fix(cli): isolate source development profile

Author: MoonOld

CONTRIBUTING.md

@@ -94,8 +94,8 @@ Architecture is documented in [ARCHITECTURE.md](./ARCHITECTURE.md).
 npm run dev          # desktop app with HMR
 npm run dev:full     # full build, then launch the desktop app
 
-npm --workspace maka-agent exec -- maka          # TUI
-npm --workspace maka-agent exec -- maka run "…"  # one non-interactive turn
+npm run cli:dev                                  # TUI with the Maka Dev profile
+npm run cli:dev -- run "…"                       # one non-interactive turn
 ```
 
 Evaluation commands and contracts live in [`packages/eval`](./packages/eval).

README.md

@@ -124,18 +124,20 @@ npm run build
 Then start the TUI or run one Turn:
 
 ```sh
-npm --workspace maka-agent exec -- maka
-npm --workspace maka-agent exec -- maka run "Summarize this repository and identify its most important risk"
-npm --workspace maka-agent exec -- maka run --graph "Implement two independent slices, integrate them, then review the result"
-npm --workspace maka-agent exec -- maka --help
+npm run cli:dev
+npm run cli:dev -- run "Summarize this repository and identify its most important risk"
+npm run cli:dev -- run --graph "Implement two independent slices, integrate them, then review the result"
+npm run cli:dev -- --help
 ```
 
 The TUI also accepts `/graph on`, `/graph off`, and `/graph <task>`. Non-interactive
 `--graph` runs wait for the durable Graph to finish before printing the final
 supervisor output. Graph implementation operators use isolated Git worktrees, so
 the source project must be a clean Git worktree.
 
-The CLI reads the same model connections and workspace configuration written by Desktop. Evaluation specs and adapters live in [`packages/eval`](./packages/eval).
+The repository CLI uses the same `Maka Dev` profile as a development Desktop build. The
+released `maka` binary continues to use the `Maka` profile; the two profiles are not copied or
+synchronized automatically. Evaluation specs and adapters live in [`packages/eval`](./packages/eval).
 
 ## Architecture
 

package.json

@@ -32,6 +32,7 @@
     "test:dist:serial": "node scripts/run-workspace-tests-parallel.mjs --serial",
     "dev": "npm --workspace @maka/desktop run dev:hmr --",
     "dev:full": "npm run build && npm --workspace @maka/desktop run start",
+    "cli:dev": "node packages/cli/dist/dev-cli.js",
     "build": "npm --workspace @maka/code-mode run build && npm --workspace @maka/core run build && npm --workspace @maka/storage run build && npm --workspace @maka/mcp run build && npm --workspace @maka/runtime run build && npm --workspace @maka/runtime-host run build && npm --workspace @maka/computer-use run build && npm --workspace @maka/eval run build && npm --workspace maka-agent run build && npm --workspace @maka/ui run build && npm --workspace @maka/desktop run build",
     "build:test": "npm run clean && npm --workspace @maka/code-mode run build && npm --workspace @maka/core run build && npm --workspace @maka/storage run build && npm --workspace @maka/mcp run build && npm --workspace @maka/runtime run build && npm --workspace @maka/runtime-host run build && npm --workspace @maka/computer-use run build && npm --workspace @maka/eval run build && npm --workspace maka-agent run build && npm --workspace @maka/ui run build && npm --workspace @maka/desktop run build:test",
     "clean": "node scripts/clean-build.mjs",

packages/cli/src/__tests__/cli-invocation.test.ts

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import { describe, test } from 'node:test';
+import { formatMakaResumeCommand, formatMakaResumeHint } from '../cli-invocation.js';
+
+describe('Maka CLI invocation copy', () => {
+  test('keeps release resume instructions on the release launcher', () => {
+    assert.equal(
+      formatMakaResumeHint('maka', 'session-1'),
+      'Resume this session with:\n  maka --resume session-1',
+    );
+  });
+
+  test('keeps development remote and cwd retries on the development launcher', () => {
+    assert.equal(
+      formatMakaResumeHint('npm run cli:dev --', 'session-2', { hostProfileId: 'office' }),
+      'Resume this session with:\n  npm run cli:dev -- --resume session-2 --host office',
