perf: incremental memory optimization across Maka

.gitattributes

@@ -5,6 +5,9 @@
 # repository needs CRLF, so the working tree stays LF everywhere.
 * text=auto eol=lf
 
+# Unified diffs prefix upstream tab-indented context with a required space.
+/patches/*.patch whitespace=-space-before-tab
+
 # Repository-local agent configuration, visual review evidence, and incubation
 # working notes are not source-release inputs.
 /.claude export-ignore

.github/workflows/release-windows-check.yml

@@ -81,6 +81,7 @@ on:
       - 'packages/runtime/src/file-stable-write.ts'
       - 'packages/runtime/src/image-file.ts'
       - 'packages/runtime/src/process-tree-terminator.ts'
+      - 'packages/runtime/src/text-line-window.ts'
       - 'packages/runtime/src/unified-diff.ts'
       - 'packages/core/src/absolute-path.ts'
       - 'packages/core/src/artifacts.ts'

LICENSE

@@ -261,6 +261,112 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+Pi TUI dependency patch
+
+Source: https://www.npmjs.com/package/@earendil-works/pi-tui/v/0.84.4
+Repository: https://github.com/earendil-works/pi/tree/v0.84.4/packages/tui
+Version: 0.84.4
+Dependency patch: patches/@earendil-works+pi-tui+0.84.4.patch
+Copyright (c) 2025 Mario Zechner
+License: MIT
+
+Maka redistributes a source patch that copies mutable editor undo state while
+sharing immutable pasted strings. The following MIT License applies to that
+material:
+
+MIT License
+
+Copyright (c) 2025 Mario Zechner
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Zod dependency patch
+
+Source: https://www.npmjs.com/package/zod/v/4.5.4
+Repository: https://github.com/colinhacks/zod
+Version: 4.5.4
+Dependency patch: patches/zod+4.5.4.patch
+Copyright (c) 2025 Colin McDonnell
+License: MIT
+
+Maka redistributes a source patch that releases recursive parse state after
+completion or failure. The following MIT License applies to that material:
+
+MIT License
+
+Copyright (c) 2025 Colin McDonnell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+Model Context Protocol client dependency patch
+
+Source: https://www.npmjs.com/package/@modelcontextprotocol/client/v/2.0.0
+Repository: https://github.com/modelcontextprotocol/typescript-sdk
+Version: 2.0.0
+Dependency patch: patches/@modelcontextprotocol+client+2.0.0.patch
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+Declared package license: MIT
+
+Maka redistributes a source patch that releases settled request observers under
+transport backpressure. The upstream package's LICENSE describes a transition
+from MIT to Apache-2.0: contributions with relicensing consent use Apache-2.0,
+while contributions without that consent retain their original MIT license.
+The Apache License, Version 2.0 is reproduced above. The upstream MIT notice is:
+
+MIT License
+
+Copyright (c) 2024-2025 Model Context Protocol a Series of LF Projects, LLC.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
 Sigstore dependency patch
 
 Source: https://www.npmjs.com/package/@sigstore/core/v/4.0.1

apps/desktop/renderer-architecture.json

@@ -592,8 +592,7 @@
         "importDeclarations": 2,
         "bridgePaths": {},
         "environmentCapabilities": {
-          "requestAnimationFrame": 1,
-          "window.setTimeout": 2
+          "window.setTimeout": 1
         },
         "hookCalls": {},
         "lifecycleMethods": {},
@@ -603,12 +602,13 @@
           "createAppShellSessionEventHandlers"
         ],
         "dependencyPaths": {
+          "./features/conversation/index.js": 1,
           "./locales/conversation-copy.js": 1,
           "./model-connection-errors.js": 1,
           "@maka/ui": 1
         },
         "importSpecifiers": 8,
-        "nonTriviaTokens": 2808
+        "nonTriviaTokens": 2755
       },
       "src/renderer/app-shell-session-start-actions.ts": {
         "importDeclarations": 2,
@@ -872,7 +872,7 @@
           "react": 1
         },
         "importSpecifiers": 108,
-        "nonTriviaTokens": 13696
+        "nonTriviaTokens": 13695
       },
       "src/renderer/use-app-shell-composer-quotes.ts": {
         "importDeclarations": 2,

apps/desktop/src/main/__tests__/session-local.test.ts

@@ -122,7 +122,10 @@ test('local acceptance survives restart with attachment bytes and an immutable d
   const db = await database(t);
   const record = db.store.enqueue('authority-1', intent());
   assert.equal(record.state, 'saved');
-  assert.equal((await stat(db.path)).mode & 0o777, 0o600);
+  // POSIX permission bits do not describe Windows ACLs.
+  if (process.platform !== 'win32') {
+    assert.equal((await stat(db.path)).mode & 0o777, 0o600);
+  }
   db.store.update({
     ...record,
     state: 'sending',

