@aspectlylabs/mikka 0.0.155 → 0.0.157

package/cli.js

@@ -4480,7 +4480,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.155",
+  version: "0.0.157",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4540,7 +4540,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "a0295ff9031591fc84944f77c47074e8345d129e"
+  gitHead: "6b1b0ad1cf20baee870da2c08c5d57c49a02daba"
 };
 
 // src/paths.ts
@@ -4815,7 +4815,7 @@ function classifySegment(segment, depth) {
   if (entry && verb && entry[1].includes(verb)) return "install_dependency";
   return null;
 }
-function claudePermissionRules(policy) {
+function claudePermissionRules(policy, agentDelivers = false) {
   const install2 = INSTALL_COMMANDS.flatMap(
     ([tool2, verbs]) => verbs.map((verb) => `Bash(${tool2} ${verb}:*)`)
   );
@@ -4825,7 +4825,7 @@ function claudePermissionRules(policy) {
     ask: decision === "ask" ? install2 : [],
     deny: [
       ...!rawCliShellAvailable(policy) ? ["Bash", "PowerShell", "Monitor"] : [],
-      "Bash(git push:*)",
+      ...agentDelivers && !policy.readOnly ? [] : ["Bash(git push:*)"],
       ...policy.readOnly ? READ_ONLY_TOOLS : [],
       ...decision === "deny" ? install2 : []
     ]
@@ -4881,11 +4881,251 @@ function classifyWrite(worktree, target) {
   return ok2 ? "write_in_worktree" : "write_outside_repo";
 }
 
+// src/agents/run-sandbox-launcher.ts
+import { spawn } from "node:child_process";
+import { isIP } from "node:net";
+import { isAbsolute as isAbsolute2 } from "node:path";
+import { fileURLToPath } from "node:url";
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+var MAX_PENDING_NETWORK = 128;
+var NETWORK_DECISION_MS = 5 * 6e4;
+function canonicalHost(host) {
+  if (!host || /[\s\x00-\x1f\x7f%\\/@?#*]/u.test(host)) return;
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  if (isIP(bare) === 6) return new URL(`http://[${bare}]`).hostname.slice(1, -1);
+  if (bare.includes(":")) return;
+  try {
+    return new URL(`http://${bare}`).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function matchesRunSandboxDomain(request, domains) {
+  const host = canonicalHost(request.host);
+  if (!host || !Number.isInteger(request.port) || request.port < 1 || request.port > 65535) return false;
+  return domains.some((entry) => {
+    if (entry === "*") return true;
+    const parts = /^(\[[^\]]+\]|[^:]+?)(?::([1-9][0-9]{0,4}))?$/u.exec(entry);
+    if (!parts || parts[2] !== void 0 && (Number(parts[2]) > 65535 || Number(parts[2]) !== request.port)) return false;
+    const wildcard = parts[1].startsWith("*.");
+    const pattern = canonicalHost(wildcard ? parts[1].slice(2) : parts[1]);
+    if (!pattern) return false;
+    if (!wildcard) return host === pattern;
+    return !isIP(host) && pattern.includes(".") && host.endsWith(`.${pattern}`);
+  });
+}
+function signalGroup(pid, signal) {
+  if (pid === void 0) return;
+  try {
+    process.kill(-pid, signal);
+  } catch (error) {
+    if (error.code !== "ESRCH") throw error;
+  }
+}
+function spawnRunSandbox(options) {
+  if (process.platform !== "linux" && process.platform !== "darwin") {
+    throw new Error("run sandbox launcher requires Linux or macOS process groups");
+  }
+  if (!options.command || options.command.includes("\0") || !isAbsolute2(options.cwd)) {
+    throw new Error("run sandbox requires a command and absolute cwd");
+  }
+  if (options.authToken !== void 0 && (!options.authToken || Buffer.byteLength(options.authToken) > 1048576)) {
+    throw new Error("invalid run sandbox auth pipe payload length");
+  }
+  const maximum = Object.freeze([...options.maxAllowDomains]);
