@aspectlylabs/mikka 0.0.141 → 0.0.143

package/mikka.js

@@ -3561,6 +3561,16 @@ var setupRecipeSchema = z14.object({
   approved: z14.boolean()
 });
 var REPO_ORIGIN_HEADER = "x-mikka-repo-origin-check";
+var MODEL_CREDENTIAL_HEADER = "x-mikka-model-credential";
+var credentialKey = z14.string().min(1).max(4096).refine((value) => !/[\r\n\0]/.test(value));
+var credentialBaseUrl = z14.url().max(500).refine((value) => {
+  const url = new URL(value);
+  return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+});
+var runModelCredentialSchema = z14.discriminatedUnion("kind", [
+  z14.object({ kind: z14.literal("api_key"), key: credentialKey }).strict(),
+  z14.object({ kind: z14.literal("provider"), protocol: z14.enum(["anthropic", "openai"]), baseUrl: credentialBaseUrl, key: credentialKey }).strict()
+]);
 var deviceRepoSchema = z14.object({
   repoId: id2,
   name: z14.string().max(500),
@@ -3608,6 +3618,12 @@ var runAssignmentSchema = z14.object({
     consumerId: z14.uuid(),
     route: z14.enum(["codex_cli", "claude_code_cli"])
   }).strict().optional(),
+  /**
+   * The run's own API key, opened for this claim only. Never with
+   * `subscriptionBinding`. The daemon keeps it in memory and hands it only
+   * to the run's Agent process or container; it is never journaled.
+   */
+  modelCredential: runModelCredentialSchema.optional(),
   /** Local host authority comes only from the server's owner-bound Bot run. */
   localComputer: z14.object({
     botId: z14.uuid(),
@@ -3725,7 +3741,7 @@ var runAssignmentSchema = z14.object({
   skillReceipt: skillAssignmentReceiptSchema.optional(),
   /** Frozen by the server benchmark ledger; never extracted from model output. */
   benchmark: runBenchmarkContext.optional()
-});
+}).refine((value) => !(value.modelCredential && value.subscriptionBinding), { message: "A run has one model credential", path: ["modelCredential"] });
 var runPatchSchema = z14.object({
   state: z14.enum([
     "queued",
@@ -4458,7 +4474,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.141",
+  version: "0.0.143",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4518,7 +4534,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "dec8d3597bd9fb2b049a00efcee8e64d3288f2fa"
+  gitHead: "1a7ea7ffcdb44a8228f84d936a7a395f33f13355"
 };
 
 // src/paths.ts
@@ -5359,6 +5375,7 @@ var HttpServerLink = class {
           [TEAM_SKILL_HEADER]: "1",
           [REPO_ORIGIN_HEADER]: "1",
           [RECOVERY_WORKTREE_HEADER]: "1",
+          [MODEL_CREDENTIAL_HEADER]: "1",
           ...token ? { authorization: `Bearer ${token}` } : {},
           ...this.protectionBypass ? { "x-vercel-protection-bypass": this.protectionBypass } : {}
         },
@@ -7659,15 +7676,15 @@ sandbox_mode = "read-only"
 // src/main.ts
 import { randomBytes as randomBytes4, randomUUID as randomUUID10 } from "node:crypto";
 import {
-  chmodSync as chmodSync5,
+  chmodSync as chmodSync6,
   existsSync as existsSync9,
-  mkdirSync as mkdirSync18,
+  mkdirSync as mkdirSync19,
   readFileSync as readFileSync12,
-  rmSync as rmSync20,
+  rmSync as rmSync21,
   realpathSync as realpathSync12
 } from "node:fs";
 import { arch as arch2, hostname, platform as platform3 } from "node:os";
-import { join as join31 } from "node:path";
+import { join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/adapters/claude.ts
@@ -8509,7 +8526,8 @@ var ClaudeAdapter = class {
         },
         ...mode === "new" ? { sessionId } : { resume: sessionId },
         ...options.model ? { model: options.model } : {},
-        ...outerLocal ? { spawnClaudeCodeProcess: spawnOuter } : this.options.spawnHosted && externalAuth ? { spawnClaudeCodeProcess: (options2) => this.options.spawnHosted(options2, nativeToken) } : binary || externalAuth ? { spawnClaudeCodeProcess: spawnBinary(binary, nativeToken) } : {},
+        // A hosted runtime always spawns into its own container; an API-key run there holds the placeholder too.
