isCanonicalRuntimeHostWebSocketPath, PROJECT_DIRECTORY_MAX_ROOTS, projectDirectoryRootSpecValid, RUNTIME_HOST_PROTOCOL_VERSION, } from '@maka/runtime-host/protocol';
 import { connectExistingRuntimeHost, prepareConnectedRuntimeHostRetirement, } from '@maka/runtime-host/client';
 import { resolveRuntimeHostManagedServiceId, RUNTIME_HOST_SERVICE_LOG_MAX_BYTES, } from '@maka/runtime-host/operator';
-import { withLegacyFileUpdateLockLease, withProcessLifetimeFileUpdateLock, } from '@maka/storage/process-lifetime-file-update-lock';
+import { withProcessLifetimeFileUpdateLock } from '@maka/storage/process-lifetime-file-update-lock';
 import { discoverMarkedStorageRoot, resolveExistingStorageRoot, tryAcquireInteractiveRootOwner, } from '@maka/storage/root-authority';
 import { isRuntimeHostManagedDeploymentCli, removeRuntimeHostManagedDeployment, resolveExistingRuntimeHostManagedDeploymentRoot, resolveRuntimeHostManagedDeploymentForCli, resolveRuntimeHostManagedDeploymentRoot, } from './runtime-host-managed-deployment.js';
 import { writeRuntimeHostManagedUpdatePolicy } from './runtime-host-update-policy-store.js';
@@ -79,11 +79,6 @@ export async function withRuntimeHostManagedServiceDeploymentLock(clientDataRoot
     await mkdir(clientDataRoot, { recursive: true, mode: 0o700 });
     return withProcessLifetimeFileUpdateLock(join(clientDataRoot, SERVICE_DEPLOYMENT_LOCK_FILE), operation, timeoutMs);
 }
-export async function withRuntimeHostManagedServiceLegacyOperatorLeases(clientDataRoot, operation, timeoutMs = SERVICE_OPERATION_LOCK_TIMEOUT_MS) {
-    const configPath = resolveRuntimeHostManagedServiceConfigPath(clientDataRoot);
-    await mkdir(dirname(configPath), { recursive: true, mode: 0o700 });
-    return withLegacyFileUpdateLockLease(join(clientDataRoot, SERVICE_LIFECYCLE_LOCK_FILE), (lifecycleFd) => withLegacyFileUpdateLockLease(configPath, (configFd) => operation([lifecycleFd, configFd]), timeoutMs), timeoutMs);
-}
 export async function replaceRuntimeHostManagedService(input, backend, overrides = {}) {
     const deps = runtimeHostServiceManagerDeps(overrides);
     const configPath = resolveRuntimeHostManagedServiceConfigPath(input.clientDataRoot);

package/dist/runtime-host-tui-command.js

@@ -50,7 +50,7 @@ export async function runRuntimeHostTui(input) {
             throw error;
         const configured = await runFirstRunOnboarding(input.clientDataRoot, input.workspaceRoot, input.cwd, input.locale, input.hostProfileId);
         if (!configured)
-            throw error;
+            return 0;
         context = await createRuntimeHostTuiContext(contextInput);
     }
     let ownerAction;