+  const modelApiDomains = Object.freeze([...options.modelApiDomains ?? []]);
+  NetworkConfigSchema.parse({ allowedDomains: maximum.filter((entry) => entry !== "*"), deniedDomains: [] });
+  NetworkConfigSchema.parse({ allowedDomains: [...modelApiDomains], deniedDomains: [] });
+  const onNetwork = options.onNetwork;
+  const abortSignal = options.signal;
+  const launch = {
+    type: "init",
+    command: options.command,
+    args: [...options.args],
+    cwd: options.cwd,
+    env: { ...options.env },
+    policy: {
+      allowWrite: [...options.policy.allowWrite],
+      denyWrite: [...options.policy.denyWrite ?? []],
+      denyRead: [...options.policy.denyRead ?? []]
+    },
+    maxAllowDomains: [...maximum],
+    modelApiDomains: [...modelApiDomains],
+    hasAuthToken: options.authToken !== void 0
+  };
+  const child = spawn(process.execPath, [fileURLToPath(new URL("./run-sandbox-worker.mjs", import.meta.url))], {
+    // Runtime helpers use the trusted daemon's environment. CLI env arrives
+    // over IPC and is passed explicitly by the worker, without inheritance.
+    env: process.env,
+    cwd: options.cwd,
+    stdio: ["pipe", "pipe", "pipe", "pipe", "ipc"],
+    detached: true
+  });
+  const lifetime = new AbortController();
+  const pending = /* @__PURE__ */ new Map();
+  let stderr = "";
+  let stopped = false;
+  let gone = false;
+  let outcome;
+  let hardStop;
+  let settle;
+  const exited = new Promise((resolve13) => {
+    settle = resolve13;
+  });
+  function send(message) {
+    if (!child.connected || gone) return;
+    child.send(message, (error) => {
+      if (error) stop(0);
+    });
+  }
+  function stop(graceMs = 3e3) {
+    if (gone) return;
+    if (!stopped) {
+      stopped = true;
+      lifetime.abort();
+      for (const request of pending.values()) {
+        clearTimeout(request.timer);
+        request.controller.abort();
+      }
+      pending.clear();
+      send({ type: "stop", graceMs });
+    }
+    if (!hardStop) hardStop = setTimeout(() => {
+      stderr += "\nrun sandbox worker did not stop; terminating its process group";
+      try {
+        signalGroup(child.pid, "SIGKILL");
+      } catch (error) {
+        stderr += `
+run sandbox group termination failed: ${String(error)}`;
+      }
+    }, Math.max(0, Math.min(graceMs, 3e4)) + 5e3);
+  }
+  child.stderr.on("data", (data) => {
+    stderr = (stderr + data.toString()).slice(-16e3);
+  });
+  child.stdin.on("error", () => void 0);
+  child.on("message", (message) => {
+    if (!message || typeof message !== "object") return;
+    const value = message;
+    if (value.type === "finished") {
+      if ((value.code === null || Number.isInteger(value.code)) && (value.signal === null || typeof value.signal === "string")) {
+        outcome = { code: value.code, signal: value.signal };
+      }
+      return;
+    }
+    if (value.type !== "network" || !Number.isSafeInteger(value.id) || value.id < 1 || pending.has(value.id)) return;
+    const id4 = value.id;
+    const request = {
+      host: typeof value.host === "string" ? value.host : "",
+      port: typeof value.port === "number" ? value.port : 0
+    };
+    if (typeof value.port !== "number" || stopped || lifetime.signal.aborted || pending.size >= MAX_PENDING_NETWORK || !matchesRunSandboxDomain(request, maximum)) {
+      send({ type: "decision", id: id4, allow: false });
+      return;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+      if (!pending.delete(id4)) return;
+      controller.abort();
+      send({ type: "decision", id: id4, allow: false });
+    }, NETWORK_DECISION_MS);
+    pending.set(id4, { controller, timer });
