@aspectlylabs/mikka 0.0.113 → 0.0.115

package/client.js

@@ -2346,7 +2346,11 @@ var harnessInfoSchema = z6.object({
   defaultModelSlot: z6.string().trim().min(1).max(128).optional(),
   /** Deprecated (#312, 2026-10-27): could host the native Coordinator. The server keeps that runtime switched off. */
   coordinator: z6.boolean().optional(),
-  /** Set only by a runner with an isolated, owner-bound subscription broker. */
+  /**
+   * Set only by a runner that runs subscriptions under owner-bound custody:
+   * the hosted runner's broker, or a device daemon that takes one run's
+   * short-lived access lease (never the refresh grant) and wipes it at run end.
+   */
   subscriptionBroker: z6.literal(true).optional(),
   /** Set only by an E2B worker with the guarded Bot computer broker. */
   computerBroker: z6.literal(true).optional(),
@@ -2842,6 +2846,17 @@ var runSkillRefSchema = z13.object({
 var id2 = z14.string().min(1).max(64);
 var isoTime = z14.iso.datetime({ offset: true });
 var deviceComputerCapability = z14.object({ installed: z14.boolean(), version: z14.string().max(100).nullable() }).strict();
+var deviceRunnerCapability = z14.object({
+  os: z14.string().max(50),
+  arch: z14.string().max(50),
+  freeDiskBytes: z14.number().int().nonnegative().nullable(),
+  docker: z14.boolean(),
+  harnesses: z14.array(z14.object({
+    harness: harnessSchema,
+    state: z14.enum(["installed", "not_installed", "unsupported"]),
+    version: z14.string().max(100)
+  })).max(20)
+});
 var deviceRegistration = z14.object({
   deviceType: z14.enum(["laptop", "server"]).optional(),
   name: z14.string().trim().min(1).max(200),
@@ -2852,6 +2867,7 @@ var deviceRegistration = z14.object({
   protocolVersion: z14.number().int(),
   harnesses: z14.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   /**
    * This machine's one device id, the same in every workspace (ADR ORV-284).
    * Registering with it in another workspace joins the same device there.
@@ -2877,6 +2893,7 @@ var deviceHeartbeatSchema = z14.object({
   failedDeviceCommands: z14.array(z14.object({ id: z14.uuid(), error: z14.string().max(500) })).max(100).optional(),
   harnesses: z14.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   deviceType: z14.enum(["laptop", "server"]).optional(),
   runs: z14.array(heartbeatRunSchema).max(500),
   worktreeDiskBytes: z14.number().int().nonnegative(),
@@ -3684,6 +3701,9 @@ var nativeBrokerContextSchema = z22.object({
   plan: z22.string().max(40).optional(),
   expiresAt: z22.iso.datetime()
 }).strict();
+var nativeLeaseSchema = nativeBrokerContextSchema.extend({
+  accessToken: z22.string().min(1).max(32768).regex(/^[^\r\n\0]+$/)
+}).strict();
 
 // src/rpc/client.ts
 import {
@@ -3699,7 +3719,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.113",
+  version: "0.0.115",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3731,7 +3751,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:run-container": "node --import tsx --test --test-timeout=900000 test/run-container.docker-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3758,7 +3779,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "aaeb12ba1c18c1b1212089f956f9469c3c987929"
+  gitHead: "359ba1cd2bc68cbb7b92e957579690d9f43878b8"
 };
 
