@aspectlylabs/mikka 0.0.171 → 0.0.173

package/cli.js

@@ -4480,7 +4480,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4540,7 +4540,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/client.js

@@ -3741,7 +3741,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3801,7 +3801,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/http-link.js

@@ -4175,7 +4175,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4235,7 +4235,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/login.js

@@ -3748,7 +3748,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3808,7 +3808,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/main.js

@@ -3785,7 +3785,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3845,7 +3845,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6",
+  "sourceSha": "f0f4857928d1cfc385e5087b443f6c740b47727d",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41307387816",
+  "buildRunId": "41308067207",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "c99f1e4f641d8e004cfe807653478e10f91e53fcf47102add5f4c154cdc1cb57",
-  "createdAt": "2026-11-01T12:56:16.291Z",
+  "createdAt": "2026-11-01T13:04:13.631Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -41,12 +41,12 @@
     {
       "path": "cli.js",
       "size": 650230,
-      "sha256": "9c996c01515be09f396c9d14daa0a7d49e1cc2242b01ef1c9f43e257c06fd26f"
+      "sha256": "666643726eeb6514a80ab849b658f35199aaebd0d0967ea9a9aa341d5d57ec6e"
     },
     {
       "path": "client.js",
       "size": 141206,
-      "sha256": "a4e646fb4fe5f65e7be9aedb4d8b3b917cb626c1639e647e4fb76ecd6f80c6fc"
+      "sha256": "32a6dcff6ecb0b1f2f3378db5ba1cc5b555168d484def492360ef7f9345ad298"
     },
     {
       "path": "computer/driver.mjs",
@@ -176,7 +176,7 @@
     {
       "path": "http-link.js",
       "size": 184199,
-      "sha256": "3390bf6e0a298b88aed177633b2e8b1f445a4f5b4dc90caf463afdbe5fcae382"
+      "sha256": "6df0de0bd6a3afd4c5ab74d3f8d63830ce3c7b049675b7769cd2373d7df4adfc"
     },
     {
       "path": "log.js",
@@ -186,12 +186,12 @@
     {
       "path": "login.js",
       "size": 146084,
-      "sha256": "9abb32cfccbac412207f95e288a37b35d07d9e7b7c0cd22ca0aa24d5ec3098a4"
+      "sha256": "d34c26ba6b9f0ad87edeebab91df1655c9d3b1dd32f729cc61382e52731518e2"
     },
     {
       "path": "main.js",
       "size": 595447,
-      "sha256": "5451490258aa6c34ffb8ced9e93353e3b3f2345f99a919e96763f3e05ede99ca"
+      "sha256": "464d5d501c71a1bbe4a38712465244d9aec70c125e75b124ff120d61c1b6bc83"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -201,22 +201,27 @@
     {
       "path": "mikka.js",
       "size": 650246,
-      "sha256": "31125fea354f25f9ec7ee9152404e20fda7786d80bc82ae309c9544e7ea24280"
+      "sha256": "a06968aefae3c1ccd33dd43f165d9492119d21db921dee708a7a0896d09a734f"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78117,
-      "sha256": "40ca75057e21c063a2637aabc338d35f354676d1a62d7c138406242609f43157"
+      "sha256": "65a4dfcacfbb51ec07e851a08615dea08e603bca3ab661e7bb210aaeac8a395a"
     },
     {
       "path": "package.json",
       "size": 1247,
-      "sha256": "806a8d151256ed272b6b8c94414058c6107540b0982f8399f1f7f3b5899ecf77"
+      "sha256": "b04797960d02bec545262483034f898bd2ef46bc2a2ca23fb8e8d4f48bc66c7f"
     },
     {
       "path": "paths.js",
       "size": 4138,
-      "sha256": "01f69fa71cfe973e3a1ee6ec4a98d81bf0b84877c68680531be00e2d66682527"
+      "sha256": "16aaad5f1e7e7b699fa646821418d2136f6c40dc4d7dd63e838240c8e3f75e89"
+    },
+    {
+      "path": "run-sandbox-worker.mjs",
+      "size": 15600,
+      "sha256": "e66dd3ff9beaef137695abc18486acee89f22ab0d9ba51e01d0f8fd4c947c4d7"
     },
     {
       "path": "sandbox.js",
@@ -226,7 +231,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144314,
-      "sha256": "9f11de1ee8a867f5fa4b77fd84d48a94e233d5cff82712e33b612bf6f400c0cd"
+      "sha256": "ae89074dbaea988c336c6016873da9ce849d258390fdc794ea172d1cbf7b562f"
     }
   ]
 }

package/mikka.js

@@ -4481,7 +4481,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4541,7 +4541,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.171",
+  "version": "0.0.173",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.171",
+      "version": "0.0.173",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.171",
+  "version": "0.0.173",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6",
+  "gitHead": "f0f4857928d1cfc385e5087b443f6c740b47727d",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.171",
+  version: "0.0.173",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -66,7 +66,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "1c0688f38d0babb142a9bccb3ff0eb6a0b2f5ef6"
+  gitHead: "f0f4857928d1cfc385e5087b443f6c740b47727d"
 };
 