+    void Promise.resolve().then(() => {
+      if (stopped || lifetime.signal.aborted) return false;
+      return onNetwork(request, controller.signal);
+    }).then((allow) => {
+      if (!pending.delete(id4)) return;
+      clearTimeout(timer);
+      send({ type: "decision", id: id4, allow: allow === true && !stopped && !lifetime.signal.aborted && !controller.signal.aborted });
+    }, () => {
+      if (pending.delete(id4)) {
+        clearTimeout(timer);
+        send({ type: "decision", id: id4, allow: false });
+      }
+    });
+  });
+  function onParentExit() {
+    try {
+      signalGroup(child.pid, "SIGKILL");
+    } catch {
+    }
+  }
+  process.once("exit", onParentExit);
+  function finish(code, signal) {
+    if (gone) return;
+    gone = true;
+    stopped = true;
+    lifetime.abort();
+    for (const request of pending.values()) {
+      clearTimeout(request.timer);
+      request.controller.abort();
+    }
+    pending.clear();
+    clearTimeout(hardStop);
+    abortSignal?.removeEventListener("abort", onAbort);
+    process.removeListener("exit", onParentExit);
+    try {
+      signalGroup(child.pid, "SIGKILL");
+    } catch (error) {
+      stderr += `
+run sandbox group cleanup failed: ${String(error)}`;
+    }
+    settle(outcome ?? { code, signal });
+  }
+  child.once("error", (error) => {
+    stderr += `
+${error.message}`;
+    stop(0);
+    if (child.pid === void 0) finish(null, null);
+  });
+  child.once("exit", finish);
+  child.once("disconnect", () => {
+    if (!outcome) stop(0);
+  });
+  const authPipe = child.stdio[3];
+  authPipe.on("error", () => stop(0));
+  authPipe.end(options.authToken);
+  function onAbort() {
+    stop(0);
+  }
+  abortSignal?.addEventListener("abort", onAbort, { once: true });
+  child.kill = (signal = "SIGTERM") => {
+    if (gone) return false;
+    if (signal === 0) {
+      try {
+        process.kill(child.pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    stop(signal === "SIGKILL" ? 0 : 3e3);
+    return true;
+  };
+  Object.defineProperty(child, "killed", { get: () => stopped });
+  if (abortSignal?.aborted) stop(0);
+  else send(launch);
+  return {
+    process: child,
+    exited,
+    stderrTail: () => stderr.slice(-4e3).trim(),
+    async kill(graceMs = 3e3) {
+      stop(graceMs);
+      await exited;
+    },
+    async revoke() {
+      stop(0);
+      await exited;
+    }
+  };
+}
+
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree, apps = []) {
+function toolApprovalDecision(request, policy, worktree, apps = [], runHosts = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
+    if (policy.permissions.network === "ask" && matchesRunSandboxDomain({ host: value.host, port: Number(value.port) }, [...policy.networkAllow, ...runHosts])) return "allow";
     return policy.permissions.network;
   }
   if (request.method.startsWith("cli/") && policy && worktree) {
@@ -5248,7 +5488,13 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
+      permission: (request) => toolApprovalDecision(
+        request,
+        assignment.policy,
+        worktree,
+        runApps(assignment.mcp)?.apps.map((app) => app.name),
+        assignment.github ? [new URL(assignment.github.endpoint).host] : []
+      ),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {
@@ -5754,7 +6000,7 @@ function buildChildEnv(options = {}) {
 }
 
 // src/agents/child.ts
-import { spawn } from "node:child_process";
+import { spawn as spawn2 } from "node:child_process";
 import {
   mkdirSync as mkdirSync4,
   readFileSync as readFileSync3,
@@ -5919,7 +6165,7 @@ function endedSession(sessionId, exit) {
