maka-agent 0.2.1-dev.84.20261014 → 0.2.1-dev.85.20261014

package/node_modules/@maka/core/dist/image-delivery.js

@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+/** Client-safe delivery contract. No filesystem or networking capabilities live here. */
+export const IMAGE_DELIVERY_IDENTITY_MAX_LENGTH = 512;
+export const IMAGE_DELIVERY_SOURCE_MAX_LENGTH = 4096;
+/** JavaScript string length, shared by stream capture and Markdown consumers. */
+export const IMAGE_MARKDOWN_MAX_LENGTH = 1024 * 1024;
+export function isImageDeliverySource(value) {
+    return (typeof value === 'string' &&
+        value.length > 0 &&
+        value.length <= IMAGE_DELIVERY_SOURCE_MAX_LENGTH &&
+        !/[\x00-\x1f\x7f]/.test(value));
+}
+export function isRemoteImageSource(source) {
+    return /^https?:/i.test(source);
+}
+export function isImageDeliveryRequest(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    const identity = (s) => typeof s === 'string' &&
+        s.length > 0 &&
+        s.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+        !/[\x00-\x1f\x7f]/.test(s);
+    return (Object.keys(v).every((k) => ['turnId', 'messageId', 'source', 'retry', 'loadRemote'].includes(k)) &&
+        identity(v.turnId) &&
+        identity(v.messageId) &&
+        isImageDeliverySource(v.source) &&
+        (v.retry === undefined || typeof v.retry === 'boolean') &&
+        (v.loadRemote === undefined || typeof v.loadRemote === 'boolean'));
+}
+export const IMAGE_DELIVERY_FAILURES = [
+    'not_found',
+    'not_allowed',
+    'too_large',
+    'unsupported_mime',
+    'quota_exceeded',
+    'download_failed',
+    'read_failed',
+    'queue_full',
+];
+export function isImageDeliveryAttempt(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    return (Object.keys(v).every((k) => ['status', 'reason'].includes(k)) &&
+        (v.status === 'pending'
+            ? v.reason === undefined
+            : v.status === 'failed' && IMAGE_DELIVERY_FAILURES.includes(v.reason)));
+}
+export const DEFAULT_IMAGE_ARCHIVE_LIMITS = Object.freeze({
+    sessionBytes: 100 * 1024 * 1024,
+    workspaceBytes: 1024 * 1024 * 1024,
+});
+export function isImageDeliveryMetadata(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const v = value;
+    return (Object.keys(v).every((k) => ['messageId', 'source', 'status', 'contentSha256'].includes(k)) &&
+        typeof v.messageId === 'string' &&
+        v.messageId.length > 0 &&
+        v.messageId.length <= IMAGE_DELIVERY_IDENTITY_MAX_LENGTH &&
+        isImageDeliverySource(v.source) &&
+        v.status === 'ready' &&
+        typeof v.contentSha256 === 'string' &&
+        /^[a-f0-9]{64}$/.test(v.contentSha256));
+}

package/node_modules/@maka/core/dist/image-markdown.js

@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { Lexer, Marked } from 'marked';
+import { IMAGE_MARKDOWN_MAX_LENGTH } from './image-delivery.js';
+const parser = new Marked({ gfm: true });
+/** Canonical image destinations in real Markdown nodes, including attachment refs.
+ * Consumers own their source policy; parsing grants no filesystem or network access.
+ */
+export function markdownImageSources(text) {
+    return [...new Set(markdownImages(text).map((image) => image.source))];
+}
+/** Original token spelling and canonical destination, including reference images. */
+export function markdownImages(text) {
+    if (!text.includes('![') || text.length > IMAGE_MARKDOWN_MAX_LENGTH)
+        return [];
+    const images = [];
+    parser.walkTokens(parser.lexer(text), (token) => {
+        if (token.type === 'image')
+            images.push({ raw: token.raw, source: token.href });
+    });
+    return images;
+}
+/** Resolve a complete inline destination, rejecting trailing or partial syntax. */
+export function parseMarkdownImageDestination(source) {
+    const markdown = `![](${source})`;
+    const [token] = Lexer.lexInline(markdown, { gfm: true });
+    return token?.type === 'image' && token.raw === markdown ? token.href : undefined;
+}

