@aspectlylabs/mikka 0.0.245 → 0.0.247

package/cli.js

@@ -4519,7 +4519,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4543,7 +4543,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4551,7 +4551,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4577,7 +4578,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts
@@ -4832,6 +4833,13 @@ function personalMessagePacket(source, body) {
   return encode({ version: 1, kind: "personal_agent_message", authority: "coordination_data_only", source: validateSource(source), untrustedData: { body } });
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 function mailboxNoticeText(runId, ids) {
   const messageIds = z25.array(z25.uuid()).min(1).max(50).parse(ids);
@@ -4901,7 +4909,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {
@@ -6529,7 +6537,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join8(dir2, "gh")).find((file) => existsSync3(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -6648,7 +6656,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {

package/client.js

@@ -3763,7 +3763,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3787,7 +3787,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3795,7 +3795,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3821,7 +3822,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts

package/http-link.js

@@ -4011,7 +4011,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4035,7 +4035,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4043,7 +4043,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4069,7 +4070,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts
@@ -4090,6 +4091,13 @@ var mailboxInputs = {
   mailbox_sent: z24.object({}).strict()
 };
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 var requestSchema = z25.union([
   z25.object({ operation: z25.literal("list") }).strict(),
@@ -4130,7 +4138,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {

package/login.js

@@ -3770,7 +3770,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3794,7 +3794,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3802,7 +3802,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3828,7 +3829,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts

package/main.js

@@ -3327,6 +3327,13 @@ function localGitConfig(env = process.env) {
   return origin ? [[`url.${pathToFileURL(origin).href}.insteadOf`, repository], ["protocol.file.allow", "always"]] : [];
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/agents/github-runtime.ts
 var GITHUB_CREDENTIAL_SCRIPT = resolve4(import.meta.dirname, "github-credentials.mjs");
 var helper = GITHUB_CREDENTIAL_SCRIPT;
@@ -3352,7 +3359,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join4(dir2, "gh")).find((file) => existsSync2(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -3471,7 +3478,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {
@@ -3881,7 +3888,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3905,7 +3912,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -3913,7 +3920,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3939,7 +3947,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "79868b988c6aa2f93c11d26296f04c780de9eaf1",
+  "sourceSha": "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41380207198",
+  "buildRunId": "41380593625",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "d5866677d0c52d856be14efba47832070bc7f2fb92ef64b3bb253a4836587d30",
-  "createdAt": "2026-11-02T03:11:50.250Z",
+  "createdAt": "2026-11-02T03:21:08.941Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -35,13 +35,13 @@
     },
     {
       "path": "cli.js",
-      "size": 589936,
-      "sha256": "3e28f4eca60b5491b88aaa8086b7253aa1d6f1fc6812b287f20c7d66ea99ab2b"
+      "size": 589846,
+      "sha256": "66557aa94feae4a2762b543bcc08ac2f673011b5406497c207b4095c3dcd6645"
     },
     {
       "path": "client.js",
-      "size": 142533,
-      "sha256": "5496a72a97b8ca9011c0755e403f5bd7ff3d70f7dd33aaf9ec7ea58f0e3e3ddb"
+      "size": 142669,
+      "sha256": "b7e0cd398efb0c24f738769f89f772ebf454e1066092c095a9eb7ee78803c47b"
     },
     {
       "path": "computer/driver.mjs",
@@ -165,8 +165,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 174863,
-      "sha256": "840e64202d5ca96279b338e02b13bd6b933812d38db80b27cb924ff5757361fb"
+      "size": 175107,
+      "sha256": "eee963ef6b730d4dd8cb6460b703e4d22884858c75800e7eefba094bed6e5ecd"
     },
     {
       "path": "log.js",
@@ -175,13 +175,13 @@
     },
     {
       "path": "login.js",
-      "size": 147268,
-      "sha256": "9958cf6c9cd1fc885d2647c4429dfbb8585ed7ddb2f093c61b3f3eb3b6eb75eb"
+      "size": 147404,
+      "sha256": "e854cdb263d88e1e13e849ac1012369df26e6817fe648df155104c5c5c9a4bf7"
     },
     {
       "path": "main.js",
-      "size": 542406,
-      "sha256": "0d6f65255f1b5ce97e1cfdd82986567bd5902347f1683fbf402f6f79099795df"
+      "size": 542495,
+      "sha256": "4715fbf8870f8fb677bfd5af8ce6bf6f7f23e2914ffdb3b36ad22d4a99ff5c53"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -190,23 +190,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 589952,
-      "sha256": "4fc2a59e83712ac9cba3ba096471c641f8741d3720557938447a5b02392828a9"
+      "size": 589862,
+      "sha256": "2b7f9c93782b2358cca5e4107630ea1ae21ed0f069d4717a5bd3cf800fa09471"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 76020,
-      "sha256": "826efdcf49ff48fdf9cce7abc30381b5f10a7af9c9cba56a6b3e0006404fb171"
+      "sha256": "596e35231925c4acbf526831b4143f8b19349c37be0831fbcb50ee7a12491e37"
     },
     {
       "path": "package.json",
       "size": 1200,
-      "sha256": "8de086f4bb77c84869cd35b6f4ac28a8bf9b84459ab7760db32a334d9b9c74e7"
+      "sha256": "d78c1511c8bea6a98b40c136cf1b8e5aaf599c4fcab3de4b9c12e638350d39e9"
     },
     {
       "path": "paths.js",
-      "size": 3981,
-      "sha256": "4a2223b6ab5ba9ecefb2e758d00511f5b02533e8fae61b9fd15ea8187cb3409f"
+      "size": 4117,
+      "sha256": "4e6539753ae13ec89bee93f7ed2df92434a2e739a70d8d8d4d63f9565a5c566e"
     },
     {
       "path": "sandbox.js",
@@ -216,7 +216,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 139999,
-      "sha256": "96eee7d1d2716d04131d5b652b84db31655ad9540c8b006399f5de065bdde19f"
+      "sha256": "fa91256db3239f7ffe5e8ea17fefdd17f02e4784118d413ebe63a50a4f5572e4"
     }
   ]
 }