+        ...outerLocal ? { spawnClaudeCodeProcess: spawnOuter } : this.options.spawnHosted ? { spawnClaudeCodeProcess: (options2) => this.options.spawnHosted(options2, nativeToken ?? NATIVE_AUTH_PLACEHOLDER) } : binary || externalAuth ? { spawnClaudeCodeProcess: spawnBinary(binary, nativeToken) } : {},
         stderr: (data) => {
           if (!externalAuth) stderr = (stderr + data).slice(-STDERR_TAIL2 * 4);
         }
@@ -11476,7 +11494,10 @@ function withoutTaskEnv(assignment) {
 
 // src/runs/journal.ts
 function persisted(entries) {
-  return Object.fromEntries(Object.entries(entries).map(([id4, entry]) => [id4, { ...entry, assignment: withoutTaskEnv(entry.assignment) }]));
+  return Object.fromEntries(Object.entries(entries).map(([id4, entry]) => {
+    const { modelCredential, ...assignment } = withoutTaskEnv(entry.assignment);
+    return [id4, { ...entry, assignment, ...modelCredential ? { credentialWithheld: true } : {} }];
+  }));
 }
 var RunJournal = class {
   constructor(file) {
@@ -12241,10 +12262,10 @@ var RunSupervisor = class {
     }
     const existing = this.deps.journal.get(assignment.runId);
     if (existing) return this.summary(existing);
-    const masker = createRunMasker((assignment.taskSecretNames ?? []).flatMap((name) => {
+    const masker = createRunMasker([...(assignment.taskSecretNames ?? []).flatMap((name) => {
       const value = assignment.taskEnv?.[name];
       return typeof value === "string" ? [{ name, value }] : [];
-    }));
+    }), ...assignment.modelCredential ? [{ name: "MODEL_API_KEY", value: assignment.modelCredential.key }] : []]);
     if (masker) this.maskers.set(assignment.runId, masker);
     let repo;
     try {
@@ -12344,6 +12365,10 @@ var RunSupervisor = class {
         }
         continue;
       }
+      if (entry.credentialWithheld && !entry.assignment.modelCredential) {
+        this.finish(entry.assignment.runId, "error", "The run stopped with the daemon; its API key is not kept. Retry the thread.");
+        continue;
+      }
       if (entry.assignment.leaseExpiresAt)
         this.leases.set(entry.assignment.runId, Date.now() + DEFAULT_LEASE_MS);
       this.launch(entry.assignment.runId, repo);
@@ -12921,7 +12946,9 @@ var RunSupervisor = class {
       } : void 0,
       fixture: assignment.fixture,
       model: assignment.model,
-      mailbox
+      mailbox,
+      // In memory only: the adapter hands it to the run's CLI environment.
+      credential: assignment.modelCredential
     };
     const resuming = entry.sessionId !== null && adapter.capabilities.supportsResume;
     const inEarlierWorktree = continued !== null || entry.worktree !== null && resolve11(entry.worktree) !== resolve11(this.deps.worktrees.pathFor(runId));
@@ -12946,8 +12973,9 @@ var RunSupervisor = class {
     const previousExecution = entry.execution;
     const previousRuntime = entry.runtime;
     let session;
+    if (assignment.subscriptionBinding && assignment.modelCredential) throw new Error("A run has one model credential");
     try {
-      session = assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
+      session = assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
         throw new Error("subscription_hosted_runtime_unavailable");
       })() : resuming ? await adapter.resume(entry.sessionId, options) : await (async () => {
         if (assignment.requireSessionResume)
@@ -13351,16 +13379,141 @@ import { randomUUID as randomUUID8 } from "node:crypto";
 import {
   existsSync as existsSync8,
   lstatSync as lstatSync10,
-  mkdirSync as mkdirSync17,
-  mkdtempSync as mkdtempSync8,
+  mkdirSync as mkdirSync18,
+  mkdtempSync as mkdtempSync9,
   readdirSync as readdirSync9,
   realpathSync as realpathSync11,
-  rmSync as rmSync19
+  rmSync as rmSync20
 } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter as delimiter3, dirname as dirname15, join as join30 } from "node:path";
+import { delimiter as delimiter3, dirname as dirname15, join as join31 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { promisify as promisify6 } from "node:util";
+
+// src/api-key-broker.ts
+import { chmodSync as chmodSync4, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync8, rmSync as rmSync19 } from "node:fs";
+import { createServer as createServer4 } from "node:http";
+import { join as join30 } from "node:path";
+import { once as once2 } from "node:events";
+var DEFAULT_BASE = { anthropic: "https://api.anthropic.com", openai: "https://api.openai.com/v1" };
+var PATHS = {
+  anthropic: /* @__PURE__ */ new Set(["/v1/messages", "/v1/messages/count_tokens"]),
+  openai: /* @__PURE__ */ new Set(["/responses", "/responses/compact"])
+};
+var FORWARD = ["content-type", "accept", "anthropic-version", "anthropic-beta", "openai-beta", "user-agent"];
+var RETURN = ["content-type", "retry-after", "request-id", "x-request-id"];
+var MAX_BODY = 32 * 1024 * 1024;
+async function createApiKeyBroker(host) {
+  const { credential, protocol } = host;
+  if (credential.kind === "provider" && credential.protocol !== protocol) throw new Error("api_key_broker_unavailable");
+  const base = new URL(credential.kind === "provider" ? credential.baseUrl : DEFAULT_BASE[protocol]);