apps/desktop/src/main/__tests__/workhub-presentation.test.ts

@@ -276,6 +276,7 @@ test('animates from the current height, keeps the bottom anchored and survives r
   const h = await harness(true);
   await h.command(h.main.webContents, 'host', { visible: true, rect: { x: 0, y: 40, width: 1000, height: 760 } });
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   await h.command(view.webContents, 'conversation-layout', { expanded: false, compactHeight: 110 });
   await h.command(view.webContents, 'detach');
   const floating = h.windows[1]!;
@@ -318,6 +319,7 @@ test('reparents one live conversation across docking, floating, hide and main-wi
   h.main.show();
   await h.command(h.main.webContents, 'host', { visible: true, rect: { x: 100, y: 40, width: 900, height: 760 } });
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   await h.command(view.webContents, 'conversation-layout', { expanded: true, compactHeight: 96 });
   assert.ok(h.main.children.has(view));
   await h.command(view.webContents, 'detach');
@@ -515,6 +517,7 @@ test('all WorkHub entries obey the client enable setting and disabling retains t
   await h.controller.show();
   const view = h.views[0]!;
   const floating = h.windows[1]!;
+  await h.command(view.webContents, 'ready');
   assert.equal(floating.visible, true);
   const opened = deferred<void>();
   const opening = h.deferOpening(opened.promise);
@@ -550,13 +553,21 @@ test('all WorkHub entries obey the client enable setting and disabling retains t
 });
 
 
-test('prewarms once and the shortcut shows and hides synchronously', async () => {
+test('creates on first shortcut, then shows and hides synchronously', async () => {
   const h = await harness();
   await h.controller.refreshSettings();
+  assert.equal(h.views.length, 0, 'enabling alone must not create the renderer');
+  h.shortcut();
+  assert.equal(h.windows[1]!.visible, false, 'a cold summon waits for the composer to mount');
+  assert.equal(h.windows[1]!.focused, 0, 'loading must not steal keyboard input');
+  await h.command(h.views[0]!.webContents, 'ready');
+  assert.equal(h.windows[1]!.visible, true);
+  assert.equal(h.views[0]!.webContents.sent.some(([channel]) => channel === 'workhub-presentation:focus-composer'), true);
+  h.shortcut();
   const floating = h.windows[1]!;
   const view = h.views[0]!;
   assert.equal(floating.visible, false);
-  assert.equal(view.visible, false);
+  assert.equal(view.visible, true);
   assert.ok(floating.children.has(view));
   await h.controller.refreshSettings();
   assert.equal(h.windows.length, 2);
@@ -570,6 +581,26 @@ test('prewarms once and the shortcut shows and hides synchronously', async () =>
   h.controller.dispose();
 });
 
+test('a second shortcut or disabling cancels a cold summon before ready', async () => {
+  for (const cancel of ['shortcut', 'disable'] as const) {
+    const h = await harness();
+    await h.controller.refreshSettings();
+    h.shortcut();
+    const view = h.views[0]!;
+    const floating = h.windows[1]!;
+    if (cancel === 'shortcut') h.shortcut();
+    else {
+      h.setEnabled(false);
+      await h.controller.refreshSettings();
+    }
+    await h.command(view.webContents, 'ready');
+    assert.equal(floating.visible, false, cancel);
+    assert.equal(floating.focused, 0, cancel);
+    assert.equal(view.webContents.sent.some(([channel]) => channel === 'workhub-presentation:focus-composer'), false, cancel);
+    h.controller.dispose();
+  }
+});
+
 test('a pending backdrop capture and older hide cannot delay or undo the shortcut', async () => {
   const h = await harness();
   await h.controller.refreshSettings();
@@ -600,6 +631,7 @@ test('the shortcut supersedes a pending dock without waiting for the main window
   await h.controller.refreshSettings();
   h.shortcut();
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   const floating = h.windows[1]!;
   await h.command(view.webContents, 'conversation-layout', { expanded: true, compactHeight: 96 });
   h.advance(80);
@@ -627,6 +659,7 @@ test('native resize callbacks do not submit duplicate view bounds and follow dis
   const h = await harness(true, 120);
   await h.controller.show();
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   view.webContents.getZoomFactor = () => 2;
   await h.command(view.webContents, 'conversation-layout', { expanded: true, compactHeight: 96 });
   const before = view.boundsUpdates.length;
@@ -654,6 +687,7 @@ test('hiding returns the live view to Desktop and preserves floating geometry fo
   h.shortcut();
   const floating = h.windows[1]!;
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   await h.command(view.webContents, 'conversation-layout', { expanded: false, compactHeight: 144 });
   h.shortcut();
   assert.equal(floating.visible, false);
@@ -676,6 +710,7 @@ test('hiding with Desktop closed keeps the conversation alive without reopening
   const h = await harness();
   await h.controller.show();
   const view = h.views[0]!;
+  await h.command(view.webContents, 'ready');
   h.main.destroy();
   await h.controller.toggle();
   assert.equal(h.controller.getSnapshot().placement, 'docked');
@@ -768,6 +803,7 @@ test('closing progress suppresses the current turn and old paint acknowledgement
 test('the shortcut opens the normal composer from progress without waiting for its paint', async () => {
   const h = await harness();
   await h.controller.prepareControl('turn');
+  await h.command(h.views[0]!.webContents, 'ready');
   const request = h.controller.getSnapshot().progressRequest!;
   await h.controller.toggle(true);
   const floating = h.windows[1]!;

