maka-agent 0.2.0-dev.67.20261002 → 0.2.0-dev.69.20261004

package/node_modules/@maka/core/dist/executor-catalog.js

@@ -23,12 +23,17 @@ export function isExecutorConfiguration(value) {
     if (!value || typeof value !== 'object' || Array.isArray(value))
         return false;
     const record = value;
-    return (Object.keys(record).every((key) => key === 'model') &&
+    return (Object.keys(record).every((key) => key === 'model' || key === 'mode') &&
         (record.model === undefined ||
             (typeof record.model === 'string' &&
                 record.model.length > 0 &&
                 record.model.length <= 1024 &&
-                !/[\0\r\n]/u.test(record.model))));
+                !/[\0\r\n]/u.test(record.model))) &&
+        (record.mode === undefined ||
+            (typeof record.mode === 'string' &&
+                record.mode.length > 0 &&
+                record.mode.length <= 1024 &&
+                !/[\0\r\n]/u.test(record.mode))));
 }
 export function normalizeCatalogEntry(value, id) {
     if (!value ||
@@ -54,8 +59,18 @@ export function normalizeCatalogEntry(value, id) {
             (model.providerType === undefined || CATALOG_PROVIDER_TYPES.includes(model.providerType))) ||
         new Set(value.models.map((model) => model.id)).size !== value.models.length ||
         !isExecutorConfiguration({ model: value.currentModel }) ||
+        (value.modes !== undefined &&
+            (!Array.isArray(value.modes) ||
+                value.modes.length > 64 ||
+                !value.modes.every((mode) => mode &&
+                    typeof mode.id === 'string' &&
+                    isExecutorConfiguration({ mode: mode.id }) &&
+                    isCatalogText(mode.name)) ||
+                new Set(value.modes.map((mode) => mode.id)).size !== value.modes.length)) ||
+        !isExecutorConfiguration({ mode: value.currentMode }) ||
         typeof value.supportsAttachments !== 'boolean' ||
-        typeof value.supportsModelChange !== 'boolean')
+        typeof value.supportsModelChange !== 'boolean' ||
+        (value.supportsModeChange !== undefined && typeof value.supportsModeChange !== 'boolean'))
         throw new TypeError('Executor catalog is invalid');
     const usedModels = new Set();
     const groupIds = new Set();
@@ -106,8 +121,15 @@ export function normalizeCatalogEntry(value, id) {
             }
             : {}),
         ...(value.currentModel !== undefined ? { currentModel: value.currentModel } : {}),
+        ...(value.modes !== undefined
+            ? { modes: Object.freeze(value.modes.map(({ id, name }) => Object.freeze({ id, name }))) }
+            : {}),
+        ...(value.currentMode !== undefined ? { currentMode: value.currentMode } : {}),
         supportsAttachments: value.supportsAttachments,
         supportsModelChange: value.supportsModelChange,
+        ...(value.supportsModeChange !== undefined
+            ? { supportsModeChange: value.supportsModeChange }
+            : {}),
     });
 }
 function isCatalogText(value) {

package/node_modules/@maka/core/dist/recall.js

@@ -682,6 +682,18 @@ async function collectHits(deps, input) {
             scannedFully = false;
         }
     }
+    // A narrowed scan needs the corpus count to rank the same way as a full
+    // scan. Resolve it before reading transcripts so a declined count cannot
+    // discard work and reread every candidate during fallback.
+    const storedCorpusSize = deps.countSearchableMessages
+        ? await deps.countSearchableMessages({ sessionIds: input.sessionIds })
+        : null;
+    if (input.abortSignal?.aborted)
+        return null;
+    if (storedCorpusSize === null && !scannedFully) {
+        sessionIds = input.sessionIds;
+        scannedFully = true;
+    }
     const hits = [];
     let counted = 0;
     for (const sessionId of sessionIds) {
@@ -711,20 +723,7 @@ async function collectHits(deps, input) {
                 hits.push(hit);
         }
     }
-    // The narrowed path never sees the Sessions it skipped, so its corpus size
-    // has to come from the store. The full scan takes the same number when the
-    // store offers one, which is what keeps a score independent of the path.
-    let corpusSize = counted;
-    if (deps.countSearchableMessages) {
-        corpusSize = await deps.countSearchableMessages({ sessionIds: input.sessionIds });
-        if (input.abortSignal?.aborted)
-            return null;
-        if (corpusSize === null) {
-            if (!scannedFully)
-                return collectHits(deps, { ...input, forceFullScan: true });
-            corpusSize = counted;
-        }
-    }
+    const corpusSize = storedCorpusSize ?? counted;
     return { hits, corpusSize, scannedFully, transcripts };
 }
 /**

