@aspectlylabs/mikka 0.0.230 → 0.0.232

package/npm-shrinkwrap.json

@@ -1,17 +1,16 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.230",
+  "version": "0.0.232",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.230",
+      "version": "0.0.232",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",
         "@anthropic-ai/claude-agent-sdk": "0.3.305",
-        "@anthropic-ai/sandbox-runtime": "0.0.80",
         "ai": "7.0.142",
         "execa": "10.1.1",
         "pino": "10.4.0",
@@ -225,33 +224,6 @@
         "win32"
       ]
     },
-    "node_modules/@anthropic-ai/sandbox-runtime": {
-      "version": "0.0.80",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/sandbox-runtime/-/sandbox-runtime-0.0.80.tgz",
-      "integrity": "sha512-WG4P8faU/JDH90I8NLUBPmg7e72zhanlW3AVCD0OF06JCtId9IDFewFgv4YRvHLcnn//h1r6a1AMosBsMLpxnA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@pondwader/socks5-server": "^1.0.10",
-        "commander": "^12.1.0",
-        "node-forge": "^1.4.0",
-        "zod": "^3.25.0"
-      },
-      "bin": {
-        "srt": "dist/cli.js"
-      },
-      "engines": {
-        "node": ">=22.12.0"
-      }
-    },
-    "node_modules/@anthropic-ai/sandbox-runtime/node_modules/zod": {
-      "version": "3.25.76",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz",
-      "integrity": "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==",
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/sponsors/colinhacks"
-      }
-    },
     "node_modules/@anthropic-ai/sdk": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/@anthropic-ai/sdk/-/sdk-1.3.0.tgz",
@@ -370,12 +342,6 @@
       "integrity": "sha512-k2ENnmBugE/rzQfEcdWHcCY+/FM3VLzH9cYEsbdsoqrvzAKRhUZeRNhAZvB8OitQJ1TBed3yqWtdjzS6wJKBwg==",
       "license": "MIT"
     },
-    "node_modules/@pondwader/socks5-server": {
-      "version": "1.0.10",
-      "resolved": "https://registry.npmjs.org/@pondwader/socks5-server/-/socks5-server-1.0.10.tgz",
-      "integrity": "sha512-bQY06wzzR8D2+vVCUoBsr5QS2U6UgPUQRmErNwtsuI6vLcyRKkafjkr3KxbtGFf9aBBIV2mcvlsKD1UYaIV+sg==",
-      "license": "MIT"
-    },
     "node_modules/@sec-ant/readable-stream": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/@sec-ant/readable-stream/-/readable-stream-0.4.1.tgz",
@@ -592,15 +558,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/commander": {
-      "version": "12.1.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz",
-      "integrity": "sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/content-disposition": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-2.0.1.tgz",
@@ -1394,15 +1351,6 @@
         "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/node-forge": {
-      "version": "1.4.2",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.2.tgz",
-      "integrity": "sha512-rRtAR5XLJ8gCKd9du4qrKAsgCG1ObGP4gLeNJMa4vYSeq4bmBMOJk5IHkrviBV0q7uoAJlVd8HEQYQSVUb4FGQ==",
-      "license": "(BSD-3-Clause OR GPL-2.0)",
-      "engines": {
-        "node": ">= 6.13.0"
-      }
-    },
     "node_modules/npm-run-path": {
       "version": "6.0.0",
       "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-6.0.0.tgz",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.230",
+  "version": "0.0.232",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "65379b6f85c1a910fba0062edb7936f9cd36a106",
+  "gitHead": "0d277e06e505130445631d9ecfa06d0a78f8e0d4",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",
@@ -36,7 +36,6 @@
   "dependencies": {
     "@agentclientprotocol/sdk": "1.9.0",
     "@anthropic-ai/claude-agent-sdk": "0.3.305",
-    "@anthropic-ai/sandbox-runtime": "0.0.80",
     "ai": "7.0.142",
     "execa": "10.1.1",
     "pino": "10.4.0",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.230",
+  version: "0.0.232",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -30,7 +30,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:local-git-origin-sandbox",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -38,14 +38,11 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
-    "test:run-container": "node --import tsx --test --test-timeout=900000 test/run-container.docker-test.ts",
-    "test:local-git-origin-sandbox": "node --import tsx --test --test-timeout=60000 test/local-git-origin.sandbox-test.ts"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
     "@anthropic-ai/claude-agent-sdk": "^0.3.305",
-    "@anthropic-ai/sandbox-runtime": "0.0.80",
     "@mikka/protocol": "workspace:*",
     ai: "7.0.142",
     execa: "10.1.1",
@@ -67,7 +64,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "65379b6f85c1a910fba0062edb7936f9cd36a106"
+  gitHead: "0d277e06e505130445631d9ecfa06d0a78f8e0d4"
 };
 