+  if (base.protocol !== "https:" || base.username || base.password || !credential.key || /[\r\n\0]/.test(credential.key))
+    throw new Error("api_key_broker_unavailable");
+  const origin = base.href.replace(/\/+$/, "");
+  let key2 = credential.key;
+  const send = host.fetch ?? fetch;
+  await host.check();
+  mkdirSync17(host.root, { recursive: true, mode: 448 });
+  const dir = mkdtempSync8(join30(host.root, "api-key-broker-"));
+  chmodSync4(dir, 448);
+  const socket = join30(dir, "broker.sock");
+  const pending = /* @__PURE__ */ new Set();
+  let halted = false;
+  const server = createServer4(async (request, response) => {
+    const abort = new AbortController();
+    pending.add(abort);
+    response.on("close", () => {
+      if (!response.writableFinished) abort.abort();
+    });
+    try {
+      const url = new URL(request.url ?? "/", "http://broker");
+      if (halted || !key2 || request.method !== "POST" || (request.url ?? "").length > 256 || !PATHS[protocol].has(url.pathname) || url.search && url.search !== "?beta=true") {
+        response.writeHead(404, { "content-type": "application/json", "cache-control": "no-store" }).end('{"error":"not_found"}');
+        return;
+      }
+      const chunks = [];
+      let length = 0;
+      for await (const part of request) {
+        length += part.length;
+        if (length > MAX_BODY) throw new Error("request refused");
+        chunks.push(part);
+      }
+      await host.check();
+      if (halted || !key2 || abort.signal.aborted) throw new Error("request refused");
+      const headers = {};
+      for (const name of FORWARD) {
+        const value = request.headers[name];
+        if (typeof value === "string") headers[name] = value;
+      }
+      if (headers["anthropic-beta"]) {
+        const betas = headers["anthropic-beta"].split(",").map((item) => item.trim()).filter((item) => item && !item.startsWith("oauth-"));
+        if (betas.length) headers["anthropic-beta"] = betas.join(",");
+        else delete headers["anthropic-beta"];
+      }
+      if (protocol === "anthropic") headers["x-api-key"] = key2;
+      else headers.authorization = `Bearer ${key2}`;
+      const upstream = await send(origin + url.pathname + url.search, {
+        method: "POST",
+        headers,
+        body: Buffer.concat(chunks),
+        redirect: "error",
+        signal: abort.signal,
+        cache: "no-store"
+      });
+      const returned = { "cache-control": "no-store" };
+      for (const name of RETURN) {
+        const value = upstream.headers.get(name);
+        if (value) returned[name] = value;
+      }
+      response.writeHead(upstream.status, returned);
+      if (upstream.body) {
+        const reader = upstream.body.getReader();
+        try {
+          for (; ; ) {
+            const { done, value } = await reader.read();
+            if (done) break;
+            if (abort.signal.aborted) throw new Error("request cancelled");
+            if (!response.write(value)) await once2(response, "drain", { signal: abort.signal });
+          }
+        } finally {
+          await reader.cancel().catch(() => void 0);
+          reader.releaseLock();
+        }
+      }
+      response.end();
+    } catch {
+      abort.abort();
+      if (response.headersSent) response.destroy();
+      else response.writeHead(502, { "content-type": "application/json", "cache-control": "no-store" }).end(JSON.stringify({ type: "error", error: { type: "api_key_unavailable", message: "API key unavailable" } }));
+    } finally {
+      pending.delete(abort);
+    }
+  });
+  try {
+    await new Promise((resolve13, reject) => {
+      server.once("error", reject);
+      server.listen(socket, resolve13);
+    });
+    chmodSync4(socket, 384);
+  } catch {
+    key2 = void 0;
+    rmSync19(dir, { recursive: true, force: true });
+    throw new Error("api_key_broker_unavailable");
+  }
+  return {
+    socket,
+    async close() {
+      halted = true;
+      key2 = void 0;
+      for (const abort of pending) abort.abort();
+      server.closeAllConnections();
+      await new Promise((resolve13) => server.close(() => resolve13()));
+      rmSync19(dir, { recursive: true, force: true });
+    }
+  };
+}
+
+// src/subscription-hosted-runner.ts
 var exec3 = promisify6(execFile6);
 var image = HOSTED_NATIVE_IMAGE;
 var bootstrap = fileURLToPath3(
@@ -13385,8 +13538,8 @@ async function createHostedBotRunner(host) {
   }).catch(() => {
     throw unavailable3();
   });
-  const resources = join30(host.stateDir, "native-resources");
-  mkdirSync17(resources, { recursive: true, mode: 448 });
+  const resources = join31(host.stateDir, "native-resources");
+  mkdirSync18(resources, { recursive: true, mode: 448 });
   const removeResource = async (file, record) => {
     if (!/^mikka-native-(?:verify-)?[a-f0-9-]{36}$/.test(record.name) || !/^[a-f0-9-]{36}$/.test(record.nonce))
       throw unavailable3();
@@ -13406,9 +13559,9 @@ async function createHostedBotRunner(host) {
       if (record.state === "created" && /No such (?:container|object)/i.test(
         String(error.stderr)
       )) {