package/node_modules/@maka/runtime/dist/admission-limiter.js

@@ -19,12 +19,13 @@
 /**
  * Abort-aware FIFO permits, bounded by capacity.
  *
- * Two boundaries use it, at different lifetimes. Child-agent runs take one
+ * Boundaries use it at different lifetimes. Child-agent runs take one
  * instance per turn: tool-call admission and child-run capacity are separate
  * boundaries, since one admitted tool may eventually spawn multiple children,
  * so the limiter belongs at the narrow spawn capability where every caller
  * shares the same real-run budget. Code Mode cells take one per backend, which
- * has to outlive a turn — see `executeCodeModeCell`.
+ * has to outlive a turn — see `executeCodeModeCell`. ACP catalog probes share
+ * one per runtime Entry and hold permits through process cleanup.
  *
  * A caller that must turn work away rather than queue it reads `waitingCount`
  * before calling `acquire`. Nothing awaits between that read and the enqueue

package/node_modules/@maka/runtime/dist/ai-sdk-turn.js

@@ -1127,9 +1127,6 @@ export class AiSdkTurn {
                     }
                     const requestSystemPromptBase = joinPromptFragments([
                         systemPrompt,
-                        priorUnknownProjection.kind === 'projected'
-                            ? priorUnknownProjection.systemNotice
-                            : undefined,
                         finalChildSummaryStep ? CHILD_STEP_BUDGET_FINALIZATION_PROMPT : undefined,
                         toolRuntime.hasSandboxBoundaryDenial() ? SANDBOX_BOUNDARY_DENIED_FOR_TURN : undefined,
                         sandboxBoundaryFinalizationStep ? SANDBOX_BOUNDARY_FINALIZATION_PROMPT : undefined,

package/node_modules/@maka/runtime/dist/model-history.js

@@ -177,20 +177,10 @@ export function inspectPriorUnknownToolOutcomes(events, invocations) {
     }
     if (outcomes.length === 0)
         return { kind: 'none' };
-    const rows = outcomes
-        .slice(0, 64)
-        .map((outcome) => `- ${outcome.toolName} (operation ${outcome.operationId})`);
-    if (outcomes.length > 64)
-        rows.push(`- and ${outcomes.length - 64} more unknown operations`);
-    return {
-        kind: 'projected',
-        outcomes,
-        systemNotice: [
-            'A prior execution was interrupted after these tools were dispatched. No durable tool results were recorded; their side effects may or may not have happened.',
-            'The outcome_unknown tool responses in history are temporary context, not proof of success or failure. Inspect current state before repeating any action.',
-            ...rows,
-        ].join('\n'),
-    };
+    // The unknown is carried only by the request-local tool responses below
+    // (appendPriorUnknownToolResponses): the system prompt stays byte-stable,
+    // so the provider's cached request prefix is never churned per event.
+    return { kind: 'projected', outcomes };
 }
 /** Insert request-only tool responses beside their calls so provider history stays well-formed. */
 export function appendPriorUnknownToolResponses(events, projection) {

package/node_modules/@maka/runtime/dist/plugin-data-services.js

@@ -131,6 +131,13 @@ export class PluginStorageService extends PluginNamespacedDataService {
         const result = await this.mutateValues([{ key, value, ...options }]);
         return result[key];
     }
+    /** The callback must drain any process using the directory before settling. */
+    withScratchDirectory(key, signal, use) {
+        const runtime = this.runtime();
+        if (!runtime.withScratchDirectory)
+            throw new Error('Plugin scratch directories are unavailable');
+        return runtime.withScratchDirectory(this.namespace(), validKey(key), signal, use);
+    }
     async delete(key, options = {}) {
         const result = await this.mutateValues([{ key, ...options }]);
         return result[key];