 // src/paths.ts

package/sandbox.js

@@ -1,7 +1,4 @@
 // src/agents/sandbox.ts
-import { randomBytes } from "node:crypto";
-import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
-import { execa } from "execa";
 function shellQuote(arg) {
   if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(arg)) return arg;
   return `'${arg.replaceAll("'", `'"'"'`)}'`;
@@ -9,117 +6,6 @@ function shellQuote(arg) {
 function shellJoin(argv) {
   return argv.map(shellQuote).join(" ");
 }
-var SandboxRuntime = class _SandboxRuntime {
-  constructor(onAsk, options = {}) {
-    this.onAsk = onAsk;
-    this.options = options;
-  }
-  onAsk;
-  options;
-  kind = "sandbox-runtime";
-  static owner = null;
-  ready = null;
-  resetting = null;
-  /** The platform is supported and its tools (Linux: bwrap, socat, rg) exist. */
-  static supported() {
-    return SandboxManager.isSupportedPlatform() && SandboxManager.checkDependencies().errors.length === 0;
-  }
-  /** Check that the runtime can actually start isolation on this host. */
-  async probe() {
-    const wrapped = await this.wrap(["/bin/sh", "-c", ":"], {
-      allowWrite: [],
-      allowDomains: []
-    });
-    try {
-      const result = await execa("/bin/sh", ["-c", wrapped.command], {
-        reject: false,
-        timeout: 1e4
-      });
-      if (result.failed) {
-        throw new Error(
-          `sandbox probe failed: ${result.timedOut ? "timed out" : result.stderr.trim() || `exit ${result.exitCode}`}`
-        );
-      }
-    } finally {
-      wrapped.release();
-    }
-  }
-  init() {
-    if (this.resetting) return Promise.reject(new Error("sandbox runtime is stopping"));
-    if (this.ready) return this.ready;
-    if (_SandboxRuntime.owner && _SandboxRuntime.owner !== this) {
-      return Promise.reject(new Error("sandbox runtime is already in use by another instance"));
-    }
-    _SandboxRuntime.owner = this;
-    this.ready = SandboxManager.initialize(
-      {
-        // Everything is per run (`registerCommandNetworkLists`).
-        network: {
-          allowedDomains: [],
-          deniedDomains: [],
-          ...this.options.allowAllUnixSockets ? { allowAllUnixSockets: true } : {}
-        },
-        filesystem: { denyRead: [], allowWrite: [], denyWrite: [] },
-        // Rust and Go CLIs (codex) verify TLS through trustd; without it
-        // every HTTPS request from them fails inside the sandbox.
-        enableWeakerNetworkIsolation: true
-      },
-      async ({ host, port }) => await this.onAsk?.({ host, port }) === true
-    ).catch(async (error) => {
-      await SandboxManager.reset().catch(() => void 0);
-      _SandboxRuntime.owner = null;
-      this.ready = null;
-      throw error;
-    });
-    return this.ready;
-  }
-  async wrap(argv, policy) {
-    await this.init();
-    const commandId = randomBytes(16).toString("base64url");
-    const command = await SandboxManager.wrapWithSandbox(
-      shellJoin(argv),
-      "/bin/sh",
-      {
-        filesystem: {
-          denyRead: policy.denyRead ?? [],
-          allowWrite: policy.allowWrite,
-          denyWrite: policy.denyWrite ?? []
-        }
-      },
-      void 0,
-      { commandId }
-    );
-    SandboxManager.registerCommandNetworkLists(commandId, {
-      allowedDomains: policy.allowDomains
-    });
-    let released = false;
-    return {
-      command,
-      annotate: (stderr) => SandboxManager.annotateStderrWithSandboxFailures(commandId, stderr),
-      release() {
-        if (released) return;
-        released = true;
-        SandboxManager.unregisterCommandNetworkLists(commandId);
-      }
-    };
-  }
-  /** Stops the proxy; the next `wrap` starts it again. */
-  reset() {
-    if (this.resetting) return this.resetting;
-    if (_SandboxRuntime.owner !== this) return Promise.resolve();
-    this.resetting = (async () => {
-      try {
-        await this.ready?.catch(() => void 0);
-        if (_SandboxRuntime.owner === this) await SandboxManager.reset();
-      } finally {
-        if (_SandboxRuntime.owner === this) _SandboxRuntime.owner = null;
-        this.ready = null;
-        this.resetting = null;
-      }
-    })();
-    return this.resetting;
-  }
-};
 var NoSandbox = class {
   kind = "none";
   async wrap(argv) {
@@ -133,7 +19,6 @@ var NoSandbox = class {
 };
 export {
   NoSandbox,
-  SandboxRuntime,
   shellJoin,
   shellQuote
 };