 // src/paths.ts
@@ -3775,6 +3796,8 @@ function daemonPaths(dataDir) {
     worktrees: join(dataDir, "worktrees"),
     repos: join(dataDir, "repos"),
     adapterState: join(dataDir, "adapters"),
+    /** Pinned Claude Code and Codex the daemon installs for its runs. */
+    harness: join(dataDir, "harness"),
     logs: join(dataDir, "logs"),
     devRepos: join(dataDir, "dev-repos.json")
   };

package/harness/Dockerfile

@@ -0,0 +1,19 @@
+# The runner image: a clean Linux with the daemon's pinned Claude Code and
+# Codex (harness/pins.json), the same harnesses a device installs for itself.
+# A device with Docker runs each harness in a disposable container of it;
+# the E2B template installs from the same pins and installer.
+#
+# Context: packages/daemon (or the npm package root). Multi-arch: the installer picks the build for the
+# image's own arch, e.g.
+#   docker buildx build --platform linux/amd64,linux/arm64 -f harness/Dockerfile .
+# The base is the multi-arch node 24 index also pinned as HOSTED_NATIVE_IMAGE.
+FROM node@sha256:6449e19d8184d84062525b6a7524def03146c2cb04a7f08b076680d0e8e4240a
+COPY harness/pins.json harness/install.mjs harness/cli.mjs /opt/mikka/installer/
+# An optional `--secret id=ca,src=<bundle>` trusts a proxy's CA while downloading.
+RUN --mount=type=secret,id=ca,required=false \
+    if [ -f /run/secrets/ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/ca; fi \
+ && node /opt/mikka/installer/cli.mjs /opt/mikka/harness > /tmp/harnesses \
+ && while read -r binary; do ln -sf "$binary" "/usr/local/bin/$(basename "$binary")"; done < /tmp/harnesses \
+ && rm -rf /opt/mikka/installer /tmp/harnesses \
+ && chmod -R go+rX,go-w /opt/mikka/harness \
+ && claude --version && codex --version

package/harness/cli.mjs

@@ -0,0 +1,12 @@
+// Installs the pinned harnesses with plain Node, for images built from the
+// same pins as the daemon (Dockerfile, scripts/e2b/build-template.py):
+//   node harness/cli.mjs <root> [claude_code|codex ...]
+// Prints each installed binary's path.
+import { ensureHarness, MANAGED_HARNESSES } from './install.mjs'
+
+const [root, ...names] = process.argv.slice(2)
+if (!root) throw new Error('usage: cli.mjs <root> [harness ...]')
+for (const harness of names.length ? names : MANAGED_HARNESSES) {
+  if (!MANAGED_HARNESSES.includes(harness)) throw new Error(`unknown harness ${harness}`)
+  console.log(await ensureHarness({ root }, harness))
+}

