@aspectlylabs/mikka 0.0.81 → 0.0.83

package/cli.js

@@ -3631,7 +3631,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -4425,7 +4431,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4484,7 +4490,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts
@@ -4824,7 +4830,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -4837,6 +4843,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool2 === `mcp__mikka__${name}`)) return "allow";
     if (tool2 === "Bash" || tool2 === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool2.startsWith(`mcp__${name}__`) && tool2.length > `mcp__${name}__`.length)) return "allow";
+    if (tool2 === "WebFetch" || tool2 === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool2)) {
       if (policy.readOnly) return "deny";
@@ -4848,6 +4856,26 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // ../protocol/src/capture.ts
 import { z as z23 } from "zod";
 var CAPTURE_CONTENT_TYPES = [
@@ -5165,7 +5193,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {
@@ -7044,6 +7072,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -7846,11 +7875,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -7962,6 +7991,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -8225,6 +8257,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8285,7 +8318,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -8318,7 +8351,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -8499,6 +8533,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -8667,6 +8709,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8712,6 +8755,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -8729,7 +8773,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -8752,7 +8796,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -12826,6 +12870,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/client.js

@@ -3012,7 +3012,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -3687,7 +3693,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3746,7 +3752,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts

package/http-link.js

@@ -2411,7 +2411,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -2424,6 +2424,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool === `mcp__mikka__${name}`)) return "allow";
     if (tool === "Bash" || tool === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool.startsWith(`mcp__${name}__`) && tool.length > `mcp__${name}__`.length)) return "allow";
+    if (tool === "WebFetch" || tool === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool)) {
       if (policy.readOnly) return "deny";
@@ -2435,6 +2437,25 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+
 // ../protocol/src/skill.ts
 import { z as z5 } from "zod";
 
@@ -3499,7 +3520,13 @@ var runAssignmentSchema = z18.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z18.object({ url: z18.url(), token: z18.string().min(1).max(200), mailbox: z18.literal(true).optional() }).optional(),
+  mcp: z18.object({
+    url: z18.url(),
+    token: z18.string().min(1).max(200),
+    mailbox: z18.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z18.array(z18.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z18.object({
     endpoint: z18.url(),
@@ -4065,7 +4092,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4124,7 +4151,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts
@@ -4349,7 +4376,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {

package/login.js

@@ -3008,7 +3008,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -3694,7 +3700,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3753,7 +3759,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts

package/main.js

@@ -3335,6 +3335,26 @@ async function agentPublishedReceipt(input) {
   }
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // src/agents/run-context.ts
 import { execFileSync } from "node:child_process";
 import {
@@ -3728,7 +3748,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3787,7 +3807,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts
@@ -4721,7 +4741,13 @@ var runAssignmentSchema = z15.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z15.object({ url: z15.url(), token: z15.string().min(1).max(200), mailbox: z15.literal(true).optional() }).optional(),
+  mcp: z15.object({
+    url: z15.url(),
+    token: z15.string().min(1).max(200),
+    mailbox: z15.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z15.array(z15.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z15.object({
     endpoint: z15.url(),
@@ -5836,6 +5862,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -6644,11 +6671,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -6789,6 +6816,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -7052,6 +7082,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -7112,7 +7143,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -7145,7 +7176,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -7326,6 +7358,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -7494,6 +7534,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -7539,6 +7580,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -7556,7 +7598,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -7579,7 +7621,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -11894,6 +11936,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "ff4e8d01e3a0b7d09232a157912c20b62f877e41",
+  "sourceSha": "8f9a75a2b7683088201e0d3149e12b1778455a72",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41229967204",
+  "buildRunId": "41235955128",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "333de14ab33e455ec8a3a699f59b49d7a125caebb37d557cc6cfa5024f0c15f7",
-  "createdAt": "2026-10-31T18:47:58.690Z",
+  "createdAt": "2026-10-31T19:55:37.551Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -35,13 +35,13 @@
     },
     {
       "path": "cli.js",
-      "size": 621856,
-      "sha256": "1b9ac461011339f3a20c01c5df2d53a2ba07c839d503f43716c8b35cdb5f0af4"
+      "size": 624106,
+      "sha256": "1fc4b8b45af683484c9dc73c0b7be0318df250c6391f9bcf6e43e667c6e9e390"
     },
     {
       "path": "client.js",
-      "size": 138369,
-      "sha256": "9e3aaa20a39a95a0cd96b1232bba5f41eacf385c7ce99c6c6c6ddf8e99236746"
+      "size": 138568,
+      "sha256": "f242016e09455688a344efdbd346a753ee13f64d919b48c32f30767d0e25a7bf"
     },
     {
       "path": "computer/driver.mjs",
@@ -145,8 +145,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 178124,
-      "sha256": "01532afabd23755447a3bfc062cf96c6c8e70a686e6b311903a4e8c2c761d55d"
+      "size": 179427,
+      "sha256": "6c2ec57be0c00c8e7584d94f51ac3bd6e2525c0f3a178c3e569e449954b27be8"
     },
     {
       "path": "log.js",
@@ -155,13 +155,13 @@
     },
     {
       "path": "login.js",
-      "size": 142938,
-      "sha256": "53c5b7111a6558530cd5df290a0c6b84c07d8f24dd407f95f85c5f072da4cdf7"
+      "size": 143137,
+      "sha256": "23070a9c9c142334dcba3c9a9960e5496d01219b50564d84ca07c5c9f6821e59"
     },
     {
       "path": "main.js",
-      "size": 567990,
-      "sha256": "82f66cb6b76dd54c00dda6bbd59b42720ea9011cb291b131618f44994d0252a4"
+      "size": 569962,
+      "sha256": "75615e495757db37d79f36822bb49aae28de7d62f431fc70b139ce414fa2d144"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -170,23 +170,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 621872,
-      "sha256": "34860031cf2fd8c2708447dc1908eae2b4b8efcb5d4af161b37f9e8ba953d432"
+      "size": 624122,
+      "sha256": "8862373a773675fbb94a260fe8679311de328d0bceb36a4cc0293428c68a9287"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78115,
-      "sha256": "a6d1c63daec116021738db2c22d93fb2fe4748189f5bc2657a544d788a26de79"
+      "sha256": "15e06636046143371107339390667d7564dc62122da4d77c70c0caa960abbf4c"
     },
     {
       "path": "package.json",
       "size": 1246,
-      "sha256": "ae3f8324214951706368fc0b3d2c78d7317e3bfcd66f62375ac0fcae51428759"
+      "sha256": "67361f295ee430943170236af2caa45ecc46969a1ccd54324bc1750f8ccca8c3"
     },
     {
       "path": "paths.js",
       "size": 3914,
-      "sha256": "0c2be40e5db203ec70fd1a81c029acfefef047f1a6ebe7ac3a604694ebc71e09"
+      "sha256": "7c681c48c6c1cd9f0f97daa147bb76d4d6b831644d604e85155aaaea5c93609d"
     },
     {
       "path": "sandbox.js",
@@ -196,7 +196,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144310,
-      "sha256": "86420124d2dfcf1978683151befd3f13b18156b1105a9ec09719de45cfb29514"
+      "sha256": "784d88d9fb2053b0121b05d25edc30d62de62aefeb0d6ebd281d5a58e95f6679"
     }
   ]
 }

package/mikka.js

@@ -3632,7 +3632,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -4426,7 +4432,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4485,7 +4491,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts
@@ -4825,7 +4831,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -4838,6 +4844,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool2 === `mcp__mikka__${name}`)) return "allow";
     if (tool2 === "Bash" || tool2 === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool2.startsWith(`mcp__${name}__`) && tool2.length > `mcp__${name}__`.length)) return "allow";
+    if (tool2 === "WebFetch" || tool2 === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool2)) {
       if (policy.readOnly) return "deny";
@@ -4849,6 +4857,26 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // ../protocol/src/capture.ts
 import { z as z23 } from "zod";
 var CAPTURE_CONTENT_TYPES = [
@@ -5166,7 +5194,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {
@@ -7045,6 +7073,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -7847,11 +7876,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -7963,6 +7992,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -8226,6 +8258,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8286,7 +8319,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -8319,7 +8352,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -8500,6 +8534,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -8668,6 +8710,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8713,6 +8756,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -8730,7 +8774,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -8753,7 +8797,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -12827,6 +12871,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.81",
+  "version": "0.0.83",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.81",
+      "version": "0.0.83",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.81",
+  "version": "0.0.83",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "ff4e8d01e3a0b7d09232a157912c20b62f877e41",
+  "gitHead": "8f9a75a2b7683088201e0d3149e12b1778455a72",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.81",
+  version: "0.0.83",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -65,7 +65,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "ff4e8d01e3a0b7d09232a157912c20b62f877e41"
+  gitHead: "8f9a75a2b7683088201e0d3149e12b1778455a72"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:c4d40748-f959-4bbb-b65d-b6879ea87552",
+  "serialNumber": "urn:uuid:320b27b5-120d-457a-92b3-060312cb5bd8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-31T18:47:57.660Z",
+    "timestamp": "2026-10-31T19:55:36.634Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.81",
+      "bom-ref": "@aspectlylabs/mikka@0.0.83",
       "type": "library",
-      "name": ".retained-build-gmsjtN",
-      "version": "0.0.81",
+      "name": ".retained-build-4zRcnD",
+      "version": "0.0.83",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.81",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.83",
       "properties": [],
       "externalReferences": [
         {
@@ -4627,7 +4627,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.81",
+      "ref": "@aspectlylabs/mikka@0.0.83",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",