package/node_modules/@maka/runtime/dist/plugin-executor-service.js

@@ -66,6 +66,9 @@ export class PluginExecutorService extends Service {
                     ? { configureConversation: provider.configureConversation.bind(provider) }
                     : {}),
                 ...(provider.discover ? { discover: provider.discover.bind(provider) } : {}),
+                ...(provider.invalidateCatalog
+                    ? { invalidateCatalog: provider.invalidateCatalog.bind(provider) }
+                    : {}),
                 ...(provider.inspectConversation
                     ? { inspectConversation: provider.inspectConversation.bind(provider) }
                     : {}),
@@ -152,7 +155,11 @@ export class PluginExecutorService extends Service {
                         cwd: input.cwd,
                         ...(input.configuration ? { configuration: input.configuration } : {}),
                     })
-                    : await entry.provider.discover?.({ cwd: input.cwd, signal: combined });
+                    : await entry.provider.discover?.({
+                        cwd: input.cwd,
+                        signal: combined,
+                        ...(input.refresh ? { refresh: true } : {}),
+                    });
                 combined.throwIfAborted();
                 if (!result)
                     return fallback;
@@ -163,6 +170,12 @@ export class PluginExecutorService extends Service {
             }
         })));
     }
+    invalidateCatalog() {
+        for (const entry of this.registry.entries('profile')) {
+            if (!entry.retired)
+                entry.provider.invalidateCatalog?.();
+        }
+    }
     async configureConversation(sessionId, executorId, input) {
         const entry = this.entry(sessionId, executorId);
         const configure = entry.provider.configureConversation;
@@ -171,8 +184,11 @@ export class PluginExecutorService extends Service {
             throw new Error('Executor configuration is unavailable or busy');
         if (!isExecutorConfiguration(input.configuration))
             throw new TypeError('Invalid executor configuration');
-        await this.withActiveOperation(entry, { conversationKey: input.conversationKey }, async (signal) => {
-            await configure(input, AbortSignal.any([signal, AbortSignal.timeout(30_000)]));
+        return await this.withActiveOperation(entry, { conversationKey: input.conversationKey }, async (signal) => {
+            const confirmed = await configure(input, AbortSignal.any([signal, AbortSignal.timeout(30_000)]));
+            if (confirmed !== undefined && !isExecutorConfiguration(confirmed))
+                throw new TypeError('Invalid confirmed executor configuration');
+            return confirmed;
         });
     }
     /** Task retirement releases retained provider resources; backend refresh must not. */

package/node_modules/@maka/runtime/dist/runtime-read-model.js

@@ -42,9 +42,23 @@ export class RuntimeReadModel {
     async getSessionView(sessionId) {
         const diagnostics = [];
         const inFlightTurnIds = new Set();
+        let snapshot;
+        if (this.deps.runtimeEventStore.readSessionRuntimeSnapshot) {
+            try {
+                snapshot = await this.deps.runtimeEventStore.readSessionRuntimeSnapshot(sessionId);
+            }
+            catch (error) {
+                throw new RuntimeReadModelError('RuntimeEvent Session snapshot read failed', [
+                    readModelDiagnostic('unsupported_event', 'RuntimeEventStore.readSessionRuntimeSnapshot failed', {
+                        error: errorMessage(error),
+                    }),
+                ]);
+            }
+        }
         let invocations;
         try {
-            invocations = (await this.deps.runtimeEventStore.listSessionInvocations(sessionId)).filter((invocation) => isSessionInlineInvocation(invocation.opening));
+            invocations = (snapshot?.invocations ??
+                (await this.deps.runtimeEventStore.listSessionInvocations(sessionId))).filter((invocation) => isSessionInlineInvocation(invocation.opening));
         }
         catch (error) {
             throw new RuntimeReadModelError('RuntimeReadModel could not list Session invocations', [
@@ -56,15 +70,20 @@ export class RuntimeReadModel {
         if (invocations.length === 0) {
             return this.buildView({ invocations, events: [], diagnostics });
         }
-        const durableEventOrdinals = await this.readSessionRuntimeEventOrdinals(sessionId);
-        const durableEventOrdinalById = new Map(durableEventOrdinals.map(({ event, ordinal }) => [event.id, ordinal]));
+        const durableEventOrdinalById = snapshot?.durableEventOrdinalById ??
+            new Map((await this.readSessionRuntimeEventOrdinals(sessionId)).map(({ event, ordinal }) => [
+                event.id,
+                ordinal,
+            ]));
         const ordered = [];
         const terminalFacts = [];
         for (let runIndex = 0; runIndex < invocations.length; runIndex += 1) {
             const invocation = invocations[runIndex];
             let runEvents;
             try {
-                runEvents = await this.deps.runtimeEventStore.readRuntimeEvents(sessionId, invocation.runId);
+                runEvents = snapshot
+                    ? (snapshot.eventsByRun.get(invocation.runId) ?? [])
+                    : await this.deps.runtimeEventStore.readRuntimeEvents(sessionId, invocation.runId);
             }
             catch (error) {
                 throw new RuntimeReadModelError('RuntimeEvent ledger read failed', [