   };
 }
 var STDERR_TAIL = 4e3;
-function signalGroup(pgid, signal) {
+function signalGroup2(pgid, signal) {
   if (pgid === void 0) return;
   try {
     process.kill(-pgid, signal);
@@ -5941,7 +6187,7 @@ async function reapStale(pidFile2, marker) {
     const [group, ...command] = line.trim().split(/\s+/);
     return Number(group) === pgid && command.join(" ").includes(marker);
   });
-  if (member) signalGroup(pgid, "SIGKILL");
+  if (member) signalGroup2(pgid, "SIGKILL");
 }
 async function claimRunDir(paths) {
   ownDir(paths.runDir);
@@ -5952,7 +6198,7 @@ async function claimRunDir(paths) {
 async function spawnCli(sandbox, argv, options) {
   await reapStale(options.pidFile, options.marker);
   const wrapped = await sandbox.wrap(argv, options.policy);
-  const child = spawn("/bin/sh", ["-c", wrapped.command], {
+  const child = spawn2("/bin/sh", ["-c", wrapped.command], {
     cwd: options.cwd,
     env: options.env,
     stdio: ["pipe", "pipe", "pipe"],
@@ -5979,7 +6225,7 @@ ${error.message}`;
       child.once("exit", (code, signal) => resolve13({ code, signal }));
     }
   ).finally(() => {
-    signalGroup(pgid, "SIGKILL");
+    signalGroup2(pgid, "SIGKILL");
     rmSync3(options.pidFile, { force: true });
     wrapped.release();
   });
@@ -5989,7 +6235,7 @@ ${error.message}`;
     exited,
     stderrTail: () => wrapped.annotate(stderr.slice(-STDERR_TAIL)).trim(),
     async kill(graceMs = 3e3) {
-      signalGroup(pgid, "SIGTERM");
+      signalGroup2(pgid, "SIGTERM");
       let timer;
       await Promise.race([
         exited,
@@ -5998,7 +6244,7 @@ ${error.message}`;
         })
       ]);
       clearTimeout(timer);
-      signalGroup(pgid, "SIGKILL");
+      signalGroup2(pgid, "SIGKILL");
       await exited;
     }
   };
@@ -6153,7 +6399,7 @@ import {
   rmSync as rmSync4
 } from "node:fs";
 import { lstat, readdir } from "node:fs/promises";
-import { dirname as dirname6, isAbsolute as isAbsolute2, join as join7, relative as relative2, resolve as resolve4 } from "node:path";
+import { dirname as dirname6, isAbsolute as isAbsolute3, join as join7, relative as relative2, resolve as resolve4 } from "node:path";
 import { execa as execa2 } from "execa";
 import { simpleGit } from "simple-git";
 var DISK_USAGE_TTL_MS = 5 * 6e4;
@@ -6171,7 +6417,7 @@ function runBranch(runId) {
 }
 function isInside(parent, child) {
   const rel = relative2(parent, child);
-  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+  return rel === "" || !rel.startsWith("..") && !isAbsolute3(rel);
 }
 var configWriters = /* @__PURE__ */ new Map();
 function withRepoConfig(repoPath, work) {
@@ -6309,7 +6555,7 @@ var WorktreeManager = class {
     const worktreeReal = realpathSync4(worktree);
     for (const file of recipe.copyFiles) {
       const rel = relative2(repoPath, resolve4(repoPath, file));
-      if (rel === "" || rel.startsWith("..") || isAbsolute2(rel)) {
+      if (rel === "" || rel.startsWith("..") || isAbsolute3(rel)) {
         throw new Error(`setup recipe copies a file outside the repo: ${file}`);
       }
       const from = join7(repoPath, rel);
@@ -7230,6 +7476,14 @@ var RunContext = class {
   tempEnv() {
     return { TMPDIR: this.tmpDir, TMPPREFIX: join11(this.tmpDir, "zsh"), ...withGitConfig(this.githubEnv, RUN_GIT_CONFIG), ...this.options.policyHash ? { MIKKA_POLICY_HASH: this.options.policyHash } : {} };
   }
+  /**
+   * The agent delivers this run itself: it commits, pushes to the issue
+   * branch and opens the pull request with run-scoped GitHub credentials. The
+   * server sends GitHub delivery only for a run whose push is allowed.
