@aspectlylabs/mikka 0.0.154 → 0.0.156

package/cli.js

@@ -4480,7 +4480,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4540,7 +4540,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts
@@ -4815,7 +4815,7 @@ function classifySegment(segment, depth) {
   if (entry && verb && entry[1].includes(verb)) return "install_dependency";
   return null;
 }
-function claudePermissionRules(policy) {
+function claudePermissionRules(policy, agentDelivers = false) {
   const install2 = INSTALL_COMMANDS.flatMap(
     ([tool2, verbs]) => verbs.map((verb) => `Bash(${tool2} ${verb}:*)`)
   );
@@ -4825,7 +4825,7 @@ function claudePermissionRules(policy) {
     ask: decision === "ask" ? install2 : [],
     deny: [
       ...!rawCliShellAvailable(policy) ? ["Bash", "PowerShell", "Monitor"] : [],
-      "Bash(git push:*)",
+      ...agentDelivers && !policy.readOnly ? [] : ["Bash(git push:*)"],
       ...policy.readOnly ? READ_ONLY_TOOLS : [],
       ...decision === "deny" ? install2 : []
     ]
@@ -6115,7 +6115,7 @@ import {
   rmSync as rmSync5
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
+import { basename as basename2, dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
 
 // src/ids.ts
 var SAFE_ID = /^[A-Za-z0-9_-]{1,64}$/;
@@ -6532,12 +6532,10 @@ async function worktreeGitDir(repoPath, worktree) {
   throw new Error(`${worktree} is not a worktree of ${repoPath}`);
 }
 async function worktreeGitWritePaths(repoPath, worktree, runId) {
-  const gitDir = await worktreeGitDir(repoPath, worktree);
-  const common = resolve5(gitDir, "..", "..");
-  const branch = `mikka/run-${assertSafeId("run id", runId)}`;
-  const ref = join8(common, "refs", "heads", branch);
-  const logsRef = join8(common, "logs", "refs", "heads", branch);
-  return [gitDir, join8(common, "objects"), dirname7(ref), ref, `${ref}.lock`, dirname7(logsRef), logsRef];
+  assertSafeId("run id", runId);
+  const common = resolve5(await worktreeGitDir(repoPath, worktree), "..", "..");
+  if (basename2(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
+  return [dirname7(common)];
 }
 function safeRealpath(path) {
   try {
@@ -7014,6 +7012,16 @@ var HARNESS_DOMAINS = {
 var MCP_SERVER_SCRIPT = resolve7(import.meta.dirname, "mikka-mcp.mjs");
 var MCP_SERVER_NAME = "mikka";
 var COMPUTER_MCP_SERVER_NAME = "mikka_computer";
+var RUN_GIT_CONFIG = [["maintenance.auto", "false"], ["gc.auto", "0"]];
+function withGitConfig(env, entries) {
+  const start = Number(env.GIT_CONFIG_COUNT ?? 0);
+  const out = { ...env, GIT_CONFIG_COUNT: String(start + entries.length) };
+  entries.forEach(([key2, value], i) => {
+    out[`GIT_CONFIG_KEY_${start + i}`] = key2;
+    out[`GIT_CONFIG_VALUE_${start + i}`] = value;
+  });
+  return out;
+}
 function credentialDenyRead(harness, home = homedir4()) {
   return [
     ".ssh",
@@ -7155,6 +7163,10 @@ var RunContext = class {
         join11(this.gitDir, "commondir"),
         join11(this.gitDir, "gitdir"),
         join11(this.gitDir, "config.worktree"),
+        // sandbox-runtime's own protection of a repository's config and hooks
+        // covers repositories under the process's working directory only;
+        // the shared clone lies outside it, so it is declared here the same way.
+        ...this.options.gitWritePaths?.length ? [join11(this.gitDir, "..", "..", "config"), join11(this.gitDir, "..", "..", "hooks")] : [],
         ...readOnly ? [this.worktree, ...this.options.gitWritePaths ?? []] : []
       ],
       denyRead: [
@@ -7216,7 +7228,15 @@ var RunContext = class {
    * and zsh writes here-docs to `$TMPPREFIX` (default `/tmp/zsh`).
    */
   tempEnv() {
-    return { TMPDIR: this.tmpDir, TMPPREFIX: join11(this.tmpDir, "zsh"), ...this.githubEnv, ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+    return { TMPDIR: this.tmpDir, TMPPREFIX: join11(this.tmpDir, "zsh"), ...withGitConfig(this.githubEnv, RUN_GIT_CONFIG), ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+  }