 // src/paths.ts

package/run-sandbox-worker.mjs

@@ -0,0 +1,360 @@
+// This trusted host process owns exactly one SandboxManager and one CLI.
+// Only its parent's private IPC channel can configure it or answer a request.
+import { spawn } from "node:child_process"
+import { randomUUID } from "node:crypto"
+import { isIP, Socket } from "node:net"
+import { isAbsolute } from "node:path"
+import { fileURLToPath } from "node:url"
+
+const AUTH_LIMIT = 1_048_576
+const MAX_PENDING_NETWORK = 128
+const NETWORK_DECISION_MS = 5 * 60_000
+
+export function assertRunSandboxDependencies(dependencies, platform = process.platform) {
+  if (dependencies.errors.length) {
+    throw new Error(`sandbox dependencies unavailable: ${dependencies.errors.join("; ")}`)
+  }
+  // Official 0.0.80 reports a missing apply-seccomp helper as only a warning.
+  // That would leave host Unix sockets reachable, so this launcher refuses to
+  // initialize or wrap. Old/unknown Linux dependency warnings also fail closed.
+  if (platform === "linux" && dependencies.warnings.length) {
+    throw new Error(`sandbox isolation dependencies unsafe: ${dependencies.warnings.join("; ")}`)
+  }
+}
+
+// Runs INSIDE the official sandbox. Linux bwrap deliberately closes extra
+// inherited fds, so a framed stdin prefix carries the token across that
+// boundary. It is converted to a token-only fd3 pipe before the real CLI starts.
+async function authBridge() {
+  let token
+  let child
+  let headerBytes = 0
+  let tokenBytes = 0
+  const header = Buffer.alloc(4)
+  let complete = false
+  const fail = () => {
+    token?.fill(0)
+    process.stderr.write("run sandbox auth pipe was incomplete or invalid\n")
+    process.exit(1)
+  }
+  process.stdin.on("error", fail)
+  process.stdin.once("end", () => { if (!complete) fail() })
+  const read = (chunk) => {
+    let offset = 0
+    if (headerBytes < 4) {
+      const count = Math.min(4 - headerBytes, chunk.length)
+      chunk.copy(header, headerBytes, 0, count)
+      headerBytes += count
+      offset += count
+      if (headerBytes === 4) {
+        const length = header.readUInt32BE()
+        if (length < 1 || length > AUTH_LIMIT) return fail()
+        token = Buffer.alloc(length)
+      }
+    }
+    if (token) {
+      const count = Math.min(token.length - tokenBytes, chunk.length - offset)
+      chunk.copy(token, tokenBytes, offset, offset + count)
+      chunk.fill(0, offset, offset + count)
+      tokenBytes += count
+      offset += count
+    }
+    if (!token || tokenBytes !== token.length) return
+    complete = true
+    process.stdin.pause()
+    process.stdin.off("data", read)
+    if (offset < chunk.length) process.stdin.unshift(chunk.subarray(offset))
+    child = spawn(process.argv[3], process.argv.slice(4), {
+      env: { ...process.env, CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR: "3" },
+      stdio: ["pipe", "pipe", "pipe", "pipe"],
+    })
+    child.once("error", () => fail())
+    child.stdin.on("error", () => undefined)
+    child.stdio[3].on("error", fail)
+    const payload = token
+    child.stdio[3].end(payload, () => { payload.fill(0); token = undefined })
+    // unshift above preserves protocol bytes delivered in the frame's last
+    // chunk. pipe handles subsequent data and backpressure without parsing it.
+    process.stdin.pipe(child.stdin)
+    child.stdout.pipe(process.stdout, { end: false })
+    child.stderr.pipe(process.stderr, { end: false })
+    child.once("close", async (code, signal) => {
+      token?.fill(0)
+      await Promise.all([process.stdout, process.stderr].map((stream) =>
+        new Promise((resolve) => stream.write("", resolve))))
+      process.exit(code ?? (signal === "SIGINT" ? 130 : 143))
+    })
+  }
+  process.stdin.on("data", read)
+}
+
+async function runWorker() {
+const { NetworkConfigSchema, SandboxManager, SandboxRuntimeConfigSchema } = await import("@anthropic-ai/sandbox-runtime")
+
+let configured = false
+let active = false
+let stopping = false
+let cli
+let initialize
+let wrapping
+let nextRequest = 0
+let stderr = ""
+let correlation
+let initTimer
+const pending = new Map()
+const lifetime = new AbortController()
+