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:63bad7a2-bb31-4f10-bfd8-94e7f670f43e",
+  "serialNumber": "urn:uuid:cd913f9e-a562-4d85-9df4-c46e4f496351",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-02T00:51:59.907Z",
+    "timestamp": "2026-11-02T01:11:54.685Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.230",
+      "bom-ref": "@aspectlylabs/mikka@0.0.232",
       "type": "library",
-      "name": ".retained-build-WXwzJm",
-      "version": "0.0.230",
+      "name": ".retained-build-Ulm9gB",
+      "version": "0.0.232",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.230",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.232",
       "properties": [],
       "externalReferences": [
         {
@@ -344,62 +344,6 @@
         }
       ]
     },
-    {
-      "bom-ref": "@anthropic-ai/sandbox-runtime@0.0.80",
-      "type": "library",
-      "name": "@anthropic-ai/sandbox-runtime",
-      "version": "0.0.80",
-      "scope": "required",
-      "purl": "pkg:npm/%40anthropic-ai/sandbox-runtime@0.0.80",
-      "properties": [],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/@anthropic-ai/sandbox-runtime/-/sandbox-runtime-0.0.80.tgz"
-        }
-      ],
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "586e0ff1f694fc90c7f7423c34b5013e683b7bbdb385a9e55b7015083d0e174e890ad21df480c57b0160bf8611bc72dc9e7fff875afa6b500ca2c06c30ba719c"
-        }
-      ],
-      "licenses": [
-        {
-          "license": {
-            "id": "Apache-2.0"
-          }
-        }
-      ]
-    },
-    {
-      "bom-ref": "zod@3.25.76",
-      "type": "library",
-      "name": "zod",
-      "version": "3.25.76",
-      "scope": "required",
-      "purl": "pkg:npm/zod@3.25.76",
-      "properties": [],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/zod/-/zod-3.25.76.tgz"
-        }
-      ],
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "83352dfeab7cd675ec14628815c0b76277c4031e4d92e9c27e70e5bee0524854b4d9b717bb82e679ad001485306cb5b158fc7777da7c4b94286ae8ca70d43171"
-        }
-      ],
-      "licenses": [
-        {
-          "license": {
-            "id": "MIT"
-          }
-        }
-      ]
-    },
     {
       "bom-ref": "@anthropic-ai/sdk@1.3.0",
       "type": "library",
@@ -624,34 +568,6 @@
         }
       ]
     },
-    {
-      "bom-ref": "@pondwader/socks5-server@1.0.10",
-      "type": "library",
-      "name": "@pondwader/socks5-server",
-      "version": "1.0.10",
-      "scope": "required",
-      "purl": "pkg:npm/%40pondwader/socks5-server@1.0.10",
-      "properties": [],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/@pondwader/socks5-server/-/socks5-server-1.0.10.tgz"
-        }
-      ],
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "6d0634eb0cf347c0f6faf54252806caf9412d94e9480f51046612b370b6cb88eaf2dcc912a469f8e4af72b16ed1857fd68104857699cbe5b0a0f551868857eb2"
-        }
-      ],
-      "licenses": [
-        {
-          "license": {
-            "id": "MIT"
-          }
-        }
-      ]
-    },
     {
       "bom-ref": "@sec-ant/readable-stream@0.4.1",
       "type": "library",
