@aspectlylabs/mikka 0.0.86 → 0.0.87

package/main.js

@@ -878,10 +878,10 @@ var require_truncate = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/functions/truncate.js"(exports, module) {
     "use strict";
     var parse2 = require_parse();
-    var constants3 = require_constants();
+    var constants4 = require_constants();
     var SemVer = require_semver();
     var truncate = (version, truncation, options) => {
-      if (!constants3.RELEASE_TYPES.includes(truncation)) {
+      if (!constants4.RELEASE_TYPES.includes(truncation)) {
         return null;
       }
       const clonedVersion = cloneInputVersion(version, options);
@@ -1930,7 +1930,7 @@ var require_semver2 = __commonJS({
   "../../node_modules/.pnpm/semver@7.8.5/node_modules/semver/index.js"(exports, module) {
     "use strict";
     var internalRe = require_re();
-    var constants3 = require_constants();
+    var constants4 = require_constants();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse2 = require_parse();
@@ -2014,8 +2014,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants3.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants3.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants4.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants4.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -3748,7 +3748,7 @@ import { join as join5 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.86",
+  version: "0.0.87",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3807,7 +3807,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "da9593f91f3620f251d08a7260322a52cf39d23a"
+  gitHead: "f2ef942a44623501b27027f8926e0666a640bcfe"
 };
 
 // src/paths.ts
@@ -4347,6 +4347,12 @@ var harnessInfoSchema = z12.object({
   computerBroker: z12.literal(true).optional(),
   /** Run-scoped CLI approvals and policy-version checks are supported. */
   toolApproval: z12.literal(true).optional(),
+  /**
+   * The CLI exists but `installed` stays false because the daemon cannot run it
+   * in a sandbox. `missing` names the absent packages; empty means the machine
+   * itself refused isolation.
+   */
+  sandboxBlocked: z12.object({ missing: z12.array(z12.string().trim().min(1).max(64)).max(8) }).optional(),
   /** Version string reported by the CLI, null when not installed. */
   version: z12.string().nullable()
 });
@@ -5862,6 +5868,7 @@ var RunContext = class {
       ],
       allowDomains: [
         ...HARNESS_DOMAINS[this.options.harness],
+        ...this.options.harnessDomains ?? [],
         ...runAppsHost(this.options.apps) ? [runAppsHost(this.options.apps)] : [],
         ...runDomains(
           runPolicy(this.options.policy),
@@ -6385,15 +6392,15 @@ sandbox_mode = "read-only"
 // src/main.ts
 import { randomBytes as randomBytes3, randomUUID as randomUUID9 } from "node:crypto";
 import {
-  chmodSync as chmodSync4,
-  existsSync as existsSync7,
-  mkdirSync as mkdirSync16,
-  readFileSync as readFileSync11,
-  rmSync as rmSync17,
+  chmodSync as chmodSync5,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync17,
+  readFileSync as readFileSync12,
+  rmSync as rmSync18,
   realpathSync as realpathSync13
 } from "node:fs";
 import { arch, hostname, platform as platform2 } from "node:os";
-import { join as join28 } from "node:path";
+import { join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/adapters/claude.ts
@@ -6419,7 +6426,52 @@ function computerSandboxPolicy(policy, spec) {
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { realpathSync as realpathSync8 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { join as join11 } from "node:path";
+
+// src/adapters/claude-gateway.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+import { join as join10 } from "node:path";
+var GATEWAY_ENV = [
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_DEFAULT_FABLE_MODEL",
+  "ANTHROPIC_DEFAULT_OPUS_MODEL",
+  "ANTHROPIC_DEFAULT_SONNET_MODEL",
+  "ANTHROPIC_DEFAULT_HAIKU_MODEL",
+  "CLAUDE_CODE_SUBAGENT_MODEL"
+];
+function readClaudeGateway(configDir) {