+    );
+    assert.equal(
+      formatMakaResumeCommand('npm run cli:dev --', 'session-2', { cwd: '<new-path>' }),
+      'npm run cli:dev -- --resume session-2 --cwd <new-path>',
+    );
+  });
+});

packages/cli/src/__tests__/cli.test.ts

@@ -1,8 +1,13 @@
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
 import { once } from 'node:events';
+import { access, mkdtemp, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { describe, test } from 'node:test';
-import { parseMakaCliArgs } from '../cli.js';
+import { fileURLToPath } from 'node:url';
+import { parseMakaCliArgs, runMakaCli } from '../cli.js';
 
 describe('Maka CLI args', () => {
   test('selects a Runtime Host and Project for TUI startup', () => {
@@ -13,6 +18,34 @@ describe('Maka CLI args', () => {
     });
   });
 
+  test('uses the active launcher in development help and rejects an empty profile name', async () => {
+    const help = parseMakaCliArgs(['--help'], '0.1.0', 'npm run cli:dev --');
+    assert.equal(help.kind, 'help');
+    if (help.kind === 'help') {
+      assert.match(help.text, /^Usage: npm run cli:dev --$/m);
+      assert.match(
+        help.text,
+        /^  npm run cli:dev -- runtime-host access issue --principal <id> --preset /m,
+      );
+      assert.match(help.text, /^  npm run cli:dev -- runtime-host project list /m);
+      assert.match(
+        help.text,
+        /^  npm run cli:dev -- runtime-host profile set .*--ssh-destination /m,
+      );
+      assert.match(help.text, /^  npm run cli:dev -- runtime-host profile set .*--plaintext-url /m);
+      assert.doesNotMatch(help.text, /^  maka runtime-host /m);
+      assert.doesNotMatch(help.text, /maka-agent/);
+    }
+    await assert.rejects(
+      runMakaCli(['--version'], {
+        dataProfileName: '',
+        cliCommand: 'invalid',
+        capabilityProviderIdentityScope: 'client-data-root',
+      }),
+      /profile name must be a non-empty path segment/,
+    );
+  });
+
   test('establishes the fatal exit before reporting can throw', async () => {
     const cliUrl = new URL('../cli.js', import.meta.url).href;
     const childSource = `
@@ -29,4 +62,199 @@ describe('Maka CLI args', () => {
     assert.equal(signal, null);
     assert.equal(code, 1);
   });
+
+  test('compiled release and repository entries isolate profile writes', async (t) => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-cli-launch-profile-'));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const home = join(root, 'home');
+    const applicationData = join(root, 'application-data');
+    const releaseRoot = platformProfileRoot(home, applicationData, 'Maka');
+    const developmentRoot = platformProfileRoot(home, applicationData, 'Maka Dev');
+    const env = {
+      ...process.env,
+      HOME: home,
+      USERPROFILE: home,
+      APPDATA: applicationData,
+      XDG_CONFIG_HOME: applicationData,
+      MAKA_TEST_RUNTIME_HOST_CREDENTIAL: 'opaque-token',
+    };
+    const profileArgs = [
+      'runtime-host',
+      'profile',
+      'set',
+      '--id',
+      'office',
+      '--name',
+      'Office',
+      '--tls-url',
+      'wss://runtime.example.com/runtime-host',
+      '--expected-root',
+      'a'.repeat(64),
+      '--credential-env',
+      'MAKA_TEST_RUNTIME_HOST_CREDENTIAL',
+    ];
+
+    await mkdir(releaseRoot, { recursive: true });
+    await writeFile(join(releaseRoot, 'sentinel.txt'), 'release-data\n', 'utf8');
+    const development = await runCompiledCli('dev-cli.js', profileArgs, env);
+    assert.equal(development.signal, null);
+    assert.equal(development.code, 0, development.stderr);
+    await assertProfileFiles(developmentRoot);
+    assert.deepEqual(await readdir(releaseRoot), ['sentinel.txt']);
+    assert.equal(await readFile(join(releaseRoot, 'sentinel.txt'), 'utf8'), 'release-data\n');
+    await assert.rejects(access(join(developmentRoot, 'sentinel.txt')), { code: 'ENOENT' });
+
+    const developmentProfile = await readFile(
+      join(developmentRoot, 'runtime-host-profiles.json'),
+      'utf8',
+    );
+    const release = await runCompiledCli('cli.js', profileArgs, env);
+    assert.equal(release.signal, null);
+    assert.equal(release.code, 0, release.stderr);
