You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maka.apache.org by as...@apache.org on 2026/10/19 02:23:10 UTC
(maka) branch main updated: chore(release): prepare 0.2.2 and correct source packaging (#6148)
This is an automated email from the ASF dual-hosted git repository.
Astro-Han pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/maka.git
The following commit(s) were added to refs/heads/main by this push:
new 2ddaa74c3a chore(release): prepare 0.2.2 and correct source packaging (#6148)
2ddaa74c3a is described below
commit 2ddaa74c3aa200cf836e51a2d279fe2ee29c6dc0
Author: AstroHan <le...@outlook.com>
AuthorDate: Mon Oct 19 13:23:06 2026 +1100
chore(release): prepare 0.2.2 and correct source packaging (#6148)
Prepare 0.2.2 release metadata and address the source-package review from 0.2.1: keep QuickJS WASM out of the source patch, correct source license references and mixed-origin cursor headers, clarify DISCLAIMER-WIP, and register the installer regression in CI selection.
Runtime behavior is unchanged. Desktop, CLI and remote Hosts upgrade together at compatibility epoch 224; the Rust/GPUI preview remains separate.
Generated-by: Codex
---
CHANGELOG.md | 35 ++++++++++
DISCLAIMER-WIP | 2 +-
LICENSE | 12 ++--
apps/desktop/package.json | 2 +-
.../computer-use-overlay/engine/cursor-engine.ts | 20 ++----
.../computer-use-overlay/engine/palette.ts | 26 ++-----
package-lock.json | 8 +--
package.json | 4 +-
packages/cli/package.json | 2 +-
patches/README.md | 3 +-
patches/run+2.1.4.patch | 4 +-
patches/run-2.1.4-notices.md | 6 +-
scripts/apply-dependency-patches.mjs | 40 +++++++++--
scripts/apply-dependency-patches.test.mjs | 81 ++++++++++++++++++++++
scripts/asf-license-headers.mjs | 6 ++
scripts/asf-source-release.mjs | 5 ++
scripts/asf-source-release.test.mjs | 15 ++++
scripts/ci-test-plan.mjs | 2 +
scripts/source-legal-inventory.test.mjs | 12 ++++
19 files changed, 223 insertions(+), 62 deletions(-)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index facf068c99..ab4bb99eaf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,41 @@
## Unreleased
+## 0.2.2 - Unreleased
+
+### Added
+
+- A personal assistant with indexed memory, durable tasks and an inbox bot for coordinating work (#6004, #6124), and durable observation of event waits (#6113).
+- Import Cursor sessions through their SQLite history adapter (#6039).
+- Configured external agents in the model picker, alongside unified model and effort options (#6103, #5789).
+- Automatic rendering and archiving of chat images, and clearer project, task and execution-location controls (#5969, #6088).
+
+### Fixed
+
+- Preserve cached replies, new Side Chat sessions and question forms across session switches (#6129, #6111, #5854).
+- Recover failed message delivery and workspace Skill deletion, retain client tool outcomes, and release settled external executions whose results were rejected (#5058, #6009, #5458, #5823).
+- Render imported Codex user context without raw envelopes, scope WorkHub tool lookups to the owning turn, and include tool and human evidence in Goal context (#6117, #6096, #6087).
+- Keep fullscreen editing usable on short terminals, mask fine-grained GitHub tokens, and align connection URL validation with the Host (#6085, #6062, #6098).
+- Restore image attachments in Codex imports and preserve running tool state when reconnecting (#6118, #6145).
+- Invalidate deleted Artifact previews, allow new projects without a custom name, and keep conversations centered with classic scrollbars (#5394, #6073, #6102).
+- Resolve linked-worktree read boundaries through the common Git directory, and initialize vacuum mode when databases are created concurrently (#6105, #6136).
+- Preserve Windows browser launcher paths and SSH operator arguments, and validate project roots for the target platform (#6121, #6123, #6122).