package/node_modules/@maka/core/package.json

@@ -63,6 +63,8 @@
     "./context-offload": "./dist/context-offload.js",
     "./tool-result-archive-evidence": "./dist/tool-result-archive-evidence.js",
     "./attachments": "./dist/attachments.js",
+    "./image-delivery": "./dist/image-delivery.js",
+    "./image-markdown": "./dist/image-markdown.js",
     "./artifacts": "./dist/artifacts.js",
     "./pet": "./dist/pet.js",
     "./skill-invocation": "./dist/skill-invocation.js",
@@ -169,6 +171,7 @@
     "./workhub-routing": "./dist/workhub-routing.js"
   },
   "dependencies": {
-    "intl-messageformat": "11.2.15"
+    "intl-messageformat": "11.2.15",
+    "marked": "18.0.11"
   }
 }

package/node_modules/@maka/runtime/dist/filesystem-executor.js

@@ -270,6 +270,8 @@ function createWorkspaceFilesystemExecutor(workspace) {
                     const result = await workspace.readFile({
                         cwd,
                         path,
+                        ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+                        ...(abortSignal ? { abortSignal } : {}),
                     });
                     if ('bytes' in result) {
                         return { kind: 'read_image', bytes: result.bytes, mimeType: result.mimeType };

package/node_modules/@maka/runtime/dist/filesystem-worker/operations.js

@@ -30,7 +30,7 @@ import { readPage } from '../read-page.js';
 import { formatJsonText } from '../format-json.js';
 import { createEditUnifiedDiff, createUnifiedDiff } from '../unified-diff.js';
 import { compareAndDeleteEntry, hostVisibilityAfterWrite, openStableTarget, readModifyWriteThroughHandle, StableWriteFailure, writeThroughHandle, } from '../file-stable-write.js';
-import { readWorkspaceFile } from '../image-file.js';
+import { ImageFileError, readWorkspaceFile } from '../image-file.js';
 import { FILESYSTEM_WORKER_PROTOCOL_VERSION, operationAccess, operationUsesDirectoryEntry, } from './protocol.js';
 import { isLikelySandboxDenial } from '../sandbox/detect.js';
 // Canonicalisation must match the sandbox the worker runs in: realpath-based
@@ -61,8 +61,10 @@ export async function executeFilesystemOperation(operation, operationBoundary, d
     switch (operation.kind) {
         case 'read': {
             const path = await resolveExistingAllowed(operation.cwd, operation.path, 'Read', 'read', operationBoundary);
-            const file = await readWorkspaceFile(path).catch((error) => {
-                throw operationError('filesystem_error', error instanceof Error ? error.message : 'File could not be read.');
+            const file = await readWorkspaceFile(path, {
+                ...(operation.imagePurpose ? { imagePurpose: operation.imagePurpose } : {}),
+            }).catch((error) => {
+                throw operationError(normalizeOperationError(error).code, error instanceof Error ? error.message : 'File could not be read.');
             });
             if ('bytes' in file) {
                 return {
@@ -318,6 +320,8 @@ function operationError(code, message) {
 function normalizeOperationError(error) {
     if (error instanceof FilesystemOperationError)
         return error;
+    if (error instanceof ImageFileError)
+        return operationError(error.code === 'ERR_IMAGE_TOO_LARGE' ? 'image_too_large' : 'invalid_image', error.message);
     if (error instanceof StableWriteFailure) {
         return operationError(error.code, error.message);
     }

package/node_modules/@maka/runtime/dist/filesystem-worker/protocol.js

@@ -20,10 +20,9 @@ import { z } from 'zod';
 import { readContinuationSchema, readPageSchema } from '../read-page.js';
 import { validateSandboxBoundaryExpansion } from '@maka/core/sandbox-boundary';
 import { GREP_MAX_LINES, GREP_MAX_LINES_PER_FILE, GREP_MAX_MATCH_BYTES } from '../grep-search.js';
-// v10 adds bounded Read pages to v9's exact Grep counts; v11 adds Glob's
-// truncation flag to v10's result contract. Older workers cannot satisfy the
-// combined result contract and must be rejected at the handshake.
-export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 11;
+// v12 adds chat image reads with a bounded payload and no model dimension limit.
+// Older workers cannot satisfy this read policy and must be rejected at the handshake.
+export const FILESYSTEM_WORKER_PROTOCOL_VERSION = 12;
 /** The single authority on which operation kinds are writes. Shared by the
  * client (permission/identity decisions) and the worker (operation guards) so
  * the set cannot drift. */
@@ -98,6 +97,7 @@ export const FilesystemWorkerOperationSchema = z.union([
         kind: z.literal('read'),
         cwd,
         path,
+        imagePurpose: z.literal('chat').optional(),
         offset: z.number().int().nonnegative().optional(),
         limit: z.number().int().positive().optional(),
         continuation: readContinuationSchema.optional(),
@@ -236,6 +236,8 @@ export const FilesystemWorkerErrorCodeSchema = z.enum([
     'grep_unavailable',
     'sandbox_denied',
     'filesystem_denied',
+    'image_too_large',
+    'invalid_image',
     'filesystem_error',
     // The worker may have applied the mutation before it lost the ability to
     // report back (e.g. it wrote the file then the post-write identity check