+  /**
+   * The agent delivers this run itself: it commits, pushes to the issue
+   * branch and opens the pull request with run-scoped GitHub credentials. The
+   * server sends GitHub delivery only for a run whose push is allowed.
+   */
+  get agentDelivers() {
+    return Object.keys(this.githubEnv).length > 0;
   }
   /** A hand-in from an earlier session would end this one at once. */
   clearHandoff() {
@@ -8240,10 +8260,10 @@ function claudeSandboxSettings(policy) {
     }
   };
 }
-function claudeSettings(policy, workspace) {
+function claudeSettings(policy, workspace, agentDelivers = false) {
   return {
     sandbox: claudeSandboxSettings(policy),
-    permissions: claudePermissionRules(runPolicy(workspace))
+    permissions: claudePermissionRules(runPolicy(workspace), agentDelivers)
   };
 }
 function claudeChunks(message) {
@@ -8583,7 +8603,7 @@ var ClaudeAdapter = class {
         },
         settingSources: [],
         settings: {
-          ...claudeSettings(ctx.policy(), options.policy),
+          ...claudeSettings(ctx.policy(), options.policy, ctx.agentDelivers),
           // The official runtime launcher encloses the entire CLI. Nesting
           // the CLI's Bash-only sandbox is unsupported on macOS.
           ...outerLocal ? { sandbox: { enabled: false, allowUnsandboxedCommands: true, autoAllowBashIfSandboxed: false } } : {},
@@ -9438,7 +9458,7 @@ var CodexAdapter = class {
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
 import { join as join16 } from "node:path";
-function acpPermissionResponse(params, policy) {
+function acpPermissionResponse(params, policy, agentDelivers = false) {
   const pick = (kinds) => {
     for (const kind of kinds) {
       const option = params.options.find((o) => o.kind === kind);
@@ -9450,7 +9470,7 @@ function acpPermissionResponse(params, policy) {
   const raw = params.toolCall.rawInput;
   const command = Array.isArray(raw?.command) ? raw.command.join(" ") : typeof raw?.command === "string" ? raw.command : params.toolCall.title ?? "";
   const action = classifyCommand(command);
-  const refused = action === "git_push" || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
+  const refused = action === "git_push" && !agentDelivers || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
   if (refused)
     return { response: pick(["reject_once", "reject_always"]), refused };
   const allowed = pick(["allow_always", "allow_once"]);
@@ -9633,7 +9653,8 @@ var CursorAdapter = class {
         async requestPermission(params) {
           const { response, refused } = acpPermissionResponse(
             params,
-            options.policy
+            options.policy,
+            ctx.agentDelivers
           );
           if (refused)
             log.info(
@@ -10226,7 +10247,7 @@ import { SandboxManager as SandboxManager2 } from "@anthropic-ai/sandbox-runtime
 import { execFile as execFile3 } from "node:child_process";
 import { readdir as readdir2, realpath, stat } from "node:fs/promises";
 import { homedir as homedir5, platform } from "node:os";
-import { basename as basename2, dirname as dirname11, isAbsolute as isAbsolute5, join as join19, resolve as resolve9 } from "node:path";
+import { basename as basename3, dirname as dirname11, isAbsolute as isAbsolute5, join as join19, resolve as resolve9 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 var run = promisify3(execFile3);
 async function git(cwd, args) {
@@ -10312,7 +10333,7 @@ async function browseFolder(request) {
   return {
     ok: true,
     path,
-    parent: parent === path || basename2(path) === "" ? null : parent,
+    parent: parent === path || basename3(path) === "" ? null : parent,
     home,
     platform: platform(),
     entries: folders,