package/dist/runtime-host-update-command.js

@@ -22,7 +22,7 @@ import { truncateUtf8 } from '@maka/core/diagnostic-log';
 import { activateRuntimeHostManagedDeployment } from '@maka/runtime-host/client';
 import { compareProductReleaseVersions, createRuntimeHostLegacyPosixOperatorCommand, decodeRuntimeHostServiceManagementFrame, encodeRuntimeHostServiceManagementFrame, RUNTIME_HOST_SERVICE_ERROR_CODE_MAX_BYTES, RUNTIME_HOST_SERVICE_ERROR_MESSAGE_MAX_BYTES, RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY, RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV, RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY, runtimeHostOperatorInvocation, RuntimeHostManagedDeploymentError as RuntimeHostDeploymentAuthorityError, } from '@maka/runtime-host/operator';
 import { isRuntimeHostDevelopmentPackageVersion, assertRuntimeHostManagedOperatorConfig, assertRuntimeHostManagedOperatorDeployment, convergeRuntimeHostManagedOperator, verifyRuntimeHostManagedOperator, openRuntimeHostManagedPackageDeployment, prepareRuntimeHostManagedPackageDeployment, pruneRuntimeHostManagedPackages, resolveRuntimeHostManagedControlRoot, resolveRuntimeHostManagedPackageCliPath, RuntimeHostManagedDeploymentError, } from './runtime-host-managed-deployment.js';
-import { runtimeHostManagedServiceConfigFingerprint, manageRuntimeHostService, replaceRuntimeHostManagedService, resolveRuntimeHostManagedServiceId, RuntimeHostServiceManagerError, verifyRuntimeHostManagedServiceReady, withRuntimeHostManagedServiceDeploymentLock, withRuntimeHostManagedServiceLegacyOperatorLeases, withRuntimeHostManagedServiceLifecycleLock, } from './runtime-host-service-manager.js';
+import { runtimeHostManagedServiceConfigFingerprint, manageRuntimeHostService, replaceRuntimeHostManagedService, resolveRuntimeHostManagedServiceId, RuntimeHostServiceManagerError, verifyRuntimeHostManagedServiceReady, withRuntimeHostManagedServiceDeploymentLock, withRuntimeHostManagedServiceLifecycleLock, } from './runtime-host-service-manager.js';
 import { createPlatformRuntimeHostServiceBackend, resolveRuntimeHostLifecycleProvider, runtimeHostServiceSummary, } from './runtime-host-service-management-command.js';
 import { resolveManagedRuntimeHostUpdateSelection, RuntimeHostUpdateDiscoveryError, } from './runtime-host-update-discovery.js';
 import { RuntimeHostUpdatePackageError, withRuntimeHostRegistryUpdatePackage, } from './runtime-host-update-package.js';
@@ -60,7 +60,6 @@ export async function runManagedRuntimeHostUpdateCli(options, overrides = {}, fr
         }),
         withLifecycleLock: withRuntimeHostManagedServiceLifecycleLock,
         withDeploymentLock: withRuntimeHostManagedServiceDeploymentLock,
-        withLegacyOperatorLeases: withRuntimeHostManagedServiceLegacyOperatorLeases,
         createBackend: createPlatformRuntimeHostServiceBackend,
         verifyReady: verifyRuntimeHostManagedServiceReady,
         runOperator: runManagedRuntimeHostOperator,
@@ -170,19 +169,48 @@ export async function runManagedRuntimeHostUpdateCli(options, overrides = {}, fr
                     }
                 }
                 const currentOperator = createRuntimeHostLegacyPosixOperatorCommand(join(serviceConfig.managedDeploymentRoot, 'operator'));
-                let currentOperatorUsesProcessLifetimeLock = false;
                 let currentOperatorUnavailable = false;
                 if (status.service.active) {
+                    let probeSupportsLifetimeLock = false;
                     try {
-                        currentOperatorUsesProcessLifetimeLock = operatorUsesProcessLifetimeLock(await deps.runOperator(currentOperator, ['status', '--framed', ...expectedTargetArgs(options.expectedTarget)], {
+                        const probe = await deps.runOperator(currentOperator, ['status', '--framed', ...expectedTargetArgs(options.expectedTarget)], {
                             capabilityRequest: RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY,
-                        }));
+                        });
+                        if (probe.kind === 'error') {
+                            throw new RuntimeHostServiceManagerError('service_manager_operation_failed', `The current Runtime Host operator could not report its status: ${probe.error.message}`);
+                        }
+                        if (probe.action !== 'status') {
+                            throw new Error('The current Runtime Host operator returned an invalid status result');
+                        }
+                        probeSupportsLifetimeLock =
+                            probe.operatorCapabilities?.includes(RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY) ?? false;
                     }
                     catch (error) {
                         if (!activeTargetNeedsRepair)
                             throw error;
                         currentOperatorUnavailable = true;
                     }
+                    // An operator that answered but cannot echo the requested