@@ -1156,34 +1072,6 @@
         }
       ]
     },
-    {
-      "bom-ref": "commander@12.1.0",
-      "type": "library",
-      "name": "commander",
-      "version": "12.1.0",
-      "scope": "required",
-      "purl": "pkg:npm/commander@12.1.0",
-      "properties": [],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/commander/-/commander-12.1.0.tgz"
-        }
-      ],
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "570f2a1caddb64cf72fcfd74bb75626fca3f0dd92f0363ad3ed66f0fcef540a8f2ef85a3d5648a1482cc3d13d27544b1e5114ad5aae527312d0383e41609dbb8"
-        }
-      ],
-      "licenses": [
-        {
-          "license": {
-            "id": "MIT"
-          }
-        }
-      ]
-    },
     {
       "bom-ref": "content-disposition@2.0.1",
       "type": "library",
@@ -2862,32 +2750,6 @@
         }
       ]
     },
-    {
-      "bom-ref": "node-forge@1.4.2",
-      "type": "library",
-      "name": "node-forge",
-      "version": "1.4.2",
-      "scope": "required",
-      "purl": "pkg:npm/node-forge@1.4.2",
-      "properties": [],
-      "externalReferences": [
-        {
-          "type": "distribution",
-          "url": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.2.tgz"
-        }
-      ],
-      "hashes": [
-        {
-          "alg": "SHA-512",
-          "content": "ad1b404795cb27c80229df5dbb8aab280b20086d4e6c63f880b78d24c6b8bd849eab86e604c38993920792bbe2055d2aeeea0026555df0711061049551be0519"
-        }
-      ],
-      "licenses": [
-        {
-          "expression": "(BSD-3-Clause OR GPL-2.0)"
-        }
-      ]
-    },
     {
       "bom-ref": "npm-run-path@6.0.0",
       "type": "library",
@@ -4627,11 +4489,10 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.230",
+      "ref": "@aspectlylabs/mikka@0.0.232",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",
-        "@anthropic-ai/sandbox-runtime@0.0.80",
         "ai@7.0.142",
         "execa@10.1.1",
         "pino@10.4.0",
@@ -4722,19 +4583,6 @@
       "ref": "@anthropic-ai/claude-agent-sdk-win32-x64@0.3.305",
       "dependsOn": []
     },
-    {
-      "ref": "@anthropic-ai/sandbox-runtime@0.0.80",
-      "dependsOn": [
-        "@pondwader/socks5-server@1.0.10",
-        "commander@12.1.0",
-        "node-forge@1.4.2",
-        "zod@3.25.76"
-      ]
-    },
-    {
-      "ref": "zod@3.25.76",
-      "dependsOn": []
-    },
     {
       "ref": "@anthropic-ai/sdk@1.3.0",
       "dependsOn": [
@@ -4794,10 +4642,6 @@
       "ref": "@pinojs/redact@0.4.0",
       "dependsOn": []
     },
-    {
-      "ref": "@pondwader/socks5-server@1.0.10",
-      "dependsOn": []
-    },
     {
       "ref": "@sec-ant/readable-stream@0.4.1",
       "dependsOn": []
@@ -4903,10 +4747,6 @@
         "get-intrinsic@1.3.0"
       ]
     },
-    {
-      "ref": "commander@12.1.0",
-      "dependsOn": []
-    },
     {
       "ref": "content-disposition@2.0.1",
       "dependsOn": []
@@ -5253,10 +5093,6 @@
         "content-type@2.1.0"
       ]
     },
-    {
-      "ref": "node-forge@1.4.2",
-      "dependsOn": []
-    },
     {
       "ref": "npm-run-path@6.0.0",
       "dependsOn": [