package/client.js

@@ -3741,7 +3741,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3801,7 +3801,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts

package/http-link.js

@@ -4144,7 +4144,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4204,7 +4204,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts

package/login.js

@@ -3748,7 +3748,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3808,7 +3808,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts

package/main.js

@@ -2665,7 +2665,7 @@ import {
   rmSync as rmSync4
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
+import { basename, dirname as dirname3, join as join3, resolve as resolve2 } from "node:path";
 
 // src/ids.ts
 var SAFE_ID = /^[A-Za-z0-9_-]{1,64}$/;
@@ -3082,12 +3082,10 @@ async function worktreeGitDir(repoPath, worktree) {
   throw new Error(`${worktree} is not a worktree of ${repoPath}`);
 }
 async function worktreeGitWritePaths(repoPath, worktree, runId) {
-  const gitDir = await worktreeGitDir(repoPath, worktree);
-  const common = resolve2(gitDir, "..", "..");
-  const branch = `mikka/run-${assertSafeId("run id", runId)}`;
-  const ref = join3(common, "refs", "heads", branch);
-  const logsRef = join3(common, "logs", "refs", "heads", branch);
-  return [gitDir, join3(common, "objects"), dirname3(ref), ref, `${ref}.lock`, dirname3(logsRef), logsRef];
+  assertSafeId("run id", runId);
+  const common = resolve2(await worktreeGitDir(repoPath, worktree), "..", "..");
+  if (basename(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
+  return [dirname3(common)];
 }
 function safeRealpath(path) {
   try {
@@ -3787,7 +3785,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3847,7 +3845,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts
@@ -3890,7 +3888,7 @@ function daemonPaths(dataDir) {
 // src/permissions.ts
 import { lstatSync as lstatSync5, readlinkSync, realpathSync as realpathSync5 } from "node:fs";
 import {
-  basename,
+  basename as basename2,
   dirname as dirname4,
   isAbsolute as isAbsolute2,
   join as join6,
@@ -3961,7 +3959,7 @@ function classifySegment(segment, depth) {
       words.shift();
       continue;
     }
-    if (WRAPPERS.has(basename(words[0]))) {
+    if (WRAPPERS.has(basename2(words[0]))) {
       words.shift();
       while (words.length && words[0].startsWith("-")) {
         const option = words.shift();
@@ -3973,7 +3971,7 @@ function classifySegment(segment, depth) {
   }
   const [tool2, verb] = words;
   if (!tool2) return null;
-  const name = basename(tool2);
+  const name = basename2(tool2);
   if (SHELLS.has(name) && depth < 3) {
     const index = words.findIndex((word) => word === "--command" || /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
     if (index !== -1) {
@@ -3987,7 +3985,7 @@ function classifySegment(segment, depth) {
   if (entry && verb && entry[1].includes(verb)) return "install_dependency";
   return null;
 }
-function claudePermissionRules(policy) {
+function claudePermissionRules(policy, agentDelivers = false) {
   const install2 = INSTALL_COMMANDS.flatMap(
     ([tool2, verbs]) => verbs.map((verb) => `Bash(${tool2} ${verb}:*)`)