+  let settings;
+  try {
+    settings = JSON.parse(readFileSync8(join10(configDir, "settings.json"), "utf8"));
+  } catch {
+    return null;
+  }
+  const declared = settings?.env;
+  if (!declared || typeof declared !== "object") return null;
+  const values = declared;
+  const domain = gatewayDomain(values.ANTHROPIC_BASE_URL);
+  if (!domain) return null;
+  const env = {};
+  for (const name of GATEWAY_ENV) {
+    const value = values[name];
+    if (typeof value === "string" && value) env[name] = value;
+  }
+  return { env, domain };
+}
+function gatewayDomain(baseUrl) {
+  if (typeof baseUrl !== "string") return null;
+  try {
+    const url = new URL(baseUrl);
+    return url.protocol === "https:" || url.protocol === "http:" ? url.hostname : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/adapters/claude.ts
+import { join as join12 } from "node:path";
 import {
   query as query2,
   createSdkMcpServer as createSdkMcpServer2
@@ -6715,15 +6767,15 @@ function mailboxToolResult(result) {
 // src/subscription-native-broker.ts
 import { chmodSync, mkdirSync as mkdirSync9, mkdtempSync as mkdtempSync4, rmSync as rmSync9 } from "node:fs";
 import { createServer } from "node:http";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { once } from "node:events";
 var NATIVE_AUTH_PLACEHOLDER = "mikka-native-broker-placeholder";
 async function createNativeSubscriptionBroker(host) {
   await host.check();
   mkdirSync9(host.root, { recursive: true, mode: 448 });
-  const dir = mkdtempSync4(join10(host.root, "native-broker-"));
+  const dir = mkdtempSync4(join11(host.root, "native-broker-"));
   chmodSync(dir, 448);
-  const socket = join10(dir, "broker.sock");
+  const socket = join11(dir, "broker.sock");
   const pending = /* @__PURE__ */ new Set();
   let halted = false;
   const server = createServer(async (request, response) => {
@@ -7077,10 +7129,12 @@ var ClaudeAdapter = class {
         throw new Error(SUBSCRIPTION_ERROR);
       }
     }
-    const nativeHome = externalAuth ? join11(runDir, "native-home") : void 0;
-    const configDir = nativeHome ? join11(nativeHome, ".claude") : this.options.configDir ?? join11(homedir4(), ".claude");
+    const nativeHome = externalAuth ? join12(runDir, "native-home") : void 0;
+    const configDir = nativeHome ? join12(nativeHome, ".claude") : this.options.configDir ?? join12(homedir4(), ".claude");
     if (nativeHome) ownDir(configDir);
+    const gateway = nativeHome || externalAuth ? null : readClaudeGateway(configDir);
     const ctx = new RunContext({
+      harnessDomains: gateway ? [gateway.domain] : void 0,
       github: options.github,
       apps: options.apps,
       githubRuntime: options.githubRuntime,
@@ -7099,8 +7153,8 @@ var ClaudeAdapter = class {
       privateDir: paths.privateDir,
       // Its session store, so `resume` works; keyed by the cwd it sees.
       extraWrite: [
-        join11(configDir, "projects", claudeProjectDirName(options.cwd)),
-        join11(
+        join12(configDir, "projects", claudeProjectDirName(options.cwd)),
+        join12(
           configDir,
           "projects",
           claudeProjectDirName(realpathSync8(options.cwd))
@@ -7159,6 +7213,7 @@ var ClaudeAdapter = class {
           ...options.env,
           ...ctx.tempEnv(),
           ...CLAUDE_RUN_ENV,
+          ...gateway?.env,
           CLAUDE_CODE_TMPDIR: ctx.tmpDir,
           ...nativeHome ? {
             HOME: nativeHome,
@@ -7345,7 +7400,26 @@ var ClaudeAdapter = class {
 };
 
 // src/adapters/codex.ts
-import { isAbsolute as isAbsolute4, join as join12, relative as relative3 } from "node:path";
+import { isAbsolute as isAbsolute4, join as join13, relative as relative3 } from "node:path";
+
+// src/adapters/codex-version.ts
+var VERSION = /(?:^|[ /])(\d+)\.(\d+)\.(\d+)(?:$|[ ();])/;
+var MINIMUM_APPROVAL_VERSION = [0, 162, 0];
+var AUDITED_DYNAMIC_TOOLS = "0.163.0";
+function codexSupportsRunApproval(version) {
+  const match = VERSION.exec(version ?? "");
+  if (!match) return false;