+   */
+  get agentDelivers() {
+    return Object.keys(this.githubEnv).length > 0;
+  }
   /** A hand-in from an earlier session would end this one at once. */
   clearHandoff() {
     rmSync8(this.handoffFile, { force: true });
@@ -7810,245 +8064,6 @@ import {
   createSdkMcpServer as createSdkMcpServer2
 } from "@anthropic-ai/claude-agent-sdk";
 
-// src/agents/run-sandbox-launcher.ts
-import { spawn as spawn2 } from "node:child_process";
-import { isIP } from "node:net";
-import { isAbsolute as isAbsolute3 } from "node:path";
-import { fileURLToPath } from "node:url";
-import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
-var MAX_PENDING_NETWORK = 128;
-var NETWORK_DECISION_MS = 5 * 6e4;
-function canonicalHost(host) {
-  if (!host || /[\s\x00-\x1f\x7f%\\/@?#*]/u.test(host)) return;
-  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
-  if (isIP(bare) === 6) return new URL(`http://[${bare}]`).hostname.slice(1, -1);
-  if (bare.includes(":")) return;
-  try {
-    return new URL(`http://${bare}`).hostname.toLowerCase();
-  } catch {
-    return void 0;
-  }
-}
-function matchesRunSandboxDomain(request, domains) {
-  const host = canonicalHost(request.host);
-  if (!host || !Number.isInteger(request.port) || request.port < 1 || request.port > 65535) return false;
-  return domains.some((entry) => {
-    if (entry === "*") return true;
-    const parts = /^(\[[^\]]+\]|[^:]+?)(?::([1-9][0-9]{0,4}))?$/u.exec(entry);
-    if (!parts || parts[2] !== void 0 && (Number(parts[2]) > 65535 || Number(parts[2]) !== request.port)) return false;
-    const wildcard = parts[1].startsWith("*.");
-    const pattern = canonicalHost(wildcard ? parts[1].slice(2) : parts[1]);
-    if (!pattern) return false;
-    if (!wildcard) return host === pattern;
-    return !isIP(host) && pattern.includes(".") && host.endsWith(`.${pattern}`);
-  });
-}
-function signalGroup2(pid, signal) {
-  if (pid === void 0) return;
-  try {
-    process.kill(-pid, signal);
-  } catch (error) {
-    if (error.code !== "ESRCH") throw error;
-  }
-}
-function spawnRunSandbox(options) {
-  if (process.platform !== "linux" && process.platform !== "darwin") {
-    throw new Error("run sandbox launcher requires Linux or macOS process groups");
-  }
-  if (!options.command || options.command.includes("\0") || !isAbsolute3(options.cwd)) {
-    throw new Error("run sandbox requires a command and absolute cwd");
-  }
-  if (options.authToken !== void 0 && (!options.authToken || Buffer.byteLength(options.authToken) > 1048576)) {
-    throw new Error("invalid run sandbox auth pipe payload length");
-  }
-  const maximum = Object.freeze([...options.maxAllowDomains]);
-  const modelApiDomains = Object.freeze([...options.modelApiDomains ?? []]);
-  NetworkConfigSchema.parse({ allowedDomains: maximum.filter((entry) => entry !== "*"), deniedDomains: [] });
-  NetworkConfigSchema.parse({ allowedDomains: [...modelApiDomains], deniedDomains: [] });
-  const onNetwork = options.onNetwork;
-  const abortSignal = options.signal;
-  const launch = {
-    type: "init",
-    command: options.command,
-    args: [...options.args],
-    cwd: options.cwd,
-    env: { ...options.env },
-    policy: {
-      allowWrite: [...options.policy.allowWrite],
-      denyWrite: [...options.policy.denyWrite ?? []],
-      denyRead: [...options.policy.denyRead ?? []]
-    },
-    maxAllowDomains: [...maximum],
-    modelApiDomains: [...modelApiDomains],
-    hasAuthToken: options.authToken !== void 0
-  };
-  const child = spawn2(process.execPath, [fileURLToPath(new URL("./run-sandbox-worker.mjs", import.meta.url))], {
-    // Runtime helpers use the trusted daemon's environment. CLI env arrives
-    // over IPC and is passed explicitly by the worker, without inheritance.
