@aspectlylabs/mikka 0.0.193 → 0.0.194

package/cli.js

@@ -2433,7 +2433,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2451,7 +2452,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2479,7 +2482,8 @@ var networkAllowSchema = z2.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).
 var storedPermissionsSchema = z2.strictObject({
   install_dependency: z2.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z2.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z2.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z2.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z2.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2514,7 +2518,8 @@ var runPolicySchema = z2.strictObject({
   permissions: z2.strictObject({
     install_dependency: z2.enum(PERMISSION_DECISIONS),
     write_outside_repo: z2.enum(PERMISSION_DECISIONS),
-    git_push: z2.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z2.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z2.enum(PERMISSION_DECISIONS).optional()
@@ -4482,7 +4487,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4542,7 +4547,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts
@@ -4751,14 +4756,14 @@ function runDomains(policy, repoAllow = []) {
   const destinations = policy.permissions.network === "allow" ? ["*"] : [.../* @__PURE__ */ new Set([...policy.networkAllow, ...repoAllow, ...registries])];
   return policy.networkCeiling === void 0 ? destinations : intersectNetworkDomains(destinations, policy.networkCeiling);
 }
-function pushDecision(policy, repoApproved) {
+function pushDecision(policy) {
   if (policy.readOnly)
     return { push: false, note: "A read-only check does not push" };
   const decision = policy.permissions.git_push;
+  if (decision === "allow") return { push: true };
   if (decision === "deny")
-    return { push: false, note: "Push is turned off for this workspace" };
-  if (decision === "allow" || repoApproved) return { push: true };
-  return { push: false, note: "Push needs approval for this repo" };
+    return { push: false, note: "Push is turned off for this run" };
+  return { push: false, note: "Push needs the Mikka GitHub App's access on this repository" };
 }
 var INSTALL_COMMANDS = [
   ["npm", ["install", "i", "add", "ci"]],
@@ -6912,7 +6917,7 @@ async function publishRun(options) {
       pushed: false,
       remote: null,
       skipped: "not_approved",
-      note: options.push.note ?? "Push needs approval for this repo"
+      note: options.push.note ?? "Push needs the Mikka GitHub App's access on this repository"
     };
   }
   return push(commit);
@@ -9864,6 +9869,9 @@ import { setTimeout as sleep2 } from "node:timers/promises";
 import { execa as execa5 } from "execa";
 