package/node_modules/@maka/runtime/dist/image-file-reader.js

@@ -0,0 +1,83 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { createBoundaryFilesystemExecutor, } from './filesystem-executor.js';
+import { createLocalWorkspaceExecutor } from './workspace-executor.js';
+import { ImageFileError, imageFileFailureReason } from './image-file.js';
+import { FilesystemWorkerClientError } from './filesystem-worker/client.js';
+import { SandboxCommandError } from './sandbox/errors.js';
+/** Normalizes filesystem backends at the image reader boundary. */
+export class ImageFileReadError extends Error {
+    reason;
+    constructor(reason, cause) {
+        super(cause instanceof Error ? cause.message : `Image read failed: ${reason}`, { cause });
+        this.reason = reason;
+        this.name = 'ImageFileReadError';
+    }
+}
+function readFailure(error) {
+    if (error instanceof ImageFileError)
+        return imageFileFailureReason(error);
+    if (error instanceof SandboxCommandError)
+        return 'not_allowed';
+    const code = error instanceof FilesystemWorkerClientError
+        ? error.reason
+        : error?.code;
+    switch (code) {
+        case 'image_too_large':
+            return 'too_large';
+        case 'invalid_image':
+            return 'unsupported_mime';
+        case 'ENOENT':
+        case 'ENOTDIR':
+        case 'not_found':
+            return 'not_found';
+        case 'EACCES':
+        case 'EPERM':
+        case 'filesystem_denied':
+        case 'path_denied':
+        case 'sandbox_denied':
+        case 'sandbox_required':
+        case 'sandbox_boundary_required':
+            return 'not_allowed';
+        default:
+            return 'read_failed';
+    }
+}
+/** The same filesystem boundary as Read, without model snapshots or tool execution. */
+export function createImageFileReader(options = {}) {
+    const filesystem = createBoundaryFilesystemExecutor({
+        workspace: options.executor ?? createLocalWorkspaceExecutor(),
+        ...(options.filesystemWorker ? { worker: options.filesystemWorker } : {}),
+        ...(options.permissionProfile ? { permissionProfile: options.permissionProfile } : {}),
+    });
+    return async (input) => {
+        const { path, ...context } = input;
+        const result = await filesystem
+            .execute({
+            ...context,
+            operation: { kind: 'read', path, imagePurpose: 'chat' },
+        })
+            .catch((error) => {
+            throw new ImageFileReadError(readFailure(error), error);
+        });
+        if (result.kind !== 'read_image')
+            throw new ImageFileReadError('unsupported_mime');
+        return { bytes: result.bytes, mimeType: result.mimeType };
+    };
+}

