@aspectlylabs/mikka 0.0.0-stage → 0.0.3

package/README.md

@@ -1,3 +1,80 @@
-# Temporary Holding Version
+# Mikka daemon
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The daemon connects your computer to Mikka and runs threads with your installed
+Claude Code or Codex. Node.js 24 or newer and Git are required. Sign in to the
+coding CLI and make sure your local Git credentials can read the repositories
+you want to use.
+
+The release candidate is a single `@aspectlylabs/mikka` package containing the
+`mikka` command and its daemon subcommands. The source workspace stays private;
+`pnpm --filter @mikka/daemon build` produces the package with the private
+protocol bundled. The npm organization and trusted publisher must be verified
+before publication.
+
+Once the package has been published, install it once and start the daemon:
+
+```sh
+npm install -g @aspectlylabs/mikka
+mikka daemon login
+mikka daemon
+```
+
+Login prints a browser confirmation link and a short code. The daemon
+saves a device credential, never the browser session. The default server is
+`https://app.aspectlylabs.com/mikka`. For a Preview or self-hosted server, use
+the full application URL (including its base path) in both commands:
+
+```sh
+mikka daemon login --server https://preview.example/mikka
+mikka daemon --server https://preview.example/mikka
+```
+
+`mikka daemon status` reports an already running daemon. `Ctrl+C` shuts it down.
+Manual test setup can use `mikka daemon login --token <device-token>`; keep the
+token out of screenshots, logs and shell history.
+
+## Release candidate
+
+```sh
+pnpm --filter @mikka/daemon build
+export MIKKA_DAEMON_DIST_DIR=/absolute/path/printed/by/the/build
+pnpm --filter @mikka/daemon test:package
+npm pack "$MIKKA_DAEMON_DIST_DIR"
+```
+
+Each build writes a new `.retained-build-*` directory in the source package.
+Existing builds remain intact. The package test requires that exact directory
+and retains its `.retained-package-test-*` installation, tarball and fixture
+index for inspection. The test daemon still performs its normal lifecycle
+cleanup inside the new dedicated fixture; previously retained resources are
+not part of that fixture.
+
+No global `tsx` or separate `@mikka/protocol` package is needed. Every push to
+`main` publishes through `.github/workflows/publish-daemon.yml` after daemon
+checks and the installed-package runtime test pass. The workflow uses npm
+trusted publishing and provenance; its npm trust configuration must authorize
+this exact repository and workflow filename.
+
+CI stamps `0.0.<workflow run number + 1>` into the source manifest before the
+build, so the npm package and runtime report the same version. Source commits
+keep their development version. Re-running a workflow keeps its version and
+skips publication if npm already records that version from the same commit.
+CI writes the commit SHA into the published manifest as `gitHead`; an existing
+version with absent or different commit metadata stops the release. After
+publication, CI reads npm metadata back and checks the commit SHA. If npm
+serves 404 while the published version becomes available, CI checks up to 31
+times with 10-second waits. Exhausting that wait reports registry verification
+as incomplete; it does not claim that npm rejected publication.
+Releases queue without cancellation (up to GitHub's 100 pending-run limit).
+An older run can publish under its own `build-<version>` tag, preserving the
+newer `latest` version. Manual dispatch remains available on `main` and gets
+a new run version. Running local tests or builds does not publish anything.
+
+`test:package` installs the actual tarball into a new directory with public
+registry dependencies, without workspace symlinks or install scripts. Plain
+Node then runs the installed CLI and bundled mock daemon through a real
+clone/worktree/verification/commit/push against a disposable local bare origin.
+It verifies the pushed file and preserves the personal checkout. The test logs
+the tarball digest; its control plane and model are explicit in-memory fixtures.
+This is not real Claude Code/Codex, native-helper, live GitHub App or production
+device-authorization acceptance.