 // src/chunks.ts
+function runStageChunk(stage, ms, ok2) {
+  return { type: "data-run-stage", data: { stage, ms: Math.max(0, Math.round(ms)), ok: ok2 } };
+}
 function runStateChunk(state, error, stopReason) {
   return {
     type: "data-run-state",
@@ -12732,6 +12740,23 @@ var RunSupervisor = class {
       this.deps.log.error({ run_id: runId, err }, "outbox compaction failed");
     });
   }
+  /**
+   * Runs one start-up stage and records it as a stored `data-run-stage`
+   * chunk with its duration, ok or not, so a run that fails while starting
+   * shows which stage it reached. The stage's own result or error passes
+   * through unchanged.
+   */
+  async stage(runId, stage, work) {
+    const started = performance.now();
+    try {
+      const value = await work();
+      this.emit(runId, runStageChunk(stage, performance.now() - started, true));
+      return value;
+    } catch (error) {
+      this.emit(runId, runStageChunk(stage, performance.now() - started, false));
+      throw error;
+    }
+  }
   setState(runId, state, extra = {}) {
     const entry = this.deps.journal.update(runId, {
       state,
@@ -12866,7 +12891,7 @@ var RunSupervisor = class {
     }
     const branch = assignment.pushBranch;
     const base = await this.deps.baseRef(assignment);
-    if (!branch || !pushDecision(runPolicy(assignment.policy), repo.push?.approved === true).push) return base;
+    if (!branch || !pushDecision(runPolicy(assignment.policy)).push) return base;
     try {
       return await withRunGitCredentials(
         assignment,
@@ -12978,7 +13003,7 @@ var RunSupervisor = class {
       this.setState(runId, "preparing");
       entry = this.deps.journal.get(runId);
     }
-    await this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal]));
+    await this.stage(runId, "repository", () => this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal])));
     if (this.stopping || run3.cancelRequested) {
       if (!this.stopping) this.finish(runId, run3.forcedStop ?? "cancelled");
       return;
@@ -12997,11 +13022,11 @@ var RunSupervisor = class {
       );
     if (assignment.requireWorktreeContinuation && !entry.worktree && !continued)
       throw new CheckpointRecoveryError("Original worktree is unavailable and there is no usable recovery snapshot.");
-    const worktree = entry.worktree ?? continued ?? await this.deps.worktrees.create(
+    const worktree = entry.worktree ?? continued ?? await this.stage(runId, "worktree", async () => this.deps.worktrees.create(
       runId,
       repo.path,
       await this.startPoint(runId, repo, assignment)
-    );
+    ));
     if (!entry.worktree) {
       const baseCommit = (continued && assignment.continuesRunId ? this.deps.journal.get(assignment.continuesRunId)?.baseCommit : void 0) ?? await headCommit(repo.path, worktree);
       if (!continued && assignment.resumeFrom) {
@@ -13125,7 +13150,7 @@ var RunSupervisor = class {
     let session;
     if (assignment.subscriptionBinding && assignment.modelCredential) throw new Error("A run has one model credential");
     try {
-      session = assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
+      session = await this.stage(runId, "agent_start", async () => assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
         throw new Error("subscription_hosted_runtime_unavailable");
       })() : resuming ? await adapter.resume(entry.sessionId, options) : await (async () => {
         if (assignment.requireSessionResume)
@@ -13138,7 +13163,7 @@ var RunSupervisor = class {
           continueSession,
           requireSessionResume: assignment.requireSessionResume
         });
-      })();
+      })());
     } catch (error) {
       if (assignment.skillReceipt) this.deps.journal.update(runId, { skillMount: void 0, execution: void 0, runtime: void 0 });
       throw error;
@@ -13275,7 +13300,7 @@ var RunSupervisor = class {
         const policy = runPolicy(assignment.policy);
         if (stopReason === "submitted" && report.verify.status !== "failed" && tree && // The draft-PR exception requires an explicit repository push
         // approval. It must not even create a local commit without it.
-        (report.verify.status === "passed" || pushDecision(policy, repo.push?.approved === true).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
+        (report.verify.status === "passed" || pushDecision(policy).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
         // on the commit the implementation run already pushed.
         policy.readOnly !== true) {
           const publish = await this.publish(
@@ -13672,9 +13697,15 @@ var bootstrap = fileURLToPath3(
 );
 var placeholder = "mikka-native-broker-placeholder";
 var unavailable3 = (cause) => new Error("subscription_hosted_runtime_unavailable", cause === void 0 ? void 0 : { cause });
-var dockerFailure = (error) => {
+var DOCKER_CREATE_TIMEOUT_MS = 18e4;
+var dockerFailure = (error, startedAt) => {
   const value = error;
-  return new Error(String(value.stderr || value.message || error).trim().slice(-500));
+  const took = startedAt === void 0 ? "" : ` after ${Math.round((performance.now() - startedAt) / 1e3)}s`;
+  const stderr = String(value.stderr ?? "").trim();
+  if (stderr) return new Error(`${stderr.slice(-500)}${took}`);
+  if (value.killed) return new Error(`docker timed out${took}`);
+  if (error instanceof Error && error.message === "subscription_hosted_runtime_unavailable") return new Error(`run fenced${took}`);
+  return new Error(`docker failed (exit ${String(value.code ?? value.signal ?? "unknown")})${took}`);
 };
 var blockedSandbox = {
   kind: "none",
@@ -13871,7 +13902,7 @@ async function createHostedBotRunner(host) {
           "-c",
           script
         ],
-        { env: bareEnv, timeout: 3e4, signal, maxBuffer: 1024 * 1024 }
+        { env: bareEnv, timeout: DOCKER_CREATE_TIMEOUT_MS, signal, maxBuffer: 1024 * 1024 }
       );
       resource.id = created.stdout.trim();
       if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -14191,10 +14222,11 @@ async function createHostedBotRunner(host) {
         ];
         await live();
         writeJsonAtomic(resourceFile, resource);
+        const createStarted = performance.now();
         try {
           creating = exec3("docker", containerArgs2, {
             env: bareEnv,
-            timeout: 3e4
+            timeout: DOCKER_CREATE_TIMEOUT_MS
           }).then((created) => {
             resource.id = created.stdout.trim();
             if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -14202,9 +14234,10 @@ async function createHostedBotRunner(host) {
             writeJsonAtomic(resourceFile, resource);
           });
           await creating;
+          console.info(`run ${assignment.runId}: hosted container created in ${Math.round((performance.now() - createStarted) / 1e3)}s`);
           await live();
         } catch (error) {
-          const reason = dockerFailure(error);
+          const reason = dockerFailure(error, createStarted);
           try {
             await close();
           } catch (cleanup) {
@@ -15190,10 +15223,7 @@ var Daemon = class {
           pushBranch: assignment.pushBranch,
           baseBranch: assignment.remoteUrl ? await this.repositories.baseRef(assignment.remoteUrl, assignment.baseBranch) : assignment.baseBranch,
           push: (() => {
-            const decision = pushDecision(
-              runPolicy(assignment.policy),
-              repo.push?.approved === true
-            );
+            const decision = pushDecision(runPolicy(assignment.policy));
             return {
               approved: decision.push,
               remote: repo.push?.remote ?? "origin",