-        if (record.assets?.startsWith(join30(host.stateDir, "native-verify-git-")))
-          rmSync19(record.assets, { recursive: true, force: true });
-        rmSync19(file, { force: true });
+        if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
+          rmSync20(record.assets, { recursive: true, force: true });
+        rmSync20(file, { force: true });
         return;
       }
       throw new Error("native_runtime_cleanup_unconfirmed");
@@ -13417,13 +13570,13 @@ async function createHostedBotRunner(host) {
     if (labels?.["com.mikka.native.resource"] !== record.nonce || record.id && record.id !== id4)
       throw unavailable3();
     await exec3("docker", ["rm", "-f", id4], { env: bareEnv, timeout: 3e4 });
-    if (record.assets?.startsWith(join30(host.stateDir, "native-verify-git-")))
-      rmSync19(record.assets, { recursive: true, force: true });
-    rmSync19(file, { force: true });
+    if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
+      rmSync20(record.assets, { recursive: true, force: true });
+    rmSync20(file, { force: true });
   };
   for (const name of readdirSync9(resources))
     if (name.endsWith(".json")) {
-      const file = join30(resources, name);
+      const file = join31(resources, name);
       const record = readJson(file);
       if (!record) throw unavailable3();
       await removeResource(file, record);
@@ -13434,7 +13587,7 @@ async function createHostedBotRunner(host) {
     const bundled = createRequire(
       require2.resolve("@anthropic-ai/claude-agent-sdk")
     );
-    claude ??= join30(
+    claude ??= join31(
       dirname15(
         bundled.resolve(
           "@anthropic-ai/claude-agent-sdk-linux-x64/package.json"
@@ -13444,7 +13597,7 @@ async function createHostedBotRunner(host) {
     );
   } catch {
   }
-  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter3).map((dir) => join30(dir, "codex")).find((path) => existsSync8(path));
+  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter3).map((dir) => join31(dir, "codex")).find((path) => existsSync8(path));
   const binaries = { codex, claude_code: claude };
   for (const kind of ["codex", "claude_code"])
     if (binaries[kind]) {
@@ -13458,12 +13611,12 @@ async function createHostedBotRunner(host) {
   if (!binaries.codex && !binaries.claude_code) throw unavailable3();
   const command = async (worktree, script, readOnly, timeoutMs, signal) => {
     const name = `mikka-native-verify-${randomUUID8()}`;
-    const file = join30(resources, name + ".json");
+    const file = join31(resources, name + ".json");
     const resource = { name, nonce: randomUUID8(), state: "creating" };
     const timing = { createMs: 0, runMs: 0 };
     let phase = "create";
     let began = performance.now();
-    const gitCopy = mkdtempSync8(join30(host.stateDir, "native-verify-git-"));
+    const gitCopy = mkdtempSync9(join31(host.stateDir, "native-verify-git-"));
     resource.assets = gitCopy;
     try {
       const cwd = realpathSync11(worktree);
@@ -13479,7 +13632,7 @@ async function createHostedBotRunner(host) {
           "--no-checkout",
           "--",
           cwd,
-          join30(gitCopy, "repo")
+          join31(gitCopy, "repo")
         ],
         {
           env: {
@@ -13494,8 +13647,8 @@ async function createHostedBotRunner(host) {
           maxBuffer: 1024 * 1024
         }
       );
-      const safeGit = join30(gitCopy, "repo", ".git");
-      const protectedGit = lstatSync10(join30(cwd, ".git")).isFile() ? join30(cwd, ".git") : safeGit;
+      const safeGit = join31(gitCopy, "repo", ".git");
+      const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : safeGit;
       writeJsonAtomic(file, resource);
       const created = await exec3(
         "docker",
@@ -13583,7 +13736,7 @@ async function createHostedBotRunner(host) {
       };
     } finally {
       if (existsSync8(file)) await removeResource(file, resource);
-      else rmSync19(gitCopy, { recursive: true, force: true });
+      else rmSync20(gitCopy, { recursive: true, force: true });
     }
   };
   return {
@@ -13594,12 +13747,14 @@ async function createHostedBotRunner(host) {
     async start(assignment, options) {
       const gate = requireRunToolApproval(options.runId, options.toolApproval);
       const selected = assignment.subscriptionBinding;
+      const apiKey = assignment.modelCredential;
       const kind = assignment.harness;
-      if (!selected || options.runId !== assignment.runId || kind !== "codex" && kind !== "claude_code" || !binaries[kind] || selected.consumerId.length !== 36 || selected.route !== (kind === "codex" ? "codex_cli" : "claude_code_cli") || options.continueSession)
+      const protocol = kind === "codex" ? "openai" : "anthropic";
+      if (Boolean(selected) === Boolean(apiKey) || options.runId !== assignment.runId || kind !== "codex" && kind !== "claude_code" || !binaries[kind] || selected && (selected.consumerId.length !== 36 || selected.route !== (kind === "codex" ? "codex_cli" : "claude_code_cli")) || apiKey?.kind === "provider" && apiKey.protocol !== protocol || options.continueSession)
         throw unavailable3();