+  for (const [index, minimum] of MINIMUM_APPROVAL_VERSION.entries()) {
+    const part = Number(match[index + 1]);
+    if (part !== minimum) return part > minimum;
+  }
+  return true;
+}
+function codexHasAuditedDynamicTools(version) {
+  return VERSION.exec(version ?? "")?.slice(1).join(".") === AUDITED_DYNAMIC_TOOLS;
+}
+
+// src/adapters/codex.ts
 var SUBSCRIPTION_AUTH_ERROR = "Codex subscription authentication unavailable";
 var SUBSCRIPTION_EXECUTION_ERROR2 = "Codex subscription execution failed";
 function subscriptionTokens(value, accountId) {
@@ -7514,8 +7588,8 @@ var CodexAdapter = class {
           options.continueSession.runId
         ).runDir;
         carryHistory(
-          join12(earlier2, "codex-home"),
-          join12(runDir, "codex-home"),
+          join13(earlier2, "codex-home"),
+          join13(runDir, "codex-home"),
           CODEX_HISTORY
         );
       } catch (error) {
@@ -7527,7 +7601,7 @@ var CodexAdapter = class {
       }
     }
     const codexHome = prepareCodexHome(
-      join12(runDir, "codex-home"),
+      join13(runDir, "codex-home"),
       log,
       this.options.userHome,
       !externalAuth
@@ -7866,7 +7940,8 @@ var CodexAdapter = class {
         }),
         "initialize"
       );
-      if ((options.mailbox || !rawCliShellAvailable(runPolicy(options.policy))) && !/(?:^|[ /])0\.163\.0(?:$|[ ();])/.test(initialized.userAgent ?? "")) throw new Error("Run permissions require the audited Codex0.163.0 tool interface");
+      if (options.mailbox && !codexHasAuditedDynamicTools(initialized.userAgent)) throw new Error("Run permissions require the audited Codex0.163.0 tool interface");
+      if (!codexSupportsRunApproval(initialized.userAgent)) throw new Error("This Codex version is too old for Mikka; update Codex");
       await rpc.sendNotification("initialized");
       if (externalAuth) {
         try {
@@ -7979,7 +8054,7 @@ var CodexAdapter = class {
 // src/adapters/cursor.ts
 import { Readable, Writable } from "node:stream";
 import * as acp from "@agentclientprotocol/sdk";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 function acpPermissionResponse(params, policy) {
   const pick = (kinds) => {
     for (const kind of kinds) {
@@ -8114,15 +8189,15 @@ var CursorAdapter = class {
           options.continueSession.runId
         ).runDir;
         carryHistory(
-          join13(earlier2, "cursor-home"),
-          join13(paths.runDir, "cursor-home"),
+          join14(earlier2, "cursor-home"),
+          join14(paths.runDir, "cursor-home"),
           CURSOR_HISTORY
         );
       } catch (error) {
         log.info({ err: error }, "could not copy the earlier cursor chats");
       }
     }
-    const configDir = prepareCursorHome(join13(paths.runDir, "cursor-home"));
+    const configDir = prepareCursorHome(join14(paths.runDir, "cursor-home"));
     const ctx = new RunContext({
       github: options.github,
       childPath: options.env.PATH,
@@ -8354,8 +8429,8 @@ ${firstMessage}` : firstMessage
 
 // src/adapters/mock.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname7, join as join14, resolve as resolve6 } from "node:path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync6 } from "node:fs";
+import { dirname as dirname7, join as join15, resolve as resolve6 } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { execa as execa5 } from "execa";
 
@@ -8411,7 +8486,7 @@ var MockAdapter = class {
   fixturesDir;
   speed;
   stateFile(sessionId) {
-    return join14(
+    return join15(
       this.options.stateDir,
       `mock-${assertSafeId("session id", sessionId)}.json`
     );
@@ -8455,7 +8530,7 @@ var MockAdapter = class {
   open(sessionId, state, options) {
     const name = assertSafeId("fixture", state.fixture.replace(/\.jsonl$/, ""));
     const lines = parseFixture(
-      readFileSync8(join14(this.fixturesDir, `${name}.jsonl`), "utf8"),
+      readFileSync9(join15(this.fixturesDir, `${name}.jsonl`), "utf8"),
       name
     );
     const abort = new AbortController();