package/client.js

@@ -2054,7 +2054,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2072,7 +2073,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2092,7 +2095,8 @@ var networkAllowSchema = z2.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).
 var storedPermissionsSchema = z2.strictObject({
   install_dependency: z2.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z2.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z2.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z2.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z2.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2101,7 +2105,8 @@ var runPolicySchema = z2.strictObject({
   permissions: z2.strictObject({
     install_dependency: z2.enum(PERMISSION_DECISIONS),
     write_outside_repo: z2.enum(PERMISSION_DECISIONS),
-    git_push: z2.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z2.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z2.enum(PERMISSION_DECISIONS).optional()
@@ -3743,7 +3748,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3803,7 +3808,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts

package/http-link.js

@@ -2181,7 +2181,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2199,7 +2200,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2224,7 +2227,8 @@ var networkAllowSchema = z2.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).
 var storedPermissionsSchema = z2.strictObject({
   install_dependency: z2.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z2.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z2.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z2.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z2.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2238,7 +2242,8 @@ var runPolicySchema = z2.strictObject({
   permissions: z2.strictObject({
     install_dependency: z2.enum(PERMISSION_DECISIONS),
     write_outside_repo: z2.enum(PERMISSION_DECISIONS),
-    git_push: z2.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z2.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z2.enum(PERMISSION_DECISIONS).optional()
@@ -4177,7 +4182,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4237,7 +4242,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts

package/login.js

@@ -2050,7 +2050,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2068,7 +2069,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2088,7 +2091,8 @@ var networkAllowSchema = z2.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).
 var storedPermissionsSchema = z2.strictObject({
   install_dependency: z2.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z2.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z2.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z2.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z2.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2097,7 +2101,8 @@ var runPolicySchema = z2.strictObject({
   permissions: z2.strictObject({
     install_dependency: z2.enum(PERMISSION_DECISIONS),
     write_outside_repo: z2.enum(PERMISSION_DECISIONS),
-    git_push: z2.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z2.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z2.enum(PERMISSION_DECISIONS).optional()
@@ -3750,7 +3755,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3810,7 +3815,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts

package/main.js

@@ -2456,7 +2456,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2474,7 +2475,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2502,7 +2505,8 @@ var networkAllowSchema = z.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).t
 var storedPermissionsSchema = z.strictObject({
   install_dependency: z.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2537,7 +2541,8 @@ var runPolicySchema = z.strictObject({
   permissions: z.strictObject({
     install_dependency: z.enum(PERMISSION_DECISIONS),
     write_outside_repo: z.enum(PERMISSION_DECISIONS),
-    git_push: z.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z.enum(PERMISSION_DECISIONS).optional()
@@ -3216,7 +3221,7 @@ async function publishRun(options) {
       pushed: false,
       remote: null,
       skipped: "not_approved",
-      note: options.push.note ?? "Push needs approval for this repo"
+      note: options.push.note ?? "Push needs the Mikka GitHub App's access on this repository"
     };
   }
   return push(commit);
@@ -3803,7 +3808,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3863,7 +3868,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts
@@ -3937,14 +3942,14 @@ function runDomains(policy, repoAllow = []) {
   const destinations = policy.permissions.network === "allow" ? ["*"] : [.../* @__PURE__ */ new Set([...policy.networkAllow, ...repoAllow, ...registries])];
   return policy.networkCeiling === void 0 ? destinations : intersectNetworkDomains(destinations, policy.networkCeiling);
 }
-function pushDecision(policy, repoApproved) {
+function pushDecision(policy) {
   if (policy.readOnly)
     return { push: false, note: "A read-only check does not push" };
   const decision = policy.permissions.git_push;
+  if (decision === "allow") return { push: true };
   if (decision === "deny")
-    return { push: false, note: "Push is turned off for this workspace" };
-  if (decision === "allow" || repoApproved) return { push: true };
-  return { push: false, note: "Push needs approval for this repo" };
+    return { push: false, note: "Push is turned off for this run" };
+  return { push: false, note: "Push needs the Mikka GitHub App's access on this repository" };
 }
 var INSTALL_COMMANDS = [
   ["npm", ["install", "i", "add", "ci"]],
@@ -8677,6 +8682,9 @@ import { setTimeout as sleep } from "node:timers/promises";
 import { execa as execa5 } from "execa";
 