+- Source patches no longer include the unchanged QuickJS WebAssembly binary; installation reuses it from the pinned npm dependency. Source verification also rejects Base64-encoded WASM.
+- Correct stale source-license component and dependency references, preserve the cursor files' upstream MIT scope, and identify the historical 0.2.0 RC1 in DISCLAIMER-WIP.
+
+### Changed
+
+- Bound transcript work on session switches and Read line-index memory; allow providers to own reasoning defaults (#5712, #5461, #6092).
+- Use dedicated directories for projectless tasks and preserve distinct titles for branched sessions (#5966, #4994).
+- Improve Computer Use cursor positioning and visibility; recover interrupted macOS notarization and validation requests and native Windows PTY exit codes (#5051, #5052, #6125, #6101, #6097, #6094).
+- Guard packaged dependency contents with a reviewed ledger and document the Linux support baseline (#5455, #6099).
+
+### Upgrade notes
+
+- Update Desktop, CLI and remote Runtime Hosts together. The Runtime Host compatibility epoch is 224 (217 in 0.2.1); mismatched peers cannot connect.
+- Back up configuration and workspace data before upgrading if rollback is needed. This release adds durable assistant and event-wait state; older releases must not reuse data written by a newer Host without a verified downgrade path.
+- This release continues the TypeScript Runtime Host and Electron desktop. The Rust Host and GPUI desktop remain on the separate `rust-preview` development branch.
+
## 0.2.1 - Unreleased
### Added
diff --git a/DISCLAIMER-WIP b/DISCLAIMER-WIP
index 1cd9ddf107..21ef07de9d 100644
--- a/DISCLAIMER-WIP
+++ b/DISCLAIMER-WIP
@@ -12,7 +12,7 @@ conditions. What follows is a list of issues the project is currently aware of
(this list is likely to be incomplete):
* The initial-code authorization review remains open at
- https://github.com/apache/maka/issues/3268. Since RC1, the ASF has recorded
+ https://github.com/apache/maka/issues/3268. Since 0.2.0 RC1, the ASF has recorded
the ICLA of contributor Mingqwqqaq, and the Deep Research implementation
has been removed. The review still needs to record the authorization basis
for the retained initial code; these changes do not establish that an SGA
diff --git a/LICENSE b/LICENSE
index cfff851951..64fc6abc9e 100644
--- a/LICENSE
+++ b/LICENSE
@@ -218,7 +218,9 @@ License: Apache-2.0
These patches modify the execution time policy and its SDK forwarding. The
Apache License, Version 2.0 above applies. The generated run Worker includes
embedded third-party code; its upstream notices and license texts are retained
-in patches/run-2.1.4-notices.md.
+in patches/run-2.1.4-notices.md. The patch carries no WebAssembly binary:
+postinstall substitutes the unchanged payload from the installed run package
+for `__MAKA_RUN_WASM_BASE64__` before applying the patch.
Vercel AI SDK
@@ -240,7 +242,7 @@ License, Version 2.0 above applies to the adapted material.
The pinned versions are the ones present when the adaptation was made. The
adapted declarations are unchanged through @ai-sdk/provider-utils 5.0.25 and
@ai-sdk/provider 4.0.7, the versions recorded by the code origin audit. Maka
-also redistributes a patch against @ai-sdk/provider-utils 5.0.40; that patch
+also redistributes a patch against @ai-sdk/provider-utils 5.0.51; that patch
modifies Apache-2.0 source and is covered by the license reproduced above.
Astryx
@@ -622,6 +624,9 @@ License: MIT
adaptations of this component.
The following MIT License applies to that material:
+Maka-authored modifications are licensed under the Apache License, Version 2.0
+reproduced above; the upstream portions retain the MIT terms below.
+
MIT License
Copyright (c) 2025 Cua AI, Inc.