@@ -8569,18 +8644,18 @@ var MockAdapter = class {
 
 // src/agents/verify.ts
 import { mkdirSync as mkdirSync11, mkdtempSync as mkdtempSync5, realpathSync as realpathSync9, rmSync as rmSync10 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 var OUTPUT_TAIL = 4e3;
 async function runVerify(sandbox, options) {
   mkdirSync11(options.tmpRoot, { recursive: true, mode: 448 });
-  const tmpDir = mkdtempSync5(join15(realpathSync9(options.tmpRoot), "verify-"));
+  const tmpDir = mkdtempSync5(join16(realpathSync9(options.tmpRoot), "verify-"));
   const child = await spawnCli(sandbox, ["/bin/sh", "-c", options.command], {
     cwd: options.worktree,
     env: { ...options.env, TMPDIR: tmpDir },
     policy: {
       allowWrite: options.readOnly ? [tmpDir] : [options.worktree, tmpDir],
       denyWrite: [
-        join15(options.worktree, ".git"),
+        join16(options.worktree, ".git"),
         ...options.readOnly ? [options.worktree] : []
       ],
       denyRead: [
@@ -8751,7 +8826,7 @@ import { SandboxManager as SandboxManager2 } from "@anthropic-ai/sandbox-runtime
 import { execFile } from "node:child_process";
 import { readdir as readdir2, realpath, stat } from "node:fs/promises";
 import { homedir as homedir5, platform } from "node:os";
-import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute5, join as join16, resolve as resolve7 } from "node:path";
+import { basename as basename2, dirname as dirname8, isAbsolute as isAbsolute5, join as join17, resolve as resolve7 } from "node:path";
 import { promisify } from "node:util";
 var run = promisify(execFile);
 async function git(cwd, args) {
@@ -8821,7 +8896,7 @@ async function browseFolder(request) {
   let truncated = false;
   const dirs = names.filter((e) => e.isDirectory() || e.isSymbolicLink()).filter((e) => request.showHidden || !e.name.startsWith(".")).sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of dirs) {
-    const full = join16(path, entry.name);
+    const full = join17(path, entry.name);
     if (entry.isSymbolicLink() && !await isDir(full)) continue;
     if (folders.length >= FS_MAX_ENTRIES) {
       truncated = true;
@@ -8830,7 +8905,7 @@ async function browseFolder(request) {
     folders.push({
       name: entry.name,
       path: full,
-      isRepo: await exists(join16(full, ".git"))
+      isRepo: await exists(join17(full, ".git"))
     });
   }
   const parent = dirname8(path);
@@ -8861,7 +8936,7 @@ async function verifyExpectedOrigin(path, expected) {
 import { execFile as execFile2 } from "node:child_process";
 import { realpathSync as realpathSync10 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname9, join as join17, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join18, resolve as resolve8 } from "node:path";
 import { promisify as promisify2 } from "node:util";
 var exec = promisify2(execFile2);
 var DAY = 24 * 60 * 60 * 1e3;
@@ -8873,7 +8948,7 @@ function newerStableVersion(candidate, current) {
   return false;
 }
 async function runServiceNpm(args) {
-  const npm = realpathSync10(join17(dirname9(process.execPath), "npm"));
+  const npm = realpathSync10(join18(dirname9(process.execPath), "npm"));
   const { stdout } = await exec(process.execPath, [npm, ...args], {
     cwd: homedir6(),
     timeout: 3e5,
@@ -8895,7 +8970,7 @@ import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { mkdir, writeFile, rm } from "node:fs/promises";
 import { homedir as homedir7 } from "node:os";
-import { dirname as dirname10, join as join18, resolve as resolve9 } from "node:path";
+import { dirname as dirname10, join as join19, resolve as resolve9 } from "node:path";
 var exec2 = promisify3(execFile3);
 var label = "com.aspectlylabs.mikka.daemon";
 async function restartService(update, beforeRestart, dependencies = {
@@ -8930,10 +9005,10 @@ async function uninstallService(clearCredential, dependencies = {
   try {
     if (dependencies.manager === "systemd") {
       await dependencies.run("systemctl", ["--user", "disable", "mikka-daemon.service"]);