 // src/chunks.ts
+function runStageChunk(stage, ms, ok2) {
+  return { type: "data-run-stage", data: { stage, ms: Math.max(0, Math.round(ms)), ok: ok2 } };
+}
 function runStateChunk(state, error, stopReason) {
   return {
     type: "data-run-state",
@@ -11786,6 +11794,23 @@ var RunSupervisor = class {
       this.deps.log.error({ run_id: runId, err }, "outbox compaction failed");
     });
   }
+  /**
+   * Runs one start-up stage and records it as a stored `data-run-stage`
+   * chunk with its duration, ok or not, so a run that fails while starting
+   * shows which stage it reached. The stage's own result or error passes
+   * through unchanged.
+   */
+  async stage(runId, stage, work) {
+    const started = performance.now();
+    try {
+      const value = await work();
+      this.emit(runId, runStageChunk(stage, performance.now() - started, true));
+      return value;
+    } catch (error) {
+      this.emit(runId, runStageChunk(stage, performance.now() - started, false));
+      throw error;
+    }
+  }
   setState(runId, state, extra = {}) {
     const entry = this.deps.journal.update(runId, {
       state,
@@ -11920,7 +11945,7 @@ var RunSupervisor = class {
     }
     const branch = assignment.pushBranch;
     const base = await this.deps.baseRef(assignment);
-    if (!branch || !pushDecision(runPolicy(assignment.policy), repo.push?.approved === true).push) return base;
+    if (!branch || !pushDecision(runPolicy(assignment.policy)).push) return base;
     try {
       return await withRunGitCredentials(
         assignment,
@@ -12032,7 +12057,7 @@ var RunSupervisor = class {
       this.setState(runId, "preparing");
       entry = this.deps.journal.get(runId);
     }
-    await this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal]));
+    await this.stage(runId, "repository", () => this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal])));
     if (this.stopping || run3.cancelRequested) {
       if (!this.stopping) this.finish(runId, run3.forcedStop ?? "cancelled");
       return;
@@ -12051,11 +12076,11 @@ var RunSupervisor = class {
       );
     if (assignment.requireWorktreeContinuation && !entry.worktree && !continued)
       throw new CheckpointRecoveryError("Original worktree is unavailable and there is no usable recovery snapshot.");
-    const worktree = entry.worktree ?? continued ?? await this.deps.worktrees.create(
+    const worktree = entry.worktree ?? continued ?? await this.stage(runId, "worktree", async () => this.deps.worktrees.create(
       runId,
       repo.path,
       await this.startPoint(runId, repo, assignment)
-    );
+    ));
     if (!entry.worktree) {
       const baseCommit = (continued && assignment.continuesRunId ? this.deps.journal.get(assignment.continuesRunId)?.baseCommit : void 0) ?? await headCommit(repo.path, worktree);
       if (!continued && assignment.resumeFrom) {
@@ -12179,7 +12204,7 @@ var RunSupervisor = class {
     let session;
     if (assignment.subscriptionBinding && assignment.modelCredential) throw new Error("A run has one model credential");
     try {
-      session = assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
+      session = await this.stage(runId, "agent_start", async () => assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
         throw new Error("subscription_hosted_runtime_unavailable");
       })() : resuming ? await adapter.resume(entry.sessionId, options) : await (async () => {
         if (assignment.requireSessionResume)
@@ -12192,7 +12217,7 @@ var RunSupervisor = class {
           continueSession,
           requireSessionResume: assignment.requireSessionResume
         });
-      })();
+      })());
     } catch (error) {
       if (assignment.skillReceipt) this.deps.journal.update(runId, { skillMount: void 0, execution: void 0, runtime: void 0 });
       throw error;
@@ -12329,7 +12354,7 @@ var RunSupervisor = class {
         const policy = runPolicy(assignment.policy);
         if (stopReason === "submitted" && report.verify.status !== "failed" && tree && // The draft-PR exception requires an explicit repository push
         // approval. It must not even create a local commit without it.
-        (report.verify.status === "passed" || pushDecision(policy, repo.push?.approved === true).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
+        (report.verify.status === "passed" || pushDecision(policy).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
         // on the commit the implementation run already pushed.
         policy.readOnly !== true) {
           const publish = await this.publish(
@@ -12738,9 +12763,15 @@ var bootstrap = fileURLToPath3(
 );
 var placeholder = "mikka-native-broker-placeholder";
 var unavailable3 = (cause) => new Error("subscription_hosted_runtime_unavailable", cause === void 0 ? void 0 : { cause });
-var dockerFailure = (error) => {
+var DOCKER_CREATE_TIMEOUT_MS = 18e4;
+var dockerFailure = (error, startedAt) => {
   const value = error;
-  return new Error(String(value.stderr || value.message || error).trim().slice(-500));
+  const took = startedAt === void 0 ? "" : ` after ${Math.round((performance.now() - startedAt) / 1e3)}s`;
+  const stderr = String(value.stderr ?? "").trim();
+  if (stderr) return new Error(`${stderr.slice(-500)}${took}`);
+  if (value.killed) return new Error(`docker timed out${took}`);
+  if (error instanceof Error && error.message === "subscription_hosted_runtime_unavailable") return new Error(`run fenced${took}`);
+  return new Error(`docker failed (exit ${String(value.code ?? value.signal ?? "unknown")})${took}`);
 };
 var blockedSandbox = {
   kind: "none",
@@ -12937,7 +12968,7 @@ async function createHostedBotRunner(host) {
           "-c",
           script
         ],
-        { env: bareEnv, timeout: 3e4, signal, maxBuffer: 1024 * 1024 }
+        { env: bareEnv, timeout: DOCKER_CREATE_TIMEOUT_MS, signal, maxBuffer: 1024 * 1024 }
       );
       resource.id = created.stdout.trim();
       if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -13257,10 +13288,11 @@ async function createHostedBotRunner(host) {
         ];
         await live();
         writeJsonAtomic(resourceFile, resource);
+        const createStarted = performance.now();
         try {
           creating = exec3("docker", containerArgs2, {
             env: bareEnv,
-            timeout: 3e4
+            timeout: DOCKER_CREATE_TIMEOUT_MS
           }).then((created) => {
             resource.id = created.stdout.trim();
             if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -13268,9 +13300,10 @@ async function createHostedBotRunner(host) {
             writeJsonAtomic(resourceFile, resource);
           });
           await creating;
+          console.info(`run ${assignment.runId}: hosted container created in ${Math.round((performance.now() - createStarted) / 1e3)}s`);
           await live();
         } catch (error) {
-          const reason = dockerFailure(error);
+          const reason = dockerFailure(error, createStarted);
           try {
             await close();
           } catch (cleanup) {
@@ -14256,10 +14289,7 @@ var Daemon = class {
           pushBranch: assignment.pushBranch,
           baseBranch: assignment.remoteUrl ? await this.repositories.baseRef(assignment.remoteUrl, assignment.baseBranch) : assignment.baseBranch,
           push: (() => {
-            const decision = pushDecision(
-              runPolicy(assignment.policy),
-              repo.push?.approved === true
-            );
+            const decision = pushDecision(runPolicy(assignment.policy));
             return {
               approved: decision.push,
               remote: repo.push?.remote ?? "origin",

