chore(release): prepare 0.2.2 and correct source packaging

[Astro-Han]

Summary

Prepare Apache Maka 0.2.2 with aligned root, Desktop, CLI and lockfile versions and a changelog covering main since 0.2.1 RC1. Both unreleased versions remain undated while 0.2.1 completes its existing vote. The upgrade notes reflect Host compatibility epoch 224, versus 217 in 0.2.1; Desktop, CLI and remote Hosts must upgrade together. Rust Host and GPUI remain on rust-preview.

Address the four source-package concerns in JB's 0.2.1 IPMC review:

• Replace the embedded, unchanged QuickJS WASM in run+2.1.4.patch with a source-only placeholder. The existing postinstall script expands it from the pinned, installed dependency into a temporary patch directory and runs patch-package normally. Source verification now rejects Base64-encoded WASM as well as binary files.
• Correct stale Ant/Semi component references and the provider-utils version in LICENSE.
• Identify 0.2.0 RC1 explicitly in DISCLAIMER-WIP, retaining its outstanding initial-code authorization disclosure.
• Preserve Cua's copyright and MIT scope in the two adapted cursor files, separately from Maka's Apache-2.0 modifications.

Register the dependency patch installer and its regression test in the existing ASF source CI selection. The planner's existing coverage assertion exposed the missing registration. No runtime behavior or voted 0.2.1 candidate bytes change.

Verification

• Original release-preparation base, Node 24 on macOS: clean npm ci, complete workspace build, Desktop typecheck, 227 release checks, 97 ASF source checks and 33 Runtime Code Mode tests passed.
• Fresh upstream run 2.1.4 tarball: all 11 patched files match the prior installation byte for byte, including repeat application. The install, encoded-WASM and cursor-attribution regressions failed before their fixes.
• After rebasing onto main 286ffa8206cfaa9f58c0d50e806ab6287c457575: clean npm ci, complete workspace build, all 141 tests in CI's planner/policy step, all 97 ASF source checks and all 227 release checks pass locally. The planner assertion failed before adding the missing registration.
• Format, lint and diff checks pass. Created and verified an unsigned source preflight from 539843b8ef3c6734dada3dddc8b59976e1a171b2; its fresh extraction passes the header audit (4,551 covered files, 258 reviewed exclusions).
• Automated review on f61033b5e found no P0–P2 issues. Both P3 documentation notes are addressed in 539843b8e: the patch regeneration guide now documents the source-only placeholder, and the changelog includes fix(desktop): invalidate artifact previews after deletion #5394, fix(ui): allow submitting the New project dialog without a name #6073 and fix(desktop): keep conversations centered with classic scrollbars #6102. All 97 ASF source checks pass again, and both inline threads are resolved. Independent human review remains required.
• GitHub Actions on exact head 539843b8ef3c6734dada3dddc8b59976e1a171b2: all 17 reported checks succeeded; installed CLI Eval was skipped by workflow configuration. This includes main CI (workspace and Runtime Host tests, Desktop E2E, browser smoke, Storybook, transcript geometry and CLI packaging), Windows/Linux Desktop packages, native builds, installed CLI validation and released State Root qualification.
• Full repository tests, native platform acceptance and local E2E were not run locally. PR/main CI and the source-candidate workflow must qualify the selected release commit.

RC preparation

After independent committer review, merge and green CI on the selected main commit, run the source-candidate workflow for 0.2.2. Verify, sign and stage the workflow's exact RC1 bytes and prepare fresh vote emails. The local archive is an unsigned preflight. This PR does not publish a release or close the pending 0.2.1 vote.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex prepared release metadata, source-package repairs, CI selection and regression tests. All commits carry Generated-by: Codex.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — source packaging and dependency patch installation change as described above; runtime behavior is preserved
• No

[Astro-Han]

Automated review notice: This comment was posted by an automated review agent. It is not an independent human review and does not replace one.

First review. Reviewed range: 286ffa82..f61033b5 (5 commits; merge-base is current main 286ffa8206cf). No prior findings.

Verdict: No P0–P2 defects found. Two P3 items below; neither blocks merge.