package/harness/install.mjs

@@ -0,0 +1,113 @@
+// Daemon-managed harnesses: the daemon runs its own pinned Claude Code and
+// Codex, never a CLI the person installed. Each is the official npm
+// platform package, checked against the integrity pinned in `pins.json`
+// (the registry is never trusted for it) and unpacked into
+// `<root>/<harness>/<version>/bin/<command>`. A daemon release that bumps a
+// pin installs the new version on its next run and removes the old.
+//
+// Plain JavaScript with no local imports beyond the pins: the runner image
+// (Dockerfile) and the E2B template run it through `cli.mjs`.
+import { createHash, randomBytes } from 'node:crypto'
+import { execFile } from 'node:child_process'
+import { createWriteStream, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import { Readable, Transform } from 'node:stream'
+import { pipeline } from 'node:stream/promises'
+import { promisify } from 'node:util'
+
+import pins from './pins.json' with { type: 'json' }
+
+export const MANAGED_HARNESSES = ['claude_code', 'codex']
+export const HARNESS_PINS = pins
+
+const MARKER = '.mikka-installed'
+const run = promisify(execFile)
+const inflight = new Map()
+
+export function platformKey(platform = process.platform, arch = process.arch) {
+  return `${platform}-${arch}`
+}
+
+function resolvePin(store, harness) {
+  const pin = (store.pins ?? HARNESS_PINS).harnesses[harness]
+  return { pin, artifact: pin.platforms[store.platform ?? platformKey()] }
+}
+
+function versionDir(store, harness) {
+  return join(store.root, harness, resolvePin(store, harness).pin.version)
+}
+
+/** Where the pinned binary lives once installed. */
+export function harnessBinaryPath(store, harness) {
+  return join(versionDir(store, harness), 'bin', resolvePin(store, harness).pin.command)
+}
+
+export function harnessInstallState(store, harness) {
+  const { pin, artifact } = resolvePin(store, harness)
+  if (!artifact) return { state: 'unsupported', version: pin.version }
+  let installed = false
+  try {
+    installed = readFileSync(join(versionDir(store, harness), MARKER), 'utf8') === artifact.integrity
+      && statSync(harnessBinaryPath(store, harness)).isFile()
+  } catch {
+    // Not installed (or a half-finished one, which is replaced).
+  }
+  return { state: installed ? 'installed' : 'not_installed', version: pin.version }
+}
+
+/** The pinned binary, downloaded and verified on first need. */
+export function ensureHarness(store, harness) {
+  const key = `${store.root}\0${harness}`
+  let pending = inflight.get(key)
+  if (!pending) {
+    pending = install(store, harness).finally(() => inflight.delete(key))
+    inflight.set(key, pending)
+  }
+  return pending
+}
+
+async function install(store, harness) {
+  const binary = harnessBinaryPath(store, harness)
+  const { state } = harnessInstallState(store, harness)
+  if (state === 'unsupported') throw new Error(`${harness} has no build for ${store.platform ?? platformKey()}`)
+  if (state === 'installed') return binary
+  const { pin, artifact } = resolvePin(store, harness)
+  const parent = join(store.root, harness)
+  mkdirSync(parent, { recursive: true, mode: 0o700 })
+  const staging = join(parent, `.staging-${randomBytes(6).toString('hex')}`)
+  mkdirSync(join(staging, 'bin'), { recursive: true, mode: 0o700 })
+  try {
+    const tarball = join(staging, 'package.tgz')
+    await download(`${(store.pins ?? HARNESS_PINS).registry.replace(/\/$/, '')}/${artifact.tarball}`, tarball, artifact.integrity)
+    await run('tar', ['-xzf', tarball, '-C', staging, artifact.entry])
+    renameSync(join(staging, artifact.entry), join(staging, 'bin', pin.command))
+    rmSync(tarball)
+    rmSync(join(staging, artifact.entry.split('/')[0]), { recursive: true, force: true })
+    writeFileSync(join(staging, MARKER), artifact.integrity, { mode: 0o600 })
+    const target = versionDir(store, harness)
+    rmSync(target, { recursive: true, force: true })
+    renameSync(staging, target)
+  } catch (error) {
+    rmSync(staging, { recursive: true, force: true })
+    throw error
+  }
+  // Older pins and interrupted downloads.
+  for (const name of readdirSync(parent)) if (name !== pin.version) rmSync(join(parent, name), { recursive: true, force: true })
+  return binary
+}
+
+async function download(url, file, integrity) {
+  const [algorithm, expected] = integrity.split(/-(.*)/s)
+  if (algorithm !== 'sha512' || !expected) throw new Error('Unsupported harness integrity')
+  const response = await fetch(url, { redirect: 'follow' })
+  if (!response.ok || !response.body) throw new Error(`Harness download failed (${response.status})`)
+  const hash = createHash('sha512')
+  const tap = new Transform({ transform(chunk, _encoding, done) { hash.update(chunk); done(null, chunk) } })
+  await pipeline(Readable.fromWeb(response.body), tap, createWriteStream(file, { mode: 0o600 }))
+  if (hash.digest('base64') !== expected) throw new Error('Harness download failed its integrity check')
+}
+
+/** Pinned versions and what is installed, for the device report. */
+export function managedHarnessReport(store) {
+  return MANAGED_HARNESSES.map(harness => ({ harness, ...harnessInstallState(store, harness) }))
+}