-      await rm(join18(dependencies.home, ".config/systemd/user/mikka-daemon.service"), { force: true });
+      await rm(join19(dependencies.home, ".config/systemd/user/mikka-daemon.service"), { force: true });
       await dependencies.run("systemctl", ["--user", "daemon-reload"]);
     } else if (dependencies.manager === "launchd") {
-      await rm(join18(dependencies.home, "Library/LaunchAgents", `${label}.plist`), { force: true });
+      await rm(join19(dependencies.home, "Library/LaunchAgents", `${label}.plist`), { force: true });
     }
   } finally {
     clearCredential();
@@ -8975,6 +9050,9 @@ async function detectDeviceType() {
 }
 
 // src/harnesses.ts
+import { readdirSync as readdirSync4, statSync as statSync2 } from "node:fs";
+import { homedir as homedir8, userInfo } from "node:os";
+import { delimiter as delimiter3, isAbsolute as isAbsolute7, join as join21 } from "node:path";
 import { execa as execa9 } from "execa";
 
 // src/harness-models.ts
@@ -9120,12 +9198,99 @@ async function discover(harness, binary) {
   return {};
 }
 
+// src/path-search.ts
+import { accessSync, constants as constants2, statSync } from "node:fs";
+import { delimiter as delimiter2, isAbsolute as isAbsolute6, join as join20 } from "node:path";
+function findOnPath(command, path = process.env.PATH ?? "") {
+  for (const directory of path.split(delimiter2)) {
+    if (!directory) continue;
+    const candidate = join20(directory, command);
+    try {
+      accessSync(candidate, constants2.X_OK);
+      if (statSync(candidate).isFile()) return candidate;
+    } catch {
+    }
+  }
+  return null;
+}
+function appendToPath(directories) {
+  const entries = (process.env.PATH ?? "").split(delimiter2).filter(Boolean);
+  for (const directory of directories) {
+    if (isAbsolute6(directory) && !entries.includes(directory)) entries.push(directory);
+  }
+  process.env.PATH = entries.join(delimiter2);
+}
+
 // src/harnesses.ts
 var HARNESS_BINARIES = {
   claude_code: ["claude"],
   codex: ["codex"],
   cursor: ["cursor-agent", "agent"]
 };
+var LOGIN_SHELL_TIMEOUT_MS = 5e3;
+var PATH_MARKER = "__MIKKA_PATH__";
+function subdirectories(directory) {
+  try {
+    return readdirSync4(directory).map((name) => join21(directory, name));
+  } catch {
+    return [];
+  }
+}
+function knownAgentDirectories(home = homedir8()) {
+  return [
+    join21(home, ".local/bin"),
+    join21(home, "bin"),
+    join21(home, ".claude/local"),
+    join21(home, ".npm-global/bin"),
+    join21(home, ".bun/bin"),
+    join21(home, ".volta/bin"),
+    join21(home, ".local/share/pnpm"),
+    join21(home, "Library/pnpm"),
+    join21(home, ".asdf/shims"),
+    join21(home, ".local/share/mise/shims"),
+    ...subdirectories(join21(home, ".nvm/versions/node")).map((version) => join21(version, "bin")),
+    ...subdirectories(join21(home, ".local/share/fnm/node-versions")).map((version) => join21(version, "installation/bin")),
+    "/opt/homebrew/bin",
+    "/usr/local/bin",
+    "/snap/bin"
+  ];
+}
+async function loginShellPath(shell = process.env.SHELL || userInfo().shell) {
+  if (!shell || !isAbsolute7(shell)) return [];
+  let timer;
+  try {
+    const shellProcess = execa9(shell, ["-ilc", `printf '${PATH_MARKER}%s${PATH_MARKER}' "$PATH"`], {
+      stdin: "ignore",
+      detached: true,
+      reject: false
+    });
+    const timedOut = new Promise((resolve12) => {
+      timer = setTimeout(() => {
+        try {
+          process.kill(-shellProcess.pid, "SIGKILL");
+        } catch {
+        }
+        resolve12(null);
+      }, LOGIN_SHELL_TIMEOUT_MS);
+    });
+    const result = await Promise.race([shellProcess, timedOut]);
+    return String(result?.stdout ?? "").split(PATH_MARKER)[1]?.split(delimiter3).filter(isAbsolute7) ?? [];
+  } catch {
+    return [];
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function harnessFingerprint() {
+  appendToPath(knownAgentDirectories());
+  return Object.values(HARNESS_BINARIES).map((binaries) => {
+    for (const binary of binaries) {
+      const found = findOnPath(binary);
