@aspectlylabs/mikka 0.0.82 → 0.0.84

package/cli.js

@@ -3631,7 +3631,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -4425,7 +4431,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4484,7 +4490,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts
@@ -4824,7 +4830,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -4837,6 +4843,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool2 === `mcp__mikka__${name}`)) return "allow";
     if (tool2 === "Bash" || tool2 === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool2.startsWith(`mcp__${name}__`) && tool2.length > `mcp__${name}__`.length)) return "allow";
+    if (tool2 === "WebFetch" || tool2 === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool2)) {
       if (policy.readOnly) return "deny";
@@ -4848,6 +4856,26 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // ../protocol/src/capture.ts
 import { z as z23 } from "zod";
 var CAPTURE_CONTENT_TYPES = [
@@ -5165,7 +5193,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {
@@ -7044,6 +7072,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -7846,11 +7875,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -7962,6 +7991,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -8225,6 +8257,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8285,7 +8318,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -8318,7 +8351,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -8499,6 +8533,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -8667,6 +8709,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8712,6 +8755,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -8729,7 +8773,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -8752,7 +8796,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -12826,6 +12870,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/client.js

@@ -3012,7 +3012,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -3687,7 +3693,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3746,7 +3752,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts

package/http-link.js

@@ -2411,7 +2411,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -2424,6 +2424,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool === `mcp__mikka__${name}`)) return "allow";
     if (tool === "Bash" || tool === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool.startsWith(`mcp__${name}__`) && tool.length > `mcp__${name}__`.length)) return "allow";
+    if (tool === "WebFetch" || tool === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool)) {
       if (policy.readOnly) return "deny";
@@ -2435,6 +2437,25 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+
 // ../protocol/src/skill.ts
 import { z as z5 } from "zod";
 
@@ -3499,7 +3520,13 @@ var runAssignmentSchema = z18.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z18.object({ url: z18.url(), token: z18.string().min(1).max(200), mailbox: z18.literal(true).optional() }).optional(),
+  mcp: z18.object({
+    url: z18.url(),
+    token: z18.string().min(1).max(200),
+    mailbox: z18.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z18.array(z18.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z18.object({
     endpoint: z18.url(),
@@ -4065,7 +4092,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4124,7 +4151,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts
@@ -4349,7 +4376,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {

package/login.js

@@ -3008,7 +3008,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -3694,7 +3700,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3753,7 +3759,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts

package/main.js

@@ -3335,6 +3335,26 @@ async function agentPublishedReceipt(input) {
   }
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // src/agents/run-context.ts
 import { execFileSync } from "node:child_process";
 import {
@@ -3728,7 +3748,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3787,7 +3807,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts
@@ -4721,7 +4741,13 @@ var runAssignmentSchema = z15.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z15.object({ url: z15.url(), token: z15.string().min(1).max(200), mailbox: z15.literal(true).optional() }).optional(),
+  mcp: z15.object({
+    url: z15.url(),
+    token: z15.string().min(1).max(200),
+    mailbox: z15.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z15.array(z15.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z15.object({
     endpoint: z15.url(),
@@ -5836,6 +5862,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -6644,11 +6671,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -6789,6 +6816,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -7052,6 +7082,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -7112,7 +7143,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -7145,7 +7176,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -7326,6 +7358,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -7494,6 +7534,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -7539,6 +7580,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -7556,7 +7598,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -7579,7 +7621,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -11894,6 +11936,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/mikka-release-manifest.json

