feat(cli): expose one-shot Cloud Session activation protocol

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.

[Nyvo-io]

Closes#1554

Summary

• add strict maka activate JSONL entry point with versioned request/output contracts
• require explicit non-overlapping state, workspace, and config roots
• support new/resumed sessions, safe-boundary continuation, bounded redacted runtime events, deterministic outcomes, timeout, and clean shutdown
• keep existing maka run text output unchanged

Scope

Session Bundle, CAS/SessionRepository, sandbox lifecycle, activation leases/deduplication, cross-activation approval workflow, and Cloud Session fork remain out of scope.

Verification

• npm --workspace maka-agent run build
• node --test packages/cli/dist/__tests__/activation-command.test.js
• npm --workspace maka-agent run test:dist (661 passed)
• npm --workspace maka-agent run typecheck (CLI/dependencies pass; existing desktop preload @maka/ui dist artifact is unavailable in this worktree)

[Astro-Han]

Checked at f42a5a2.

P1: root overlap is checked in one direction only

pathsOverlap(left, right) checks whether right is inside left, but not the reverse. With the fixed state, workspace, config ordering, this permits layouts such as:

• state inside the agent workspace;
• workspace inside the credential/config root.

The root check needs symmetric containment for each pair, preferably through the existing root-layout implementation.

Code: packages/cli/src/activation-command.ts:655

P1: resumed activation writes non-JSON data to the JSONL stream

Existing-session activation calls the continuation planner. Its lifecycle callback uses:

console.info("[runtime-resume]", ...)

console.info writes to stdout, which is also the activation protocol stream. A line-oriented client receives JSON, then a [runtime-resume] line, then JSON. Parsing fails on every real resumed activation.

Code: packages/cli/src/runtime-bootstrap.ts:768

P2:

• Malformed input exits without the protocol's terminal fatal_failure outcome.
• Existing auth, tool_failed, and similar states are emitted with requiredAction: "grant_permission", which is the wrong recovery action and falls outside the public blocked-reason model.

[Nyvo-io]

Addressed all review points in commit 66b371e:\n\n- root containment validation is symmetric for every state/workspace/config pair;\n- activation resume diagnostics use stderr, keeping stdout valid JSONL;\n- malformed input now emits a terminal fatal_failure outcome;\n- non-permission blocked sessions (auth/tool_failed/etc.) now return retryable_failure with retry_activation instead of grant_permission.\n\nAdded regression coverage for each case. Verification: CLI typecheck passes, format check passes, and the focused activation/runtime-bootstrap suite passes all 33 tests.

[Astro-Han]

Re-reviewed 66b371e. The previous findings are fixed: root overlap is checked both ways, activation resume diagnostics stay on stderr, malformed JSON emits a terminal fatal_failure, and non-permission blocked sessions return retryable_failure with retry_activation. The focused CLI tests pass, 33/33. No remaining findings.

The branch still conflicts with current main in runtime-bootstrap.test.ts, so it needs a rebase before merge.

[Nyvo-io]

Rebased onto the latest main at 0f9a38a; the branch is now mergeable. During the final review I also made root-layout rejection side-effect-free, so unsafe state/workspace/config layouts are rejected before any missing directory is created, with a regression test covering that contract. Verification on the rebased branch: CLI typecheck and build pass, formatting and git diff checks pass, focused activation/runtime-bootstrap tests pass 35/35, full CLI tests pass 689/689, and CI typecheck/test/e2e all pass.

[Astro-Han]

Rechecked 0f9a38ad. The previous four findings remain fixed, and the root-layout validation now rejects unsafe layouts before creating directories.

One P1 remains. The activation command handles sandbox_boundary_request, but the actual activation surface cannot create that event. buildCliRuntime exposes the boundary tool and its create/settle callbacks only to the TUI.

Under activation's default explore managed boundary, a real Write produces a sandbox_boundary_required tool result instead. Activation does not inspect that failure, so the run can finish as completed if the model responds after the failed write, or fall back to a generic retryable_failure. It cannot produce the deterministic in-flight blocked outcome promised by the protocol.

The current blocked test injects sandbox_boundary_request through a fake runtime, so it does not cover the production wiring. Cross-activation approval can stay out of scope, but the unhandled sandbox failure still needs to map to blocked, or the request path needs to be wired and immediately denied.

[Nyvo-io]

Addressed the remaining P1 in cef97fd3. Activation now maps unresolved production sandbox_boundary_required and requires_bypass tool failures to the deterministic blocked / permission_required / grant_permission outcome (exit 3), while preserving recovery when a later tool operation succeeds. The boundary-failure classification is shared with maka run, and the regression test exercises the production tool_result / function_response shape rather than an injected boundary request.

Verification on the latest main: focused related suites 70/70, full CLI 702/702, script tests 227/227, root typecheck, lint, format check, third-party notices, and git diff --check all pass. An independent final review reported no findings, and GitHub CI typecheck, test, and e2e are all green.

[Astro-Han]

Re-reviewed the current head. The fixes from the earlier rounds remain intact, and I found no P0 or P1 issue.

Approving with four non-blocking protocol follow-ups. They affect recovery or bounded-output edge cases, and there is no current production Cloud coordinator relying on these paths yet.

[Nyvo-io]

Thanks for the approval. I rechecked the four inline follow-ups on cef97fd3. They are explicitly non-blocking and concern future coordinator/recovery and protocol-boundary hardening; no production Cloud coordinator consumes this surface yet. The required activation behavior and prior P1s are complete, and typecheck, test, and e2e remain green.

I am leaving the implementation unchanged rather than adding an unrelated mechanical patch; these items should be tracked with the future coordinator work. This head is ready to merge once the non-blocking review threads are resolved.

[Astro-Han]

The four review items are non-blocking for this foundation, so I’m resolving the threads and proceeding with the merge.

Please capture them in a follow-up issue before the production coordinator work begins:

• make retry_activation executable for the same blocked session;
• avoid treating an unrelated successful tool call as sandbox-boundary recovery;
• represent event truncation with a valid protocol frame and include it in the budgets;
• truncate large responses on a UTF-8 byte boundary without corrupting their representation.

Linking that issue back to #1587 will keep the protocol debt visible when the first production consumer is implemented.