@@ -809,8 +814,7 @@ Desktop renderer vendored source assets
The source archive includes third-party SVG paths and source assets from
Lobe Icons (MIT), LocalAI (MIT), Simple Icons (CC0-1.0), TDesign Icons (MIT),
-MingCute (Apache-2.0), Allogo (MIT), Ant Design Icons (MIT), and Semi Design
-(MIT), used by the desktop renderer. Their file-by-file inventory, immutable upstream revisions,
+MingCute (Apache-2.0), and Allogo (MIT), used by the desktop renderer. Their file-by-file inventory, immutable upstream revisions,
copyright notices, and license texts are in:
apps/desktop/src/renderer/public/THIRD_PARTY_LICENSES.txt
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 2f886c3f30..c7dbbe8551 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -2,7 +2,7 @@
"name": "@maka/desktop",
"productName": "Maka",
"description": "A local-first agent workspace built for real work.",
- "version": "0.2.1",
+ "version": "0.2.2",
"author": "The Maka Authors",
"license": "Apache-2.0",
"homepage": "https://github.com/apache/maka",
diff --git a/apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts b/apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts
index d29e37617c..6564420da3 100644
--- a/apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts
+++ b/apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts
@@ -1,20 +1,8 @@
/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
+ * Portions Copyright (c) 2025 Cua AI, Inc.
+ * Adapted from trycua/cua cursor-overlay under the MIT License.
+ * Maka modifications are licensed under Apache-2.0.
+ * See the repository-root LICENSE for both license texts.
*/
// Maka's agent-cursor renderer.
diff --git a/apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts b/apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts
index 3d8d1aa03b..96d9aa375b 100644
--- a/apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts
+++ b/apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts
@@ -1,26 +1,12 @@
/*
- * Licensed to the Apache Software Foundation (ASF) under one
- * or more contributor license agreements. See the NOTICE file
- * distributed with this work for additional information
- * regarding copyright ownership. The ASF licenses this file
- * to you under the Apache License, Version 2.0 (the
- * "License"); you may not use this file except in compliance
- * with the License. You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
- * KIND, either express or implied. See the License for the
- * specific language governing permissions and limitations
- * under the License.
+ * Portions Copyright (c) 2025 Cua AI, Inc.
+ * Adapted from trycua/cua cursor-overlay under the MIT License.
+ * Maka modifications are licensed under Apache-2.0.
+ * See the repository-root LICENSE for both license texts.
*/
-// Agent-cursor colour palettes — faithful 1:1 port of trycua/cua's
-// cursor-overlay/src/palette.rs (itself a port of AgentCursorPalette.cs).
-// Colours are [R,G,B] 0-255. The overlay picks a palette from the session id so
-// distinct agent runs are visually distinct but a given id is stable.
+// Palette shape adapted from cursor-overlay/src/palette.rs.
+// Maka uses one brand palette; colours are [R,G,B] in 0-255.
export type Rgb = readonly [number, number, number];
export interface Palette {
diff --git a/package-lock.json b/package-lock.json
index e3bb6837e8..a35cc9687a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "maka",
- "version": "0.2.1",
+ "version": "0.2.2",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "maka",
- "version": "0.2.1",
+ "version": "0.2.2",
"hasInstallScript": true,
"license": "Apache-2.0",
"workspaces": [
@@ -44,7 +44,7 @@
},
"apps/desktop": {
"name": "@maka/desktop",
- "version": "0.2.1",
+ "version": "0.2.2",
"license": "Apache-2.0",
"dependencies": {
"@jackwener/opencli": "1.8.8",
@@ -17261,7 +17261,7 @@
},