   );
@@ -3997,7 +3995,7 @@ function claudePermissionRules(policy) {
     ask: decision === "ask" ? install2 : [],
     deny: [
       ...!rawCliShellAvailable(policy) ? ["Bash", "PowerShell", "Monitor"] : [],
-      "Bash(git push:*)",
+      ...agentDelivers && !policy.readOnly ? [] : ["Bash(git push:*)"],
       ...policy.readOnly ? READ_ONLY_TOOLS : [],
       ...decision === "deny" ? install2 : []
     ]
@@ -4037,7 +4035,7 @@ function realTarget(path) {
       }
       const parent = dirname4(current);
       if (parent === current) return path;
-      missing.push(basename(current));
+      missing.push(basename2(current));
       current = parent;
     }
   }
@@ -5799,6 +5797,16 @@ var HARNESS_DOMAINS = {
 var MCP_SERVER_SCRIPT = resolve5(import.meta.dirname, "mikka-mcp.mjs");
 var MCP_SERVER_NAME = "mikka";
 var COMPUTER_MCP_SERVER_NAME = "mikka_computer";
+var RUN_GIT_CONFIG = [["maintenance.auto", "false"], ["gc.auto", "0"]];
+function withGitConfig(env, entries) {
+  const start = Number(env.GIT_CONFIG_COUNT ?? 0);
+  const out = { ...env, GIT_CONFIG_COUNT: String(start + entries.length) };
+  entries.forEach(([key2, value], i) => {
+    out[`GIT_CONFIG_KEY_${start + i}`] = key2;
+    out[`GIT_CONFIG_VALUE_${start + i}`] = value;
+  });
+  return out;
+}
 function credentialDenyRead(harness, home = homedir2()) {
   return [
     ".ssh",
@@ -5940,6 +5948,10 @@ var RunContext = class {
         join8(this.gitDir, "commondir"),
         join8(this.gitDir, "gitdir"),
         join8(this.gitDir, "config.worktree"),
+        // sandbox-runtime's own protection of a repository's config and hooks
+        // covers repositories under the process's working directory only;
+        // the shared clone lies outside it, so it is declared here the same way.
+        ...this.options.gitWritePaths?.length ? [join8(this.gitDir, "..", "..", "config"), join8(this.gitDir, "..", "..", "hooks")] : [],
         ...readOnly ? [this.worktree, ...this.options.gitWritePaths ?? []] : []
       ],
       denyRead: [
@@ -6001,7 +6013,15 @@ var RunContext = class {
    * and zsh writes here-docs to `$TMPPREFIX` (default `/tmp/zsh`).
    */
   tempEnv() {
-    return { TMPDIR: this.tmpDir, TMPPREFIX: join8(this.tmpDir, "zsh"), ...this.githubEnv, ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+    return { TMPDIR: this.tmpDir, TMPPREFIX: join8(this.tmpDir, "zsh"), ...withGitConfig(this.githubEnv, RUN_GIT_CONFIG), ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+  }
+  /**
+   * The agent delivers this run itself: it commits, pushes to the issue
+   * branch and opens the pull request with run-scoped GitHub credentials. The
+   * server sends GitHub delivery only for a run whose push is allowed.
+   */
+  get agentDelivers() {
+    return Object.keys(this.githubEnv).length > 0;
   }
   /** A hand-in from an earlier session would end this one at once. */
   clearHandoff() {
@@ -7060,10 +7080,10 @@ function claudeSandboxSettings(policy) {
     }
   };
 }
-function claudeSettings(policy, workspace) {
+function claudeSettings(policy, workspace, agentDelivers = false) {