+    await assertProfileFiles(releaseRoot);
+    assert.equal(
+      await readFile(join(developmentRoot, 'runtime-host-profiles.json'), 'utf8'),
+      developmentProfile,
+    );
+    assert.equal(await readFile(join(releaseRoot, 'sentinel.txt'), 'utf8'), 'release-data\n');
+  });
+
+  test('compiled launchers isolate capability-provider identities', async (t) => {
+    const root = await mkdtemp(join(tmpdir(), 'maka-cli-provider-identity-'));
+    t.after(() => rm(root, { recursive: true, force: true }));
+    const home = join(root, 'home');
+    const applicationData = join(root, 'application-data');
+    const releaseRoot = platformProfileRoot(home, applicationData, 'Maka');
+    const developmentRoot = platformProfileRoot(home, applicationData, 'Maka Dev');
+    const configPath = join(root, 'mcp.json');
+    const url = 'https://invalid.example/runtime-host';
+    const identityFile = providerIdentityFileName(url, configPath);
+    const developmentIdentityPath = join(
+      developmentRoot,
+      'runtime-host-capability-providers',
+      identityFile,
+    );
+    const releaseIdentityPath = join(
+      home,
+      '.maka',
+      'runtime-host-capability-providers',
+      identityFile,
+    );
+    const releaseProfileIdentityPath = join(
+      releaseRoot,
+      'runtime-host-capability-providers',
+      identityFile,
+    );
+    const explicitUrl = 'https://explicit.invalid/runtime-host';
+    const explicitDefaultIdentityPath = join(
+      developmentRoot,
+      'runtime-host-capability-providers',
+      providerIdentityFileName(explicitUrl, configPath),
+    );
+    const explicitIdentityPath = join(root, 'explicit-provider-identity.json');
+    const env = {
+      ...process.env,
+      HOME: home,
+      USERPROFILE: home,
+      APPDATA: applicationData,
+      XDG_CONFIG_HOME: applicationData,
+      MAKA_TEST_RUNTIME_HOST_CREDENTIAL: 'opaque-token',
+    };
+    await writeFile(configPath, '{"mcpServers": {}}\n', 'utf8');
+    const providerArgs = [
+      'runtime-host',
+      'capability-provider',
+      'serve',
+      '--url',
+      url,
+      '--mcp-config',
+      configPath,
+      '--expected-root',
+      'b'.repeat(64),
+      '--credential-env',
+      'MAKA_TEST_RUNTIME_HOST_CREDENTIAL',
+    ];
+
+    const development = await runCompiledCli('dev-cli.js', providerArgs, env);
+    assert.equal(development.signal, null);
+    assert.equal(development.code, 1);
+    const developmentIdentity = await readClientInstanceId(developmentIdentityPath);
+    await assert.rejects(access(releaseIdentityPath), { code: 'ENOENT' });
+
+    const release = await runCompiledCli('cli.js', providerArgs, env);
+    assert.equal(release.signal, null);
+    assert.equal(release.code, 1);
+    const releaseIdentity = await readClientInstanceId(releaseIdentityPath);
+    assert.notEqual(releaseIdentity, developmentIdentity);
+    await assert.rejects(access(releaseProfileIdentityPath), { code: 'ENOENT' });
+
+    const developmentIdentityBeforeOverride = await readFile(developmentIdentityPath, 'utf8');
+    const explicitProviderArgs = providerArgs.map((arg) => (arg === url ? explicitUrl : arg));
+    const explicit = await runCompiledCli(
+      'dev-cli.js',
+      [...explicitProviderArgs, '--client-identity', explicitIdentityPath],
+      env,
+    );
+    assert.equal(explicit.signal, null);
+    assert.equal(explicit.code, 1);
+    const explicitIdentity = await readClientInstanceId(explicitIdentityPath);
+    assert.notEqual(explicitIdentity, developmentIdentity);
+    assert.notEqual(explicitIdentity, releaseIdentity);
+    await assert.rejects(access(explicitDefaultIdentityPath), { code: 'ENOENT' });
+    assert.equal(
+      await readFile(developmentIdentityPath, 'utf8'),
+      developmentIdentityBeforeOverride,
+    );
+  });
 });
+
+async function runCompiledCli(
+  entrypoint: string,
+  args: readonly string[],
+  env: NodeJS.ProcessEnv,
+): Promise<{ code: number | null; signal: NodeJS.Signals | null; stderr: string }> {
+  const child = spawn(
+    process.execPath,
+    [fileURLToPath(new URL(`../${entrypoint}`, import.meta.url)), ...args],
+    { env, stdio: ['ignore', 'ignore', 'pipe'], timeout: 15_000, killSignal: 'SIGKILL' },