@@ -1,11 +1,11 @@
 {
   "version": 1,
-  "sourceSha": "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc",
+  "sourceSha": "c0f9e8eac73c0747211b504fe154f65dfd9b3082",
   "repository": "alexj11324/Mikka",
-  "buildRunId": "41235331563",
+  "buildRunId": "41237598294",
   "buildKind": "github-actions-main",
   "sourceLockSha256": "333de14ab33e455ec8a3a699f59b49d7a125caebb37d557cc6cfa5024f0c15f7",
-  "createdAt": "2026-10-31T19:42:29.825Z",
+  "createdAt": "2026-10-31T20:11:38.645Z",
   "sbom": "sbom.cdx.json",
   "files": [
     {
@@ -35,13 +35,13 @@
     },
     {
       "path": "cli.js",
-      "size": 621856,
-      "sha256": "ff406de2f66e83777d8320ae6fd516ca3500ca00db6ff0a8d0b5841ea83156c5"
+      "size": 624106,
+      "sha256": "4b7394188ed96a234f17681cf47a29fc074b8d9346c53a6cdd48d93692dca8d2"
     },
     {
       "path": "client.js",
-      "size": 138369,
-      "sha256": "7dc81e62163ec91dc4860ed03e1ab711f3e7d44734e02990c5d00fba2974c485"
+      "size": 138568,
+      "sha256": "c557e3ef82bfefdf8e1bd560b31657ad47c8291944ae8ce5c2fd7af9615911ea"
     },
     {
       "path": "computer/driver.mjs",
@@ -145,8 +145,8 @@
     },
     {
       "path": "http-link.js",
-      "size": 178124,
-      "sha256": "41f94a8aac301414461700f48278ab42b43212c2241dda53fd6c945b66aeac95"
+      "size": 179427,
+      "sha256": "08c9992dde744f8859f9e6810055b0ff414a826ea79c1a4a9cd37829d0a978e9"
     },
     {
       "path": "log.js",
@@ -155,13 +155,13 @@
     },
     {
       "path": "login.js",
-      "size": 142938,
-      "sha256": "d8c63004f28a91e1aa27fc3ea84804144bd712fc32cc754f8af710dd917ea30b"
+      "size": 143137,
+      "sha256": "d705d5181fe37d36e4e7c6e7a66589f878592f10e073551446422f4ecc9ed1e2"
     },
     {
       "path": "main.js",
-      "size": 567990,
-      "sha256": "d05ee42d76de2851cacb09e9cded96b2f80d9e07a459b15aeeb4874c5127bed9"
+      "size": 569962,
+      "sha256": "7ce65cd4243adc1f26b0d060d7578357cbeb41950b3a4748f3decf43bd30c01d"
     },
     {
       "path": "mikka-mcp.mjs",
@@ -170,23 +170,23 @@
     },
     {
       "path": "mikka.js",
-      "size": 621872,
-      "sha256": "ed217f527322c8dfe5ed80fe46552b003cb90aa8c590bc133ecc530ba7edcc62"
+      "size": 624122,
+      "sha256": "bd4bfd1c9d51095e095e580782ef63544f7f3a2f067b6e36f893a87b24ed7917"
     },
     {
       "path": "npm-shrinkwrap.json",
       "size": 78115,
-      "sha256": "02428ba917cd4934e40b317a8e4cfd3970b1adfd663db1d113155f1393c5cc9c"
+      "sha256": "fb853a81752c910860acadda27290dc605253be0ced337b4497268f648dcbb2e"
     },
     {
       "path": "package.json",
       "size": 1246,
-      "sha256": "2e6a3c8a41eb394578e07dc8715b912c2f3853b45bc4f1153b3c842a76a9d844"
+      "sha256": "0ce2c96ce161393a5241fa0940d505337db8bb6a7f920baf2a98f79f567c8a83"
     },
     {
       "path": "paths.js",
       "size": 3914,
-      "sha256": "82f2406ed3bd7e521ce9a0fb03061ebf1b6ac82f702e814b680414b412a84ce8"
+      "sha256": "a74d181cffa978c7089484f3a8cf15283ec45beeeeee88dfcd526bafc18685b4"
     },
     {
       "path": "sandbox.js",
@@ -196,7 +196,7 @@
     {
       "path": "sbom.cdx.json",
       "size": 144310,
-      "sha256": "b5145136d73c9778b0a8bae31e36e659bd96280eb069ed99e11ca7655b68563a"
+      "sha256": "31c261ab1c6335fb5509e8a16de2aaece282dc38d8e75d191f2b0d5ab5f2acd2"
     }
   ]
 }

package/mikka.js

@@ -3632,7 +3632,13 @@ var runAssignmentSchema = z14.object({
    * it stops working when the run ends. Absent: the server could not issue
    * one, and the run goes ahead without it.
    */
-  mcp: z14.object({ url: z14.url(), token: z14.string().min(1).max(200), mailbox: z14.literal(true).optional() }).optional(),
+  mcp: z14.object({
+    url: z14.url(),
+    token: z14.string().min(1).max(200),
+    mailbox: z14.literal(true).optional(),
+    /** Apps (Composio toolkits) this run may use through the Mikka server, one MCP entry each. */
+    apps: z14.array(z14.string().regex(/^[a-z][a-z0-9_]{0,63}$/)).max(64).optional()
+  }).optional(),
   /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
   github: z14.object({
     endpoint: z14.url(),
@@ -4426,7 +4432,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4485,7 +4491,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts
@@ -4825,7 +4831,7 @@ function classifyWrite(worktree, target) {
 }
 