"packages/cli": {
"name": "maka-agent",
- "version": "0.2.1",
+ "version": "0.2.2",
"license": "Apache-2.0",
"dependencies": {
"@agentclientprotocol/sdk": "1.5.0",
diff --git a/package.json b/package.json
index 5120ed6261..a574866441 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
{
"name": "maka",
- "version": "0.2.1",
+ "version": "0.2.2",
"license": "Apache-2.0",
"private": true,
"engines": {
@@ -72,7 +72,7 @@
"release:asf:source": "node scripts/asf-source-release.mjs create",
"release:asf:verify": "node scripts/asf-source-release.mjs verify",
"release:asf:sign": "node scripts/asf-source-release.mjs sign",
- "check:asf-source": "npm run check:model-metadata && node --test scripts/asf-source-release.test.mjs scripts/asf-source-workflow-policy.test.mjs scripts/asf-license-headers.test.mjs scripts/model-metadata-upkeep-workflow-policy.test.mjs scripts/source-legal-inventory.test.mjs scripts/sync-model-metadata.test.mjs",
+ "check:asf-source": "npm run check:model-metadata && node --test scripts/apply-dependency-patches.test.mjs scripts/asf-source-release.test.mjs scripts/asf-source-workflow-policy.test.mjs scripts/asf-license-headers.test.mjs scripts/model-metadata-upkeep-workflow-policy.test.mjs scripts/source-legal-inventory.test.mjs scripts/sync-model-metadata.test.mjs",
"check:asf-npm": "node --test scripts/asf-npm-workflow-policy.test.mjs",
"check:product-release-identity": "node scripts/product-release-identity.mjs",
"package:cli:macos-arm64": "node scripts/package-macos-arm64-cli.mjs",
diff --git a/packages/cli/package.json b/packages/cli/package.json
index 75f4423b61..e1e2613acd 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -1,6 +1,6 @@
{
"name": "maka-agent",
- "version": "0.2.1",
+ "version": "0.2.2",
"license": "Apache-2.0",
"private": true,
"type": "module",
diff --git a/patches/README.md b/patches/README.md
index e41dd37b73..284c210c51 100644
--- a/patches/README.md
+++ b/patches/README.md
@@ -73,8 +73,7 @@ To rebuild, check out upstream `vercel-labs/run` tag `run@2.1.4`
package and regenerate with `node node_modules/patch-package/index.js run`.
Copy the patched package manifest as well, and pass `--exclude '^$'` when
regenerating so patch-package includes that manifest change.
-The large generated hunk is the inline Worker with unchanged embedded WASM;
-`run-2.1.4-notices.md` retains its embedded dependency notices.
+Before committing the regenerated patch, replace the unchanged Base64 WASM payload in both inline Worker diff lines with `__MAKA_RUN_WASM_BASE64__`. `scripts/apply-dependency-patches.mjs` restores that payload from the installed `run@2.1.4` package into a temporary patch directory during postinstall. Run `npm run check:asf-source` to verify the source-only patch and installation; the source verifier rejects embedded WASM. `run-2.1.4-notices.md` retains its embedded dependency notices.
Remove both patches and the run override when published versions support the
same execution budget semantics. Regression coverage lives in
diff --git a/patches/run+2.1.4.patch b/patches/run+2.1.4.patch
index b0d9a7a36e..f90d87fb93 100644
--- a/patches/run+2.1.4.patch
+++ b/patches/run+2.1.4.patch
@@ -138,8 +138,8 @@ index df1fc01..254a45b 100644
+++ b/node_modules/run/dist/runtime/worker-source.js
@@ -1,2 +1,2 @@
// This file is generated by scripts/embed-inline-worker.mjs.
--export const INLINE_RUN_WORKER_SOURCE = "globalThis.__RUN_QUICKJS_WASM_BASE64__ = \"AGFzbQEAAAAB8QZuYAN/f38Bf2AEf35/fwF+YAJ/fwBgAn9/AX9gAX8Bf2ADf39/AGAFf35/f38BfmAEf39/fwF/YAJ/fgF+YAF/AGABfAF8YAJ/fgBgAn9+AX9gAn9/AX5gA39/fwF+YAN/f34Bf2AGf35/f39/AX5gAX4Bf2ADf35/AGADf35/AX5gBX9/f39/AX9gA39+fwF/YAABf2AEf39/fwF+YAN/fn4BfmAGf35+f39/AX5gA39+fgF/YAZ/f39/f38Bf2AEf39/fwBgBH9/fn8Bf2ABfwF+YAJ8fAF8YAR/f39+AX9gBX9/f39/AX5gBX9+fn9/AX5gAABgBX9/f39/AGAFf35/fn8Bf2ACfn8Bf2AEf35/fwF/YAd/fn9+fn5/AX9gBX9+fn5 [...]