+  );
+  let stderr = '';
+  child.stderr.setEncoding('utf8');
+  child.stderr.on('data', (chunk: string) => {
+    stderr += chunk;
+  });
+  const [code, signal] = (await once(child, 'close')) as [number | null, NodeJS.Signals | null];
+  return { code, signal, stderr };
+}
+
+function platformProfileRoot(home: string, applicationData: string, profileName: string): string {
+  if (process.platform === 'darwin') {
+    return join(home, 'Library', 'Application Support', profileName);
+  }
+  return join(applicationData, profileName);
+}
+
+async function assertProfileFiles(root: string): Promise<void> {
+  await access(join(root, 'runtime-host-profiles.json'));
+  await access(join(root, 'runtime-host-client', 'credentials.json'));
+}
+
+function providerIdentityFileName(url: string, configPath: string): string {
+  const identity = createHash('sha256')
+    .update(`runtime-host-capability-provider\0${url}\0${configPath}`)
+    .digest('hex')
+    .slice(0, 24);
+  return `${identity}.json`;
+}
+
+async function readClientInstanceId(path: string): Promise<string> {
+  const document = JSON.parse(await readFile(path, 'utf8')) as {
+    schemaVersion?: unknown;
+    clientInstanceId?: unknown;
+  };
+  assert.equal(document.schemaVersion, 1);
+  if (typeof document.clientInstanceId !== 'string') {
+    assert.fail('Expected a persisted Client instance id');
+  }
+  return document.clientInstanceId;
+}

packages/cli/src/__tests__/runtime-host-cli-context.test.ts

@@ -1,9 +1,12 @@
 import assert from 'node:assert/strict';
-import { basename } from 'node:path';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, join } from 'node:path';
 import { test } from 'node:test';
 import { fileURLToPath } from 'node:url';
 import {
   connectRemoteRuntimeHostProfile,
+  createClientRuntimeHostProfileCatalog,
   RuntimeHostStartupError,
   type RuntimeHostConnection,
 } from '@maka/runtime-host/client';
@@ -192,6 +195,64 @@ test('remote CLI profiles pin root identity and resolve credential outside the p
   await context.close();
 });
 
+test('remote CLI profile state and Client identity use the explicit Client Data Root', async (t) => {
+  const clientDataRoot = await mkdtemp(join(tmpdir(), 'maka-cli-client-root-'));
+  t.after(() => rm(clientDataRoot, { recursive: true, force: true }));
+  const rootId = 'b'.repeat(64);
+  await createClientRuntimeHostProfileCatalog(clientDataRoot).save(
+    {
+      id: 'office',
+      name: 'Office',
+      kind: 'remote',
+      transport: { kind: 'tls', url: 'wss://runtime.example.com/runtime-host' },
+      rootId,
+    },
+    'opaque-token',
+  );
+  let identityPath: string | undefined;
+  let credential: string | undefined;
+  const connection = {
+    rootId,
+    hostEpoch: 'host-remote',
+    connectionId: 'connection-remote',
+    selectedProtocol: 0,
+    closed: new Promise<void>(() => {}),
+    status: async () => ({ state: 'ready' }),
+    subscribeConfigurationChanges: () => () => {},
+    subscribeProjectCatalogChanges: () => () => {},
+    subscribeSessionCatalogChanges: () => () => {},
+    subscribeScheduledTaskChanges: () => () => {},
+    close: async () => {},
+  } as unknown as RuntimeHostConnection;
+
+  const context = await connectRuntimeHostCli(
+    {
+      rootPath: '/unused-local-root',
+      clientDataRoot,
+      surface: 'run',
+      profileId: 'office',
+    },
+    {
+      connectOrSpawn: async () => {
+        throw new Error('remote profile must not use local discovery');
+      },
+      connectRemoteProfile: async (input) => {
+        credential = input.credential;
+        return connection;
+      },
+      loadClientInstanceId: async (path) => {
+        identityPath = path;
+        return '22222222-2222-4222-8222-222222222222';
+      },
+      readConnectionCatalog: async () => ({ revision: 1, defaultTarget: null, connections: [] }),
+    },
+  );
+
+  assert.equal(credential, 'opaque-token');
+  assert.equal(identityPath, join(clientDataRoot, 'runtime-host-client.json'));
+  await context.close();
+});
+
 function hostRegistration(overrides: Partial<{ compatibilityEpoch: number }> = {}) {
   return {
     kind: 'maka-runtime-host' as const,