 // src/agents/tool-approval-policy.ts
-function toolApprovalDecision(request, policy, worktree) {
+function toolApprovalDecision(request, policy, worktree, apps = []) {
   if (request.method === "sandbox/network" && policy) {
     const value = request.input;
     if (!value || typeof value.host !== "string" || /[*/:]/.test(value.host) || !networkDomainSchema.safeParse(value.host).success || !Number.isInteger(value.port) || Number(value.port) < 1 || Number(value.port) > 65535) return "deny";
@@ -4838,6 +4844,8 @@ function toolApprovalDecision(request, policy, worktree) {
     }
     if (["submit", "request_help", "ask_human", "report_blocked", "submit_capture"].some((name) => tool2 === `mcp__mikka__${name}`)) return "allow";
     if (tool2 === "Bash" || tool2 === "PowerShell") return rawCliShellAvailable(policy) ? "allow" : "unavailable";
+    if (apps.some((name) => tool2.startsWith(`mcp__${name}__`) && tool2.length > `mcp__${name}__`.length)) return "allow";
+    if (tool2 === "WebFetch" || tool2 === "WebSearch") return policy.permissions.network;
     const input = request.input;
     if (["Write", "Edit", "MultiEdit", "NotebookEdit"].includes(tool2)) {
       if (policy.readOnly) return "deny";
@@ -4849,6 +4857,26 @@ function toolApprovalDecision(request, policy, worktree) {
   return "unavailable";
 }
 
+// src/agents/run-apps.ts
+var TOOLKIT = /^[a-z][a-z0-9_]{0,63}$/;
+function runApps(mcp) {
+  if (!mcp?.apps?.length) return void 0;
+  let base;
+  try {
+    base = new URL(mcp.url);
+  } catch {
+    return void 0;
+  }
+  if (!/\/api\/mcp\/?$/.test(base.pathname) || base.username || base.password || base.search || base.hash || base.protocol !== "https:" && !(base.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(base.hostname)) || !/^mkw_[A-Za-z0-9_-]{43}$/.test(mcp.token)) return void 0;
+  const names = [...new Set(mcp.apps)].filter((name) => TOOLKIT.test(name) && !name.startsWith("mikka"));
+  if (!names.length) return void 0;
+  return {
+    token: mcp.token,
+    apps: names.map((name) => ({ name, url: new URL(base.pathname.replace(/\/api\/mcp\/?$/, `/api/runs/mcp/${name}`), base).toString() }))
+  };
+}
+var runAppsHost = (apps) => apps?.apps[0] ? new URL(apps.apps[0].url).host : void 0;
+
 // ../protocol/src/capture.ts
 import { z as z23 } from "zod";
 var CAPTURE_CONTENT_TYPES = [
@@ -5166,7 +5194,7 @@ var HttpServerLink = class {
     const response = z26.object({ decision: z26.enum(["pending", "allow", "deny"]) });
     const liveness = new AbortController();
     const gate = new ToolApprovalGate(assignment.runId, {
-      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree),
+      permission: (request) => toolApprovalDecision(request, assignment.policy, worktree, runApps(assignment.mcp)?.apps.map((app) => app.name)),
       // Keep the callback pending at the tool boundary. The adapter's current
       // session and checkpoint remain intact; handback resolves this same call.
       isLive: async () => {
@@ -7045,6 +7073,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
           [...this.options.networkAllow ?? [], ...this.options.github ? ["github.com", "api.github.com", new URL(this.options.github.endpoint).host] : []]
@@ -7847,11 +7876,11 @@ ${error.message}`;
 }
 
