maka-agent 0.2.0-dev.64.20260929 → 0.2.0-dev.67.20261002

package/node_modules/@maka/storage/dist/storage-footprint.js

@@ -0,0 +1,239 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { SUBAGENT_WORKTREE_DIRECTORY } from './git-worktree-child-executor.js';
+import { LONG_TERM_MEMORY_DATABASE_NAME } from './long-term-memory-store.js';
+import { acquireOperationalStateDatabase, OPERATIONAL_STATE_DATABASE_NAME, } from './operational-state-store.js';
+import { CONTEXT_OFFLOAD_DATABASE_NAME, CONTEXT_OFFLOAD_VALUES_DIRECTORY_NAME, } from './sqlite-context-offload-store.js';
+import { sqliteDatabaseSidecars } from './sqlite-file-set.js';
+/**
+ * Per-Session payload sums. Each statement covers one Session through an index
+ * that leads with `session_id`, so its cost grows with that Session's rows
+ * rather than with the table. `octet_length` on TEXT and `length` on BLOB skip
+ * the overflow pages of large values, but every matching row is still read.
+ */
+const TRANSCRIPT_SOURCES = [
+    { table: 'session_messages', bytes: 'octet_length(record_json)' },
+    { table: 'session_message_chunks', bytes: 'length(data)' },
+];
+const RUNTIME_SOURCES = [
+    { table: 'runtime_events', bytes: 'octet_length(payload_json)' },
+    {
+        table: 'runtime_partial_snapshots',
+        bytes: 'octet_length(payload_json) + octet_length(text_content)',
+    },
+    { table: 'core_agent_run_events', bytes: 'octet_length(record_json)' },
+];
+const ARTIFACT_SOURCE = {
+    table: 'artifact_records',
+    bytes: "COALESCE(json_extract(record_json, '$.sizeBytes'), 0)",
+};
+const HAS_WORKTREE = "json_extract(payload_json, '$.subagentWorkspace') IS NOT NULL";
+/**
+ * Opens a read-only footprint reader over one State Root. It shares the
+ * process-local runtime.sqlite connection and adds no triggers or counters, so
+ * the write path pays nothing for it (#5038). Every statement runs on its own
+ * and the reader yields to the event loop after it, so no read transaction is
+ * held and the Host keeps serving between statements.
+ */
+export function openStorageFootprintReader(root, options = {}) {
+    const lease = acquireOperationalStateDatabase(root, { schemaMigration: 'require_current' });
+    return new SqliteStorageFootprintReader(root, lease, options.contextOffload);
+}
+class SqliteStorageFootprintReader {
+    root;
+    lease;
+    contextOffload;
+    #closed = false;
+    constructor(root, lease, contextOffload) {
+        this.root = root;
+        this.lease = lease;
+        this.contextOffload = contextOffload;
+    }
+    async measure() {
+        this.#assertOpen();
+        const databaseBytes = await fileSetBytes(join(this.root, OPERATIONAL_STATE_DATABASE_NAME));
+        const reclaimableBytes = this.#readReclaimableBytes();
+        await yieldToEventLoop();
+        // One small metadata row per artifact file, so the whole table stays cheap.
+        const artifacts = this.#readAllArtifactBytes();
+        await yieldToEventLoop();
+        // Inline blobs live inside the SQLite file set, so only the managed value
+        // files outside it are added; the Store's physical-byte counter covers both.
+        const contextBytes = (await fileSetBytes(join(this.root, CONTEXT_OFFLOAD_DATABASE_NAME))) +
+            (await directoryBytes(join(this.root, CONTEXT_OFFLOAD_VALUES_DIRECTORY_NAME)));
+        const memoryBytes = await fileSetBytes(join(this.root, LONG_TERM_MEMORY_DATABASE_NAME));
+        const worktreeCount = await countDirectories(join(this.root, SUBAGENT_WORKTREE_DIRECTORY));
+        const totals = [
+            { kind: 'database', bytes: databaseBytes, exact: true },
+            { kind: 'artifacts', bytes: artifacts, exact: false },
+            { kind: 'context_offload', bytes: contextBytes, exact: true },
+            { kind: 'memory', bytes: memoryBytes, exact: true },
+        ];
+        return { totals, reclaimableBytes, worktreeCount };
+    }
+    async measureSessions(sessionIds) {
+        this.#assertOpen();
+        const results = [];
+        // One Session per statement, with a yield after each: a large task's sum
+        // is still a long range scan, and the Host serves other work between them.
+        for (const sessionId of new Set(sessionIds)) {
+            if (!(await this.#sessionExists(sessionId)))
+                continue;
+            const transcript = await this.#sumForSession(TRANSCRIPT_SOURCES, sessionId);
+            const runtime = await this.#sumForSession(RUNTIME_SOURCES, sessionId);
+            const artifacts = await this.#sumForSession([ARTIFACT_SOURCE], sessionId);