package/agents/native-container.mjs

@@ -0,0 +1,191 @@
+// Private hosted-run bootstrap. The first stdin frame is host configuration;
+// later bytes are the existing CLI protocol. No vault/provider token is accepted.
+import { spawn } from "node:child_process";
+import { createServer, request as httpRequest } from "node:http";
+import { mkdirSync } from "node:fs";
+import { startNativeEgress } from "./native-egress.mjs";
+
+const PLACEHOLDER = "mikka-native-broker-placeholder";
+const fail = () => {
+  process.stderr.write("native_runtime_unavailable\n");
+  process.exit(1);
+};
+let initial = Buffer.alloc(0);
+let starting = false;
+process.stdin.on("data", onData);
+function onData(part) {
+  if (starting) return;
+  initial = Buffer.concat([initial, part]);
+  const newline = initial.indexOf(10);
+  if (newline < 0) {
+    if (initial.length > 131072) fail();
+    return;
+  }
+  starting = true;
+  process.stdin.pause();
+  process.stdin.removeListener("data", onData);
+  let config;
+  try {
+    config = JSON.parse(initial.subarray(0, newline).toString("utf8"));
+  } catch {
+    fail();
+  }
+  const remainder = initial.subarray(newline + 1);
+  initial = Buffer.alloc(0);
+  void start(config, remainder).catch(fail);
+}
+async function start(config, remainder) {
+  if (
+    !["claude_code", "codex"].includes(config.kind) ||
+    !Array.isArray(config.args) ||
+    !config.args.every((a) => typeof a === "string") ||
+    typeof config.cwd !== "string" ||
+    !config.env ||
+    typeof config.env !== "object"
+  )
+    fail();
+  for (const [key, value] of Object.entries(config.env)) {
+    if (
+      typeof value !== "string" ||
+      /INFISICAL|E2B_API_KEY|REFRESH_TOKEN|^AWS_|^GOOGLE_|^OPENAI_|^ANTHROPIC_.*(?:KEY|TOKEN)|SECRET|PASSWORD/.test(
+        key,
+      )
+    )
+      fail();
+    if (key === "CLAUDE_CODE_OAUTH_TOKEN" && value !== PLACEHOLDER) fail();
+  }
+  delete config.env.CLAUDE_CODE_OAUTH_TOKEN;
+  config.env.PATH = "/usr/local/bin:/usr/bin:/bin";
+  mkdirSync(config.env.HOME, { recursive: true, mode: 0o700 });
+  // Model credentials stay on the original task broker. Public downloads use
+  // a separate live, public-IP-only host proxy, never that credential endpoint.
+  const egress = config.publicEgress === true ? await startNativeEgress() : null;
+  if (egress) {
+    Object.assign(config.env, {
+      HTTP_PROXY: egress.url, HTTPS_PROXY: egress.url,
+      http_proxy: egress.url, https_proxy: egress.url,
+      NO_PROXY: 'localhost,127.0.0.1,::1', no_proxy: 'localhost,127.0.0.1,::1',
+      NODE_USE_ENV_PROXY: '1',
+    });
+  }
+  // The model transport remains bound to the mounted task broker socket.
+  const proxy = createServer((request, response) => {
+    if (request.method !== "POST") {
+      response.writeHead(404).end();
+      return;
+    }
+    let path = request.url;
+    if (config.kind === "codex" && path.endsWith("/responses"))
+      path = "/responses";
+    const upstream = httpRequest(
+      {
+        socketPath: "/run/mikka-native.sock",
+        method: "POST",
+        path,
+        headers: request.headers,
+      },
+      (result) => {
+        response.writeHead(result.statusCode, {
+          "content-type": result.headers["content-type"] ?? "application/json",
+        });
+        result.pipe(response);
+      },
+    );
+    upstream.on("error", () => response.destroy());
+    request.pipe(upstream);
+    response.on("close", () => upstream.destroy());
+  });
+  await new Promise((resolve) => proxy.listen(0, "127.0.0.1", resolve));
+  const base = `http://127.0.0.1:${proxy.address().port}`;
+  const args = [...config.args];
+  if (config.kind === "claude_code") {
+    config.env.ANTHROPIC_BASE_URL = base;
+    config.env.CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR = "3";
+    // Docker confines all tools here; never request a privileged nested sandbox.
+    const settingsIndex = args.findIndex(
+      (value) => value === "--settings" || value.startsWith("--settings="),
+    );
+    if (settingsIndex < 0) fail();
+    const inline = args[settingsIndex].startsWith("--settings=");
+    const settings = JSON.parse(
+      inline
+        ? args[settingsIndex].slice("--settings=".length)
+        : args[settingsIndex + 1],
+    );
+    if (!settings || typeof settings !== "object" || Array.isArray(settings))
+      fail();
+    settings.sandbox = { ...settings.sandbox, enabled: false };
+    if (inline) args[settingsIndex] = "--settings=" + JSON.stringify(settings);
+    else args[settingsIndex + 1] = JSON.stringify(settings);
+    for (let i = 0; i < args.length; i++)
+      if (args[i] === "--mcp-config" && args[i + 1]) {
+        const value = JSON.parse(args[i + 1]);
+        if (value.mcpServers?.mikka)
+          value.mcpServers.mikka.command = "/usr/local/bin/node";
+        args[i + 1] = JSON.stringify(value);
+      }
+  } else {
+    args.push(
+      "-c",
+      `chatgpt_base_url=${JSON.stringify(base + "/backend-api/")}`,
+    );
+    args.push(
+      "-c",
+      "model_providers.openai.supports_websockets=false",
+      "-c",
+      "features.responses_websockets=false",
+      "-c",
+      "features.responses_websockets_v2=false",
+    );
+    args.push("-c", 'mcp_servers.mikka.command="/usr/local/bin/node"');
+    for (const key of [
+      "GIT_DIR",
+      "GIT_WORK_TREE",
+      "GIT_CONFIG_GLOBAL",
+      "GIT_CONFIG_SYSTEM",
+      "GIT_TERMINAL_PROMPT",
+      "HOME",
+      ...(egress ? ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy", "NO_PROXY", "no_proxy", "NODE_USE_ENV_PROXY"] : []),
+    ])
+      args.push(
+        "-c",
+        `shell_environment_policy.set.${key}=${JSON.stringify(config.env[key])}`,
+      );
+  }
+  const child = spawn("/usr/local/bin/native-cli", args, {
+    cwd: config.cwd,
+    env: config.env,
+    stdio:
+      config.kind === "claude_code"
+        ? ["pipe", "pipe", "pipe", "pipe"]
+        : ["pipe", "pipe", "pipe"],
+  });
+  if (config.kind === "claude_code") {
+    child.stdio[3].on("error", () => child.kill("SIGTERM"));
+    child.stdio[3].end(PLACEHOLDER);
+  }
+  // Raw native diagnostics can echo model data: never publish stderr.
+  child.stderr.resume();
+  child.stdout.pipe(process.stdout);
+  if (remainder.length) child.stdin.write(remainder);
+  process.stdin.pipe(child.stdin);
+  process.stdin.resume();
+  child.stdin.on("error", () => undefined);
+  let timer;
+  const stop = () => {
+    child.kill("SIGTERM");
+    timer ??= setTimeout(() => child.kill("SIGKILL"), 3000);
+  };
+  process.on("SIGTERM", stop);
+  process.on("SIGINT", stop);
+  process.stdin.on("end", () => {
+    child.stdin.end();
+    timer ??= setTimeout(stop, 3000);
+  });
+  child.on("error", fail);
+  child.on("exit", (code) => {
+    clearTimeout(timer);
+    proxy.closeAllConnections();
+    void (egress?.close() ?? Promise.resolve()).finally(() => proxy.close(() => process.exit(code ?? 1)));
+  });
+}