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b",
+  "sourceSha": "c28c48908fb4b35a1cb5f57c391d27cc68aae252",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41312499534",
+  "buildRunId": "41316302270",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "c99f1e4f641d8e004cfe807653478e10f91e53fcf47102add5f4c154cdc1cb57",
-  "createdAt": "2026-11-01T14:44:20.643Z",
+  "createdAt": "2026-11-01T14:49:22.004Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -40,13 +40,13 @@
     },
     {
       "path": "cli.js",
-      "size": 652780,
-      "sha256": "fdccebf7a555446dff920a0fb4588504c6a836eab03e1891c985203ba54badb2"
+      "size": 654772,
+      "sha256": "12286d810a77bb3af96496faffa3fe69d8605c1d59e02c0f0084d603cfc74638"
     },
     {
       "path": "client.js",
-      "size": 141342,
-      "sha256": "54b5ec5cce1903535b4a02c7b0a232f882e416c210ae4c24026d71a2d1a1392d"
+      "size": 141838,
+      "sha256": "538f6f65ed041a1a80b0297e3ca0307abc538829e639f34f771a09e8d33849a0"
     },
     {
       "path": "computer/driver.mjs",
@@ -175,8 +175,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 184275,
-      "sha256": "314b00afc84636988e9f119fa16865c9ebac4aa8510ef89e95d2159470968e40"
+      "size": 184771,
+      "sha256": "904f3ee238a7189fec153dbe0841246c386d0a2ab4049465ebe2388c8ae1d61c"
     },
     {
       "path": "log.js",
@@ -185,13 +185,13 @@
     },
     {
       "path": "login.js",
-      "size": 146220,
-      "sha256": "6c12846b1e72f0ed2157831ede757d4384d47da0592b413d810ea81ba15e8b13"
+      "size": 146716,
+      "sha256": "fea6b4b25199dcb5b6a0c327d320560caca96b9767f8cd85509f3cd68f7066d7"
     },
     {
       "path": "main.js",
-      "size": 597997,
-      "sha256": "cf67e7024fd5c766fc28b2b83ecb1df3fb5893649de4cb0f2a0152b6db9142c4"
+      "size": 599989,
+      "sha256": "2f3f8ae8033053cd35d605901661ada617f7b48e469e991bdf53f7a1db7d7499"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -200,23 +200,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 652796,
-      "sha256": "d7b9824bcf7732358feeeecebe26836763d931a4e093008b2823c0e662c99593"
+      "size": 654788,
+      "sha256": "d5d50e32789fb9c2a41836b744896d52152fa35f64d568a1e40e8ae08d1acb30"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78117,
-      "sha256": "dde9cf97a2ef3c980117f436eab19add4589b368b6303313a5adafe21419f260"
+      "sha256": "8413ae7a61c4ccbcb8d4057e386bc464fc45475b08914b27a0d60f633263e3f1"
     },
     {
       "path": "package.json",
       "size": 1247,
-      "sha256": "61030ffae3f847591ee9c5fa6d277bac6e30254e55e0e63780d09df25c4a0a2a"
+      "sha256": "cf50bd8cc85decabee2e373153b0c8291236337ef3fe005bc5a84d92ad3f60c3"
     },
     {
       "path": "paths.js",
       "size": 4138,
-      "sha256": "34334c3022e05698adc7554cacea9a5dbaea36c55b109774203be834c44de197"
+      "sha256": "2d8980e4b4edb9f70609503c56a7e3c281b7af138ec8efc11f1b4b006344e481"
     },
     {
       "path": "run-sandbox-worker.mjs",
@@ -231,7 +231,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144314,
-      "sha256": "80f48439a26ba0542aabc94684d9615c32db1d029c10aa3e2f581204e5d38427"
+      "sha256": "74f7c4498bffbc5f9808459363773cfbe29f9ecf496eac262c6506626bd3fd68"
     }
   ]
 }