-    env: process.env,
-    cwd: options.cwd,
-    stdio: ["pipe", "pipe", "pipe", "pipe", "ipc"],
-    detached: true
-  });
-  const lifetime = new AbortController();
-  const pending = /* @__PURE__ */ new Map();
-  let stderr = "";
-  let stopped = false;
-  let gone = false;
-  let outcome;
-  let hardStop;
-  let settle;
-  const exited = new Promise((resolve13) => {
-    settle = resolve13;
-  });
-  function send(message) {
-    if (!child.connected || gone) return;
-    child.send(message, (error) => {
-      if (error) stop(0);
-    });
-  }
-  function stop(graceMs = 3e3) {
-    if (gone) return;
-    if (!stopped) {
-      stopped = true;
-      lifetime.abort();
-      for (const request of pending.values()) {
-        clearTimeout(request.timer);
-        request.controller.abort();
-      }
-      pending.clear();
-      send({ type: "stop", graceMs });
-    }
-    if (!hardStop) hardStop = setTimeout(() => {
-      stderr += "\nrun sandbox worker did not stop; terminating its process group";
-      try {
-        signalGroup2(child.pid, "SIGKILL");
-      } catch (error) {
-        stderr += `
-run sandbox group termination failed: ${String(error)}`;
-      }
-    }, Math.max(0, Math.min(graceMs, 3e4)) + 5e3);
-  }
-  child.stderr.on("data", (data) => {
-    stderr = (stderr + data.toString()).slice(-16e3);
-  });
-  child.stdin.on("error", () => void 0);
-  child.on("message", (message) => {
-    if (!message || typeof message !== "object") return;
-    const value = message;
-    if (value.type === "finished") {
-      if ((value.code === null || Number.isInteger(value.code)) && (value.signal === null || typeof value.signal === "string")) {
-        outcome = { code: value.code, signal: value.signal };
-      }
-      return;
-    }
-    if (value.type !== "network" || !Number.isSafeInteger(value.id) || value.id < 1 || pending.has(value.id)) return;
-    const id4 = value.id;
-    const request = {
-      host: typeof value.host === "string" ? value.host : "",
-      port: typeof value.port === "number" ? value.port : 0
-    };
-    if (typeof value.port !== "number" || stopped || lifetime.signal.aborted || pending.size >= MAX_PENDING_NETWORK || !matchesRunSandboxDomain(request, maximum)) {
-      send({ type: "decision", id: id4, allow: false });
-      return;
-    }
-    const controller = new AbortController();
-    const timer = setTimeout(() => {
-      if (!pending.delete(id4)) return;
-      controller.abort();
-      send({ type: "decision", id: id4, allow: false });
-    }, NETWORK_DECISION_MS);
-    pending.set(id4, { controller, timer });
-    void Promise.resolve().then(() => {
-      if (stopped || lifetime.signal.aborted) return false;
-      return onNetwork(request, controller.signal);
-    }).then((allow) => {
-      if (!pending.delete(id4)) return;
-      clearTimeout(timer);
-      send({ type: "decision", id: id4, allow: allow === true && !stopped && !lifetime.signal.aborted && !controller.signal.aborted });
-    }, () => {
-      if (pending.delete(id4)) {
-        clearTimeout(timer);
-        send({ type: "decision", id: id4, allow: false });
-      }
-    });
-  });
-  function onParentExit() {
-    try {
-      signalGroup2(child.pid, "SIGKILL");
-    } catch {
-    }
-  }
-  process.once("exit", onParentExit);
-  function finish(code, signal) {
-    if (gone) return;
-    gone = true;
-    stopped = true;
-    lifetime.abort();
-    for (const request of pending.values()) {
-      clearTimeout(request.timer);
-      request.controller.abort();
-    }
-    pending.clear();
-    clearTimeout(hardStop);
-    abortSignal?.removeEventListener("abort", onAbort);
-    process.removeListener("exit", onParentExit);
-    try {
-      signalGroup2(child.pid, "SIGKILL");