+      if (found) return `${found}:${statSync2(found).mtimeMs}`;
+    }
+    return "";
+  }).join("|");
+}
 async function versionOf(binary) {
   try {
     const { stdout } = await execa9(binary, ["--version"], {
@@ -9141,6 +9306,7 @@ async function versionOf(binary) {
   }
 }
 async function detectHarnesses() {
+  if (!daemonTestMode(process.env)) appendToPath([...await loginShellPath(), ...knownAgentDirectories()]);
   const detected = await Promise.all(
     Object.keys(HARNESS_BINARIES).map(
       async (harness) => {
@@ -9161,10 +9327,130 @@ async function detectHarnesses() {
   ];
 }
 
+// src/sandbox-tools.ts
+import { chmodSync as chmodSync2, existsSync as existsSync5, lstatSync as lstatSync8, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync6, readdirSync as readdirSync5, renameSync as renameSync2, rmSync as rmSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join22 } from "node:path";
+import { execa as execa10 } from "execa";
+var TOOLS = [
+  { command: "bwrap", package: "bubblewrap", versionFlag: "--version" },
+  { command: "socat", package: "socat", versionFlag: "-V" },
+  { command: "rg", package: "ripgrep", versionFlag: "--version" }
+];
+var APT_TIMEOUT_MS = 12e4;
+var TOOL_CHECK_TIMEOUT_MS = 5e3;
+var runTool = async (file, args, cwd, env) => {
+  const { stdout } = await execa10(file, args, { cwd, env, stdin: "ignore", timeout: file === "apt-get" ? APT_TIMEOUT_MS : TOOL_CHECK_TIMEOUT_MS });
+  return { stdout: String(stdout) };
+};
+function sandboxToolsDir(dataDir) {
+  return join22(dataDir, "sandbox-tools", "bin");
+}
+function missingSandboxTools() {
+  return TOOLS.filter((tool2) => !findOnPath(tool2.command)).map((tool2) => tool2.package);
+}
+async function ensureSandboxTools(options) {
+  if ((options.platform ?? process.platform) !== "linux") return [];
+  const { dataDir, log, run: run2 = runTool } = options;
+  const binDir = sandboxToolsDir(dataDir);
+  appendToPath([binDir]);
+  const needed = TOOLS.filter((tool2) => !findOnPath(tool2.command));
+  if (needed.length === 0) return [];
+  const packages = needed.map((tool2) => tool2.package);
+  if (!findOnPath("apt-get") || !findOnPath("dpkg-deb")) {
+    log.warn({ missing: packages }, "sandbox tools missing and apt is unavailable");
+    return packages;
+  }
+  mkdirSync12(binDir, { recursive: true, mode: 448 });
+  const work = mkdtempSync6(join22(dataDir, "sandbox-tools", ".install-"));
+  try {
+    const apt = await downloadPackages(work, packages, run2);
+    for (const tool2 of needed) {
+      try {
+        await installTool(tool2, { work, dataDir, apt, run: run2 });
+      } catch (err) {
+        log.warn({ package: tool2.package, err: errorMessage2(err) }, "sandbox tool unusable on this machine");
+      }
+    }
+  } catch (err) {
+    log.warn({ missing: packages, err: errorMessage2(err) }, "could not download sandbox tools");
+  } finally {
+    rmSync11(work, { recursive: true, force: true });
+  }
+  const missing = missingSandboxTools();
+  if (missing.length < packages.length) log.info({ installed: packages.filter((name) => !missing.includes(name)) }, "sandbox tools installed");
+  return missing;
+}
+async function installTool(tool2, context) {
+  const { work, dataDir, apt, run: run2 } = context;
+  const root = join22(work, "root");
+  await run2("dpkg-deb", ["-x", join22(work, debFile(work, tool2.package)), root], work);
+  const unpacked = join22(root, "usr", "bin", tool2.command);
+  chmodSync2(unpacked, 493);
+  const binDir = sandboxToolsDir(dataDir);
+  try {
+    await run2(unpacked, [tool2.versionFlag], work);
+    renameSync2(unpacked, join22(binDir, tool2.command));
+    return;
+  } catch {
+  }
+  const plan = await run2("apt-get", ["-s", "-qq", ...apt, "install", tool2.package], work);
+  const dependencies = [...String(plan?.stdout ?? "").matchAll(/^Inst (\S+)/gm)].map((match) => match[1]).filter((name) => name !== tool2.package);
+  if (dependencies.length === 0) throw new Error("the tool does not run and has no missing dependencies");