package/mikka.js

@@ -4520,7 +4520,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4544,7 +4544,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -4552,7 +4552,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -4578,7 +4579,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts
@@ -4833,6 +4834,13 @@ function personalMessagePacket(source, body) {
   return encode({ version: 1, kind: "personal_agent_message", authority: "coordination_data_only", source: validateSource(source), untrustedData: { body } });
 }
 
+// src/trusted-endpoint.ts
+function trustedServerEndpoint(url) {
+  if (url.username || url.password || url.search || url.hash) return false;
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname);
+}
+
 // src/run-mailbox.ts
 function mailboxNoticeText(runId, ids) {
   const messageIds = z25.array(z25.uuid()).min(1).max(50).parse(ids);
@@ -4902,7 +4910,7 @@ async function createRunMailbox(host) {
   } catch {
     throw unavailable();
   }
-  if (endpoint.href !== host.endpoint.href || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
+  if (endpoint.href !== host.endpoint.href || !trustedServerEndpoint(endpoint) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(assigned.token)) throw unavailable();
   let nextId = 0, session = null, version = "2025-03-26", closed = false, inFlight = 0;
   const pending = /* @__PURE__ */ new Set();
   const active = () => {
@@ -6530,7 +6538,7 @@ function githubReceiptEnvironment(host = process.env) {
 }
 function prepareGitHubEnvironment(runDir, github, path, runtime) {
   const endpoint = new URL(github.endpoint);
-  if (!endpoint.pathname.endsWith("/api/runs/github-token") || endpoint.username || endpoint.password || endpoint.search || endpoint.hash || endpoint.protocol !== "https:" && !(endpoint.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(endpoint.hostname))) throw new Error("Invalid run GitHub endpoint");
+  if (!endpoint.pathname.endsWith("/api/runs/github-token") || !trustedServerEndpoint(endpoint)) throw new Error("Invalid run GitHub endpoint");
   const gh = runtime?.ghBinary ?? path.split(delimiter).map((dir2) => join8(dir2, "gh")).find((file) => existsSync3(file));
   const node = runtime?.nodeBinary ?? process.execPath;
   if (!gh) throw new Error("Install GitHub CLI (gh) before running GitHub tasks");
@@ -6649,7 +6657,7 @@ function runApps(mcp) {
   } catch {
     return void 0;
   }
-  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || !trustedServerEndpoint(base) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
   const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
   if (!names.length) return void 0;
   return {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.245",
+  "version": "0.0.247",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.245",
+      "version": "0.0.247",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.245",
+  "version": "0.0.247",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "79868b988c6aa2f93c11d26296f04c780de9eaf1",
+  "gitHead": "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.245",
+  version: "0.0.247",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -30,7 +30,7 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials && pnpm test:trusted-endpoint",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
@@ -38,7 +38,8 @@ var package_default = {
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
     "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
-    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs",
+    "test:trusted-endpoint": "node --experimental-strip-types --test test/trusted-endpoint.node-test.ts"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -64,7 +65,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "79868b988c6aa2f93c11d26296f04c780de9eaf1"
+  gitHead: "ee42fe84a0e7965e2ea1025875ffbb9a706e8c4b"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:57b49cb7-c3e1-46b7-93d2-43ca0b14daf6",
+  "serialNumber": "urn:uuid:75e31b62-94af-47bd-b9ca-90c367ddd97c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-11-02T03:11:49.428Z",
+    "timestamp": "2026-11-02T03:21:08.101Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.245",
+      "bom-ref": "@aspectlylabs/mikka@0.0.247",
       "type": "library",
-      "name": ".retained-build-7sspCG",
-      "version": "0.0.245",
+      "name": ".retained-build-lf5Tdr",
+      "version": "0.0.247",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.245",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.247",
       "properties": [],
       "externalReferences": [
         {
@@ -4489,7 +4489,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.245",
+      "ref": "@aspectlylabs/mikka@0.0.247",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",