   return {
     sandbox: claudeSandboxSettings(policy),
-    permissions: claudePermissionRules(runPolicy(workspace))
+    permissions: claudePermissionRules(runPolicy(workspace), agentDelivers)
   };
 }
 function claudeChunks(message) {
@@ -7403,7 +7423,7 @@ var ClaudeAdapter = class {
         },
         settingSources: [],
         settings: {
-          ...claudeSettings(ctx.policy(), options.policy),
+          ...claudeSettings(ctx.policy(), options.policy, ctx.agentDelivers),
           // The official runtime launcher encloses the entire CLI. Nesting
           // the CLI's Bash-only sandbox is unsupported on macOS.
           ...outerLocal ? { sandbox: { enabled: false, allowUnsandboxedCommands: true, autoAllowBashIfSandboxed: false } } : {},
@@ -8258,7 +8278,7 @@ var CodexAdapter = class {
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
 import { join as join13 } from "node:path";
-function acpPermissionResponse(params, policy) {
+function acpPermissionResponse(params, policy, agentDelivers = false) {
   const pick = (kinds) => {
     for (const kind of kinds) {
       const option = params.options.find((o) => o.kind === kind);
@@ -8270,7 +8290,7 @@ function acpPermissionResponse(params, policy) {
   const raw = params.toolCall.rawInput;
   const command = Array.isArray(raw?.command) ? raw.command.join(" ") : typeof raw?.command === "string" ? raw.command : params.toolCall.title ?? "";
   const action = classifyCommand(command);
-  const refused = action === "git_push" || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
+  const refused = action === "git_push" && !agentDelivers || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
   if (refused)
     return { response: pick(["reject_once", "reject_always"]), refused };
   const allowed = pick(["allow_always", "allow_once"]);
@@ -8453,7 +8473,8 @@ var CursorAdapter = class {
         async requestPermission(params) {
           const { response, refused } = acpPermissionResponse(
             params,
-            options.policy
+            options.policy,
+            ctx.agentDelivers
           );
           if (refused)
             log.info(
@@ -9046,7 +9067,7 @@ import { SandboxManager as SandboxManager2 } from "@anthropic-ai/sandbox-runtime
 import { execFile } from "node:child_process";
 import { readdir as readdir2, realpath, stat } from "node:fs/promises";
 import { homedir as homedir3, platform } from "node:os";
-import { basename as basename2, dirname as dirname9, isAbsolute as isAbsolute5, join as join16, resolve as resolve7 } from "node:path";
+import { basename as basename3, dirname as dirname9, isAbsolute as isAbsolute5, join as join16, resolve as resolve7 } from "node:path";
 import { promisify } from "node:util";
 var run = promisify(execFile);
 async function git(cwd, args) {
@@ -9132,7 +9153,7 @@ async function browseFolder(request) {
   return {
     ok: true,
     path,
-    parent: parent === path || basename2(path) === "" ? null : parent,
+    parent: parent === path || basename3(path) === "" ? null : parent,
     home,
     platform: platform(),
     entries: folders,