 // src/agents/run-network.ts
-function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint) {
+function runNetworkApproval(runId, harness, gate, maximum, localComputerEndpoint, appHost) {
   if (gate.runId !== runId) throw new Error("Run approval scope mismatch");
   if (localComputerEndpoint !== void 0 && (!/^127\.0\.0\.1:[0-9]+$/.test(localComputerEndpoint) || Number(localComputerEndpoint.split(":")[1]) < 1 || Number(localComputerEndpoint.split(":")[1]) > 65535)) throw new Error("Invalid local computer endpoint");
   const ceiling = [...maximum];
-  const model = [...HARNESS_DOMAINS[harness]];
+  const model = [...HARNESS_DOMAINS[harness], ...appHost ? [appHost] : []];
   return async (request, signal) => {
     if (signal.aborted || gate.revoked || !matchesRunSandboxDomain(request, ceiling)) return false;
     if (matchesRunSandboxDomain(request, model) || localComputerEndpoint === `${request.host}:${request.port}`) return await gate.checkLive() && !signal.aborted && !gate.revoked;
@@ -7963,6 +7992,9 @@ async function createNativeSubscriptionBroker(host) {
 
 // src/adapters/claude.ts
 var SUBSCRIPTION_ERROR = "Claude subscription authentication unavailable";
+function claudeAppServers(apps) {
+  return Object.fromEntries((apps?.apps ?? []).map((app) => [app.name, { type: "http", url: app.url, headers: { Authorization: `Bearer ${apps.token}` } }]));
+}
 function claudeMailboxServer(mailbox) {
   const server = createSdkMcpServer2({ name: "mikka_mailbox", version: "1" });
   for (const [name, schema] of Object.entries(mailboxInputs).filter(([name2]) => mailbox.tools.some((tool2) => tool2.name === name2))) server.instance.registerTool(name, {
@@ -8226,6 +8258,7 @@ var ClaudeAdapter = class {
     if (nativeHome) ownDir(configDir);
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8286,7 +8319,7 @@ var ClaudeAdapter = class {
       const policy = computerSandboxPolicy(ctx.policy(), computerMcp);
       const requested = this.options.networkCeiling;
       const maximum = requested === void 0 ? policy.allowDomains : policy.allowDomains.includes("*") ? [...requested] : requested.includes("*") ? policy.allowDomains : requested.filter((domain) => policy.allowDomains.includes(domain));
-      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
+      const child = spawnRunSandbox({ command: this.options.binary ?? config.command, args: config.args, cwd: config.cwd ?? ctx.worktree, env: config.env, policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "claude_code", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)), signal: config.signal, ...nativeToken ? { authToken: nativeToken } : {} });
       const off = options.toolApproval.onRevoke(() => {
         void child.revoke().catch(() => void 0);
       });
@@ -8319,7 +8352,8 @@ var ClaudeAdapter = class {
         mcpServers: {
           ...options.mailbox ? { mikka_mailbox: claudeMailboxServer(options.mailbox) } : {},
           [MCP_SERVER_NAME]: { type: "stdio", ...ctx.mcpServer() },
-          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {}
+          ...computerMcp ? { [COMPUTER_MCP_SERVER_NAME]: { type: "stdio", ...computerMcp } } : {},
+          ...claudeAppServers(options.apps)
         },
         strictMcpConfig: true,
         systemPrompt: {
@@ -8500,6 +8534,14 @@ function subscriptionTokens(value, accountId) {
   };
 }
 var CODEX_HISTORY = ["sessions", "archived_sessions", "session_index.jsonl"];
+function codexAppArgs(apps) {
+  return (apps?.apps ?? []).flatMap((app) => [
+    "-c",
+    `mcp_servers.${app.name}.url=${toml(app.url)}`,
+    "-c",
+    `mcp_servers.${app.name}.http_headers={ Authorization = ${toml(`Bearer ${apps.token}`)} }`
+  ]);
+}
 function toml(value) {
   return JSON.stringify(value);
 }
@@ -8668,6 +8710,7 @@ var CodexAdapter = class {
     );
     const ctx = new RunContext({
       github: options.github,
+      apps: options.apps,
       githubRuntime: options.githubRuntime,
       childPath: options.env.PATH,
       mailboxEnabled: Boolean(options.mailbox),
@@ -8713,6 +8756,7 @@ var CodexAdapter = class {
         ] : [],
         ...Object.entries(computerMcp.env).flatMap(([key2, value]) => ["-c", `mcp_servers.${COMPUTER_MCP_SERVER_NAME}.env.${key2}=${toml(value)}`])
       ] : [],
+      ...codexAppArgs(options.apps),
       // Its shells get a filtered env; give them writable temp dirs.
       ...Object.entries(ctx.tempEnv()).flatMap(([key2, value]) => [
         "-c",
@@ -8730,7 +8774,7 @@ var CodexAdapter = class {
     const requestedCeiling = this.options.networkCeiling;
     const maximum = requestedCeiling === void 0 ? spawnOptions.policy.allowDomains : spawnOptions.policy.allowDomains.includes("*") ? [...requestedCeiling] : requestedCeiling.includes("*") ? spawnOptions.policy.allowDomains : requestedCeiling.filter((domain) => spawnOptions.policy.allowDomains.includes(domain));
     let launcher;
-    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp)) });
+    const child = this.options.spawnCli || this.options.sandbox.kind === "none" ? await (this.options.spawnCli ?? spawnCli)(this.options.sandbox, argv, spawnOptions) : launcher = spawnRunSandbox({ command: argv[0], args: argv.slice(1), cwd: spawnOptions.cwd, env: spawnOptions.env, policy: spawnOptions.policy, maxAllowDomains: maximum, onNetwork: runNetworkApproval(options.runId, "codex", options.toolApproval, maximum, computerDomain(computerMcp), runAppsHost(options.apps)) });
     if (launcher) {
       const ownedLauncher = launcher;
       const off = options.toolApproval.onRevoke(() => {
@@ -8753,7 +8797,7 @@ var CodexAdapter = class {
     let lastError;
     let usage = { inputTokens: 0, outputTokens: 0 };
     const pendingMcp = /* @__PURE__ */ new Map();
-    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2);
+    const registeredMcpTool = (server, tool2) => server === MCP_SERVER_NAME && ["submit", "request_help", "ask_human", "report_blocked"].includes(tool2) || Boolean(computerMcp) && server === COMPUTER_MCP_SERVER_NAME && ["get_desktop_state", "click", "type_text", "press_key", "scroll"].includes(tool2) || Boolean(options.apps?.apps.some((app) => app.name === server));
     let ended;
     const finish = (event) => {
       if (ended) return ended;
@@ -12827,6 +12871,7 @@ var RunSupervisor = class {
     }
     const options = {
       github: assignment.github && assignment.mcp && (assignment.kind === "implement" || assignment.kind === "fix") && !runPolicy(assignment.policy).readOnly ? { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId } : void 0,
+      apps: runApps(assignment.mcp),
       toolApproval,
       runId,
       requireSessionResume: assignment.requireSessionResume,