+            const worktreeCount = await this.#countWorktrees(sessionId);
+            const context = this.contextOffload
+                ? (await this.contextOffload.usage(sessionId)).logicalBytes
+                : undefined;
+            results.push({
+                sessionId,
+                bytes: {
+                    transcript,
+                    runtime,
+                    artifacts,
+                    ...(context === undefined ? {} : { context }),
+                },
+                worktreeCount,
+            });
+        }
+        return results;
+    }
+    close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        this.lease.close();
+    }
+    async #sessionExists(sessionId) {
+        const row = this.lease.database
+            .prepare('SELECT 1 AS present FROM session_metadata WHERE session_id = ?')
+            .get(sessionId);
+        await yieldToEventLoop();
+        return row !== undefined;
+    }
+    async #sumForSession(sources, sessionId) {
+        let total = 0;
+        for (const source of sources) {
+            const row = this.lease.database
+                .prepare(`SELECT COALESCE(SUM(${source.bytes}), 0) AS bytes
+           FROM ${source.table}
+           WHERE session_id = ?`)
+                .get(sessionId);
+            total += toSafeCount(row.bytes);
+            await yieldToEventLoop();
+        }
+        return total;
+    }
+    async #countWorktrees(sessionId) {
+        const row = this.lease.database
+            .prepare(`SELECT
+           (SELECT COUNT(*) FROM session_metadata
+            WHERE session_id = ? AND ${HAS_WORKTREE})
+           + (SELECT COUNT(*) FROM session_metadata
+              WHERE subagent_parent_session_id = ? AND ${HAS_WORKTREE}) AS count`)
+            .get(sessionId, sessionId);
+        await yieldToEventLoop();
+        return toSafeCount(row.count);
+    }
+    #readAllArtifactBytes() {
+        const row = this.lease.database
+            .prepare(`SELECT COALESCE(SUM(${ARTIFACT_SOURCE.bytes}), 0) AS bytes FROM ${ARTIFACT_SOURCE.table}`)
+            .get();
+        return toSafeCount(row.bytes);
+    }
+    #readReclaimableBytes() {
+        const pageSize = this.lease.database.prepare('PRAGMA page_size').get();
+        const freelist = this.lease.database.prepare('PRAGMA freelist_count').get();
+        return toSafeCount(freelist.freelist_count) * toSafeCount(pageSize.page_size);
+    }
+    #assertOpen() {
+        if (this.#closed)
+            throw new Error('Storage footprint reader is closed');
+    }
+}
+async function fileSetBytes(databasePath) {
+    let total = 0;
+    for (const path of [databasePath, ...sqliteDatabaseSidecars(databasePath)]) {
+        try {
+            total += (await stat(path)).size;
+        }
+        catch (error) {
+            if (!isMissingFile(error))
+                throw error;
+        }
+    }
+    return total;
+}
+/** Files under the managed context value tree (`sha256/<xx>/<blob>`), stat'ed asynchronously. */
+async function directoryBytes(path, depth = 0) {
+    let entries;
+    try {
+        entries = await readdir(path, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return 0;
+        throw error;
+    }
+    let total = 0;
+    for (const entry of entries) {
+        const child = join(path, entry.name);
+        if (entry.isDirectory() && depth < 3) {
+            total += await directoryBytes(child, depth + 1);
+        }
+        else if (entry.isFile()) {
+            try {
+                total += (await stat(child)).size;
+            }
+            catch (error) {
+                // A value file deleted mid-walk simply no longer counts.
+                if (!isMissingFile(error))
+                    throw error;
+            }
+        }
+    }
+    return total;
+}
+async function countDirectories(path) {
+    try {
+        const entries = await readdir(path, { withFileTypes: true });
+        return entries.filter((entry) => entry.isDirectory()).length;
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return 0;
+        throw error;
+    }
+}
+function toSafeCount(value) {
+    const count = Number(value);
+    if (!Number.isSafeInteger(count) || count < 0) {
+        throw new Error('Storage footprint measurement is out of range');
+    }
+    return count;
+}
+function isMissingFile(error) {
+    return (error instanceof Error && 'code' in error && error.code === 'ENOENT');
+}
+function yieldToEventLoop() {
+    return new Promise((resolve) => setImmediate(resolve));
+}