+// Intentionally kept equivalent to the parent's exported matcher. Both sides
+// independently apply the immutable maximum before a permission callback runs.
+function canonicalHost(host) {
+  // eslint-disable-next-line no-control-regex -- Reject control bytes in a destination.
+  if (!host || /[\s\x00-\x1f\x7f%\\/@?#*]/u.test(host)) return
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host
+  if (isIP(bare) === 6) return new URL(`http://[${bare}]`).hostname.slice(1, -1)
+  if (bare.includes(":")) return
+  try { return new URL(`http://${bare}`).hostname.toLowerCase() } catch { return undefined }
+}
+
+function matchesDomain(request, domains) {
+  const host = canonicalHost(request.host)
+  if (!host || !Number.isInteger(request.port) || request.port < 1 || request.port > 65535) return false
+  return domains.some((entry) => {
+    if (entry === "*") return true
+    const parts = /^(\[[^\]]+\]|[^:]+?)(?::([1-9][0-9]{0,4}))?$/u.exec(entry)
+    if (!parts || (parts[2] !== undefined &&
+      (Number(parts[2]) > 65535 || Number(parts[2]) !== request.port))) return false
+    const wildcard = parts[1].startsWith("*.")
+    const pattern = canonicalHost(wildcard ? parts[1].slice(2) : parts[1])
+    if (!pattern) return false
+    return wildcard ? !isIP(host) && pattern.includes(".") && host.endsWith(`.${pattern}`) : host === pattern
+  })
+}
+
+function quote(arg) {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/u.test(arg) ? arg : `'${arg.replaceAll("'", `'"'"'`)}'`
+}
+
+function send(message) {
+  if (!process.connected) return
+  process.send(message, (error) => { if (error) void stop(0) })
+}
+
+function denyPending() {
+  active = false
+  lifetime.abort()
+  for (const request of pending.values()) {
+    clearTimeout(request.timer)
+    request.resolve(false)
+  }
+  pending.clear()
+}
+
+function groupSignal(signal) {
+  try { process.kill(-process.pid, signal) } catch (error) {
+    if (error.code !== "ESRCH") throw error
+  }
+}
+
+async function stop(graceMs = 0, outcome = { code: null, signal: "SIGTERM" }) {
+  denyPending()
+  if (stopping) return
+  stopping = true
+  clearTimeout(initTimer)
+  // The worker catches TERM; CLI descendants and runtime helpers share its
+  // group. A final parent group kill also covers a descendant that ignores it.
+  const watchdog = setTimeout(() => {
+    process.stderr.write("run sandbox teardown timed out; terminating process group\n")
+    groupSignal("SIGKILL")
+  }, Math.max(0, Math.min(graceMs, 30_000)) + 4000)
+  try {
+    groupSignal("SIGTERM")
+    if (cli && cli.exitCode === null && cli.signalCode === null) {
+      // Linux bwrap creates a new session for its PID namespace. Address the
+      // owned wrapper child directly as well as our group; --die-with-parent
+      // and --unshare-pid end its nested workload when that wrapper dies.
+      cli.kill(graceMs > 0 ? "SIGTERM" : "SIGKILL")
+      await new Promise((resolve) => {
+        const timer = setTimeout(() => { cli.kill("SIGKILL") }, Math.min(graceMs, 30_000))
+        cli.once("exit", () => { clearTimeout(timer); resolve() })
+      })
+    }
+    await initialize?.catch(() => undefined)
+    await wrapping?.catch(() => undefined)
+    // Official reset closes this launcher's established proxy connections and
+    // removes only its own ephemeral sockets/mountpoints/CA/masked artifacts.
+    // No worktree, run directory, logs or caller-owned data are removed here.
+    await SandboxManager.reset()
+    if (correlation) {
+      const annotated = SandboxManager.annotateStderrWithSandboxFailures(correlation, stderr)
+      if (annotated.length > stderr.length) process.stderr.write(annotated.slice(stderr.length))
+    }
+    if (process.connected) await new Promise((resolve) => {
+      process.send({ type: "finished", ...outcome }, () => resolve())
+    })
+    // process.exit does not wait for writes; flush the bridged output first.
+    await Promise.all([process.stdout, process.stderr].map((stream) =>
+      new Promise((resolve) => stream.write("", resolve))))
+    process.exit(outcome.code ?? (outcome.signal === "SIGINT" ? 130 : 143))
+  } catch (error) {
+    process.stderr.write(`run sandbox teardown failed: ${error.message}\n`)
