Publish the Maka CLI/TUI to npm as maka-agent

[M4n5ter]

English

Goal

Publish the existing Maka CLI/TUI as a standalone public npm package so users can install and run it without cloning the monorepo:

npm install --global maka-agent
maka

The package must provide both maka and maka-agent binaries, preserve the existing maka eval product surface, and work without resolving private @maka/* workspaces from the npm registry.

Current state

• maka-agent has been registered on npm as 0.0.0-alpha.0.
• The alpha contains a minimal functional CLI and currently occupies the next and latest tags.
• The first complete prerelease will be 0.1.0-beta.1 on next; latest will move to the first stable 0.1.0 release.
• npm organization ownership transfer is deferred until the release path is established.
• feat(runtime-host): add interactive service manager #3014 is not a prerequisite for this release.

Packaging direction

Publish one public maka-agent package while preserving the internal package topology. Snapshot the complete production dependency closure with bundled dependencies so that:

• private @maka/* workspaces are included rather than fetched from npm;
• package-relative workers, execution candidates, and import.meta.resolve continue to work;
• the production tree already modified by repository patches is preserved;
• native/platform dependencies such as node-pty remain installable across supported platforms.

Do not publish every internal workspace as a public package and do not flatten the runtime into a single JavaScript bundle for the initial release.

maka eval remains part of the public package. Include the required Eval JavaScript, Python relay, Compose overlay, network policy, wrappers, and configuration resources. Docker, Harbor/Pier Python environments, trusted toolchains, and machine-local paths remain explicit external prerequisites and must be checked before execution.

Work

• Define a bin-only release entrypoint while preserving maka, maka-agent, maka run, TUI onboarding, activation, Runtime Host commands, and maka eval.
• Generate a publishable release manifest with explicit metadata, Node engine, files, publishConfig, and bundled dependencies.
• Build a proof tarball containing the complete production closure and no unresolved private registry dependencies.
• Add strict file allowlists for the CLI and bundled internal workspaces.
• Include README, LICENSE, NOTICE, and CLI-specific third-party notices.
• Verify that repository patches and native prebuilds are present in the final tarball.
• Add clean-prefix install tests for both binaries, TUI startup, first-run setup, maka run, Runtime Host workers/candidates, and PTY behavior.
• Add Eval install-state checks, actionable prerequisite diagnostics, and real minimal Harbor and Pier cells on Linux.
• Test the same tarball on Linux x64, macOS arm64, and Windows x64.
• Add a protected release-cli.yml workflow using one built tarball, human approval, and npm Trusted Publishing/OIDC.
• Publish 0.1.0-beta.1 to next, complete real-environment acceptance, then publish 0.1.0 to latest.
• Document installation, upgrade, uninstall, supported platforms, Eval prerequisites, and rollback.

Acceptance criteria

• A clean machine can install the package from npm and run the CLI/TUI without the monorepo.
• Installation does not fetch unpublished @maka/* packages or require users to apply repository patches.
• TUI onboarding, maka run, Runtime Host workers/candidates, and PTY paths work from the installed package.
• maka eval resolves all Maka-owned resources from the installed package; supported environments complete real Harbor and Pier cells, while unsupported or incomplete environments fail before execution with actionable diagnostics.
• The exact tarball published to npm passes the Linux, macOS, and Windows release matrix.
• The tarball excludes source, tests, fixtures, credentials, local paths, and other development-only files.
• Releases use protected GitHub environments, human approval, OIDC trusted publishing, and documented dist-tag rollback.

Out of scope

• Publishing all internal @maka/* workspaces as public packages.
• Establishing a public JavaScript library API for maka-agent.

中文

目标

将现有 Maka CLI/TUI 发布为可独立安装的公共 npm 包，使用户无需克隆 monorepo 即可安装和运行：

npm install --global maka-agent
maka

发布包同时提供 maka 和 maka-agent 两个命令，保留现有 maka eval 产品能力，并且安装时不能从 npm registry 解析未公开的 @maka/* workspace。

当前状态

• npm 包名 maka-agent 已以 0.0.0-alpha.0 注册。
• alpha 包含一个最小可用 CLI，当前占用 next 和 latest。
• 第一个完整预发布版本为 0.1.0-beta.1，使用 next；第一个稳定版为 0.1.0，届时将 latest 指向稳定版。
• npm organization 所有权转移推迟到发布链路建立之后。
• feat(runtime-host): add interactive service manager #3014 不是本次发布的前置条件。

打包方向

只发布一个公共 maka-agent 包，同时保留内部包拓扑。通过 bundled dependencies 快照完整生产依赖闭包，从而保证：

• 私有 @maka/* workspace 随包提供，而不是从 npm 获取；
• 包相对 worker、execution candidate 和 import.meta.resolve 行为保持有效；
• 仓库补丁修改后的生产依赖树原样进入发布物；
• node-pty 等原生或平台依赖能在支持平台安装。

首发不公开发布全部内部 workspace，也不把 Runtime 强行压成单个 JavaScript bundle。

maka eval 保留在公共包中。发布物包含必要的 Eval JavaScript、Python relay、Compose overlay、network policy、wrapper 和配置资源。Docker、Harbor/Pier Python 环境、受信 toolchain 及机器本地路径仍是显式外部前置条件，必须在执行前完成检查。

工作项

以下状态以英文区的复选框为准：

• 建立 bin-only 发布入口，保留 maka、maka-agent、maka run、TUI 首次设置、激活、Runtime Host 命令和 maka eval。
• 生成带完整 metadata、Node engine、files、publishConfig 和 bundled dependencies 的发布 manifest。
• 构建包含完整生产闭包、且不存在私有 registry 悬空依赖的 proof tarball。
• 为 CLI 和 bundled 内部 workspace 添加严格文件白名单。
• 包含 README、LICENSE、NOTICE 和 CLI 专属第三方依赖声明。
• 验证仓库补丁和原生 prebuild 已进入最终 tarball。
• 增加空 prefix 安装测试，覆盖两个命令、TUI 启动、首次设置、maka run、Runtime Host worker/candidate 和 PTY。
• 增加 Eval 安装态检查、可操作的前置条件诊断，以及 Linux 上真实的最小 Harbor 和 Pier cell。
• 在 Linux x64、macOS arm64 和 Windows x64 测试同一个 tarball。
• 新增受保护的 release-cli.yml，使用单一构建产物、人工审批和 npm Trusted Publishing/OIDC。
• 发布 0.1.0-beta.1 到 next，完成真实环境验收后发布 0.1.0 到 latest。
• 文档化安装、升级、卸载、支持平台、Eval 前置条件和回滚方式。

验收标准

• 全新机器可以从 npm 安装并运行 CLI/TUI，不依赖 monorepo。
• 安装过程不获取未发布的 @maka/* 包，也不要求用户应用仓库补丁。
• TUI 首次设置、maka run、Runtime Host worker/candidate 和 PTY 能从安装包正常工作。
• maka eval 从安装包解析全部 Maka 自有资源；支持环境能够完成真实 Harbor 和 Pier cell，不支持或缺失依赖的环境在执行前给出可操作诊断。
• 发布到 npm 的同一个 tarball 通过 Linux、macOS 和 Windows 发布矩阵。
• tarball 不包含源码、测试、fixtures、凭证、本地路径或其他开发文件。
• 发布使用受保护的 GitHub Environment、人工审批、OIDC trusted publishing，并具备明确的 dist-tag 回滚流程。

非目标

• 将所有内部 @maka/* workspace 发布为公共包。
• 为 maka-agent 建立公共 JavaScript library API。