package/harness/pins.json

@@ -0,0 +1,25 @@
+{
+  "registry": "https://registry.npmjs.org",
+  "harnesses": {
+    "claude_code": {
+      "version": "2.1.309",
+      "command": "claude",
+      "platforms": {
+        "darwin-arm64": { "tarball": "@anthropic-ai/claude-code-darwin-arm64/-/claude-code-darwin-arm64-2.1.309.tgz", "integrity": "sha512-7ZVUH/WyxWpFfkV90tJBUSnFTQo8wwRxHNOLNj+q8eYp5DNoCU8KOVC3OiNDmo832BrfQImH0XmpWjGqKPulDg==", "entry": "package/claude" },
+        "darwin-x64": { "tarball": "@anthropic-ai/claude-code-darwin-x64/-/claude-code-darwin-x64-2.1.309.tgz", "integrity": "sha512-K+9PSzQQYYooMpohqGInTLbNDXQvbroZZJcmrpyAKonXjzkl4jAQJHe6F6wHxFLKoALntoP6/5WIuCIetoR26w==", "entry": "package/claude" },
+        "linux-arm64": { "tarball": "@anthropic-ai/claude-code-linux-arm64/-/claude-code-linux-arm64-2.1.309.tgz", "integrity": "sha512-tTZvLm0QR5d6hWsDpNvc1/QnjRzIfAEaGeZgau+tBle5z5DT8QGRe7IZsPuyBFkkS3MtSbbvsUx/ghO8zYc2ew==", "entry": "package/claude" },
+        "linux-x64": { "tarball": "@anthropic-ai/claude-code-linux-x64/-/claude-code-linux-x64-2.1.309.tgz", "integrity": "sha512-36D6kMC0fWdWLwBA8XYaJTSTXEWvw0Kc3WQYqterieKDtplIfUsE5jurZAYilhzOeF+uNL9SNn4DkwhQmUrRMg==", "entry": "package/claude" }
+      }
+    },
+    "codex": {
+      "version": "0.163.0",
+      "command": "codex",
+      "platforms": {
+        "darwin-arm64": { "tarball": "@openai/codex/-/codex-0.163.0-darwin-arm64.tgz", "integrity": "sha512-i7Dzk2a5aGmuGM9aNZgaUVTojZ/4bc5lRfosz++Y7X2BGhDkz+cySgbD+NYS1pOxfm0VEbLi9PZ3pAulI4kchw==", "entry": "package/vendor/aarch64-apple-darwin/bin/codex" },
+        "darwin-x64": { "tarball": "@openai/codex/-/codex-0.163.0-darwin-x64.tgz", "integrity": "sha512-Ioj7h+B1ME9ZU1PH1ATfvFV5DiototEpFFaSSbg3kfDifB9djhl5fcJ++g5mpcL/+uVbcnReei+RiSXEx8o+kw==", "entry": "package/vendor/x86_64-apple-darwin/bin/codex" },
+        "linux-arm64": { "tarball": "@openai/codex/-/codex-0.163.0-linux-arm64.tgz", "integrity": "sha512-IH2/R+4OarjGvsAf1ll3fdyLwrPgYLl3uzp6u9CyD9sj2Lw+ViDSe3QBZVHdcHJs0eIiZFg6Wprcuy4CRZaUGw==", "entry": "package/vendor/aarch64-unknown-linux-musl/bin/codex" },
+        "linux-x64": { "tarball": "@openai/codex/-/codex-0.163.0-linux-x64.tgz", "integrity": "sha512-uwRaOsrYogLQhcxAM/GoeWrw0QIWEMRo7c9gM8sKAviVkZQHlu9kRLJ5PkufbV+ABGjyZgIwiFdJ0LCJ0N6e8w==", "entry": "package/vendor/x86_64-unknown-linux-musl/bin/codex" }
+      }
+    }
+  }
+}

package/http-link.js

@@ -2611,6 +2611,9 @@ var nativeBrokerContextSchema = z7.object({
   plan: z7.string().max(40).optional(),
   expiresAt: z7.iso.datetime()
 }).strict();
+var nativeLeaseSchema = nativeBrokerContextSchema.extend({
+  accessToken: z7.string().min(1).max(32768).regex(/^[^\r\n\0]+$/)
+}).strict();
 