       const name = `mikka-native-${randomUUID8()}`;
       const nonce = randomUUID8();
-      const resourceFile = join30(resources, name + ".json");
+      const resourceFile = join31(resources, name + ".json");
       const resource = { name, nonce, state: "creating" };
       const lifetime = new AbortController();
       let closed = false;
@@ -13657,25 +13812,29 @@ async function createHostedBotRunner(host) {
       });
       try {
         await live();
-        const context = () => host.link.nativeContext(assignment.deviceId, assignment.runId, lifetime.signal);
-        const first = nativeBrokerContextSchema.parse(await context());
-        await live();
-        if (first.route !== selected.route || first.modelId !== options.model)
-          throw unavailable3();
-        const revision = first.revision;
-        const check = async () => {
-          await live();
-          const current = await context();
+        const subscription = selected ? await (async () => {
+          const context = () => host.link.nativeContext(assignment.deviceId, assignment.runId, lifetime.signal);
+          const first = nativeBrokerContextSchema.parse(await context());
           await live();
-          if (current.revision !== revision || current.accountId !== first.accountId || current.route !== first.route || current.modelId !== first.modelId)
+          if (first.route !== selected.route || first.modelId !== options.model)
             throw unavailable3();
-          return current;
-        };
+          const revision = first.revision;
+          const check2 = async () => {
+            await live();
+            const current = await context();
+            await live();
+            if (current.revision !== revision || current.accountId !== first.accountId || current.route !== first.route || current.modelId !== first.modelId)
+              throw unavailable3();
+            return current;
+          };
+          return { first, revision, check: check2 };
+        })() : void 0;
+        const check = subscription?.check ?? live;
         const paths = runPaths(host.stateDir, assignment.runId);
-        mkdirSync17(paths.runDir, { recursive: true, mode: 448 });
-        const shadow = join30(paths.runDir, "runtime-git");
-        const emptyHome = join30(paths.runDir, "git-bootstrap-home");
-        mkdirSync17(emptyHome, { recursive: true, mode: 448 });
+        mkdirSync18(paths.runDir, { recursive: true, mode: 448 });
+        const shadow = join31(paths.runDir, "runtime-git");
+        const emptyHome = join31(paths.runDir, "git-bootstrap-home");
+        mkdirSync18(emptyHome, { recursive: true, mode: 448 });
         if (!existsSync8(shadow))
           await exec3(
             "git",
@@ -13705,35 +13864,40 @@ async function createHostedBotRunner(host) {
             }
           );
         await live();
-        if (!lstatSync10(shadow).isDirectory() || !lstatSync10(join30(shadow, ".git")).isDirectory() || !realpathSync11(shadow).startsWith(realpathSync11(paths.runDir) + "/"))
+        if (!lstatSync10(shadow).isDirectory() || !lstatSync10(join31(shadow, ".git")).isDirectory() || !realpathSync11(shadow).startsWith(realpathSync11(paths.runDir) + "/"))
           throw unavailable3();
-        const ledger = join30(
+        const ledger = join31(
           host.stateDir,
           "native-ledgers",
           assignment.runId + ".json"
         );
-        const scope = {
+        const scope = selected && subscription ? {
           runId: assignment.runId,
           bindingId: selected.bindingId,
           ownerId: selected.ownerId,
           workspaceId: selected.workspaceId,
           consumerId: selected.consumerId,
           route: selected.route,
-          revision,
-          accountId: first.accountId,
-          modelId: first.modelId
-        };
-        const previous = readJson(ledger);
-        if (existsSync8(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
+          revision: subscription.revision,
+          accountId: subscription.first.accountId,
+          modelId: subscription.first.modelId
+        } : void 0;
+        const previous = scope ? readJson(ledger) : void 0;
+        if (scope && existsSync8(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
           throw unavailable3();
-        mkdirSync17(dirname15(ledger), { recursive: true, mode: 448 });
+        if (scope) mkdirSync18(dirname15(ledger), { recursive: true, mode: 448 });
         const record = async (sessionId) => {
           assertOpen();
-          writeJsonAtomic(ledger, { scope, sessionId });
+          if (scope) writeJsonAtomic(ledger, { scope, sessionId });
         };
-        brokerStarting = createNativeSubscriptionBroker({
-          root: join30(host.stateDir, "native-brokers"),
-          revision,
+        brokerStarting = apiKey ? createApiKeyBroker({
+          root: join31(host.stateDir, "native-brokers"),
+          protocol,
+          credential: apiKey,
+          check
+        }) : createNativeSubscriptionBroker({
+          root: join31(host.stateDir, "native-brokers"),
+          revision: subscription.revision,