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "d0202e732423480928c02e91adce73bfcaa58f90",
+  "sourceSha": "3fe02256b52ef29ce2581173987f01d3b2054448",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41301616580",
+  "buildRunId": "41301873626",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "c99f1e4f641d8e004cfe807653478e10f91e53fcf47102add5f4c154cdc1cb57",
-  "createdAt": "2026-11-01T11:24:42.088Z",
+  "createdAt": "2026-11-01T11:34:59.039Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -40,13 +40,13 @@
     },
     {
       "path": "cli.js",
-      "size": 648726,
-      "sha256": "1dd251f6c3cb66b7bfe24639b9304069051f5236fd6c6080fc2fd882c962534c"
+      "size": 649906,
+      "sha256": "ea0a5d8f7d1729d9a7febf4a1474182ea867594b08bba034046ce9e1660ea88a"
     },
     {
       "path": "client.js",
       "size": 141206,
-      "sha256": "377c2d2b7b07e582c4ae6dc40e0544f8067c10de99852208cd300c89c583c198"
+      "sha256": "186de19be0c69837ec16496844d3fce1054404df99236b0c632751ae004a6d9f"
     },
     {
       "path": "computer/driver.mjs",
@@ -176,7 +176,7 @@
     {
       "path": "http-link.js",
       "size": 182550,
-      "sha256": "5a0dfc5997254175ab653f60394b3691d394c369a01790085804d05c5fb76d4c"
+      "sha256": "b16fcb4cc7efaeb1d01b7737d7d398736c080e99b77510f42539c00cde8865a7"
     },
     {
       "path": "log.js",
@@ -186,12 +186,12 @@
     {
       "path": "login.js",
       "size": 145941,
-      "sha256": "ecfae2e89a895ff8d04b3b3db95ac6358ccce9ec0878f8c8c28173f2c04fa5db"
+      "sha256": "fc3edd9d7e5c7d59028e288c6f18c1f53380da713b49a63476d0742e2aabf1d0"
     },
     {
       "path": "main.js",
-      "size": 594252,
-      "sha256": "67911e1330b8a82be97ebc9c0442ba7ac1ee3ee5a4f611f19d50b5607a41b2bb"
+      "size": 595432,
+      "sha256": "056bb0f88e08eacfdc643f775a2d101593e0f722d076006515358c05f99f8b90"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -200,23 +200,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 648742,
-      "sha256": "f64d7ea79daf514ceaab7a8a148e5f56527651de15118d7c7e22ccd0488b3911"
+      "size": 649922,
+      "sha256": "8e03efbabb2d9a8ff443ebfbab63fd859e4b05fff4340f8543d3003eb0731053"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78117,
-      "sha256": "5766de72f85da7c99eae90ec4d1d224ad1e8bbb9478a9931b56583f302bf0f39"
+      "sha256": "7a9077f4872f82c1b74dab4c0d5abe22862bcc4cf0b349560439bd51df7f1c11"
     },
     {
       "path": "package.json",
       "size": 1247,
-      "sha256": "634c2e055b5adbace810c43d3d9db0debc848629ffb517a24a0594d8334dab36"
+      "sha256": "10cd534abaa4aedba3968f2000a3dfe0738ef5af654a76567b15edfbdb9a1db4"
     },
     {
       "path": "paths.js",
       "size": 4138,
-      "sha256": "0822e291361365bc8db2e9faf78efb4d9b55e1da4e717c836515826dde609e8d"
+      "sha256": "3f687c02d1b5442dd6243b682e8d2db4902bdf4354e4fe9b9507ff3966b9e27d"
     },
     {
       "path": "sandbox.js",
@@ -226,7 +226,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144314,
-      "sha256": "14fc7dc44acb9e8479fd6afdb345f05a008c36cab586c00f65b0d78146a197ea"
+      "sha256": "93003336a8e6c7f2520b064b5250af5188aad04e25550daee8d6fdf89164ff17"
     }
   ]
 }