package/node_modules/@maka/storage/dist/storage-writer-composition.js

@@ -24,11 +24,12 @@ import { openInteractiveLongTermMemoryStoreForWrite } from './long-term-memory-s
 import { openInteractiveMemoryBundleStoreForWrite } from './memory-bundle-store.js';
 import { openInteractivePlanStoreForWrite } from './plan-authority.js';
 import { openInteractiveProjectCatalogForWrite } from './project-catalog-authority.js';
-import { assertStorageRootLease } from './root-authority.js';
+import { assertStorageRootLease, runWithStorageRootLease, } from './root-authority.js';
 import { openInteractiveRuntimePolicyStoresForWrite } from './runtime-policy-stores.js';
 import { openInteractiveScheduledTaskStoreForWrite } from './scheduled-task-store.js';
 import { openInteractiveSessionTodoStoreForWrite } from './session-todo-authority.js';
 import { openInteractiveShellRunStoreForWrite } from './shell-run-authority.js';
+import { openStorageFootprintReader, } from './storage-footprint.js';
 import { openInteractiveUsageStoresForWrite } from './usage-stores.js';
 const activeCompositions = new WeakSet();
 export async function openStorageWriterComposition(lease, options = {}) {
@@ -109,6 +110,13 @@ async function createComposition(lease, options) {
     }
     const usage = await openWriter(() => openInteractiveUsageStoresForWrite(lease), closeWriter);
     const shellRuns = await openWriter(() => openInteractiveShellRunStoreForWrite(lease), closeWriter);
+    const footprintReader = await openWriter(async () => openStorageFootprintReader(lease.canonicalPath, {
+        ...(contextOffload ? { contextOffload } : {}),
+    }), (reader) => reader.close());
+    const footprint = Object.freeze({
+        measure: () => runWithStorageRootLease(lease, 'interactive', 'write', () => footprintReader.measure()),
+        measureSessions: (sessionIds) => runWithStorageRootLease(lease, 'interactive', 'write', () => footprintReader.measureSessions(sessionIds)),
+    });
     return Object.freeze({
         execution,
         projectCatalog,
@@ -125,6 +133,7 @@ async function createComposition(lease, options) {
         ...(contextOffloadUnavailable ? { contextOffloadUnavailable } : {}),
         usage,
         shellRuns,
+        footprint,
         close,
     });
 }

