@aspectlylabs/mikka 0.0.244 → 0.0.246

package/cli.js

@@ -4519,7 +4519,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4543,7 +4543,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4551,7 +4551,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4577,7 +4578,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts
@@ -4832,6 +4833,13 @@ function personalMessagePacket(source, body) {
   return encode({ version: 1, kind: "personal_agent_message", authority: "coordination_data_only", source: validateSource(source), untrustedData: { body } });
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 function mailboxNoticeText(runId, ids) {
   const messageIds = z25.array(z25.uuid()).min(1).max(50).parse(ids);
@@ -4901,7 +4909,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {
@@ -6529,7 +6537,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join8(dir2, "gh")).find((file) => existsSync3(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -6648,7 +6656,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {

package/client.js

@@ -3763,7 +3763,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3787,7 +3787,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3795,7 +3795,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3821,7 +3822,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts

package/http-link.js

@@ -4011,7 +4011,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4035,7 +4035,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4043,7 +4043,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4069,7 +4070,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts
@@ -4090,6 +4091,13 @@ var mailboxInputs = {
   mailbox_sent: z24.object({}).strict()
 };
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 var requestSchema = z25.union([
   z25.object({ operation: z25.literal("list") }).strict(),
@@ -4130,7 +4138,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {

package/login.js

@@ -3770,7 +3770,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3794,7 +3794,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3802,7 +3802,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3828,7 +3829,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts

package/main.js

@@ -3327,6 +3327,13 @@ function localGitConfig(env = process.env) {
   return origin ? [[`url.${pathToFileURL(origin).href}.insteadOf`, repository], ["protocol.file.allow", "always"]] : [];
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/agents/github-runtime.ts
 var GITHUB_CREDENTIAL_SCRIPT = resolve4(import.meta.dirname, "github-credentials.mjs");
 var helper = GITHUB_CREDENTIAL_SCRIPT;
@@ -3352,7 +3359,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join4(dir2, "gh")).find((file) => existsSync2(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -3471,7 +3478,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {
@@ -3881,7 +3888,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3905,7 +3912,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3913,7 +3920,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3939,7 +3947,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "44e919f1b65c17908814097f016f0c2b38fab0c3",
+  "sourceSha": "045ada80a6b7994d97e7c42918490feee63508ac",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41379782775",
+  "buildRunId": "41380285789",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "d5866677d0c52d856be14efba47832070bc7f2fb92ef64b3bb253a4836587d30",
-  "createdAt": "2026-11-02T03:08:30.465Z",
+  "createdAt": "2026-11-02T03:15:52.337Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -35,13 +35,13 @@
     },
     {
       "path": "cli.js",
-      "size": 589936,
-      "sha256": "a9cf773b1b90e17c7f4044854eae793253c778e28a5b5b69a2d821ad89ae18c0"
+      "size": 589846,
+      "sha256": "0467b88baff2c4b0bd503f0eb3f74c0422af2967919e9a0b2aaec6d9ace10752"
     },
     {
       "path": "client.js",
-      "size": 142533,
-      "sha256": "3ac35c0b3889af4b63e00efa93ab599b35132366672bdb352a37e6f8f9e39b45"
+      "size": 142669,
+      "sha256": "9e194143e23d7d14d36a2084724e4b231f1955d070e5d620bce8d07c7c355c2f"
     },
     {
       "path": "computer/driver.mjs",
@@ -165,8 +165,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 174863,
-      "sha256": "386d36300b01d4b5b721bbb22c49d1a818bcafea65efe8e557653c1e84915489"
+      "size": 175107,
+      "sha256": "eb8fa986a6e5a22a941b044a3c6ee46a6d6000c0add2a95f27bcad9821186a3b"
     },
     {
       "path": "log.js",
@@ -175,13 +175,13 @@
     },
     {
       "path": "login.js",
-      "size": 147268,
-      "sha256": "4104d15f8741dcfd34125b52da23c7d6dbfa5bb61a8b110ac6b8625775eb8ecc"
+      "size": 147404,
+      "sha256": "9af401586c2534649f4bbd7a66e372485bef37dd841a92a4805cf6d387950e94"
     },
     {
       "path": "main.js",
-      "size": 542406,
-      "sha256": "2cb7b6a6a70ca39748e655ca2c7a42dc19e5e9fe7567ff0b97987046a8e1a3e1"
+      "size": 542495,
+      "sha256": "60a6d49ab5188db108d275277733f8e1073b13142c7bcfbb567e018961668bef"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -190,23 +190,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 589952,
-      "sha256": "622d33a171ff526f0ae09135aea5b749feeeec219cdd7bdf4f95a75eb1e2511f"
+      "size": 589862,
+      "sha256": "fef3a1b223b87d07721deb0bfd56a49662ae5fd2221e63d1bf642592cad9d44f"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 76020,
-      "sha256": "4858daf3faa9fbc66755c219eda93bbb88cce9ea31b5bf77c9825865db1f1bf4"
+      "sha256": "839c69822874cfc2a56bff0c553c7bedf55f2c0a8f15d9024ec4348b6fbc9e7f"
     },
     {
       "path": "package.json",
       "size": 1200,
-      "sha256": "747277cc03ed87df983d2144c6acb816f3d8194b7fa5503be5e1a89dd93ebb12"
+      "sha256": "8511abd80d6d3dc9871d0a1830dfeb5ab694864b4360d22ff97b4a1b48fce30f"
     },
     {
       "path": "paths.js",
-      "size": 3981,
-      "sha256": "650773f4f50a2112a3a61a5bf09442cc3f3cabaa8e573e10a5f7c008d2386670"
+      "size": 4117,
+      "sha256": "f4c4557c1f6ff784834f35310910e7b5128433e4069226444d665d4d808b61d8"
     },
     {
       "path": "sandbox.js",
@@ -216,7 +216,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 139999,
-      "sha256": "ddf77254471456153c926ee566601860556f096be2bc123095e365df5aa032d6"
+      "sha256": "f80384ef7701c523e01d27a4eb13aa759749ab182c3012028860ed961bddd8a9"
     }
   ]
 }