-+export const INLINE_RUN_WORKER_SOURCE = "globalThis.__RUN_QUICKJS_WASM_BASE64__ = \"AGFzbQEAAAAB8QZuYAN/f38Bf2AEf35/fwF+YAJ/fwBgAn9/AX9gAX8Bf2ADf39/AGAFf35/f38BfmAEf39/fwF/YAJ/fgF+YAF/AGABfAF8YAJ/fgBgAn9+AX9gAn9/AX5gA39/fwF+YAN/f34Bf2AGf35/f39/AX5gAX4Bf2ADf35/AGADf35/AX5gBX9/f39/AX9gA39+fwF/YAABf2AEf39/fwF+YAN/fn4BfmAGf35+f39/AX5gA39+fgF/YAZ/f39/f38Bf2AEf39/fwBgBH9/fn8Bf2ABfwF+YAJ8fAF8YAR/f39+AX9gBX9/f39/AX5gBX9+fn9/AX5gAABgBX9/f39/AGAFf35/fn8Bf2ACfn8Bf2AEf35/fwF/YAd/fn9+fn5/AX9gBX9+fn5 [...]
+-export const INLINE_RUN_WORKER_SOURCE = "globalThis.__RUN_QUICKJS_WASM_BASE64__ = \"__MAKA_RUN_WASM_BASE64__\";\n\nimport{writeSync as ot}from\"node:fs\";import{formatWithOptions as it}from\"node:util\";import{parentPort as M}from\"node:worker_threads\";function Ie(t){return{clock_time_get(i,a,l){let u=t(),c=new DataView(u.buffer);if(i===0||i===1){let f=BigInt(Date.now())*1000000n;return c.setBigUint64(l,f,!0),0}return 52},fd_write(i,a,l,u){let c=t(),f=new DataView(c.buffer),d=new Uint8 [...]
++export const INLINE_RUN_WORKER_SOURCE = "globalThis.__RUN_QUICKJS_WASM_BASE64__ = \"__MAKA_RUN_WASM_BASE64__\";\n\nimport{writeSync as it}from\"node:fs\";import{formatWithOptions as at}from\"node:util\";import{parentPort as J}from\"node:worker_threads\";function ke(t){return{clock_time_get(i,a,u){let l=t(),c=new DataView(l.buffer);if(i===0||i===1){let f=BigInt(Date.now())*1000000n;return c.setBigUint64(u,f,!0),0}return 52},fd_write(i,a,u,l){let c=t(),f=new DataView(c.buffer),d=new Uint8 [...]
diff --git a/node_modules/run/dist/utils/options.js b/node_modules/run/dist/utils/options.js
index f6f32a5..436849c 100644
--- a/node_modules/run/dist/utils/options.js
diff --git a/patches/run-2.1.4-notices.md b/patches/run-2.1.4-notices.md
index 84acce4728..d4fad82ee3 100644
--- a/patches/run-2.1.4-notices.md
+++ b/patches/run-2.1.4-notices.md
@@ -2,8 +2,10 @@
`run` embeds the `devalue` serializer and a QuickJS WebAssembly runtime built by the
[`quickjs-wasi`](https://github.com/vercel-labs/quickjs-wasi) project.