package/node_modules/@maka/runtime/dist/image-file.js

@@ -16,18 +16,42 @@
  * specific language governing permissions and limitations
  * under the License.
  */
+import { constants } from 'node:fs';
 import { open } from 'node:fs/promises';
 import { extname } from 'node:path';
 import { imageDimensionsFromData } from 'image-dimensions';
 import { ATTACHMENT_MIME_SNIFF_BYTES, MAX_MODEL_IMAGE_EDGE, MAX_READ_IMAGE_BYTES, READ_IMAGE_TOO_LARGE_MESSAGE, sniffAttachmentMimeType, } from '@maka/core/attachments';
+import { ARTIFACT_IMAGE_PREVIEW_MAX_BYTES } from '@maka/core/artifacts';
 const IMAGE_EXTENSIONS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.webp']);
+export class ImageFileError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** Translate validated image failures without changing backend/transport errors. */
+export function imageFileFailureReason(error) {
+    return error.code === 'ERR_IMAGE_TOO_LARGE' ? 'too_large' : 'unsupported_mime';
+}
 export function isSupportedImagePath(path) {
     return IMAGE_EXTENSIONS.has(extname(path).toLowerCase());
 }
 /** Classify a bounded prefix before decoding text or allocating an image body. */
-export async function readWorkspaceFile(path) {
-    const file = await open(path, 'r');
+export async function readWorkspaceFile(path, options = {}) {
+    options.abortSignal?.throwIfAborted();
+    // Chat capture must never block opening a FIFO or read an unbounded text file.
+    const file = await open(path, options.imagePurpose === 'chat' ? constants.O_RDONLY | constants.O_NONBLOCK : 'r');
     try {
+        options.abortSignal?.throwIfAborted();
+        if (options.imagePurpose === 'chat') {
+            const size = await file.stat();
+            if (!size.isFile())
+                throw new Error('Image path is not a file.');
+            if (size.size > ARTIFACT_IMAGE_PREVIEW_MAX_BYTES)
+                throw imageTooLargeError('chat');
+            return validateImageBytes(await file.readFile({ signal: options.abortSignal }), 'chat');
+        }
         const prefix = Buffer.alloc(ATTACHMENT_MIME_SNIFF_BYTES);
         // A positioned read leaves the descriptor's offset at zero for readFile.
         const { bytesRead } = await file.read(prefix, 0, prefix.length, 0);
@@ -45,12 +69,12 @@ export async function readWorkspaceFile(path) {
         await file.close();
     }
 }
-export function validateImageBytes(bytes) {
-    if (bytes.length > MAX_READ_IMAGE_BYTES)
-        throw imageTooLargeError();
+export function validateImageBytes(bytes, purpose = 'model') {
+    if (bytes.length > (purpose === 'chat' ? ARTIFACT_IMAGE_PREVIEW_MAX_BYTES : MAX_READ_IMAGE_BYTES))
+        throw imageTooLargeError(purpose);
     const mimeType = sniffImageMime(bytes);
     if (!mimeType)
-        throw new Error('Image content is not a supported PNG, JPEG, GIF, or WebP file.');
+        throw new ImageFileError('ERR_INVALID_IMAGE', 'Image content is not a supported PNG, JPEG, GIF, or WebP file.');
     const dimensions = imageDimensionsFromData(bytes);
     if (!dimensions ||
         !Number.isFinite(dimensions.width) ||
@@ -59,15 +83,24 @@ export function validateImageBytes(bytes) {
         !Number.isInteger(dimensions.height) ||
         dimensions.width <= 0 ||
         dimensions.height <= 0) {
-        throw new Error('Image dimensions could not be read; verify the image file is valid.');
+        throw new ImageFileError('ERR_INVALID_IMAGE', 'Image dimensions could not be read; verify the image file is valid.');
     }
-    if (Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
+    if (purpose === 'model' && Math.max(dimensions.width, dimensions.height) > MAX_MODEL_IMAGE_EDGE) {
         throw new Error(`Image dimensions ${dimensions.width}x${dimensions.height} exceed the ${MAX_MODEL_IMAGE_EDGE}px model input limit; downscale it and try again.`);
     }
+    // Compressed byte size does not bound renderer decoding memory. Permit large
+    // screenshots while rejecting pathological headers before archival/preview.
+    if (purpose === 'chat' &&
+        (Math.max(dimensions.width, dimensions.height) > 16_384 ||
+            dimensions.width * dimensions.height > 32 * 1024 * 1024)) {
+        throw imageTooLargeError(purpose);
+    }
     return { bytes, mimeType };
 }
-function imageTooLargeError() {
-    return new Error(READ_IMAGE_TOO_LARGE_MESSAGE);
+function imageTooLargeError(purpose = 'model') {
+    return new ImageFileError('ERR_IMAGE_TOO_LARGE', purpose === 'chat'
+        ? 'Image exceeds a chat preview limit (2 MiB, 16384px per edge, or 32 megapixels); resize it before publishing.'
+        : READ_IMAGE_TOO_LARGE_MESSAGE);
 }
 function sniffImageMime(bytes) {
     // Core owns the byte signatures (shared with the attachment and artifact