What I checked

• Version bumps: root, apps/desktop and packages/cli manifests and the three package-lock.json entries all move 0.2.1 → 0.2.2. That is the same set the 0.2.1 prep (#6077) touched, and #6077 made the version fixtures derive from the manifests. No other first-party 0.2.1 version strings remain. The remaining 0.2.1 hits are third-party crates/packages, a story fixture and docs examples.
• Upgrade note: the epoch claim is correct: RUNTIME_HOST_COMPATIBILITY_EPOCH is 217 at v0.2.1-incubating-rc1 and 224 on head. No protocol files are touched, so this PR has no epoch impact.
• Source packaging: I ran node scripts/asf-source-release.mjs create on head (--version 0.2.2) and on main (--version 0.2.1). Both build and self-verify.
  • Head's patches/run+2.1.4.patch contains no AGFzbQ payload, only the two __MAKA_RUN_WASM_BASE64__ placeholders. The archive is about 730 KB smaller.
  • Running head's verifier on main's archive fails with Compiled artifact .../patches/run+2.1.4.patch has forbidden Base64 WASM content, so the new check catches the original problem.
  • The file lists match except for the new scripts/apply-dependency-patches.test.mjs. LICENSE, NOTICE and DISCLAIMER-WIP are present at the archive root.
• Install path: I ran a clean npm ci --ignore-scripts plus node scripts/apply-dependency-patches.mjs in separate head and main worktrees (Linux, Node 22.23). All 14 patches apply. The patched node_modules/run tree hashes identically on head and main, so the placeholder expansion reproduces the old bytes exactly. A repeat run exits 0 and the temporary node_modules/.maka-patches-* directory is removed.
• Legal text:
  • The LICENSE corrections match the tree. No Ant Design or Semi assets remain in THIRD_PARTY_LICENSES.txt or the sources, and patches/@ai-sdk+provider-utils+5.0.51.patch is the shipped patch.
  • The cursor files now carry the Cua copyright and the MIT/Apache scope, and they are added to the header-audit exclusions. NOTICE stays unchanged, which is consistent with docs/code-origin-audit.md.
  • The new palette comment is accurate: the code returns one fixed brand palette.
• Tests and lint: all 97 tests in the check:asf-source suite list pass (the check:model-metadata pre-step needs build output and was not run). scripts/ci-test-plan.test.mjs passes 40/40. Biome format and lint are clean on the touched scripts.
• Scope: every change relates to the release prep or the four IPMC items. Nothing unrelated is included.

Findings

• P3: patches/README.md is stale for the new run patch format. Line 76 still says "The large generated hunk is the inline Worker with unchanged embedded WASM". The regeneration recipe (node node_modules/patch-package/index.js run) would produce a patch with the full Base64 WASM again. Nothing says the payload must be swapped back to __MAKA_RUN_WASM_BASE64__ afterwards. The install script would still apply such a patch, because it only substitutes when the marker is present, and the source verifier would catch it at RC time. Still, the README should document the replacement step.
• P3: The 0.2.2 changelog misses three user-facing fixes that landed after v0.2.1-incubating-rc1 and appear in no section: #5394 (artifact previews invalidated after deletion), #6073 (New project dialog submits without a name) and #6102 (conversations stay centered with classic scrollbars). The other omitted PRs in range are docs, test, CI, refactor, a dependency bump or nightly-only (#4221), which is reasonable to leave out.

CI / mergeability: GitHub reports MERGEABLE, state BLOCKED (review required). On head f61033b5, all completed checks pass, including the four direct-peer builds, the installed-CLI validations on Linux, macOS and Windows, package-linux, windows_recovery and audit. test and package were still pending when this was written and must finish before merge.

[Astro-Han]

Automated follow-up (Codex).

I've addressed both P3 notes in 539843b: the run patch regeneration instructions now explain replacing the unchanged WASM with the source-only placeholder, and the 0.2.2 changelog includes #5394, #6073 and #6102. All 97 ASF source checks pass again. This follow-up changes documentation only; CI is rerunning on the new head.

[me2seeks]

AI-assisted review performed with Codex at 539843b, submitted under explicit reviewer authorization. No blocking defects found.

Verified coordinated root/Desktop/CLI versions and lockfile entries, changelog coverage and compatibility epochs (217 to 224), source-only patch expansion, temporary-directory cleanup, source verification, attribution changes and CI selection.

Local validation: 137 related source/planner tests passed; header audit passed (4,551 covered files, 258 reviewed exclusions); product release identity and diff checks passed. A fresh upstream run@2.1.4 tarball passed first and repeated patch installation. Expanding the placeholder reproduced the previous patch byte for byte. Created and self-verified the unsigned 0.2.2 source candidate from this exact commit.

At submission, all 17 executed GitHub checks passed, installed CLI Eval was skipped, and both prior review threads were resolved. Full local workspace builds and native platform/E2E acceptance were not rerun; those are covered by the reported hosted checks. This automated review does not replace independent human release review or qualify signed release bytes.

[M4n5ter]

English

Looks good to me on 539843b8e. I didn’t find any correctness or maintainability concerns in the changed code.

The temporary patch directory is a straightforward way to keep the committed patch source-only while reusing patch-package. Cleanup stays in finally, and the regression test runs the actual installer twice and checks both the installed bytes and the unchanged source patch. The extraction regex is tied to run@2.1.4, but that seems reasonable for a pinned dependency, especially since a format mismatch fails the install explicitly.

I also verified that the expanded patch matches the previous patch byte for byte, and that the source archive can be created, verified and reproduced. The 97 source-related tests and 40 CI planner tests passed locally. I haven’t run a fresh full install/build or platform E2E locally.

中文

看过 539843b8e，这版我没有发现正确性或可维护性方面的问题。

临时补丁目录的处理比较直接：既能让仓库里的补丁保持纯源码，又能继续复用 patch-package。清理放在 finally，回归测试也实际执行安装脚本两次，检查安装后的字节和原补丁保持不变。提取正则确实绑定了 run@2.1.4 的格式，不过对于锁定版本的依赖，这个约束是合理的，格式不匹配时也会明确终止安装。

另外确认了还原后的补丁与旧补丁逐字节一致，源码归档可以生成、校验并重建。本地 97 个源码相关测试和 40 个 CI 规划测试通过；没有在本地做全新完整安装、构建或平台 E2E。