-The following packages are used to build the published JavaScript and embedded
-WebAssembly artifact:
+The source patch includes the generated JavaScript changes, but no WebAssembly
+binary. During postinstall, `scripts/apply-dependency-patches.mjs` replaces
+`__MAKA_RUN_WASM_BASE64__` with the unchanged payload from the installed `run`
+package. The following packages build that dependency's JavaScript and runtime:
| Package | Version | License |
| -------------- | ------- | ------- |
diff --git a/scripts/apply-dependency-patches.mjs b/scripts/apply-dependency-patches.mjs
index 8c419d78a4..5a0af167d2 100644
--- a/scripts/apply-dependency-patches.mjs
+++ b/scripts/apply-dependency-patches.mjs
@@ -30,9 +30,9 @@
// lane runs a plain root `npm ci`, and an unpatched tree turns
// packages/runtime/src/__tests__/model-factory-tool-call-index.test.ts red.
import { spawnSync } from 'node:child_process';
-import { existsSync, readdirSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
+import { dirname, join, relative } from 'node:path';
import { fileURLToPath } from 'node:url';
const repoRoot = dirname(dirname(fileURLToPath(import.meta.url)));
@@ -55,8 +55,34 @@ try {
process.exit(0);
}
-const result = spawnSync(process.execPath, [patchPackageEntry, '--error-on-fail'], {
- cwd: repoRoot,
- stdio: 'inherit',
-});
-process.exit(result.status ?? 1);
+let temporaryPatches;
+try {
+ const runPatchName = 'run+2.1.4.patch';
+ const runPatchPath = join(patchesDirectory, runPatchName);
+ const runPatch = existsSync(runPatchPath) ? readFileSync(runPatchPath, 'utf8') : '';
+ const marker = '__MAKA_RUN_WASM_BASE64__';
+ if (runPatch.includes(marker)) {
+ // The patch changes worker code, not WASM. Reuse the npm package's binary
+ // during installation so the source distribution carries only the changes.
+ const worker = readFileSync(
+ join(repoRoot, 'node_modules/run/dist/runtime/worker-source.js'),
+ 'utf8',
+ );
+ const wasm = /__RUN_QUICKJS_WASM_BASE64__ = \\"([A-Za-z0-9+/=]+)\\";/u.exec(worker)?.[1];
+ if (!wasm) throw new Error('Cannot find the installed run 2.1.4 QuickJS payload');
+ temporaryPatches = mkdtempSync(join(repoRoot, 'node_modules/.maka-patches-'));
+ for (const name of readdirSync(patchesDirectory).filter((name) => name.endsWith('.patch'))) {
+ const contents =
+ name === runPatchName
+ ? runPatch.replaceAll(marker, wasm)
+ : readFileSync(join(patchesDirectory, name), 'utf8');
+ writeFileSync(join(temporaryPatches, name), contents);
+ }
+ }
+ const arguments_ = [patchPackageEntry, '--error-on-fail'];
+ if (temporaryPatches) arguments_.push('--patch-dir', relative(repoRoot, temporaryPatches));
+ const result = spawnSync(process.execPath, arguments_, { cwd: repoRoot, stdio: 'inherit' });
+ process.exitCode = result.status ?? 1;
+} finally {
+ if (temporaryPatches) rmSync(temporaryPatches, { recursive: true, force: true });
+}
diff --git a/scripts/apply-dependency-patches.test.mjs b/scripts/apply-dependency-patches.test.mjs
new file mode 100644
index 0000000000..fed830f44e
--- /dev/null
+++ b/scripts/apply-dependency-patches.test.mjs
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { spawnSync } from 'node:child_process';
+import {
+ cpSync,
+ mkdirSync,
+ mkdtempSync,
+ readFileSync,
+ rmSync,
+ symlinkSync,
+ writeFileSync,
+} from 'node:fs';
+import { createRequire } from 'node:module';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { test } from 'node:test';