package/node_modules/@maka/runtime/dist/network/public-network-policy.js

@@ -0,0 +1,97 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+import { lookup } from 'node:dns/promises';
+import { isIP } from 'node:net';
+export class PublicNetworkPolicyError extends Error {
+    name = 'PublicNetworkPolicyError';
+    constructor() {
+        super('Network target is not allowed by the public network policy');
+    }
+}
+/** Validate every URL, then resolve and pin direct destinations. Configured
+ * proxies resolve named destinations themselves and are trusted to enforce
+ * their egress boundary. Local DNS cannot establish a proxy's final address. */
+export async function preparePublicNetworkTarget(url, useProxy, signal) {
+    signal.throwIfAborted();
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+        throw new PublicNetworkPolicyError();
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const family = isIP(host);
+    if (family) {
+        if (!publicAddress(host))
+            throw new PublicNetworkPolicyError();
+        return useProxy ? undefined : { address: host, family };
+    }
+    if (!publicHostname(host))
+        throw new PublicNetworkPolicyError();
+    if (useProxy)
+        return undefined;
+    const addresses = await lookupWithSignal(host, signal);
+    signal.throwIfAborted();
+    if (!addresses.length || addresses.some(({ address }) => !publicAddress(address)))
+        throw new PublicNetworkPolicyError();
+    return addresses[0];
+}
+function lookupWithSignal(host, signal) {
+    return new Promise((resolve, reject) => {
+        const abort = () => {
+            signal.removeEventListener('abort', abort);
+            reject(signal.reason);
+        };
+        signal.addEventListener('abort', abort, { once: true });
+        if (signal.aborted)
+            abort();
+        else
+            void lookup(host, { all: true })
+                .then(resolve, reject)
+                .finally(() => {
+                signal.removeEventListener('abort', abort);
+            });
+    });
+}
+function publicHostname(host) {
+    const name = host.toLowerCase().replace(/\.$/, '');
+    return (name.includes('.') &&
+        !/(^|\.)(localhost|local|lan|internal|home|arpa|test|invalid)$/.test(name) &&
+        ![
+            'metadata.google.internal',
+            'metadata.goog',
+            'metadata.tencentyun.com',
+            'instance-data.ec2.internal',
+        ].includes(name));
+}
+function publicAddress(address) {
+    if (isIP(address) === 4) {
+        const [a = 0, b = 0] = address.split('.').map(Number);
+        return (a > 0 &&
+            a !== 10 &&
+            a !== 127 &&
+            a < 224 &&
+            !(a === 169 && b === 254) &&
+            !(a === 172 && b >= 16 && b <= 31) &&
+            !(a === 192 && b === 168) &&
+            !(a === 100 && b >= 64 && b <= 127) &&
+            !(a === 198 && (b === 18 || b === 19)));
+    }
+    if (isIP(address) !== 6)
+        return false;
+    // Only global-unicast IPv6 is eligible, excluding the benchmarking prefix.
+    const normalized = new URL(`http://[${address}]`).hostname;
+    return /^[23][0-9a-f]{3}:/i.test(address) && !/^\[2001:2:(?::|0:)/i.test(normalized);
+}