package/node_modules/axios/CHANGELOG.md

@@ -1,5 +1,67 @@
 # Changelog
 
+## v1.19.0 — July 22, 2026
+
+This release raises the form-data security floor, adds configuration and type-system capabilities, and fixes NO_PROXY matching, interceptor errors, progress reporting, and serialization edge cases.
+
+## 🔒 Security Fixes
+
+- Multipart Form Data: Raised the form-data dependency floor to ^4.0.6, preventing fresh installations from resolving versions affected by the CRLF injection vulnerability GHSA-hmw2-7cc7-3qxx (https://github.com/advisories/GHSA-hmw2-7cc7-3qxx). (#11028)
+
+## 🚀 New Features
+
+- Configuration Extensibility: Preserved own-enumerable symbol-keyed fields through mergeConfig and added a generic params type across public TypeScript declarations, responses, errors,
+  adapters, and serializers. (#11043, #11081)
+- Header Parameter Parsing: Added the opt-in AxiosHeaders.parseParameters() parser for quote-aware, RFC-style HTTP parameter parsing while preserving legacy parsing behavior. (#11051)
+- HTTP Status Codes: Added the missing Cloudflare 520 WebServerReturnsAnUnknownError status and matching ESM/CJS declarations. (#11067)
+
+## 🐛 Bug Fixes
+
+- Form Data Conversion: Limited formDataToJSON path splitting to dot and bracket notation, preserving literal punctuation in keys, and removed browser-facing Buffer.from usage from toFormData to avoid unnecessary polyfills. (#11006, #11018)
+- Proxy Bypass: Canonicalized IPv4 shorthand, octal, and hexadecimal forms during NO_PROXY matching and honored * entries within comma- or space-separated bypass lists. (#11029, #11053)
+- Cancellation: Propagated already-aborted input signals immediately when composing abort signals. (#11035)
+- Header Handling: Preserved empty first values for duplicate singleton headers and made AxiosHeaders#getSetCookie() consistently return arrays for present values. (#11036, #11037)
+- URL Handling: Included normalized, safely redacted offending URLs in malformed-protocol errors and removed repeated trailing slashes when combining base URLs. (#11008, #11038)
+
+- Progress Events: Clamped malformed negative progress values to zero and ensured final Node.js download progress events are delivered before streamed responses close. (#11039, #11040)
+- Error and JSON Serialization: Serialized Set values as arrays in JSON-compatible snapshots and synthesized useful AxiosError messages from otherwise-empty AggregateError instances. (#11044, #11059)
+- Content-Length Enforcement: Corrected base64 data: URL size estimation so maxContentLength is enforced consistently by the HTTP and Fetch adapters. (#11061)
+- Synchronous Interceptors: Prevented requests from being dispatched after synchronous request interceptors fail unless their paired rejection handler resolves successfully. (#11071)
+
+## 🔧 Maintenance & Chores
+
+- Dependencies: Updated development and test tooling, the docs fixture's Axios version, and GitHub Actions integrations including Checkout, Setup Node, Setup Deno, and Zizmor. (#11031, #11055, #11056, #11058, #11079, #11080, #11088, #11089, #11090)
+- Build Outputs: Limited sourcemap generation to published minified bundles, removing broken map references from non-minified builds. (#11054)
+- Form Data Internals: Centralized FormData header handling and made the Node.js adapter tolerate getHeaders() returning undefined under the content-only policy. (#11062)
+- Developer Experience: Ignored common local AI-tooling directories and fixed a constant-reassignment crash when the development sandbox serves its root path. (#11032, #11073)
+- Documentation: Updated sponsor information, clarified that baseURL is not a path-security boundary, scoped provenance claims to attested releases, and corrected the configuration-defaults documentation. (#11041, #11068, #11076, #11078)
+- Publishing: Simplified v1 publishing to use the npm version bundled with Node.js 26 and updated package metadata for the 1.19.0 release. (#11083, #11095)
+
+## 🌟 New Contributors
+
+We are thrilled to welcome our new contributors. Thank you for helping improve Axios:
+
+- @afonsojramos (#11028)
+- @MahinAnowar (#11006)
+- @yassertawfik4 (#11024)
+- @AnandSundar (#11029)
+- @lin-hongkuan (#11035)
+- @Wali007-lab (#11054)
+- @magicdawn (#11043)
+- @andrewkernel (#11053)
+- @Sagargupta16 (#11059)
+- @Rpaudel379 (#11078)
+- @kobihikri (#11076)
+- @spokodev (#11061)
+- @shaedrich (#11081)
+- @QodeXcli (#11062)
+- @akahoshi1421 (#11067)
+- @TheHonoredOne914 (#11071)
+- @Ahsan1Murtaza (#11073)
+
+[Full Changelog](https://github.com/axios/axios/compare/v1.18.1...v1.19.0)
+
+
 ## v1.18.0 — June 13, 2026
 
 This release hardens redirect and URL handling, improves the validateStatus configuration semantics, and includes updates to documentation, dependencies, and release metadata.