+  await run2("apt-get", ["-qq", ...apt, "download", ...dependencies], work);
+  for (const dependency of dependencies) await run2("dpkg-deb", ["-x", join22(work, debFile(work, dependency)), root], work);
+  const libDir = join22(dataDir, "sandbox-tools", "lib");
+  mkdirSync12(libDir, { recursive: true, mode: 448 });
+  for (const directory of [join22(root, "lib"), join22(root, "usr", "lib")]) moveSharedLibraries(directory, libDir);
+  await run2(unpacked, [tool2.versionFlag], work, { LD_LIBRARY_PATH: libDir });
+  const realDir = join22(dataDir, "sandbox-tools", "libexec");
+  mkdirSync12(realDir, { recursive: true, mode: 448 });
+  renameSync2(unpacked, join22(realDir, tool2.command));
+  const launcher = join22(work, `${tool2.command}.launcher`);
+  writeFileSync7(launcher, `#!/bin/sh
+LD_LIBRARY_PATH=${shellQuote2(libDir)} exec ${shellQuote2(join22(realDir, tool2.command))} "$@"
+`, { mode: 493 });
+  renameSync2(launcher, join22(binDir, tool2.command));
+}
+function moveSharedLibraries(directory, libDir) {
+  if (!existsSync5(directory)) return;
+  for (const entry of readdirSync5(directory)) {
+    const path = join22(directory, entry);
+    if (lstatSync8(path).isDirectory()) moveSharedLibraries(path, libDir);
+    else if (entry.includes(".so") && !existsSync5(join22(libDir, entry))) renameSync2(path, join22(libDir, entry));
+  }
+}
+function shellQuote2(value) {
+  return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+async function downloadPackages(work, packages, run2) {
+  const cache = join22(work, "cache");
+  mkdirSync12(join22(cache, "archives", "partial"), { recursive: true });
+  const unprivileged = ["-o", `Dir::Cache=${cache}`, "-o", "Debug::NoLocking=1", "-o", "APT::Sandbox::User="];
+  try {
+    await run2("apt-get", ["-qq", ...unprivileged, "download", ...packages], work);
+    return unprivileged;
+  } catch {
+    const lists = join22(work, "lists");
+    mkdirSync12(join22(lists, "partial"), { recursive: true });
+    const privateLists = [...unprivileged, "-o", `Dir::State::lists=${lists}`];
+    await run2("apt-get", ["-qq", ...privateLists, "update"], work);
+    await run2("apt-get", ["-qq", ...privateLists, "download", ...packages], work);
+    return privateLists;
+  }
+}
+function debFile(work, name) {
+  const file = readdirSync5(work).find((entry) => entry === `${name}.deb` || entry.startsWith(`${name}_`));
+  if (!file) throw new Error(`${name} package was not downloaded`);
+  return file;
+}
+function errorMessage2(err) {
+  return err instanceof Error ? err.message.slice(0, 300) : "unknown error";
+}
+
 // src/lock.ts
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync9, rmSync as rmSync11 } from "node:fs";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync10, rmSync as rmSync12 } from "node:fs";
 import { createConnection } from "node:net";
-import { join as join19 } from "node:path";
+import { join as join23 } from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import lockfile from "proper-lockfile";
 var DaemonAlreadyRunningError = class extends Error {
@@ -9179,11 +9465,11 @@ var LOCK_STALE_MS = 5 * 6e4;
 var LOCK_UPDATE_MS = 3e4;
 var LOCK_TAKEOVER_MS = 6e3;
 function pidFile(dataDir) {
-  return join19(dataDir, "daemon.pid");
+  return join23(dataDir, "daemon.pid");
 }
 function holderPid(dataDir) {
   try {
-    const pid = Number(readFileSync9(pidFile(dataDir), "utf8").trim());
+    const pid = Number(readFileSync10(pidFile(dataDir), "utf8").trim());
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -9210,7 +9496,7 @@ function socketAnswers(socketPath) {
   });
 }
 async function acquireLock(dataDir, lockfilePath, onCompromised = () => void 0, options = {}) {
-  mkdirSync12(dataDir, { recursive: true });
+  mkdirSync13(dataDir, { recursive: true });
   const lock = async () => {
     const release = await lockfile.lock(dataDir, {
       lockfilePath,
@@ -9223,7 +9509,7 @@ async function acquireLock(dataDir, lockfilePath, onCompromised = () => void 0,
     writeFileAtomic(pidFile(dataDir), `${process.pid}