package/node_modules/@maka/runtime/dist/network/scoped-fetch-transport.js

@@ -20,6 +20,8 @@ import { Agent, fetch as undiciFetch } from 'undici';
 import { matchesBypassList } from './bypass-matcher.js';
 import { buildProxyDispatcher } from './proxy-dispatcher.js';
 import { buildAbortableConnector } from './abortable-connector.js';
+import { preparePublicNetworkTarget } from './public-network-policy.js';
+export { PublicNetworkPolicyError } from './public-network-policy.js';
 export const FETCH_PROXY_SNAPSHOT = Symbol.for('maka.fetch.proxy-snapshot');
 const TRANSPORT_CLOSE_GRACE_MS = 1_000;
 export function inheritFetchProxySnapshot(fetch, source) {
@@ -40,6 +42,7 @@ export function createProxiedFetchTransport(proxy) {
     // direct and proxy connection establishment too, including TLS handshakes.
     const connections = new AbortController();
     const directDispatcher = new Agent({ connect: buildAbortableConnector(connections.signal) });
+    const publicDispatchers = new Set();
     let proxyDispatcher;
     let closePromise;
     let closed = false;
@@ -48,12 +51,61 @@ export function createProxiedFetchTransport(proxy) {
             throw new Error('Proxied fetch transport is closed');
         const url = typeof input === 'string' ? input : input instanceof URL ? input.toString() : input.url;
         const useProxy = proxySnapshot !== null && !matchesBypassList(new URL(url).hostname, proxySnapshot.bypassList);
+        const { targetPolicy, ...requestInit } = init ?? {};
+        let publicDispatcher;
+        if (targetPolicy !== undefined) {
+            if (targetPolicy !== 'public')
+                throw new Error('Unknown network target policy');
+            const inputRequest = typeof input === 'string' || input instanceof URL ? undefined : input;
+            const redirect = requestInit.redirect ?? inputRequest?.redirect ?? 'follow';
+            if (redirect !== 'manual' && redirect !== 'error')
+                throw new Error('Public network requests require manual redirects or redirect: error');
+            const requestSignal = requestInit.signal === undefined ? inputRequest?.signal : requestInit.signal;
+            const signal = requestSignal
+                ? AbortSignal.any([connections.signal, requestSignal])
+                : connections.signal;
+            const target = await preparePublicNetworkTarget(new URL(url), useProxy, signal);
+            signal.throwIfAborted();
+            requestInit.signal = signal;
+            if (target) {
+                // A separate dispatcher prevents reuse of an unchecked connection and
+                // binds this request to exactly the DNS answer admitted above.
+                publicDispatcher = new Agent({
+                    connect: buildAbortableConnector(signal, {
+                        lookup: (_host, options, callback) => options.all
+                            ? callback(null, [target])
+                            : callback(null, target.address, target.family),
+                    }),
+                });
+                publicDispatchers.add(publicDispatcher);
+            }
+        }
         if (useProxy)
             proxyDispatcher ??= buildProxyDispatcher(proxySnapshot, connections.signal);
-        return (await undiciFetch(input, {
-            ...init,
-            dispatcher: useProxy ? proxyDispatcher : directDispatcher,
-        }));
+        try {
+            const response = (await undiciFetch(
+            // Keep a mutable URL object bound to the destination checked before DNS awaited.
+            (targetPolicy === 'public' && input instanceof URL ? url : input), {
+                ...requestInit,
+                dispatcher: publicDispatcher ?? (useProxy ? proxyDispatcher : directDispatcher),
+            }));
+            if (publicDispatcher) {
+                const dispatcher = publicDispatcher;
+                // Graceful close waits for the body, without delaying delivery of headers.
+                void dispatcher
+                    .close()
+                    .catch(() => { })
+                    .finally(() => publicDispatchers.delete(dispatcher));
+            }
+            return response;
+        }
+        catch (error) {
+            if (publicDispatcher) {
+                await publicDispatcher.destroy().catch(() => { });
+                publicDispatchers.delete(publicDispatcher);
+            }
+            throw error;
+        }
     };
     Object.defineProperty(fetch, FETCH_PROXY_SNAPSHOT, {
         value: proxySnapshot,
@@ -64,6 +116,7 @@ export function createProxiedFetchTransport(proxy) {
             return closePromise;
         closed = true;
         const destroyed = Promise.all([
+            ...[...publicDispatchers].map((dispatcher) => dispatcher.destroy(new Error('Connection effect fetch transport closed')).catch(() => { })),
             directDispatcher
                 .destroy(new Error('Connection effect fetch transport closed'))
                 .catch(() => { }),

package/node_modules/@maka/runtime/dist/system-prompt/main-session-prompt.js

@@ -49,6 +49,9 @@ Keep simple answers simple; do not add headings or lists to simple answers.
 Use short headings and flat lists to organize longer answers.
 Use fenced code blocks for multiline code and backticks for inline commands, paths, identifiers, and literal values.
 Prefer descriptive link text for external sources when it is available.
+To deliver a generated screenshot or local image, include a Markdown image with its absolute path. The Host automatically saves supported local images after the assistant message completes. Supported remote images in completed assistant messages load automatically near the viewport, subject to the application's outbound/privacy policy and proxy settings. This media loading is independent of session subprocess network restrictions; include remote images only when relevant to the user's request. Reading an image for your own inspection does not deliver it.
+Keep source files available until capture finishes. Images above the save limits cannot be previewed automatically.
+Including image Markdown does not confirm that capture succeeded or that the client displayed it.
 Follow a more specific format requested by the user or task.`;
 }
 function buildProgressUpdatesPromptFragment() {