package/mikka.js

@@ -4481,7 +4481,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4541,7 +4541,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts
@@ -4816,7 +4816,7 @@ function classifySegment(segment, depth) {
   if (entry && verb && entry[1].includes(verb)) return "install_dependency";
   return null;
 }
-function claudePermissionRules(policy) {
+function claudePermissionRules(policy, agentDelivers = false) {
   const install2 = INSTALL_COMMANDS.flatMap(
     ([tool2, verbs]) => verbs.map((verb) => `Bash(${tool2} ${verb}:*)`)
   );
@@ -4826,7 +4826,7 @@ function claudePermissionRules(policy) {
     ask: decision === "ask" ? install2 : [],
     deny: [
       ...!rawCliShellAvailable(policy) ? ["Bash", "PowerShell", "Monitor"] : [],
-      "Bash(git push:*)",
+      ...agentDelivers && !policy.readOnly ? [] : ["Bash(git push:*)"],
       ...policy.readOnly ? READ_ONLY_TOOLS : [],
       ...decision === "deny" ? install2 : []
     ]
@@ -6116,7 +6116,7 @@ import {
   rmSync as rmSync5
 } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
+import { basename as basename2, dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
 
 // src/ids.ts
 var SAFE_ID = /^[A-Za-z0-9_-]{1,64}$/;
@@ -6533,12 +6533,10 @@ async function worktreeGitDir(repoPath, worktree) {
   throw new Error(`${worktree} is not a worktree of ${repoPath}`);
 }
 async function worktreeGitWritePaths(repoPath, worktree, runId) {
-  const gitDir = await worktreeGitDir(repoPath, worktree);
-  const common = resolve5(gitDir, "..", "..");
-  const branch = `mikka/run-${assertSafeId("run id", runId)}`;
-  const ref = join8(common, "refs", "heads", branch);
-  const logsRef = join8(common, "logs", "refs", "heads", branch);
-  return [gitDir, join8(common, "objects"), dirname7(ref), ref, `${ref}.lock`, dirname7(logsRef), logsRef];
+  assertSafeId("run id", runId);
+  const common = resolve5(await worktreeGitDir(repoPath, worktree), "..", "..");
+  if (basename2(common) !== ".git") throw new Error(`${repoPath} is not a standard clone`);
+  return [dirname7(common)];
 }
 function safeRealpath(path) {
   try {
@@ -7015,6 +7013,16 @@ var HARNESS_DOMAINS = {
 var MCP_SERVER_SCRIPT = resolve7(import.meta.dirname, "mikka-mcp.mjs");
 var MCP_SERVER_NAME = "mikka";
 var COMPUTER_MCP_SERVER_NAME = "mikka_computer";
+var RUN_GIT_CONFIG = [["maintenance.auto", "false"], ["gc.auto", "0"]];
+function withGitConfig(env, entries) {
+  const start = Number(env.GIT_CONFIG_COUNT ?? 0);
+  const out = { ...env, GIT_CONFIG_COUNT: String(start + entries.length) };
+  entries.forEach(([key2, value], i) => {
+    out[`GIT_CONFIG_KEY_${start + i}`] = key2;
+    out[`GIT_CONFIG_VALUE_${start + i}`] = value;
+  });
+  return out;
+}
 function credentialDenyRead(harness, home = homedir4()) {
   return [
     ".ssh",
@@ -7156,6 +7164,10 @@ var RunContext = class {
         join11(this.gitDir, "commondir"),
         join11(this.gitDir, "gitdir"),
         join11(this.gitDir, "config.worktree"),
+        // sandbox-runtime's own protection of a repository's config and hooks
+        // covers repositories under the process's working directory only;
+        // the shared clone lies outside it, so it is declared here the same way.
+        ...this.options.gitWritePaths?.length ? [join11(this.gitDir, "..", "..", "config"), join11(this.gitDir, "..", "..", "hooks")] : [],
         ...readOnly ? [this.worktree, ...this.options.gitWritePaths ?? []] : []
       ],
       denyRead: [
@@ -7217,7 +7229,15 @@ var RunContext = class {
    * and zsh writes here-docs to `$TMPPREFIX` (default `/tmp/zsh`).
    */
   tempEnv() {
-    return { TMPDIR: this.tmpDir, TMPPREFIX: join11(this.tmpDir, "zsh"), ...this.githubEnv, ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+    return { TMPDIR: this.tmpDir, TMPPREFIX: join11(this.tmpDir, "zsh"), ...withGitConfig(this.githubEnv, RUN_GIT_CONFIG), ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
+  }
+  /**
+   * The agent delivers this run itself: it commits, pushes to the issue
+   * branch and opens the pull request with run-scoped GitHub credentials. The
+   * server sends GitHub delivery only for a run whose push is allowed.
+   */
+  get agentDelivers() {
+    return Object.keys(this.githubEnv).length > 0;
   }
   /** A hand-in from an earlier session would end this one at once. */
   clearHandoff() {
@@ -8241,10 +8261,10 @@ function claudeSandboxSettings(policy) {
     }
   };
 }
-function claudeSettings(policy, workspace) {
+function claudeSettings(policy, workspace, agentDelivers = false) {
   return {
     sandbox: claudeSandboxSettings(policy),