package/mikka.js

@@ -2434,7 +2434,8 @@ var CONFIGURABLE_PERMISSIONS = {
   // Everything outside the worktree is read-only in the sandbox (ADR 0009,
   // Stage 1 isolation), so writing there cannot be allowed wholesale.
   write_outside_repo: ["ask", "deny"],
-  git_push: ["allow", "ask", "deny"],
+  // Push is what the GitHub App grants (decision 2026-11-01-1215): never asked.
+  git_push: ["allow", "deny"],
   network: ["allow", "ask", "deny"],
   computer_use: ["allow", "ask", "deny"]
 };
@@ -2452,7 +2453,9 @@ var PERMISSION_DEFAULTS = {
   ...FIXED_PERMISSIONS,
   install_dependency: "allow",
   write_outside_repo: "ask",
-  git_push: "ask",
+  // A run pushes only when the server sends allow for an admitted GitHub App
+  // grant (decision 2026-11-01-1215); a policy that does not say so never pushes.
+  git_push: "deny",
   // Agents reach the open internet unless a person restricts it in settings
   // (decision 2026-11-01-1230-network-open-by-default).
   network: "allow",
@@ -2480,7 +2483,8 @@ var networkAllowSchema = z2.array(networkDomainSchema).max(MAX_NETWORK_DOMAINS).
 var storedPermissionsSchema = z2.strictObject({
   install_dependency: z2.enum(CONFIGURABLE_PERMISSIONS.install_dependency),
   write_outside_repo: z2.enum(CONFIGURABLE_PERMISSIONS.write_outside_repo),
-  git_push: z2.enum(CONFIGURABLE_PERMISSIONS.git_push),
+  // A stored ask predates decision 2026-11-01-1215 and reads as allow.
+  git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "allow" : value),
   network: z2.enum(CONFIGURABLE_PERMISSIONS.network),
   computer_use: z2.enum(CONFIGURABLE_PERMISSIONS.computer_use)
 }).partial();
@@ -2515,7 +2519,8 @@ var runPolicySchema = z2.strictObject({
   permissions: z2.strictObject({
     install_dependency: z2.enum(PERMISSION_DECISIONS),
     write_outside_repo: z2.enum(PERMISSION_DECISIONS),
-    git_push: z2.enum(PERMISSION_DECISIONS),
+    // Push is allow (admitted) or deny; an older server's ask carries no push authority.
+    git_push: z2.enum(PERMISSION_DECISIONS).transform((value) => value === "ask" ? "deny" : value),
     network: z2.enum(PERMISSION_DECISIONS),
     // Older servers omit this field; the daemon treats that as ask, never allow.
     computer_use: z2.enum(PERMISSION_DECISIONS).optional()
@@ -4483,7 +4488,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4543,7 +4548,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts
@@ -4752,14 +4757,14 @@ function runDomains(policy, repoAllow = []) {
   const destinations = policy.permissions.network === "allow" ? ["*"] : [.../* @__PURE__ */ new Set([...policy.networkAllow, ...repoAllow, ...registries])];
   return policy.networkCeiling === void 0 ? destinations : intersectNetworkDomains(destinations, policy.networkCeiling);
 }
-function pushDecision(policy, repoApproved) {
+function pushDecision(policy) {
   if (policy.readOnly)
     return { push: false, note: "A read-only check does not push" };
   const decision = policy.permissions.git_push;
+  if (decision === "allow") return { push: true };
   if (decision === "deny")
-    return { push: false, note: "Push is turned off for this workspace" };
-  if (decision === "allow" || repoApproved) return { push: true };
-  return { push: false, note: "Push needs approval for this repo" };
+    return { push: false, note: "Push is turned off for this run" };
+  return { push: false, note: "Push needs the Mikka GitHub App's access on this repository" };
 }
 var INSTALL_COMMANDS = [
   ["npm", ["install", "i", "add", "ci"]],
@@ -6913,7 +6918,7 @@ async function publishRun(options) {
       pushed: false,
       remote: null,
       skipped: "not_approved",
-      note: options.push.note ?? "Push needs approval for this repo"
+      note: options.push.note ?? "Push needs the Mikka GitHub App's access on this repository"
     };
   }
   return push(commit);
@@ -9865,6 +9870,9 @@ import { setTimeout as sleep2 } from "node:timers/promises";
 import { execa as execa5 } from "execa";
 