+    // A failed reset cannot be followed by a successful-looking exit or a
+    // lingering live proxy. Group kill is fail-closed; parent also enforces it.
+    groupSignal("SIGKILL")
+  } finally {
+    clearTimeout(watchdog)
+  }
+}
+
+async function start(message) {
+  try {
+    if (typeof message.command !== "string" || !message.command || message.command.includes("\0") ||
+      !Array.isArray(message.args) || message.args.some((arg) => typeof arg !== "string" || arg.includes("\0")) ||
+      typeof message.cwd !== "string" || !isAbsolute(message.cwd) ||
+      !message.env || typeof message.env !== "object" || Array.isArray(message.env) ||
+      Object.entries(message.env).some(([key, value]) => key.includes("=") || key.includes("\0") ||
+        (value !== undefined && (typeof value !== "string" || value.includes("\0")))) ||
+      !Array.isArray(message.maxAllowDomains) || !Array.isArray(message.modelApiDomains) ||
+      typeof message.hasAuthToken !== "boolean") {
+      throw new Error("invalid run sandbox launch configuration")
+    }
+    const maximum = Object.freeze([...message.maxAllowDomains])
+    NetworkConfigSchema.parse({ allowedDomains: maximum.filter((entry) => entry !== "*"), deniedDomains: [] })
+    NetworkConfigSchema.parse({ allowedDomains: [...message.modelApiDomains], deniedDomains: [] })
+    const config = SandboxRuntimeConfigSchema.parse({
+      // Every connection, even a model API connection, must consult the live
+      // parent closure. No configured allow or command-id allow bypasses it.
+      network: {
+        allowedDomains: [], deniedDomains: [], strictAllowlist: false,
+        allowLocalBinding: false, allowAllUnixSockets: false, allowUnixSockets: [],
+      },
+      filesystem: message.policy,
+      enableWeakerNetworkIsolation: true,
+      enableWeakerNestedSandbox: false,
+      allowNestedUserNamespaces: false,
+    })
+    if (!SandboxManager.isSupportedPlatform()) throw new Error("sandbox platform unsupported")
+    const dependencies = SandboxManager.checkDependencies()
+    assertRunSandboxDependencies(dependencies)
+    if (stopping || !process.connected) return
+    active = true
+    initialize = SandboxManager.initialize(config, async (request) => {
+      if (!active || stopping || !process.connected || pending.size >= MAX_PENDING_NETWORK || !matchesDomain(request, maximum)) return false
+      const id = ++nextRequest
+      return new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          if (pending.delete(id)) resolve(false)
+        }, NETWORK_DECISION_MS)
+        pending.set(id, { resolve, timer })
+        send({ type: "network", id, host: request.host, port: request.port })
+      })
+    })
+    await initialize
+    if (!active || stopping || !process.connected) return
+    const argv = message.hasAuthToken
+      ? [process.execPath, fileURLToPath(import.meta.url), "--auth-bridge", message.command, ...message.args]
+      : [message.command, ...message.args]
+    const command = argv.map(quote).join(" ")
+    // Correlation is only for diagnostics, never network/run authority.
+    correlation = randomUUID()
+    wrapping = SandboxManager.wrapWithSandbox(command, "/bin/sh", undefined, lifetime.signal, { commandId: correlation })
+    const wrapped = await wrapping
+    if (!active || stopping || !process.connected) return
+    const env = { ...message.env }
+    // Node's private IPC setup must not be inherited by the untrusted CLI.
+    delete env.NODE_CHANNEL_FD
+    delete env.NODE_CHANNEL_SERIALIZATION_MODE
+    if (message.hasAuthToken === true) {
+      env.CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR = "3"
+      delete env.CLAUDE_CODE_OAUTH_TOKEN
+    }
+    cli = spawn("/bin/sh", ["-c", `exec ${wrapped}`], {
+      cwd: message.cwd,
+      env,
+      stdio: ["pipe", "pipe", "pipe"],
+      // Stay in the launcher's group, so even an abrupt worker failure cannot
+      // orphan an independently detached CLI before its pid can be reported.
+      detached: false,
+    })
+    cli.stdin.on("error", () => undefined)
+    if (message.hasAuthToken) {
+      // The token arrives on a separate host pipe. Frame it before forwarding