package/agents/native-egress.mjs

@@ -0,0 +1,51 @@
+// Only the host-supplied configuration enables this relay. The container has
+// no network interface; it forwards bytes to its single mounted egress socket.
+import { createServer, request } from 'node:http'
+
+export async function startNativeEgress(socketPath = '/run/mikka-egress.sock') {
+  const sockets = new Set()
+  const track = socket => {
+    sockets.add(socket)
+    socket.on('error', () => {})
+    socket.once('close', () => sockets.delete(socket))
+    return socket
+  }
+  const server = createServer({ maxHeaderSize: 16384 }, (incoming, response) => {
+    const outgoing = request({ socketPath, path: incoming.url, method: incoming.method, headers: incoming.headers, agent: false }, upstream => {
+      response.writeHead(upstream.statusCode ?? 502, upstream.headers)
+      upstream.pipe(response)
+    })
+    outgoing.on('socket', track)
+    outgoing.on('error', () => { if (!response.headersSent) response.writeHead(502); response.end() })
+    incoming.once('aborted', () => outgoing.destroy())
+    response.once('close', () => outgoing.destroy())
+    incoming.pipe(outgoing)
+  })
+  server.on('connection', track)
+  server.on('connect', (incoming, client, head) => {
+    const outgoing = request({ socketPath, method: 'CONNECT', path: incoming.url, headers: { host: incoming.url }, agent: false })
+    outgoing.on('socket', track)
+    outgoing.on('connect', (response, upstream, upstreamHead) => {
+      if (response.statusCode !== 200) { client.end('HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n'); upstream.destroy(); return }
+      client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
+      if (upstreamHead.length) client.write(upstreamHead)
+      if (head.length) upstream.write(head)
+      upstream.pipe(client);client.pipe(upstream)
+      client.once('close', () => upstream.destroy())
+      upstream.once('close', () => client.destroy())
+    })
+    outgoing.on('error', () => client.destroy())
+    client.once('close', () => outgoing.destroy())
+    outgoing.end()
+  })
+  server.on('upgrade', (_request, socket) => socket.destroy())
+  server.on('clientError', (_error, socket) => socket.destroy())
+  await new Promise((resolve, reject) => { server.once('error', reject);server.listen(0, '127.0.0.1', resolve) })
+  return {
+    url: `http://127.0.0.1:${server.address().port}`,
+    async close() {
+      for (const socket of sockets) socket.destroy()
+      await new Promise(resolve => server.close(resolve))
+    },
+  }
+}