package/node_modules/@maka/runtime/dist/session-manager.js

@@ -3599,6 +3599,7 @@ function sessionConfigurationMatchesExceptPermissionMode(header, configuration)
     return (header.backend === configuration.backend &&
         header.executorId === configuration.executorId &&
         header.executorConfig?.model === configuration.executorConfig?.model &&
+        header.executorConfig?.mode === configuration.executorConfig?.mode &&
         header.llmConnectionId === configuration.llmConnectionId &&
         header.llmConnectionSlug === configuration.llmConnectionSlug &&
         header.connectionLocked === configuration.connectionLocked &&

package/node_modules/@maka/runtime/package.json

@@ -5,6 +5,7 @@
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
+    "./admission-limiter": "./dist/admission-limiter.js",
     "./ask-user-question-tool": "./dist/ask-user-question-tool.js",
     "./ai-sdk-backend": "./dist/ai-sdk-backend.js",
     "./mcp-tools": "./dist/mcp-tools.js",

package/node_modules/@maka/runtime-host/dist/antigravity-program.js

@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { constants } from 'node:fs';
+import { access, realpath, stat } from 'node:fs/promises';
+import { dirname, isAbsolute, join } from 'node:path';
+/** Public diagnostics survive Electron IPC without exposing filesystem error details. */
+export class AntigravityProgramError extends Error {
+    failure;
+    constructor(failure) {
+        super(`Antigravity program: ${failure}`);
+        this.failure = failure;
+    }
+}
+/** Shared by native program selection and the Host's check/sign-in admission. */
+export async function checkAntigravityProgram(executable) {
+    const resolved = await checkedFile(executable, 'executable_unavailable');
+    const helper = await checkedFile(join(dirname(resolved), 'localharness_external'), 'helper_unavailable');
+    return { executable: resolved, helper };
+}
+async function checkedFile(path, failure) {
+    try {
+        if (!isAbsolute(path))
+            throw new Error('Absolute path required');
+        const resolved = await realpath(path);
+        if (!(await stat(resolved)).isFile())
+            throw new Error('File required');
+        await access(resolved, constants.X_OK);
+        return resolved;
+    }
+    catch {
+        throw new AntigravityProgramError(failure);
+    }
+}

package/node_modules/@maka/runtime-host/dist/protocol/index.js

@@ -65,7 +65,9 @@ export const RUNTIME_HOST_REGISTRATION_SCHEMA_VERSION = 1;
 export const RUNTIME_HOST_PROTOCOL_VERSION = 0;
 // Increment when the same protocol version no longer guarantees safe Client-Host
 // interoperability. Mismatches are rejected before domain commands are admitted.
-export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 202;
+export const RUNTIME_HOST_COMPATIBILITY_EPOCH = 204;
+// 204: Executor catalogs and Session configuration carry opaque mode IDs;
+// catalog queries may request a provider refresh. Older peers reject these fields.
 // 202: `session.remove.preview` takes a bounded list of Sessions and reports the
 // child tasks, worktrees and optionally the bytes their removal would delete;
 // `session.remove` takes `requireArchivedForMs` and may answer `too_recent`.

package/node_modules/@maka/runtime-host/dist/protocol/plugin-platform.js

@@ -93,8 +93,14 @@ export const PLUGIN_PLATFORM_OPERATION_SPECS = {
         decodeInput: (value) => {
             const record = requireRecord(value, 'Executor query');
             if (record.kind === 'catalog') {
-                const input = requireExactRecord(record, 'Executor catalog', ['kind', 'cwd']);
-                return { kind: 'catalog', cwd: requireString(input.cwd, 'cwd', 4096) };
+                const input = requireShapedRecord(record, 'Executor catalog', ['kind', 'cwd'], ['refresh']);
+                if (input.refresh !== undefined && typeof input.refresh !== 'boolean')
+                    throw invalidProtocolFrame('Invalid executor refresh flag');
+                return {
+                    kind: 'catalog',
+                    cwd: requireString(input.cwd, 'cwd', 4096),
+                    ...(input.refresh ? { refresh: true } : {}),
+                };
             }
             const input = requireExactRecord(record, 'Executor conversation', ['kind', 'sessionId']);
             if (input.kind !== 'conversation')