 // ../protocol/src/computer.ts
 import { z as z8 } from "zod";
@@ -2979,7 +2982,11 @@ var harnessInfoSchema = z14.object({
   defaultModelSlot: z14.string().trim().min(1).max(128).optional(),
   /** Deprecated (#312, 2026-10-27): could host the native Coordinator. The server keeps that runtime switched off. */
   coordinator: z14.boolean().optional(),
-  /** Set only by a runner with an isolated, owner-bound subscription broker. */
+  /**
+   * Set only by a runner that runs subscriptions under owner-bound custody:
+   * the hosted runner's broker, or a device daemon that takes one run's
+   * short-lived access lease (never the refresh grant) and wipes it at run end.
+   */
   subscriptionBroker: z14.literal(true).optional(),
   /** Set only by an E2B worker with the guarded Bot computer broker. */
   computerBroker: z14.literal(true).optional(),
@@ -3348,6 +3355,17 @@ var devicePaths = {
   runCheckpoint: (runId) => `/v1/runs/${seg(runId)}/checkpoint`
 };
 var deviceComputerCapability = z18.object({ installed: z18.boolean(), version: z18.string().max(100).nullable() }).strict();
+var deviceRunnerCapability = z18.object({
+  os: z18.string().max(50),
+  arch: z18.string().max(50),
+  freeDiskBytes: z18.number().int().nonnegative().nullable(),
+  docker: z18.boolean(),
+  harnesses: z18.array(z18.object({
+    harness: harnessSchema,
+    state: z18.enum(["installed", "not_installed", "unsupported"]),
+    version: z18.string().max(100)
+  })).max(20)
+});
 var deviceRegistration = z18.object({
   deviceType: z18.enum(["laptop", "server"]).optional(),
   name: z18.string().trim().min(1).max(200),
@@ -3358,6 +3376,7 @@ var deviceRegistration = z18.object({
   protocolVersion: z18.number().int(),
   harnesses: z18.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   /**
    * This machine's one device id, the same in every workspace (ADR ORV-284).
    * Registering with it in another workspace joins the same device there.
@@ -3383,6 +3402,7 @@ var deviceHeartbeatSchema = z18.object({
   failedDeviceCommands: z18.array(z18.object({ id: z18.uuid(), error: z18.string().max(500) })).max(100).optional(),
   harnesses: z18.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   deviceType: z18.enum(["laptop", "server"]).optional(),
   runs: z18.array(heartbeatRunSchema).max(500),
   worktreeDiskBytes: z18.number().int().nonnegative(),
@@ -4098,7 +4118,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.113",
+  version: "0.0.115",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4130,7 +4150,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:run-container": "node --import tsx --test --test-timeout=900000 test/run-container.docker-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4157,7 +4178,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "aaeb12ba1c18c1b1212089f956f9469c3c987929"
+  gitHead: "359ba1cd2bc68cbb7b92e957579690d9f43878b8"
 };
 
 // src/paths.ts
@@ -4620,6 +4641,9 @@ var HttpServerLink = class {
   async nativeContext(deviceId, runId, signal) {
     return this.call("POST", `${devicePaths.claim(checkId(deviceId), checkId(runId)).replace(/\/claim$/, "")}/subscription`, { body: { action: "context" }, schema: nativeBrokerContextSchema, signal });
   }
+  async nativeLease(deviceId, runId, signal) {
+    return this.call("POST", `${devicePaths.claim(checkId(deviceId), checkId(runId)).replace(/\/claim$/, "")}/subscription-lease`, { schema: nativeLeaseSchema, signal });
+  }
   async nativeRequest(deviceId, runId, payload, signal) {
     const response = await this.send("POST", `${devicePaths.claim(checkId(deviceId), checkId(runId)).replace(/\/claim$/, "")}/subscription`, { action: "request", payload }, this.credential, { signal, timeoutMs: 275e3 });
     const contentType = response.headers.get("content-type")?.split(";")[0];