           check,
           worker: {
             nativeRequest: async (_revision, payload, signal) => {
@@ -13759,7 +13923,7 @@ async function createHostedBotRunner(host) {
         });
         const readyBroker = await brokerStarting;
         await live();
-        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter3).map((dir) => join30(dir, "gh")).find((file) => existsSync8(file)) : void 0;
+        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter3).map((dir) => join31(dir, "gh")).find((file) => existsSync8(file)) : void 0;
         if (options.github && !githubCli) throw new Error("Install GitHub CLI (gh) in the cloud worker image");
         const githubDomains = options.github ? ["github.com", "api.github.com", new URL(options.github.endpoint).host] : [];
         const egressMaximum = runDomains(runPolicy(options.policy), [...options.networkAllow ?? [], ...githubDomains]);
@@ -13776,13 +13940,13 @@ async function createHostedBotRunner(host) {
         }
         const cwd = realpathSync11(options.cwd);
         const runDir = realpathSync11(paths.runDir);
-        const protectedGit = lstatSync10(join30(cwd, ".git")).isFile() ? join30(cwd, ".git") : join30(shadow, ".git");
+        const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : join31(shadow, ".git");
         if (!lstatSync10(runDir).isDirectory() || !runDir.startsWith(realpathSync11(host.stateDir) + "/runs/")) {
           await close();
           throw unavailable3();
         }
         const computer = assignment.computer;
-        if (computer && (!host.computerBroker || computer.ownerId !== selected.ownerId)) {
+        if (computer && (!host.computerBroker || selected && computer.ownerId !== selected.ownerId)) {
           await close();
           throw unavailable3();
         }
@@ -13830,7 +13994,7 @@ async function createHostedBotRunner(host) {
           `${MCP_SERVER_SCRIPT}:${MCP_SERVER_SCRIPT}:ro`,
           ...githubCli ? ["-v", `${githubCli}:/usr/local/bin/mikka-gh:ro`, "-v", `${GITHUB_CREDENTIAL_SCRIPT}:${GITHUB_CREDENTIAL_SCRIPT}:ro`] : [],
           "-v",
-          `${join30(dirname15(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join30(dirname15(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
+          `${join31(dirname15(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join31(dirname15(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
           "-v",
           `${readyBroker.socket}:/run/mikka-native.sock:ro`,
           ...computerGrant ? [
@@ -13873,13 +14037,13 @@ async function createHostedBotRunner(host) {
         }
         const spawnHosted = (config) => {
           assertOpen();
-          const home = join30(runDir, "runtime-home");
-          mkdirSync17(home, { recursive: true, mode: 448 });
+          const home = join31(runDir, "runtime-home");
+          mkdirSync18(home, { recursive: true, mode: 448 });
           const env = {
             ...config.env,
             HOME: kind === "claude_code" ? config.env.HOME ?? home : home,
-            PATH: `${options.github ? join30(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
-            GIT_DIR: join30(shadow, ".git"),
+            PATH: `${options.github ? join31(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
+            GIT_DIR: join31(shadow, ".git"),
             GIT_WORK_TREE: cwd,
             GIT_CONFIG_GLOBAL: "/dev/null",
             GIT_CONFIG_SYSTEM: "/dev/null",
@@ -13888,7 +14052,7 @@ async function createHostedBotRunner(host) {
           for (const [key2, value] of Object.entries(env))
             if (value !== void 0 && (/INFISICAL|E2B_API_KEY|REFRESH_TOKEN|^AWS_|^GOOGLE_|^OPENAI_|^ANTHROPIC_.*(?:KEY|TOKEN)|SECRET|PASSWORD/.test(
               key2
-            ) || key2 === "CLAUDE_CODE_OAUTH_TOKEN" && value !== placeholder))
+            ) || (key2 === "CLAUDE_CODE_OAUTH_TOKEN" || key2 === "MIKKA_MODEL_API_KEY") && value !== placeholder))
               throw unavailable3();
           const task = withTaskEnv(env, assignment.taskEnv);
           if (task.dropped.length) console.warn(`run ${assignment.runId}: skipped reserved task variables ${task.dropped.join(", ")}`);
@@ -13898,7 +14062,7 @@ async function createHostedBotRunner(host) {
             signal: AbortSignal.any([lifetime.signal, ...config.signal ? [config.signal] : []])
           });
           child.stdin.write(
-            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join30(runDir, "github", "bin") } : {} }) + "\n"
+            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join31(runDir, "github", "bin") } : {} }) + "\n"
           );
           return child;
         };
@@ -13927,19 +14091,27 @@ async function createHostedBotRunner(host) {
           };
         };
         try {
-          const adapter = kind === "codex" ? new CodexAdapter({
+          const placeholderCredential = apiKey && kind === "codex" ? { kind: "provider", protocol: "openai", baseUrl: apiKey.kind === "provider" ? apiKey.baseUrl : "https://api.openai.com/v1", key: placeholder } : void 0;
+          const adapter = apiKey ? kind === "codex" ? new CodexAdapter({ stateDir: host.stateDir, sandbox: blockedSandbox, spawnCli: codexSpawn, computerMcp }) : new ClaudeAdapter({