+                    // capability predates the lifetime-lock protocol; retiring it would
+                    // race unmanaged service state, so it must be removed before
+                    // updating. This verdict is not a probe failure: it must refuse
+                    // even when the target needs repair (where the catch above would
+                    // degrade it to an unavailable operator), and nothing has been
+                    // mutated yet — emitting directly keeps the instruction visible
+                    // instead of folding it into the post-mutation "update_incomplete"
+                    // remap.
+                    if (!currentOperatorUnavailable && !probeSupportsLifetimeLock) {
+                        emit({
+                            schemaVersion: 1,
+                            kind: 'error',
+                            action: 'update',
+                            error: {
+                                code: 'service_manager_operation_failed',
+                                message: 'The active Runtime Host operator predates capability reporting and cannot be safely retired; uninstall it before updating',
+                            },
+                        });
+                        return 1;
+                    }
                 }
                 emit(progress('staging', currentVersion, options.version));
                 deployment = await deps.withLifecycleLock(options.clientDataRoot, () => targetDeploymentIsCurrent
@@ -212,11 +240,6 @@ export async function runManagedRuntimeHostUpdateCli(options, overrides = {}, fr
                 }
                 if (status.service.active) {
                     emit(progress('retiring', currentVersion, options.version));
-                    const runCurrentOperator = (args) => currentOperatorUsesProcessLifetimeLock
-                        ? deps.runOperator(currentOperator, args)
-                        : deps.withLegacyOperatorLeases(options.clientDataRoot, (inheritedFds) => deps.runOperator(currentOperator, args, {
-                            inheritedFds,
-                        }));
                     let retirement = currentOperatorUnavailable
                         ? {
                             schemaVersion: 1,
@@ -227,7 +250,7 @@ export async function runManagedRuntimeHostUpdateCli(options, overrides = {}, fr
                                 message: 'The active Runtime Host operator is unavailable',
                             },
                         }
-                        : await runCurrentOperator([
+                        : await deps.runOperator(currentOperator, [
                             'retire',
                             '--framed',
                             ...expectedTargetArgs(options.expectedTarget),
@@ -772,16 +795,6 @@ function activeTasksRetirementFrame(status) {
         retirement: { kind: 'active_tasks' },
     };
 }
-function operatorUsesProcessLifetimeLock(frame) {
-    if (frame.kind === 'error') {
-        throw new RuntimeHostServiceManagerError('service_manager_operation_failed', `The current Runtime Host operator could not report its lock protocol: ${frame.error.message}`);
-    }
-    if (frame.action !== 'status') {
-        throw new Error('The current Runtime Host operator returned an invalid capability result');
-    }
-    return (frame.operatorCapabilities?.includes(RUNTIME_HOST_OPERATOR_PROCESS_LIFETIME_LOCK_CAPABILITY) ===
-        true);
-}
 function operatorCapabilities() {
     return process.env[RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV] ===
         RUNTIME_HOST_OPERATOR_ACCESS_MANAGEMENT_CAPABILITY
@@ -790,21 +803,20 @@ function operatorCapabilities() {
         }
         : {};
 }
-async function runManagedRuntimeHostOperator(operator, args, invocation = {}) {
+async function runManagedRuntimeHostOperator(operator, args, invocation) {
     return new Promise((resolve, reject) => {
-        const inheritedFds = invocation.inheritedFds ?? [];
         const command = runtimeHostOperatorInvocation(operator, args);
         const child = spawn(command.executable, [...command.args], {
-            // A detached legacy operator keeps the inherited advisory leases alive if
-            // this updater is interrupted, so an exact retry never steals active work.
+            // A detached operator can finish a retirement already in progress even
+            // if this updater exits, so an exact retry never steals active work.
             detached: process.platform !== 'win32',
-            env: invocation.capabilityRequest
+            env: invocation?.capabilityRequest
                 ? {
                     ...process.env,
                     [RUNTIME_HOST_OPERATOR_CAPABILITY_REQUEST_ENV]: invocation.capabilityRequest,
                 }
                 : process.env,
-            stdio: ['ignore', 'pipe', 'pipe', ...inheritedFds],
+            stdio: ['ignore', 'pipe', 'pipe'],
             windowsHide: true,
         });
         if (!child.stdout || !child.stderr) {