 // src/chunks.ts
+function runStageChunk(stage, ms, ok2) {
+  return { type: "data-run-stage", data: { stage, ms: Math.max(0, Math.round(ms)), ok: ok2 } };
+}
 function runStateChunk(state, error, stopReason) {
   return {
     type: "data-run-state",
@@ -12733,6 +12741,23 @@ var RunSupervisor = class {
       this.deps.log.error({ run_id: runId, err }, "outbox compaction failed");
     });
   }
+  /**
+   * Runs one start-up stage and records it as a stored `data-run-stage`
+   * chunk with its duration, ok or not, so a run that fails while starting
+   * shows which stage it reached. The stage's own result or error passes
+   * through unchanged.
+   */
+  async stage(runId, stage, work) {
+    const started = performance.now();
+    try {
+      const value = await work();
+      this.emit(runId, runStageChunk(stage, performance.now() - started, true));
+      return value;
+    } catch (error) {
+      this.emit(runId, runStageChunk(stage, performance.now() - started, false));
+      throw error;
+    }
+  }
   setState(runId, state, extra = {}) {
     const entry = this.deps.journal.update(runId, {
       state,
@@ -12867,7 +12892,7 @@ var RunSupervisor = class {
     }
     const branch = assignment.pushBranch;
     const base = await this.deps.baseRef(assignment);
-    if (!branch || !pushDecision(runPolicy(assignment.policy), repo.push?.approved === true).push) return base;
+    if (!branch || !pushDecision(runPolicy(assignment.policy)).push) return base;
     try {
       return await withRunGitCredentials(
         assignment,
@@ -12979,7 +13004,7 @@ var RunSupervisor = class {
       this.setState(runId, "preparing");
       entry = this.deps.journal.get(runId);
     }
-    await this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal]));
+    await this.stage(runId, "repository", () => this.deps.prepareRepository(assignment, AbortSignal.any([this.stopController.signal, run3.abort.signal])));
     if (this.stopping || run3.cancelRequested) {
       if (!this.stopping) this.finish(runId, run3.forcedStop ?? "cancelled");
       return;
@@ -12998,11 +13023,11 @@ var RunSupervisor = class {
       );
     if (assignment.requireWorktreeContinuation && !entry.worktree && !continued)
       throw new CheckpointRecoveryError("Original worktree is unavailable and there is no usable recovery snapshot.");
-    const worktree = entry.worktree ?? continued ?? await this.deps.worktrees.create(
+    const worktree = entry.worktree ?? continued ?? await this.stage(runId, "worktree", async () => this.deps.worktrees.create(
       runId,
       repo.path,
       await this.startPoint(runId, repo, assignment)
-    );
+    ));
     if (!entry.worktree) {
       const baseCommit = (continued && assignment.continuesRunId ? this.deps.journal.get(assignment.continuesRunId)?.baseCommit : void 0) ?? await headCommit(repo.path, worktree);
       if (!continued && assignment.resumeFrom) {
@@ -13126,7 +13151,7 @@ var RunSupervisor = class {
     let session;
     if (assignment.subscriptionBinding && assignment.modelCredential) throw new Error("A run has one model credential");
     try {
-      session = assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
+      session = await this.stage(runId, "agent_start", async () => assignment.modelCredential && this.deps.startCredential ? await this.deps.startCredential(assignment, { ...options, prompt: assignment.prompt }) : assignment.subscriptionBinding ? this.deps.startSubscription ? await this.deps.startSubscription(assignment, { ...options, prompt: assignment.prompt }) : (() => {
         throw new Error("subscription_hosted_runtime_unavailable");
       })() : resuming ? await adapter.resume(entry.sessionId, options) : await (async () => {
         if (assignment.requireSessionResume)
@@ -13139,7 +13164,7 @@ var RunSupervisor = class {
           continueSession,
           requireSessionResume: assignment.requireSessionResume
         });
-      })();
+      })());
     } catch (error) {
       if (assignment.skillReceipt) this.deps.journal.update(runId, { skillMount: void 0, execution: void 0, runtime: void 0 });
       throw error;
@@ -13276,7 +13301,7 @@ var RunSupervisor = class {
         const policy = runPolicy(assignment.policy);
         if (stopReason === "submitted" && report.verify.status !== "failed" && tree && // The draft-PR exception requires an explicit repository push
         // approval. It must not even create a local commit without it.
-        (report.verify.status === "passed" || pushDecision(policy, repo.push?.approved === true).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
+        (report.verify.status === "passed" || pushDecision(policy).push) && // A read-only check (ADR 0046) never commits or pushes: it reports