+            stateDir: host.stateDir,
+            computerMcp,
+            spawnHosted: (config, token) => {
+              if (token !== placeholder) throw unavailable3();
+              return spawnHosted(config);
+            }
+          }) : kind === "codex" ? new CodexAdapter({
             stateDir: host.stateDir,
             sandbox: blockedSandbox,
             spawnCli: codexSpawn,
             onHostedSession: record,
             computerMcp,
             subscriptionAuth: {
-              accountId: first.accountId,
+              accountId: subscription.first.accountId,
               verify: async () => {
                 await check();
               },
               token: async () => {
-                const current = await check();
+                const current = await subscription.check();
                 return {
                   accessToken: placeholder,
                   chatgptAccountId: current.accountId,
@@ -13957,12 +14129,12 @@ async function createHostedBotRunner(host) {
             },
             subscriptionAuth: {
               brokered: true,
-              accountId: first.accountId,
+              accountId: subscription.first.accountId,
               verify: async () => {
                 await check();
               },
               token: async () => {
-                const current = await check();
+                const current = await subscription.check();
                 return {
                   accessToken: placeholder,
                   accountId: current.accountId,
@@ -13971,7 +14143,7 @@ async function createHostedBotRunner(host) {
               }
             }
           });
-          const runtimeOptions = { ...options, ...options.github ? { githubRuntime: { nodeBinary: "/usr/local/bin/node", ghBinary: "/usr/local/bin/mikka-gh" } } : {} };
+          const runtimeOptions = { ...options, credential: placeholderCredential, ...options.github ? { githubRuntime: { nodeBinary: "/usr/local/bin/node", ghBinary: "/usr/local/bin/mikka-gh" } } : {} };
           const session = previous ? await adapter.resume(previous.sessionId, runtimeOptions) : await adapter.start(runtimeOptions);
           let checking = false;
           if (!closed) timer = setInterval(() => {
@@ -14033,8 +14205,8 @@ import {
   createHash as createHash9,
   timingSafeEqual as timingSafeEqual2
 } from "node:crypto";
-import { chmodSync as chmodSync4 } from "node:fs";
-import { createServer as createServer4 } from "node:net";
+import { chmodSync as chmodSync5 } from "node:fs";
+import { createServer as createServer5 } from "node:net";
 
 // src/computer/driver.mjs
 import { spawn as spawn6 } from "node:child_process";
@@ -14254,7 +14426,7 @@ var ComputerBroker = class {
   }
   async listen() {
     if (this.suspended) throw new Error("Broker suspended");
-    this.server = createServer4((socket) => {
+    this.server = createServer5((socket) => {
       this.sockets.add(socket);
       socket.on("close", () => this.sockets.delete(socket));
       let text3 = "", submitted = false;
@@ -14297,7 +14469,7 @@ var ComputerBroker = class {
       else this.server.listen(this.socketPath, resolve13);
     });
     if (this.transport === "tcp") this.socketPath = `tcp://127.0.0.1:${this.server.address().port}`;
-    else chmodSync4(this.socketPath, 384);
+    else chmodSync5(this.socketPath, 384);
   }
   request(token, value, signal) {
     const grant = this.grants.get(token);
@@ -14543,6 +14715,9 @@ function loadDeviceFile(raw) {
   return file;
 }
 var HARNESS_RESCAN_MS = 5 * 6e4;
+function credentialOwner(assignment) {
+  return assignment.subscriptionBinding?.ownerId ?? (assignment.modelCredential ? assignment.computer?.ownerId : void 0);
+}
 var SANDBOX_REPAIR_RETRY_MS = 60 * 6e4;
 function missingToolsUnchanged(issue) {
   return !issue?.missing.length || missingSandboxTools().length === issue.missing.length;
@@ -14618,8 +14793,8 @@ var Daemon = class {
   }
   async startInternal() {
     const { paths } = this;
-    mkdirSync18(paths.dataDir, { recursive: true, mode: 448 });
-    if (process.platform !== "win32") chmodSync5(paths.dataDir, 448);
+    mkdirSync19(paths.dataDir, { recursive: true, mode: 448 });
+    if (process.platform !== "win32") chmodSync6(paths.dataDir, 448);
     this.releaseLock = await acquireLock(
       paths.dataDir,
       paths.lock,
@@ -14632,7 +14807,7 @@ var Daemon = class {
     if (this.options.credential)
       this.saveDevice({ credential: this.options.credential });
     this.journal = new RunJournal(paths.journal);
-    this.captureUploader = new CaptureUploader((runId) => join31(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join31(paths.dataDir, "capture-pending"));
+    this.captureUploader = new CaptureUploader((runId) => join32(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join32(paths.dataDir, "capture-pending"));
     this.outbox = new Outbox(
       paths.outbox,
       this.options.link,
@@ -14649,7 +14824,7 @@ var Daemon = class {
     if (this.localComputerDriver && this.options.link.syncComputerReviews && this.options.link.localComputerAuthority) {