package/node_modules/@maka/core/dist/artifacts.js

@@ -85,6 +85,7 @@ const ARTIFACT_SOURCE_POLICIES = {
     tool_result_projection: { userDeletable: false, userVisible: false, sharedReadable: true },
     tool_result_archive: { userDeletable: false, userVisible: false, sharedReadable: false },
     subagent_writeback: { userDeletable: false, userVisible: true, sharedReadable: false },
+    // Kept so reports saved before Deep Research retirement remain readable.
     deep_research: { userDeletable: false, userVisible: true, sharedReadable: false },
     user_upload: { userDeletable: true, userVisible: false, sharedReadable: true },
     session_effect: { userDeletable: false, userVisible: false, sharedReadable: false },

package/node_modules/@maka/core/dist/chat-model-choice.js

@@ -37,6 +37,9 @@ export function buildChatModelChoices(connections) {
                 ...(provider.authKind === 'oauth_token' ? {} : { connectionName: connection.name }),
                 isDefault: entry.isDefault,
                 thinkingLevels: entry.thinkingLevels,
+                ...(entry.defaultThinkingLevel === undefined
+                    ? {}
+                    : { defaultThinkingLevel: entry.defaultThinkingLevel }),
                 supportsVision: entry.supportsVision,
                 ...(entry.contextWindow !== undefined ? { contextWindow: entry.contextWindow } : {}),
                 ...(declaredWindow !== undefined ? { declaredContextWindow: declaredWindow } : {}),

package/node_modules/@maka/core/dist/llm-connections.js

@@ -17,9 +17,9 @@
  * under the License.
  */
 import { CODEX_SUBSCRIPTION_UNSUPPORTED_CHATGPT_MODELS } from './codex-model-compatibility.js';
-import { CATALOG_PROVIDER_TYPES, OPENCODE_FREE_DEFAULT_MODEL, PROVIDER_REGISTRY, RECOMMENDED_PROVIDER_TYPES, providerDefaultsOf, providerFallbackModelIds, providerMenuLabel, } from './provider-registry.js';
+import { CATALOG_PROVIDER_TYPES, PROVIDER_REGISTRY, RECOMMENDED_PROVIDER_TYPES, providerDefaultsOf, providerFallbackModelIds, providerMenuLabel, } from './provider-registry.js';
 export { CODEX_SUBSCRIPTION_UNSUPPORTED_CHATGPT_MODELS };
-export { CATALOG_PROVIDER_TYPES, OPENCODE_FREE_DEFAULT_MODEL, PROVIDER_REGISTRY, RECOMMENDED_PROVIDER_TYPES, providerDefaultsOf, providerFallbackModelIds, providerMenuLabel, };
+export { CATALOG_PROVIDER_TYPES, PROVIDER_REGISTRY, RECOMMENDED_PROVIDER_TYPES, providerDefaultsOf, providerFallbackModelIds, providerMenuLabel, };
 export function isRelayProviderType(providerType) {
     return providerType === 'openai-compatible' || providerType === 'openai-responses-compatible';
 }
@@ -69,7 +69,7 @@ export function connectionEnabledModelIds(connection) {
  *   3. the Host's entry says the connection can hold a chat on it.
  *
  * (3) already subsumes what clients used to re-derive locally: a retired
- * provider, a quarantined `brokenModelIds` id, and a model whose metadata says
+ * provider and a model whose metadata says
  * it cannot chat are all non-offerable before a client sees them. A client
  * re-testing any of those against its OWN registry answers for a build that is
  * not the one running the send.
@@ -135,12 +135,6 @@ export function authorizeConnectionModel(connection, modelId) {
     const model = modelId.trim();
     if (!model || !connectionEnabledModelIds(connection).includes(model))
         return undefined;
-    // The one veto: quarantined ids fail in a shape the send cannot surface
-    // (e.g. a billed 200 with an empty completion), so the request settling it
-    // is not available as the arbiter. See ProviderDefaults.brokenModelIds.
-    if (providerDefaultsOf(connection.providerType)?.brokenModelIds?.includes(model)) {
-        return undefined;
-    }
     // The observed row wins wherever it exists: it carries wire metadata such as
     // `apiProtocol`, and capabilities, which a synthesized entry cannot. Absent
     // capabilities already mean "unknown", not "unsupported".
@@ -268,18 +262,6 @@ export function reconcileConnectionAfterModelFetch(connection, models, options)
         }),
     };
 }
-/**
- * The models a connection created without an explicit selection starts with,
- * or undefined when the provider seeds nothing. Derived from the provider's
- * shipped baseline rather than listed a second time: the two can then never
- * disagree about what "all of them" means.
- */
-export function defaultEnabledModelIdsWhenOmitted(providerType) {
-    const defaults = providerDefaultsOf(providerType);
-    if (!defaults?.enableShippedModelsByDefault)
-        return undefined;
-    return providerFallbackModelIds(defaults);
-}
 export function providerAuthRequiresSecret(providerType) {
     const authKind = providerDefaultsOf(providerType)?.authKind;
     return authKind === 'api_key' || authKind === 'oauth_token';