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aspectlylabs/mikka",
-      "version": "0.0.82",
+      "version": "0.0.84",
       "license": "AGPL-3.0-only",
       "dependencies": {
         "@agentclientprotocol/sdk": "1.9.0",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@aspectlylabs/mikka",
-  "version": "0.0.82",
+  "version": "0.0.84",
   "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-  "gitHead": "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc",
+  "gitHead": "c0f9e8eac73c0747211b504fe154f65dfd9b3082",
   "type": "module",
   "private": false,
   "license": "AGPL-3.0-only",

package/paths.js

@@ -6,7 +6,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.82",
+  version: "0.0.84",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -65,7 +65,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "2e77d3a51ade3932b2260dd115c8931f5a6a7cbc"
+  gitHead: "c0f9e8eac73c0747211b504fe154f65dfd9b3082"
 };
 
 // src/paths.ts

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:843fcfbc-0b74-4ade-ad5c-4aebcbd4af86",
+  "serialNumber": "urn:uuid:404e3aaa-40c5-4b39-8322-b453c4964dff",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-31T19:42:29.025Z",
+    "timestamp": "2026-10-31T20:11:37.982Z",
     "lifecycles": [
       {
         "phase": "pre-build"
@@ -19,13 +19,13 @@
       }
     ],
     "component": {
-      "bom-ref": "@aspectlylabs/mikka@0.0.82",
+      "bom-ref": "@aspectlylabs/mikka@0.0.84",
       "type": "library",
-      "name": ".retained-build-6pTAzZ",
-      "version": "0.0.82",
+      "name": ".retained-build-QGbSoL",
+      "version": "0.0.84",
       "scope": "required",
       "description": "Local Mikka daemon: runs agents through the user's own CLIs",
-      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.82",
+      "purl": "pkg:npm/%40aspectlylabs/mikka@0.0.84",
       "properties": [],
       "externalReferences": [
         {
@@ -4627,7 +4627,7 @@
   ],
   "dependencies": [
     {
-      "ref": "@aspectlylabs/mikka@0.0.82",
+      "ref": "@aspectlylabs/mikka@0.0.84",
       "dependsOn": [
         "@agentclientprotocol/sdk@1.9.0",
         "@anthropic-ai/claude-agent-sdk@0.3.305",