apps/desktop/src/main/app-update-attestation.ts

@@ -17,13 +17,14 @@
  * under the License.
  */
 
-import { bundleFromJSON, type Bundle } from '@sigstore/bundle';
-import { getTrustedRoot } from '@sigstore/tuf';
-import { toSignedEntity, toTrustMaterial, Verifier } from '@sigstore/verify';
+import type { Bundle } from '@sigstore/bundle';
 import { createHash } from 'node:crypto';
 import { createReadStream, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import { basename, join } from 'node:path';
 
+const require = createRequire(import.meta.url);
+
 const PRODUCT_REPOSITORY = 'apache/maka';
 const PRODUCT_RELEASE_WORKFLOW = '.github/workflows/release-cli-finalize.yml';
 const PRODUCT_NIGHTLY_WORKFLOW = '.github/workflows/desktop-nightly.yml';
@@ -228,6 +229,7 @@ function parseBundle(bytes: Uint8Array): Bundle {
     throw new Error('Update attestation is not valid JSON', { cause: error });
   }
   try {
+    const { bundleFromJSON } = require('@sigstore/bundle') as typeof import('@sigstore/bundle');
     return bundleFromJSON(serialized as Parameters<typeof bundleFromJSON>[0]);
   } catch (error) {
     throw new Error('Update attestation is not a valid Sigstore bundle', { cause: error });
@@ -290,6 +292,9 @@ export async function verifyDownloadedUpdateAttestation(
   if (options.verifyBundle) {
     await options.verifyBundle(bundle);
   } else {
+    const { getTrustedRoot } = require('@sigstore/tuf') as typeof import('@sigstore/tuf');
+    const { toSignedEntity, toTrustMaterial, Verifier } =
+      require('@sigstore/verify') as typeof import('@sigstore/verify');
     const trustedRoot = await getTrustedRoot({
       cachePath: options.trustRootCacheDirectory,
       timeout: 10_000,

apps/desktop/src/main/browser/session.ts

@@ -136,11 +136,12 @@ const bySession = new Map<string, Connection>();
 // so two concurrent first calls for one conversation must share one attempt
 // instead of racing into a second connection (which the bridge would reject).
 const pendingAcquires = new Map<string, Promise<Connection>>();
-// Release epoch per conversation. A delete/archive cannot reliably see an
+// Release epoch per in-flight acquire. A delete/archive cannot reliably see an
 // in-flight acquire, so instead of the release waiting on the acquire, the
 // acquire notices the bump after connecting and unwinds itself — otherwise its
 // resolveEndpoint would resurrect the just-disposed view and the connection
-// would outlive the conversation with nothing left to ever clean it up.
+// would outlive the conversation with nothing left to ever clean it up. The
+// entry only lives until the acquire settles, not for every released session.
 const releaseEpochs = new Map<string, number>();
 // In-flight actions per conversation, so the visible lease can REVOKE — not just
 // preflight. canDrive gates the START on screen; this severs an action that was
@@ -244,8 +245,11 @@ async function acquire(sessionId: string): Promise<Connection> {
   // call retries fresh; concurrent callers share the same outcome either way.
   const inflight = pendingAcquires.get(sessionId);
   if (inflight) return inflight;
+  const epoch = 0;
+  // Register before resolveEndpoint, which may synchronously release the session
+  // before this attempt can be registered in pendingAcquires.
+  releaseEpochs.set(sessionId, epoch);
   const promise = (async () => {
-    const epoch = releaseEpochs.get(sessionId);
     const endpoint = await browserViewHost().resolveEndpoint(sessionId);
     let conn: Connection;
     try {
@@ -272,7 +276,10 @@ async function acquire(sessionId: string): Promise<Connection> {
     }
     bySession.set(sessionId, conn);
     return conn;
-  })().finally(() => pendingAcquires.delete(sessionId));
+  })().finally(() => {
+    pendingAcquires.delete(sessionId);
+    releaseEpochs.delete(sessionId);
+  });
   pendingAcquires.set(sessionId, promise);
   return promise;
 }
@@ -412,7 +419,8 @@ export async function releaseBrowserSession(sessionId: string): Promise<void> {
   // when it sees the new epoch (see acquire) — it cannot be awaited here because
   // it may not have registered in pendingAcquires yet, and a hung endpoint
   // resolution must not block the session's deletion.
-  releaseEpochs.set(sessionId, (releaseEpochs.get(sessionId) ?? 0) + 1);
+  const epoch = releaseEpochs.get(sessionId);
+  if (epoch !== undefined) releaseEpochs.set(sessionId, epoch + 1);
   const conn = bySession.get(sessionId);
   if (conn) {
     bySession.delete(sessionId);