package/node_modules/@maka/core/dist/model-catalog.js

@@ -16,7 +16,7 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { applyModelOverride, resolveModelLimits } from './model-thinking.js';
+import { applyModelOverride, defaultThinkingLevelForConnection, resolveModelLimits, } from './model-thinking.js';
 import { CODEX_SUBSCRIPTION_UNSUPPORTED_CHATGPT_MODELS, PROVIDER_REGISTRY, providerDefaultsOf, providerFallbackModelIds, providerSupportsModelDiscovery, } from './llm-connections.js';
 import { lookupModelMetadata, resolveModelVisionSupport } from './model-metadata.js';
 import { thinkingVariantsForConnection, } from './model-thinking.js';
@@ -95,36 +95,22 @@ export function buildConnectionModelCatalogEntries(input) {
     if (!defaults)
         return [];
     const supportsModelDiscovery = providerSupportsModelDiscovery(connection.providerType);
-    // Quarantined ids never surface as offerable entries — from any source,
-    // including inventories stored or selections made before the quarantine —
-    // mirroring the `authorizeConnectionModel` veto.
-    const broken = new Set(defaults.brokenModelIds ?? []);
     const fallbackModels = providerFallbackModelIds(defaults);
-    // A quarantined id persisted as this connection's `defaultModel` must not
-    // re-enter the catalog either. `models` and `enabledModelIds` are filtered
-    // below, but a broken default reaches `makeMissingDefaultEntry` unfiltered and
-    // would be re-added as a selectable `provider_default` row — picker-visible
-    // and default-capable while `authorizeConnectionModel` vetoes the same id. A
-    // reachable persisted state: the id was picker-visible before the quarantine.
-    // Dropping it leaves the connection with no valid default (readiness reports
-    // `missing_model`), which is what a model that can no longer send warrants.
-    const defaultModel = broken.has((connection.defaultModel ?? '').trim())
-        ? undefined
-        : connection.defaultModel;
+    const defaultModel = connection.defaultModel;
     const fallbackModelIds = new Set(fallbackModels);
-    const projectedModelsById = new Map((connection.models ?? []).filter(({ id }) => !broken.has(id)).map((model) => [model.id, model]));
+    const projectedModelsById = new Map((connection.models ?? []).map((model) => [model.id, model]));
     // Fallback providers have no live inventory, but a projected connection can
     // still carry enabled model-facts entries that are absent from the static
     // list. Keep both sets in the catalog so those user-declared models retain
     // their metadata.
     const models = supportsModelDiscovery
-        ? connection.models?.filter(({ id }) => !broken.has(id))
+        ? connection.models
         : [
             ...fallbackModels.map((id) => projectedModelsById.get(id) ?? {
                 id,
                 ...displayNameForKnownModel(connection.providerType, id),
             }),
-            ...(connection.models ?? []).filter((model) => !broken.has(model.id) && !fallbackModelIds.has(model.id)),
+            ...(connection.models ?? []).filter((model) => !fallbackModelIds.has(model.id)),
         ];
     return buildModelCatalogEntries({
         providerType: connection.providerType,
@@ -143,7 +129,7 @@ export function buildConnectionModelCatalogEntries(input) {
         savedModelIds: [
             ...(connection.enabledModelIds ?? []),
             ...Object.keys(connection.modelOverrides ?? {}),
-        ].filter((id) => !broken.has(id)),
+        ],
     });
 }
 /**
@@ -239,6 +225,7 @@ function makeEntry(ctx, model, overrides = {}) {
             capabilities,
             ...(modalities !== undefined ? { modalities } : {}),
         });
+    const defaultThinkingLevel = defaultThinkingLevelForConnection(thinkingContext, normalizedModel.id);
     return {
         id: normalizedModel.id,
         ...displayNameForModel(input.providerType, normalizedModel),
@@ -253,6 +240,7 @@ function makeEntry(ctx, model, overrides = {}) {
             ? {}
             : { compactionThreshold: input.modelOverrides[normalizedModel.id].compactionThreshold }),
         thinkingLevels: thinkingVariantsForConnection(thinkingContext, normalizedModel.id),
+        ...(defaultThinkingLevel === undefined ? {} : { defaultThinkingLevel }),
         ...limits,
         ...(defaults.contextWindow === undefined
             ? {}