         // on the commit the implementation run already pushed.
         policy.readOnly !== true) {
           const publish = await this.publish(
@@ -13673,9 +13698,15 @@ var bootstrap = fileURLToPath3(
 );
 var placeholder = "mikka-native-broker-placeholder";
 var unavailable3 = (cause) => new Error("subscription_hosted_runtime_unavailable", cause === void 0 ? void 0 : { cause });
-var dockerFailure = (error) => {
+var DOCKER_CREATE_TIMEOUT_MS = 18e4;
+var dockerFailure = (error, startedAt) => {
   const value = error;
-  return new Error(String(value.stderr || value.message || error).trim().slice(-500));
+  const took = startedAt === void 0 ? "" : ` after ${Math.round((performance.now() - startedAt) / 1e3)}s`;
+  const stderr = String(value.stderr ?? "").trim();
+  if (stderr) return new Error(`${stderr.slice(-500)}${took}`);
+  if (value.killed) return new Error(`docker timed out${took}`);
+  if (error instanceof Error && error.message === "subscription_hosted_runtime_unavailable") return new Error(`run fenced${took}`);
+  return new Error(`docker failed (exit ${String(value.code ?? value.signal ?? "unknown")})${took}`);
 };
 var blockedSandbox = {
   kind: "none",
@@ -13872,7 +13903,7 @@ async function createHostedBotRunner(host) {
           "-c",
           script
         ],
-        { env: bareEnv, timeout: 3e4, signal, maxBuffer: 1024 * 1024 }
+        { env: bareEnv, timeout: DOCKER_CREATE_TIMEOUT_MS, signal, maxBuffer: 1024 * 1024 }
       );
       resource.id = created.stdout.trim();
       if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -14192,10 +14223,11 @@ async function createHostedBotRunner(host) {
         ];
         await live();
         writeJsonAtomic(resourceFile, resource);
+        const createStarted = performance.now();
         try {
           creating = exec3("docker", containerArgs2, {
             env: bareEnv,
-            timeout: 3e4
+            timeout: DOCKER_CREATE_TIMEOUT_MS
           }).then((created) => {
             resource.id = created.stdout.trim();
             if (!/^[a-f0-9]{64}$/.test(resource.id)) throw unavailable3();
@@ -14203,9 +14235,10 @@ async function createHostedBotRunner(host) {
             writeJsonAtomic(resourceFile, resource);
           });
           await creating;
+          console.info(`run ${assignment.runId}: hosted container created in ${Math.round((performance.now() - createStarted) / 1e3)}s`);
           await live();
         } catch (error) {
-          const reason = dockerFailure(error);
+          const reason = dockerFailure(error, createStarted);
           try {
             await close();
           } catch (cleanup) {
@@ -15191,10 +15224,7 @@ var Daemon = class {
           pushBranch: assignment.pushBranch,
           baseBranch: assignment.remoteUrl ? await this.repositories.baseRef(assignment.remoteUrl, assignment.baseBranch) : assignment.baseBranch,
           push: (() => {
-            const decision = pushDecision(
-              runPolicy(assignment.policy),
-              repo.push?.approved === true
-            );
+            const decision = pushDecision(runPolicy(assignment.policy));
             return {
               approved: decision.push,
               remote: repo.push?.remote ?? "origin",

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.193",
+  "version": "0.0.194",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.193",
+      "version": "0.0.194",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.193",
+  "version": "0.0.194",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b",
+  "gitHead": "c28c48908fb4b35a1cb5f57c391d27cc68aae252",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.193",
+  version: "0.0.194",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -66,7 +66,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "f7cc3fffbc2cce990feb9c2c4eb65f59140b305b"
+  gitHead: "c28c48908fb4b35a1cb5f57c391d27cc68aae252"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a26f957c-a2dc-4cb0-bec9-884207cd15cd",
+  "serialNumber": "urn:uuid:69e426b6-72e9-483e-a52c-15a9d233512a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-01T14:44:19.699Z",
+    "timestamp": "2026-11-01T14:49:21.369Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.193",
+      "bom-ref": "@aspectlylabs/mikka@0.0.194",
       "type": "library",
-      "name": ".retained-build-iOfsYo",
-      "version": "0.0.193",
+      "name": ".retained-build-iDX1L4",
+      "version": "0.0.194",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.193",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.194",
       "properties": [],
       "externalReferences": [
         {
@@ -4627,7 +4627,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.193",
+      "ref": "@aspectlylabs/mikka@0.0.194",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",