package/agents/native-egress.mjs

@@ -1,51 +0,0 @@
-// Only the host-supplied configuration enables this relay. The container has
-// no network interface; it forwards bytes to its single mounted egress socket.
-import { createServer, request } from 'node:http'
-
-export async function startNativeEgress(socketPath = '/run/mikka-egress.sock') {
-  const sockets = new Set()
-  const track = socket => {
-    sockets.add(socket)
-    socket.on('error', () => {})
-    socket.once('close', () => sockets.delete(socket))
-    return socket
-  }
-  const server = createServer({ maxHeaderSize: 16384 }, (incoming, response) => {
-    const outgoing = request({ socketPath, path: incoming.url, method: incoming.method, headers: incoming.headers, agent: false }, upstream => {
-      response.writeHead(upstream.statusCode ?? 502, upstream.headers)
-      upstream.pipe(response)
-    })
-    outgoing.on('socket', track)
-    outgoing.on('error', () => { if (!response.headersSent) response.writeHead(502); response.end() })
-    incoming.once('aborted', () => outgoing.destroy())
-    response.once('close', () => outgoing.destroy())
-    incoming.pipe(outgoing)
-  })
-  server.on('connection', track)
-  server.on('connect', (incoming, client, head) => {
-    const outgoing = request({ socketPath, method: 'CONNECT', path: incoming.url, headers: { host: incoming.url }, agent: false })
-    outgoing.on('socket', track)
-    outgoing.on('connect', (response, upstream, upstreamHead) => {
-      if (response.statusCode !== 200) { client.end('HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n'); upstream.destroy(); return }
-      client.write('HTTP/1.1 200 Connection Established\r\n\r\n')
-      if (upstreamHead.length) client.write(upstreamHead)
-      if (head.length) upstream.write(head)
-      upstream.pipe(client);client.pipe(upstream)
-      client.once('close', () => upstream.destroy())
-      upstream.once('close', () => client.destroy())
-    })
-    outgoing.on('error', () => client.destroy())
-    client.once('close', () => outgoing.destroy())
-    outgoing.end()
-  })
-  server.on('upgrade', (_request, socket) => socket.destroy())
-  server.on('clientError', (_error, socket) => socket.destroy())
-  await new Promise((resolve, reject) => { server.once('error', reject);server.listen(0, '127.0.0.1', resolve) })
-  return {
-    url: `http://127.0.0.1:${server.address().port}`,
-    async close() {
-      for (const socket of sockets) socket.destroy()
-      await new Promise(resolve => server.close(resolve))
-    },
-  }
-}

package/agents/run-container-entry.mjs

@@ -1,22 +0,0 @@
-// First process in a run container (run-container.ts): the container has no
-// network interface, so this relays the CLI's proxy traffic to the run's one
-// mounted egress socket, where the daemon applies the run's network approval.
-// Then it runs the CLI and exits with it.
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import { startNativeEgress } from './native-egress.mjs'
-
-const [command, ...args] = process.argv.slice(2)
-if (!command) process.exit(2)
-const env = { ...process.env }
-if (existsSync('/run/mikka-egress.sock')) {
-  const egress = await startNativeEgress()
-  Object.assign(env, {
-    HTTP_PROXY: egress.url, HTTPS_PROXY: egress.url, http_proxy: egress.url, https_proxy: egress.url,
-    NO_PROXY: 'localhost,127.0.0.1,::1', no_proxy: 'localhost,127.0.0.1,::1', NODE_USE_ENV_PROXY: '1',
-  })
-}
-const child = spawn(command, args, { stdio: 'inherit', env })
-for (const signal of ['SIGTERM', 'SIGINT', 'SIGHUP']) process.on(signal, () => child.kill(signal))
-child.on('error', () => process.exit(127))
-child.on('exit', (code, signal) => process.exit(code ?? (signal ? 128 : 1)))

package/harness/Dockerfile

@@ -1,19 +0,0 @@
-# The runner image: a clean Linux with the daemon's pinned Claude Code and
-# Codex (harness/pins.json), the same harnesses a device installs for itself.
-# A device with Docker runs each harness in a disposable container of it;
-# the E2B template installs from the same pins and installer.
-#
-# Context: packages/daemon (or the npm package root). Multi-arch: the installer picks the build for the
-# image's own arch, e.g.
-#   docker buildx build --platform linux/amd64,linux/arm64 -f harness/Dockerfile .
-# The base is the multi-arch node 24 index also pinned as HOSTED_NATIVE_IMAGE.
-FROM node@sha256:6449e19d8184d84062525b6a7524def03146c2cb04a7f08b076680d0e8e4240a
-COPY harness/pins.json harness/install.mjs harness/cli.mjs /opt/mikka/installer/
-# An optional `--secret id=ca,src=<bundle>` trusts a proxy's CA while downloading.
-RUN --mount=type=secret,id=ca,required=false \
-    if [ -f /run/secrets/ca ]; then export NODE_EXTRA_CA_CERTS=/run/secrets/ca; fi \
- && node /opt/mikka/installer/cli.mjs /opt/mikka/harness > /tmp/harnesses \
- && while read -r binary; do ln -sf "$binary" "/usr/local/bin/$(basename "$binary")"; done < /tmp/harnesses \
- && rm -rf /opt/mikka/installer /tmp/harnesses \
- && chmod -R go+rX,go-w /opt/mikka/harness \
- && claude --version && codex --version