-    permissions: claudePermissionRules(runPolicy(workspace))
+    permissions: claudePermissionRules(runPolicy(workspace), agentDelivers)
   };
 }
 function claudeChunks(message) {
@@ -8584,7 +8604,7 @@ var ClaudeAdapter = class {
         },
         settingSources: [],
         settings: {
-          ...claudeSettings(ctx.policy(), options.policy),
+          ...claudeSettings(ctx.policy(), options.policy, ctx.agentDelivers),
           // The official runtime launcher encloses the entire CLI. Nesting
           // the CLI's Bash-only sandbox is unsupported on macOS.
           ...outerLocal ? { sandbox: { enabled: false, allowUnsandboxedCommands: true, autoAllowBashIfSandboxed: false } } : {},
@@ -9439,7 +9459,7 @@ var CodexAdapter = class {
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
 import { join as join16 } from "node:path";
-function acpPermissionResponse(params, policy) {
+function acpPermissionResponse(params, policy, agentDelivers = false) {
   const pick = (kinds) => {
     for (const kind of kinds) {
       const option = params.options.find((o) => o.kind === kind);
@@ -9451,7 +9471,7 @@ function acpPermissionResponse(params, policy) {
   const raw = params.toolCall.rawInput;
   const command = Array.isArray(raw?.command) ? raw.command.join(" ") : typeof raw?.command === "string" ? raw.command : params.toolCall.title ?? "";
   const action = classifyCommand(command);
-  const refused = action === "git_push" || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
+  const refused = action === "git_push" && !agentDelivers || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
   if (refused)
     return { response: pick(["reject_once", "reject_always"]), refused };
   const allowed = pick(["allow_always", "allow_once"]);
@@ -9634,7 +9654,8 @@ var CursorAdapter = class {
         async requestPermission(params) {
           const { response, refused } = acpPermissionResponse(
             params,
-            options.policy
+            options.policy,
+            ctx.agentDelivers
           );
           if (refused)
             log.info(
@@ -10227,7 +10248,7 @@ import { SandboxManager as SandboxManager2 } from "@anthropic-ai/sandbox-runtime
 import { execFile as execFile3 } from "node:child_process";
 import { readdir as readdir2, realpath, stat } from "node:fs/promises";
 import { homedir as homedir5, platform } from "node:os";
-import { basename as basename2, dirname as dirname11, isAbsolute as isAbsolute5, join as join19, resolve as resolve9 } from "node:path";
+import { basename as basename3, dirname as dirname11, isAbsolute as isAbsolute5, join as join19, resolve as resolve9 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 var run = promisify3(execFile3);
 async function git(cwd, args) {
@@ -10313,7 +10334,7 @@ async function browseFolder(request) {
   return {
     ok: true,
     path,
-    parent: parent === path || basename2(path) === "" ? null : parent,
+    parent: parent === path || basename3(path) === "" ? null : parent,
     home,
     platform: platform(),
     entries: folders,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.154",
+  "version": "0.0.156",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.154",
+      "version": "0.0.156",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.154",
+  "version": "0.0.156",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "d0202e732423480928c02e91adce73bfcaa58f90",
+  "gitHead": "3fe02256b52ef29ce2581173987f01d3b2054448",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.154",
+  version: "0.0.156",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -66,7 +66,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "d0202e732423480928c02e91adce73bfcaa58f90"
+  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:eb1697db-3201-4fa1-b522-b4e2b2fa3ab0",
+  "serialNumber": "urn:uuid:8d063e4c-21da-49c9-a7fa-c1346a8fad06",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-01T11:24:41.150Z",
+    "timestamp": "2026-11-01T11:34:58.062Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.154",
+      "bom-ref": "@aspectlylabs/mikka@0.0.156",
       "type": "library",
-      "name": ".retained-build-WI5HWa",
-      "version": "0.0.154",
+      "name": ".retained-build-SsBNoF",
+      "version": "0.0.156",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.154",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.156",
       "properties": [],
       "externalReferences": [
         {
@@ -4627,7 +4627,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.154",
+      "ref": "@aspectlylabs/mikka@0.0.156",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",