+
+test('postinstall reuses installed WASM while applying source-only patches, including a repeat', () => {
+ const root = mkdtempSync(join(tmpdir(), 'maka-patches-'));
+ try {
+ mkdirSync(join(root, 'scripts'));
+ mkdirSync(join(root, 'patches'));
+ mkdirSync(join(root, 'node_modules/run/dist/runtime'), { recursive: true });
+ cpSync(
+ join(import.meta.dirname, 'apply-dependency-patches.mjs'),
+ join(root, 'scripts/apply-dependency-patches.mjs'),
+ );
+ symlinkSync(
+ dirname(createRequire(import.meta.url).resolve('patch-package/package.json')),
+ join(root, 'node_modules/patch-package'),
+ 'dir',
+ );
+ writeFileSync(join(root, 'package.json'), '{"name":"patch-fixture","version":"1.0.0"}');
+ writeFileSync(join(root, 'node_modules/run/package.json'), '{"name":"run","version":"2.1.4"}');
+ const wasm = Buffer.from([0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00]).toString('base64');
+ const source = (payload, code) =>
+ `export const INLINE_RUN_WORKER_SOURCE = ${JSON.stringify(`globalThis.__RUN_QUICKJS_WASM_BASE64__ = "${payload}";\n${code}`)};\n`;
+ const workerPath = join(root, 'node_modules/run/dist/runtime/worker-source.js');
+ writeFileSync(workerPath, source(wasm, 'original'));
+ const patch = [
+ 'diff --git a/node_modules/run/dist/runtime/worker-source.js b/node_modules/run/dist/runtime/worker-source.js',
+ '--- a/node_modules/run/dist/runtime/worker-source.js',
+ '+++ b/node_modules/run/dist/runtime/worker-source.js',
+ '@@ -1 +1 @@',
+ `-${source('__MAKA_RUN_WASM_BASE64__', 'original').trimEnd()}`,
+ `+${source('__MAKA_RUN_WASM_BASE64__', 'patched').trimEnd()}`,
+ '',
+ ].join('\n');
+ const patchPath = join(root, 'patches/run+2.1.4.patch');
+ writeFileSync(patchPath, patch);
+ for (let attempt = 0; attempt < 2; attempt++) {
+ const result = spawnSync(process.execPath, ['scripts/apply-dependency-patches.mjs'], {
+ cwd: root,
+ encoding: 'utf8',
+ });
+ assert.equal(result.status, 0, result.stdout + result.stderr);
+ assert.equal(readFileSync(workerPath, 'utf8'), source(wasm, 'patched'));
+ assert.equal(readFileSync(patchPath, 'utf8'), patch);
+ }
+ } finally {
+ rmSync(root, { recursive: true, force: true });
+ }
+});
diff --git a/scripts/asf-license-headers.mjs b/scripts/asf-license-headers.mjs
index 23b5fac2df..d1aba15b49 100644
--- a/scripts/asf-license-headers.mjs
+++ b/scripts/asf-license-headers.mjs
@@ -212,6 +212,8 @@ export const exclusionRules = [
'packages/runtime/src/model-protocol.ts',
'packages/eval/harbor/deepseek-harness-profile/cordis.patch.yml',
'packages/ui/src/astryx-chat-reasoning.tsx',
+ 'apps/desktop/src/renderer/computer-use-overlay/engine/palette.ts',
+ 'apps/desktop/src/renderer/computer-use-overlay/engine/cursor-engine.ts',
)(path) ||
isUnder('apps/desktop/src/renderer/assets/provider-brands', '.svg')(path) ||
isUnder('patches', '.patch')(path),
@@ -354,6 +356,10 @@ const reviewedProvenance = new Map([
'scripts/generate-runtime-host-peer-notices.mjs',
'Maka-authored generator that emits upstream copyright lines into the Runtime Host peer notices. The copyright it names is its output, not its own.',
],
+ [
+ 'scripts/source-legal-inventory.test.mjs',
+ 'Legal inventory tests quote upstream copyright and license notices to check their preservation.',
+ ],
[
'scripts/sync-model-metadata.mjs',
'Maka-authored generator that writes the models.dev attribution into the header of the catalog it generates. The copyright it names is its output, not its own.',