package/node_modules/@maka/runtime-host/dist/server/acp/antigravity.js

@@ -16,12 +16,11 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-import { constants } from 'node:fs';
-import { access, realpath, stat } from 'node:fs/promises';
-import { dirname, join, isAbsolute } from 'node:path';
+import { dirname } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { methods, RequestError } from '@agentclientprotocol/sdk';
 import { AcpSetupError, withAcpConnection } from './connection.js';
+import { checkAntigravityProgram, AntigravityProgramError } from '../../antigravity-program.js';
 const AUTH_PREFIX = 'Open the following link to authenticate the ACP server: ';
 const INITIALIZE_TIMEOUT_MS = 30_000;
 const LOGIN_TIMEOUT_MS = 5 * 60_000;
@@ -45,8 +44,7 @@ export async function runAntigravitySetup(input) {
     });
     try {
         signal.throwIfAborted();
-        const executable = await checkedFile(input.executable, 'executable_unavailable');
-        const helper = await checkedFile(join(dirname(executable), 'localharness_external'), 'helper_unavailable');
+        const { executable, helper } = await checkAntigravityProgram(input.executable);
         await withAcpConnection({
             executable,
             cwd: dirname(executable),
@@ -96,6 +94,8 @@ export async function runAntigravitySetup(input) {
         });
     }
     catch (error) {
+        if (error instanceof AntigravityProgramError)
+            throw new AcpSetupError(error.failure);
         if (error instanceof AcpSetupError)
             throw error;
         signal.throwIfAborted();
@@ -105,20 +105,6 @@ export async function runAntigravitySetup(input) {
         clearTimeout(timeout);
     }
 }
-async function checkedFile(path, failure) {
-    try {
-        if (!isAbsolute(path))
-            throw new Error('Absolute path required');
-        const resolved = await realpath(path);
-        if (!(await stat(resolved)).isFile())
-            throw new Error('File required');
-        await access(resolved, constants.X_OK);
-        return resolved;
-    }
-    catch {
-        throw new AcpSetupError(failure);
-    }
-}
 /** Official 1.1.1 prints its login link to stderr; ordinary diagnostics are discarded. */
 export function createAntigravityStderrHandler(onAuthorizationUrl) {
     const recognize = (line) => {

package/node_modules/@maka/runtime-host/dist/server/execution-composition.js

@@ -274,7 +274,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     ...(header.executorConfig ? { configuration: header.executorConfig } : {}),
                 });
             }
-            const catalog = await pluginExecutors.catalog({ cwd: input.cwd });
+            const catalog = await pluginExecutors.catalog({ cwd: input.cwd, refresh: input.refresh });
             return withBuiltinExternalAgentCatalog(catalog);
         });
         const openedProjectCatalog = storage.projectCatalog;
@@ -1333,6 +1333,10 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                 context.retainUntilProcessExit();
                 context.requestDrain();
             },
+            onSucceeded: () => {
+                pluginExecutors.invalidateCatalog();
+                hostChanges.publishConfiguration();
+            },
             capabilities: clientCapabilities,
         });
         oauth = new HostOAuthCoordinator({
@@ -1759,6 +1763,7 @@ export async function createExecutionRuntimeHostComposition(context, options = {
         });
         async function applyRuntimePolicyMutationEffects() {
             try {
+                pluginExecutors.invalidateCatalog();
                 await builtinExternalAgentPlugins.reconcile();
                 await requireMemory(memory).refreshAfterPolicyMutation();
             }
@@ -1783,10 +1788,11 @@ export async function createExecutionRuntimeHostComposition(context, options = {
             continuity: continuityCoordinator,
             workspaceResolver,
             requestDrain: context.requestDrain,
+            isTurnBusy: (sessionId) => rootCoordinator?.hasActiveOrPendingTurn(sessionId) ?? false,
             configureExecutor: async (header, configuration) => {
                 if (!header.executorId)
                     throw new Error('Session has no executor');
-                await pluginExecutors.configureConversation(header.id, header.executorId, {
+                return await pluginExecutors.configureConversation(header.id, header.executorId, {
                     conversationKey: header.id,
                     cwd: header.cwd,
                     configuration,
@@ -1804,10 +1810,15 @@ export async function createExecutionRuntimeHostComposition(context, options = {
                     throw new Error('Executor is not ready');
                 // Catalog-managed executors pin their confirmed configuration on every create path.
                 // Providers without model discovery retain main's executor-specific model contract.
-                if (entry.supportsModelChange || entry.models.length > 0) {
+                if (entry.supportsModelChange ||
+                    entry.models.length > 0 ||
+                    entry.supportsModeChange ||
+                    entry.modes?.length) {
                     if (configuration?.model &&
                         !entry.models.some((model) => model.id === configuration.model))
                         throw new Error('Executor model is unavailable');
+                    if (configuration?.mode && !entry.modes?.some((mode) => mode.id === configuration.mode))
+                        throw new Error('Executor mode is unavailable');
                     return configuration ?? {};
                 }
             },