package/login.js

@@ -2343,7 +2343,11 @@ var harnessInfoSchema = z6.object({
   defaultModelSlot: z6.string().trim().min(1).max(128).optional(),
   /** Deprecated (#312, 2026-10-27): could host the native Coordinator. The server keeps that runtime switched off. */
   coordinator: z6.boolean().optional(),
-  /** Set only by a runner with an isolated, owner-bound subscription broker. */
+  /**
+   * Set only by a runner that runs subscriptions under owner-bound custody:
+   * the hosted runner's broker, or a device daemon that takes one run's
+   * short-lived access lease (never the refresh grant) and wipes it at run end.
+   */
   subscriptionBroker: z6.literal(true).optional(),
   /** Set only by an E2B worker with the guarded Bot computer broker. */
   computerBroker: z6.literal(true).optional(),
@@ -2838,6 +2842,17 @@ var runSkillRefSchema = z13.object({
 var id2 = z14.string().min(1).max(64);
 var isoTime = z14.iso.datetime({ offset: true });
 var deviceComputerCapability = z14.object({ installed: z14.boolean(), version: z14.string().max(100).nullable() }).strict();
+var deviceRunnerCapability = z14.object({
+  os: z14.string().max(50),
+  arch: z14.string().max(50),
+  freeDiskBytes: z14.number().int().nonnegative().nullable(),
+  docker: z14.boolean(),
+  harnesses: z14.array(z14.object({
+    harness: harnessSchema,
+    state: z14.enum(["installed", "not_installed", "unsupported"]),
+    version: z14.string().max(100)
+  })).max(20)
+});
 var deviceRegistration = z14.object({
   deviceType: z14.enum(["laptop", "server"]).optional(),
   name: z14.string().trim().min(1).max(200),
@@ -2848,6 +2863,7 @@ var deviceRegistration = z14.object({
   protocolVersion: z14.number().int(),
   harnesses: z14.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   /**
    * This machine's one device id, the same in every workspace (ADR ORV-284).
    * Registering with it in another workspace joins the same device there.
@@ -2873,6 +2889,7 @@ var deviceHeartbeatSchema = z14.object({
   failedDeviceCommands: z14.array(z14.object({ id: z14.uuid(), error: z14.string().max(500) })).max(100).optional(),
   harnesses: z14.array(harnessInfoSchema).max(20),
   computerUse: deviceComputerCapability.optional(),
+  runner: deviceRunnerCapability.optional(),
   deviceType: z14.enum(["laptop", "server"]).optional(),
   runs: z14.array(heartbeatRunSchema).max(500),
   worktreeDiskBytes: z14.number().int().nonnegative(),
@@ -3681,6 +3698,9 @@ var nativeBrokerContextSchema = z22.object({
   plan: z22.string().max(40).optional(),
   expiresAt: z22.iso.datetime()
 }).strict();
+var nativeLeaseSchema = nativeBrokerContextSchema.extend({
+  accessToken: z22.string().min(1).max(32768).regex(/^[^\r\n\0]+$/)
+}).strict();
 
 // src/login.ts
 import { z as z27 } from "zod";
@@ -3706,7 +3726,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.113",
+  version: "0.0.115",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3738,7 +3758,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:run-container": "node --import tsx --test --test-timeout=900000 test/run-container.docker-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3765,7 +3786,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "aaeb12ba1c18c1b1212089f956f9469c3c987929"
+  gitHead: "359ba1cd2bc68cbb7b92e957579690d9f43878b8"
 };
 
 // src/paths.ts