diff --git a/scripts/asf-source-release.mjs b/scripts/asf-source-release.mjs
index 99169ffcc6..de6819500e 100644
--- a/scripts/asf-source-release.mjs
+++ b/scripts/asf-source-release.mjs
@@ -626,6 +626,11 @@ function validateNonTextInputs(candidateRoot, identity, entries) {
if (compiledFormat) {
throw new Error(`Compiled artifact ${entry} has forbidden ${compiledFormat} content`);
}
+ for (const match of contents.toString('utf8').matchAll(/\bAGFzbQ[A-Za-z0-9+/]{4,}={0,2}/gu)) {
+ if (compiledArtifactFormat(Buffer.from(match[0], 'base64')) === 'WASM') {
+ throw new Error(`Compiled artifact ${entry} has forbidden Base64 WASM content`);
+ }
+ }
try {
const text = decoder.decode(contents);
const basename = entry.slice(entry.lastIndexOf('/') + 1);
diff --git a/scripts/asf-source-release.test.mjs b/scripts/asf-source-release.test.mjs
index 31da2686f8..4eb9c7008e 100644
--- a/scripts/asf-source-release.test.mjs
+++ b/scripts/asf-source-release.test.mjs
@@ -191,6 +191,21 @@ describe('ASF source release verification', () => {
}
});
+ test('rejects WASM encoded inside a textual dependency patch', async () => {
+ const wasm = Buffer.from([0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00]);
+ const fixture = createFixtureCandidate({
+ 'patches/worker.patch': `+const wasm = "${wasm.toString('base64')}";\n`,
+ });
+ try {
+ await assert.rejects(
+ () => verifySourceCandidate({ archivePath: fixture.archivePath }),
+ /Compiled artifact.*worker\.patch.*Base64 WASM/,
+ );
+ } finally {
+ fixture.cleanup();
+ }
+ });
+
test('rejects compiled artifacts regardless of their file extension', async () => {
const formats = new Map([
['ELF', Buffer.from([0x7f, 0x45, 0x4c, 0x46])],
diff --git a/scripts/ci-test-plan.mjs b/scripts/ci-test-plan.mjs
index b0827f8a9c..3276c4c409 100644
--- a/scripts/ci-test-plan.mjs
+++ b/scripts/ci-test-plan.mjs
@@ -159,6 +159,8 @@ const ASF_SOURCE_FILES = new Set([
'docs/code-origin-audit.md',
'package.json',
'packages/eval/harbor/deepseek-harness-profile/cordis.patch.yml',
+ 'scripts/apply-dependency-patches.mjs',
+ 'scripts/apply-dependency-patches.test.mjs',
'scripts/asf-license-headers.mjs',
'scripts/asf-license-headers.test.mjs',
'scripts/asf-source-release.mjs',
diff --git a/scripts/source-legal-inventory.test.mjs b/scripts/source-legal-inventory.test.mjs
index 466e32d8e3..1946e0b924 100644
--- a/scripts/source-legal-inventory.test.mjs
+++ b/scripts/source-legal-inventory.test.mjs
@@ -52,6 +52,18 @@ test('mixed-origin DeepSeek profile carries both scopes without a whole-file ASF
assert.doesNotMatch(profile, /Licensed to the Apache Software Foundation \(ASF\)/);
});
+test('mixed-origin cursor files retain the upstream MIT scope without a whole-file ASF claim', async () => {
+ for (const name of ['palette.ts', 'cursor-engine.ts']) {
+ const contents = await readFile(
+ join(root, 'apps/desktop/src/renderer/computer-use-overlay/engine', name),
+ 'utf8',
+ );
+ assert.match(contents, /Copyright \(c\) 2025 Cua AI, Inc\./);
+ assert.match(contents, /MIT License/);
+ assert.doesNotMatch(contents, /Licensed to the Apache Software Foundation \(ASF\)/);
+ }
+});
+
test('PawWork browser provenance is pinned to the confirmed transfer boundary', async () => {
const audit = await readFile(join(root, 'docs/code-origin-audit.md'), 'utf8');
const section = audit
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org