+      // any protocol input, so neither packet boundaries nor early SDK writes
+      // can mix credentials with the first CLI message.
+      const source = new Socket({ fd: 3, readable: true, writable: false })
+      const chunks = []
+      let length = 0
+      source.on("data", (data) => {
+        length += data.length
+        if (length > AUTH_LIMIT) {
+          data.fill(0)
+          source.destroy(new Error("auth pipe payload too large"))
+        } else chunks.push(data)
+      })
+      source.once("error", () => {
+        for (const chunk of chunks) chunk.fill(0)
+        process.stderr.write("run sandbox auth pipe failed\n")
+        void stop(0, { code: 1, signal: null })
+      })
+      source.once("end", () => {
+        if (!length || stopping) {
+          for (const chunk of chunks) chunk.fill(0)
+          void stop(0, { code: 1, signal: null })
+          return
+        }
+        const payload = Buffer.concat(chunks)
+        for (const chunk of chunks) chunk.fill(0)
+        const header = Buffer.alloc(4)
+        header.writeUInt32BE(payload.length)
+        cli.stdin.write(header)
+        cli.stdin.write(payload, () => payload.fill(0))
+        process.stdin.pipe(cli.stdin)
+      })
+    } else process.stdin.pipe(cli.stdin)
+    cli.stdout.pipe(process.stdout, { end: false })
+    cli.stderr.on("data", (data) => { stderr = (stderr + data.toString()).slice(-16_000) })
+    cli.stderr.pipe(process.stderr, { end: false })
+    cli.once("error", (error) => {
+      process.stderr.write(`sandboxed CLI launch failed: ${error.message}\n`)
+      void stop(0, { code: 1, signal: null })
+    })
+    cli.once("close", (code, signal) => { void stop(0, { code, signal }) })
+  } catch (error) {
+    process.stderr.write(`run sandbox launch failed: ${error.message}\n`)
+    await stop(0, { code: 1, signal: null })
+  }
+}
+
+process.on("message", (message) => {
+  if (!message || typeof message !== "object") return
+  if (message.type === "stop") {
+    void stop(Number.isFinite(message.graceMs) ? Math.max(0, message.graceMs) : 0)
+  } else if (message.type === "init" && !configured && !stopping) {
+    configured = true
+    clearTimeout(initTimer)
+    void start(message)
+  } else if (message.type === "decision" && Number.isSafeInteger(message.id)) {
+    const request = pending.get(message.id)
+    if (!request) return
+    pending.delete(message.id)
+    clearTimeout(request.timer)
+    request.resolve(message.allow === true && active && !stopping && process.connected)
+  }
+})
+process.on("disconnect", () => { void stop(0) })
+process.on("SIGTERM", () => { void stop(0) })
+process.on("SIGINT", () => { void stop(0, { code: null, signal: "SIGINT" }) })
+process.stdout.on("error", () => { void stop(0) })
+process.stderr.on("error", () => { void stop(0) })
+initTimer = setTimeout(() => {
+  process.stderr.write("run sandbox launch configuration was not received\n")
+  void stop(0, { code: 1, signal: null })
+}, 10_000)
+if (!process.connected) void stop(0, { code: 1, signal: null })
+}
+
+// Importing the pure dependency check for source-only tests does not start a
+// launcher, touch resources or initialize the official manager.
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+  if (process.argv[2] === "--auth-bridge") await authBridge()
+  else await runWorker()
+}

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:996bddb9-b957-41f7-9c76-37bc5a731d85",
+  "serialNumber": "urn:uuid:57e9fca5-ac79-4f36-8d0a-71d72bbad1a7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-01T12:56:15.353Z",
+    "timestamp": "2026-11-01T13:04:12.654Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.171",
+      "bom-ref": "@aspectlylabs/mikka@0.0.173",
       "type": "library",
-      "name": ".retained-build-qZhAd8",
-      "version": "0.0.171",
+      "name": ".retained-build-lJvCJN",
+      "version": "0.0.173",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.171",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.173",
       "properties": [],
       "externalReferences": [
         {
@@ -4627,7 +4627,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.171",
+      "ref": "@aspectlylabs/mikka@0.0.173",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",