-    } catch (error) {
-      stderr += `
-run sandbox group cleanup failed: ${String(error)}`;
-    }
-    settle(outcome ?? { code, signal });
-  }
-  child.once("error", (error) => {
-    stderr += `
-${error.message}`;
-    stop(0);
-    if (child.pid === void 0) finish(null, null);
-  });
-  child.once("exit", finish);
-  child.once("disconnect", () => {
-    if (!outcome) stop(0);
-  });
-  const authPipe = child.stdio[3];
-  authPipe.on("error", () => stop(0));
-  authPipe.end(options.authToken);
-  function onAbort() {
-    stop(0);
-  }
-  abortSignal?.addEventListener("abort", onAbort, { once: true });
-  child.kill = (signal = "SIGTERM") => {
-    if (gone) return false;
-    if (signal === 0) {
-      try {
-        process.kill(child.pid, 0);
-        return true;
-      } catch {
-        return false;
-      }
-    }
-    stop(signal === "SIGKILL" ? 0 : 3e3);
-    return true;
-  };
-  Object.defineProperty(child, "killed", { get: () => stopped });
-  if (abortSignal?.aborted) stop(0);
-  else send(launch);
-  return {
-    process: child,
-    exited,
-    stderrTail: () => stderr.slice(-4e3).trim(),
-    async kill(graceMs = 3e3) {
-      stop(graceMs);
-      await exited;
-    },
-    async revoke() {
-      stop(0);
-      await exited;
-    }
-  };
-}
-
 // src/agents/run-network.ts
 function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
@@ -8252,10 +8267,10 @@ function claudeSandboxSettings(policy) {
     }
   };
 }
-function claudeSettings(policy, workspace) {
+function claudeSettings(policy, workspace, agentDelivers = false) {
   return {
     sandbox: claudeSandboxSettings(policy),
-    permissions: claudePermissionRules(runPolicy(workspace))
+    permissions: claudePermissionRules(runPolicy(workspace), agentDelivers)
   };
 }
 function claudeChunks(message) {
@@ -8595,7 +8610,7 @@ var ClaudeAdapter = class {
         },
         settingSources: [],
         settings: {
-          ...claudeSettings(ctx.policy(), options.policy),
+          ...claudeSettings(ctx.policy(), options.policy, ctx.agentDelivers),
           // The official runtime launcher encloses the entire CLI. Nesting
           // the CLI's Bash-only sandbox is unsupported on macOS.
           ...outerLocal ? { sandbox: { enabled: false, allowUnsandboxedCommands: true, autoAllowBashIfSandboxed: false } } : {},
@@ -9450,7 +9465,7 @@ var CodexAdapter = class {
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
 import { join as join16 } from "node:path";
-function acpPermissionResponse(params, policy) {
+function acpPermissionResponse(params, policy, agentDelivers = false) {
   const pick = (kinds) => {
     for (const kind of kinds) {
       const option = params.options.find((o) => o.kind === kind);
@@ -9462,7 +9477,7 @@ function acpPermissionResponse(params, policy) {
   const raw = params.toolCall.rawInput;
   const command = Array.isArray(raw?.command) ? raw.command.join(" ") : typeof raw?.command === "string" ? raw.command : params.toolCall.title ?? "";
   const action = classifyCommand(command);
-  const refused = action === "git_push" || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
+  const refused = action === "git_push" && !agentDelivers || action !== null && decide(action, { policy: runPolicy(policy) }) !== "allow";
   if (refused)
     return { response: pick(["reject_once", "reject_always"]), refused };
   const allowed = pick(["allow_always", "allow_once"]);
@@ -9645,7 +9660,8 @@ var CursorAdapter = class {
         async requestPermission(params) {
           const { response, refused } = acpPermissionResponse(
             params,
-            options.policy
+            options.policy,
+            ctx.agentDelivers
           );
           if (refused)
             log.info(