@aspectlylabs/mikka 0.0.156 → 0.0.158

package/http-link.js

@@ -2410,11 +2410,42 @@ function classifyWrite(worktree, target) {
   return ok2 ? "write_in_worktree" : "write_outside_repo";
 }
 
+// src/agents/run-sandbox-launcher.ts
+import { isIP } from "node:net";
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+var NETWORK_DECISION_MS = 5 * 6e4;
+function canonicalHost(host) {
+  if (!host || /[\s\x00-\x1f\x7f%\\/@?#*]/u.test(host)) return;
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  if (isIP(bare) === 6) return new URL(`http://[${bare}]`).hostname.slice(1, -1);
+  if (bare.includes(":")) return;
+  try {
+    return new URL(`http://${bare}`).hostname.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
+function matchesRunSandboxDomain(request, domains) {
+  const host = canonicalHost(request.host);
+  if (!host || !Number.isInteger(request.port) || request.port < 1 || request.port > 65535) return false;
+  return domains.some((entry) => {
+    if (entry === "*") return true;
+    const parts = /^(\[[^\]]+\]|[^:]+?)(?::([1-9][0-9]{0,4}))?$/u.exec(entry);
+    if (!parts || parts[2] !== void 0 && (Number(parts[2]) > 65535 || Number(parts[2]) !== request.port)) return false;
+    const wildcard = parts[1].startsWith("*.");
+    const pattern = canonicalHost(wildcard ? parts[1].slice(2) : parts[1]);
+    if (!pattern) return false;
+    if (!wildcard) return host === pattern;
+    return !isIP(host) && pattern.includes(".") && host.endsWith(`.${pattern}`);
+  });
+}
+
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree, apps = []) {
+function toolApprovalDecision(request, policy, worktree, apps = [], runHosts = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
+    if (policy.permissions.network === "ask" && matchesRunSandboxDomain({ host: value.host, port: Number(value.port) }, [...policy.networkAllow, ...runHosts])) return "allow";
     return policy.permissions.network;
   }
   if (request.method.startsWith("cli/") && policy && worktree) {
@@ -4144,7 +4175,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.156",
+  version: "0.0.158",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4204,7 +4235,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
+  gitHead: "5011b7faac02b82a863d07eba4d7180d47fccc2b"
 };
 
 // src/paths.ts
@@ -4429,7 +4460,13 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
+      permission: (request) => toolApprovalDecision(
+        request,
+        assignment.policy,
+        worktree,
+        runApps(assignment.mcp)?.apps.map((app) => app.name),
+        assignment.github ? [new URL(assignment.github.endpoint).host] : []
+      ),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {

package/login.js

@@ -3748,7 +3748,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.156",
+  version: "0.0.158",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3808,7 +3808,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
+  gitHead: "5011b7faac02b82a863d07eba4d7180d47fccc2b"
 };
 
 // src/paths.ts
@@ -3817,6 +3817,10 @@ var DAEMON_VERSION = package_default.version;
 // src/server-link-http.ts
 import { z as z26 } from "zod";
 
+// src/agents/run-sandbox-launcher.ts
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+var NETWORK_DECISION_MS = 5 * 6e4;
+
 // ../protocol/src/capture.ts
 import { z as z23 } from "zod";
 var CAPTURE_CONTENT_TYPES = [

package/main.js

@@ -3785,7 +3785,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.156",
+  version: "0.0.158",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3845,7 +3845,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "3fe02256b52ef29ce2581173987f01d3b2054448"
+  gitHead: "5011b7faac02b82a863d07eba4d7180d47fccc2b"
 };
 
 // src/paths.ts

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "3fe02256b52ef29ce2581173987f01d3b2054448",
+  "sourceSha": "5011b7faac02b82a863d07eba4d7180d47fccc2b",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41301873626",
+  "buildRunId": "41302393087",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "c99f1e4f641d8e004cfe807653478e10f91e53fcf47102add5f4c154cdc1cb57",
-  "createdAt": "2026-11-01T11:34:59.039Z",
+  "createdAt": "2026-11-01T11:42:53.862Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -40,13 +40,13 @@
     },
     {
       "path": "cli.js",
-      "size": 649906,
-      "sha256": "ea0a5d8f7d1729d9a7febf4a1474182ea867594b08bba034046ce9e1660ea88a"
+      "size": 650215,
+      "sha256": "cfc4375d3e8899a0158acdd1f1657a1a8a9a7a571f6c0e97f3b9a95073ac070f"
     },
     {
       "path": "client.js",
       "size": 141206,
-      "sha256": "186de19be0c69837ec16496844d3fce1054404df99236b0c632751ae004a6d9f"
+      "sha256": "2cdd4c4f455cb8a479cc8f3cd246bed6fca887dfa7b03930f0de1740606b8357"
     },
     {
       "path": "computer/driver.mjs",
@@ -175,8 +175,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 182550,
-      "sha256": "b16fcb4cc7efaeb1d01b7737d7d398736c080e99b77510f42539c00cde8865a7"
+      "size": 184199,
+      "sha256": "44337947eded390388ea746b45dd2f8fc1337341b55781b781a1137dbf057fca"
     },
     {
       "path": "log.js",
@@ -185,13 +185,13 @@
     },
     {
       "path": "login.js",
-      "size": 145941,
-      "sha256": "fc3edd9d7e5c7d59028e288c6f18c1f53380da713b49a63476d0742e2aabf1d0"
+      "size": 146084,
+      "sha256": "aa4ef0750fb257e5e8acdc9c84dcb2e511897a95b1233f64a08d4a6f251f1198"
     },
     {
       "path": "main.js",
       "size": 595432,
-      "sha256": "056bb0f88e08eacfdc643f775a2d101593e0f722d076006515358c05f99f8b90"
+      "sha256": "892201d33a9ccb0ade2e140734d66741a999d00db4ca1c0e5267f51d941df4b1"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -200,23 +200,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 649922,
-      "sha256": "8e03efbabb2d9a8ff443ebfbab63fd859e4b05fff4340f8543d3003eb0731053"
+      "size": 650231,
+      "sha256": "2976ffecb0e7b84e62b479ea34ffef69ff7fcb7c4560d8326a881fbd1612300b"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78117,
-      "sha256": "7a9077f4872f82c1b74dab4c0d5abe22862bcc4cf0b349560439bd51df7f1c11"
+      "sha256": "ffb3b1145474a9ae74dfe5ae6b223c573fe609c723083fb1df5a6303c705e1db"
     },
     {
       "path": "package.json",
       "size": 1247,
-      "sha256": "10cd534abaa4aedba3968f2000a3dfe0738ef5af654a76567b15edfbdb9a1db4"
+      "sha256": "7b607843a43f5c8c75e42cc9000d87a4d3d073d3825b604d6b7b12cf1586e718"
     },
     {
       "path": "paths.js",
       "size": 4138,
-      "sha256": "3f687c02d1b5442dd6243b682e8d2db4902bdf4354e4fe9b9507ff3966b9e27d"
+      "sha256": "f77cb303b7bd7a6f1e631fbeffe7bd15025b31611b358fc92f0347d458148661"
     },
     {
       "path": "sandbox.js",
@@ -226,7 +226,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144314,
-      "sha256": "93003336a8e6c7f2520b064b5250af5188aad04e25550daee8d6fdf89164ff17"
+      "sha256": "01ad52f2e39e913f6787b60ca598da642e94aaa91da6d45f90127c2c78ced0a7"
     }
   ]
 }