package/node_modules/@maka/runtime-host/dist/server/external-agent-setup-coordinator.js

@@ -132,6 +132,7 @@ export class HostExternalAgentSetupCoordinator {
                 });
                 attempt.abort.signal.throwIfAborted();
                 attempt.projection = { ...attempt.projection, phase: 'succeeded', installedExecutable };
+                this.deps.onSucceeded?.();
                 return;
             }
             await (this.deps.run ?? runAntigravitySetup)({
@@ -157,6 +158,8 @@ export class HostExternalAgentSetupCoordinator {
                     }
                 },
             });
+            if (!attempt.abort.signal.aborted)
+                this.deps.onSucceeded?.();
             attempt.projection = {
                 ...attempt.projection,
                 phase: attempt.abort.signal.aborted ? 'cancelled' : 'succeeded',

package/node_modules/@maka/runtime-host/dist/server/plugin-data-runtime.js

@@ -19,6 +19,7 @@
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
 import { chmod, mkdir, readFile, rename, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
+import { withPluginScratchDirectory } from './plugin-scratch-directory.js';
 const NAMESPACE_QUOTA_BYTES = 10 * 1024 * 1024;
 /** Durable per-extension data authority. JSON writes are atomic; secrets are AES-GCM sealed at rest. */
 export class HostPluginDataRuntime {
@@ -29,6 +30,11 @@ export class HostPluginDataRuntime {
     constructor(controlDirectory) {
         this.#root = join(controlDirectory, 'plugin-data');
     }
+    withScratchDirectory(namespace, key, signal, use) {
+        validateNamespace(namespace);
+        const identity = createHash('sha256').update(key).digest('hex');
+        return withPluginScratchDirectory(join(this.#root, digest(namespace), 'scratch', identity), signal, use);
+    }
     async read(namespace, domain, key) {
         return await this.#withNamespace(namespace, async () => {
             const item = (await this.#readData(namespace, domain)).values[key];

package/node_modules/@maka/runtime-host/dist/server/plugin-scratch-directory.js

@@ -0,0 +1,55 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { lstat, mkdir, realpath, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { tryAcquireFileLifetimeOwner } from '@maka/storage/file-lifetime-owner';
+/** Native leases cover separate runtime instances and are released by the OS on exit. */
+export async function withPluginScratchDirectory(root, signal, use) {
+    signal.throwIfAborted();
+    const lease = await acquire(root, signal);
+    const directory = join(root, 'workspace');
+    try {
+        signal.throwIfAborted();
+        await rm(directory, { recursive: true, force: true });
+        await mkdir(directory, { mode: 0o700 });
+        const state = await lstat(directory);
+        if (!state.isDirectory() || state.isSymbolicLink())
+            throw new Error('Plugin scratch cwd is not a directory');
+        signal.throwIfAborted();
+        return await use(await realpath(directory));
+    }
+    finally {
+        try {
+            await rm(directory, { recursive: true, force: true });
+        }
+        finally {
+            await lease.close();
+        }
+    }
+}
+async function acquire(root, signal) {
+    while (true) {
+        signal.throwIfAborted();
+        const lease = await tryAcquireFileLifetimeOwner(join(root, 'owner.lease'));
+        if (lease)
+            return lease;
+        await delay(25, undefined, { signal });
+    }
+}