[PR] feat(cli): resolve persistent Runtime Host installation facts [maka]

["me2seeks (via GitHub)" <gi...@apache.org>]

me2seeks opened a new pull request, #3816:
URL: https://github.com/apache/maka/pull/3816

   ## Summary
   
   - resolve one stable CLI installation owner from the canonical active npm global package slot
   - report the currently observed release version, package root, and CLI entry point without presenting them as verified artifact identity
   - reject development checkouts, direct `npx` cache packages, and packages outside the active npm global prefix
   - consolidate the existing managed-service `npx` provenance check into the same helper
   - read package metadata through a no-follow, bounded, fatal-UTF-8 handle
   
   ## Why
   
   The next #3243 adapter needs to distinguish a persistent installed CLI owner from a transient invocation before it can consume the local deployment handoff transaction.
   
   A real isolated `npm install --global` check showed that npm does not persist a package lock or `dist.integrity` beside the installed global package. Registry metadata can identify the artifact published for a version, but it cannot prove that mutable local files are still that artifact. This PR therefore keeps two facts separate:
   
   - **installation owner**: the stable account-local npm global package slot;
   - **observed release**: mutable local version/path evidence from the package currently occupying that slot.
   
   Exact deployment identity remains the responsibility of later registry resolution, archive verification, and immutable staging. This resolver performs no network request, owner mutation, Host retirement, or user-policy decision.
   
   This PR is merge-order independent from #3813. A later composition slice will consume both the stable installation facts here and the unified handoff transaction there.
   
   ## Simplification and first-principles audit
   
   **GO.** The final diff adds no durable state, lock, journal, deployment identity, or startup policy. It removes the duplicate `npx` cache-path implementation from the managed service manager. The owner ID depends only on the canonical npm global slot, so package upgrades in one prefix retain ownership while distinct Node/npm prefixes remain distinct owners.
   
   ## Verification
   
   - rebased onto exact `origin/main` `19b47632be61b9116ae25d67e286f6a7878d6645`
   - `npm --workspace maka-agent run build`
   - `npm --workspace maka-agent run typecheck`
   - installation facts + complete service-manager tests: 26/26 passed
   - scoped Biome check
   - `git diff --check`
   
   The broader Runtime workspace build still reports the unchanged local dependency-closure failures for missing `@slack/*`/`minisearch` and the existing `https-proxy-agent` type mismatch; the affected CLI and Runtime Host dependency builds used by this diff pass.
   
   Refs #3243
   Refs #3231
   Refs #3709
   
   <details>
   <summary>简体中文摘要</summary>
   
   本 PR 为 #3243 提供 installed CLI 的 source facts：从 active npm global package slot 推导稳定的 CLI installation owner，并读取当前 package 的 version、package root 与 CLI entry point。
   
   真实隔离的 `npm install --global` 取证表明，全局安装旁不会保存 package-lock 或 `dist.integrity`。因此 registry 对某个 version 的声明不能证明本机可变文件仍是那份 artifact。本 PR 明确区分：
   
   - installation owner：稳定的 account-local npm global slot；
   - observed release：当前 slot 中 package 的可变 version/path 观察。
   
   exact deployment identity 留给后续 registry 解析、archive integrity 校验与 immutable staging。本 resolver 不联网、不修改 owner record、不让 Host 退场，也不替用户选择 Restart / Wait / Cancel。
   
   同时抽取并复用 service manager 既有的 `npx` cache 判断，删除一份重复实现。最终 diff 不增加 durable state、lock、journal、deployment identity 或 startup policy。该 PR 与 #3813 merge 顺序独立；后续 composition slice 再同时消费两者。
   
   验证：基于精确 current main；CLI build/typecheck 通过；installation facts 与完整 service-manager 测试 26/26；scoped Biome 与 diff-check 通过。
   
   </details>
   
   Generated-by: Codex
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org

Re: [PR] feat(cli): resolve persistent Runtime Host installation facts [maka]

["Astro-Han (via GitHub)" <gi...@apache.org>]

Astro-Han merged PR #3816:
URL: https://github.com/apache/maka/pull/3816


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@maka.apache.org
For additional commands, e-mail: commits-help@maka.apache.org