       this.localComputerBroker = new ComputerBroker({
         driver: this.localComputerDriver,
-        socketPath: join31(paths.dataDir, "local-computer.sock"),
+        socketPath: join32(paths.dataDir, "local-computer.sock"),
         transport: "tcp",
         permitted: (runId) => {
           const assignment = this.journal.get(runId)?.assignment;
@@ -14682,7 +14857,7 @@ var Daemon = class {
       const liveComputer = (runId, display) => {
         const entry = this.journal.get(runId);
         const computer = entry?.assignment.computer;
-        if (this.stopped || !this.registered || !computer || computer.display !== display || computer.ownerId !== entry?.assignment.subscriptionBinding?.ownerId || !this.supervisor.computerRunAllowed(runId)) throw new Error("Cloud computer run unavailable");
+        if (this.stopped || !this.registered || !computer || computer.display !== display || !entry || computer.ownerId !== credentialOwner(entry.assignment) || !this.supervisor.computerRunAllowed(runId)) throw new Error("Cloud computer run unavailable");
         return computer;
       };
       const executeOrdinary = async (current, call, display, runId, assertLive) => {
@@ -14691,7 +14866,7 @@ var Daemon = class {
       };
       this.cloudComputerBroker = new ComputerBroker({
         driver,
-        socketPath: join31(paths.dataDir, "computer.sock"),
+        socketPath: join32(paths.dataDir, "computer.sock"),
         permitted: (runId) => {
           const entry = this.journal.get(runId);
           return Boolean(!this.stopped && this.registered && entry?.assignment.computer && this.supervisor?.computerRunAllowed(runId));
@@ -14759,6 +14934,7 @@ var Daemon = class {
       worktrees: this.worktrees,
       adapters,
       startSubscription: hosted?.start ?? this.localSubscriptions()?.start,
+      startCredential: hosted?.start,
       prepareRunMailbox: this.options.link.prepareRunMailbox?.bind(this.options.link),
       prepareRunToolApproval: this.options.link.prepareRunToolApproval?.bind(this.options.link),
       verifyRunPolicy: this.options.link.verifyRunPolicy ? async (assignment, signal) => {
@@ -14818,7 +14994,7 @@ var Daemon = class {
           worktree,
           tree,
           github: { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId },
-          privateDir: join31(paths.adapterState, "pids"),
+          privateDir: join32(paths.adapterState, "pids"),
           ...hosted ? { hosted: true } : {},
           env: githubReceiptEnvironment()
         }) : publishRun({
@@ -15178,11 +15354,11 @@ var Daemon = class {
       return runVerify(sandbox, {
         command,
         worktree: realpathSync12(worktree),
-        tmpRoot: join31(this.paths.adapterState, "verify", runId),
+        tmpRoot: join32(this.paths.adapterState, "verify", runId),
         privateDir: paths.privateDir,
         pidFile: paths.pidFile.replace(/\.pgid$/, ".verify.pgid"),
         networkAllow: repo.networkAllow,
-        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join31(paths.runDir, "handoff.json") },
+        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join32(paths.runDir, "handoff.json") },
         timeoutMs,
         signal,
         readOnly
@@ -15367,7 +15543,7 @@ var Daemon = class {
           setImmediate(() => {
             void this.stop().then(() => uninstallService(() => {
               this.saveDevice({ credential: void 0 });
-              rmSync20(this.paths.secret, { force: true });
+              rmSync21(this.paths.secret, { force: true });
             })).catch(() => {
               this.options.onDrained?.();
             });
@@ -15485,7 +15661,7 @@ var Daemon = class {
         throw new DaemonError(DAEMON_RPC_ERRORS.unauthorized, message);
       }
     }
-    if (assignment.computer && (!this.cloudComputerBroker || !assignment.subscriptionBinding || assignment.computer.ownerId !== assignment.subscriptionBinding.ownerId)) throw new Error("Cloud computer runtime unavailable");
+    if (assignment.computer && (!this.cloudComputerBroker || assignment.computer.ownerId !== credentialOwner(assignment))) throw new Error("Cloud computer runtime unavailable");
     return await this.supervisor.start(assignment);
   }
   /**
@@ -15692,7 +15868,7 @@ var Daemon = class {
       if (!job || controller.signal.aborted) return;
       await runNativeCoordinatorJob(job, {
         deviceId,
-        stateDir: join31(this.paths.dataDir, "coordinator"),
+        stateDir: join32(this.paths.dataDir, "coordinator"),
         link,
         signal: controller.signal,
         sandbox,
@@ -15735,7 +15911,7 @@ var Daemon = class {
         }, void 0, () => !this.stopped);
       });
     } else if (!this.updateCheck && !this.updateVersion) {
-      this.updateCheck = checkLatestVersion(join31(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
+      this.updateCheck = checkLatestVersion(join32(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
         this.updateVersion = version;
       }).catch(() => {
         this.log.warn("Daemon automatic update check failed");