package/mikka.js

@@ -4520,7 +4520,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4544,7 +4544,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4552,7 +4552,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4578,7 +4579,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts
@@ -4833,6 +4834,13 @@ function personalMessagePacket(source, body) {
   return encode({ version: 1, kind: "personal_agent_message", authority: "coordination_data_only", source: validateSource(source), untrustedData: { body } });
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 function mailboxNoticeText(runId, ids) {
   const messageIds = z25.array(z25.uuid()).min(1).max(50).parse(ids);
@@ -4902,7 +4910,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {
@@ -6530,7 +6538,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join8(dir2, "gh")).find((file) => existsSync3(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -6649,7 +6657,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.244",
+  "version": "0.0.246",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.244",
+      "version": "0.0.246",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.244",
+  "version": "0.0.246",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "44e919f1b65c17908814097f016f0c2b38fab0c3",
+  "gitHead": "045ada80a6b7994d97e7c42918490feee63508ac",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.244",
+  version: "0.0.246",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -30,7 +30,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -38,7 +38,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -64,7 +65,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "44e919f1b65c17908814097f016f0c2b38fab0c3"
+  gitHead: "045ada80a6b7994d97e7c42918490feee63508ac"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c3a83f56-2277-4009-a526-1bce77a78199",
+  "serialNumber": "urn:uuid:45498dce-023b-4a98-bcd4-a3fd8bc82827",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-02T03:08:29.907Z",
+    "timestamp": "2026-11-02T03:15:51.448Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.244",
+      "bom-ref": "@aspectlylabs/mikka@0.0.246",
       "type": "library",
-      "name": ".retained-build-8u2cjL",
-      "version": "0.0.244",
+      "name": ".retained-build-mrZGF7",
+      "version": "0.0.246",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.244",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.246",
       "properties": [],
       "externalReferences": [
         {
@@ -4489,7 +4489,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.244",
+      "ref": "@aspectlylabs/mikka@0.0.246",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",