 `);
     return async () => {
-      rmSync11(pidFile(dataDir), { force: true });
+      rmSync12(pidFile(dataDir), { force: true });
       await release();
     };
   };
@@ -9240,7 +9526,7 @@ async function acquireLock(dataDir, lockfilePath, onCompromised = () => void 0,
     const pid = holderPid(dataDir);
     const crashed = pid !== null && pid !== process.pid && !processAlive(pid);
     if (crashed || pid === null && Date.now() >= deadline) {
-      rmSync11(lockfilePath, { recursive: true, force: true });
+      rmSync12(lockfilePath, { recursive: true, force: true });
       try {
         return await lock();
       } catch (error) {
@@ -9317,13 +9603,13 @@ function closeLogger(logger) {
 // src/outbox.ts
 import {
   appendFileSync,
-  mkdirSync as mkdirSync13,
-  readFileSync as readFileSync10,
-  readdirSync as readdirSync4,
-  rmSync as rmSync12,
+  mkdirSync as mkdirSync14,
+  readFileSync as readFileSync11,
+  readdirSync as readdirSync6,
+  rmSync as rmSync13,
   truncateSync
 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join24 } from "node:path";
 var Outbox = class {
   constructor(dir, link, log, retryMs = 1e3, onUndeliverable = () => void 0, retainResources = false) {
     this.dir = dir;
@@ -9332,7 +9618,7 @@ var Outbox = class {
     this.retryMs = retryMs;
     this.onUndeliverable = onUndeliverable;
     this.retainResources = retainResources;
-    mkdirSync13(dir, { recursive: true, mode: 448 });
+    mkdirSync14(dir, { recursive: true, mode: 448 });
   }
   dir;
   link;
@@ -9346,15 +9632,15 @@ var Outbox = class {
   /** Runs whose file was checked for a torn tail since this process started. */
   repaired = /* @__PURE__ */ new Set();
   file(runId) {
-    return join20(this.dir, `${assertSafeId("run id", runId)}.jsonl`);
+    return join24(this.dir, `${assertSafeId("run id", runId)}.jsonl`);
   }
   ackFile(runId) {
-    return join20(this.dir, `${assertSafeId("run id", runId)}.ack.json`);
+    return join24(this.dir, `${assertSafeId("run id", runId)}.ack.json`);
   }
   parse(runId) {
     let data;
     try {
-      data = readFileSync10(this.file(runId));
+      data = readFileSync11(this.file(runId));
     } catch {
       return { items: [], validBytes: 0, torn: false, tornTail: false };
     }
@@ -9439,7 +9725,7 @@ var Outbox = class {
   }
   runIds() {
     try {
-      return readdirSync4(this.dir).filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length)).filter((runId) => isSafeId(runId));
+      return readdirSync6(this.dir).filter((name) => name.endsWith(".jsonl")).map((name) => name.slice(0, -".jsonl".length)).filter((runId) => isSafeId(runId));
     } catch {
       return [];
     }
@@ -9507,8 +9793,8 @@ var Outbox = class {
   }
   remove(runId) {
     if (this.retainResources) return;
-    rmSync12(this.file(runId), { force: true });
-    rmSync12(this.ackFile(runId), { force: true });
+    rmSync13(this.file(runId), { force: true });
+    rmSync13(this.ackFile(runId), { force: true });
   }
   scheduleRetry() {
     if (this.retryTimer || this.closed) return;
@@ -9533,15 +9819,15 @@ var Outbox = class {
 };
 
 // src/quota/local-credentials.ts
-import { homedir as homedir8 } from "node:os";
-import { join as join22 } from "node:path";
+import { homedir as homedir9 } from "node:os";
+import { join as join26 } from "node:path";
 
 // src/quota/files.ts
 import { execFile as execFile4 } from "node:child_process";
-import { constants as constants2 } from "node:fs";
+import { constants as constants3 } from "node:fs";
 import { lstat as lstat2, open } from "node:fs/promises";
 import { promisify as promisify4 } from "node:util";
-var NOFOLLOW = constants2.O_NOFOLLOW ?? 0;
+var NOFOLLOW = constants3.O_NOFOLLOW ?? 0;
 var execFileAsync = promisify4(execFile4);
 var KEYCHAIN_TIMEOUT_MS = 3e4;
 var MAX_CREDENTIAL_BYTES = 64 * 1024;
@@ -9617,7 +9903,7 @@ async function readSecureFile(filePath, maxBytes = MAX_CREDENTIAL_BYTES) {
   if (before.size > maxBytes) {
     throw new Error(`Credential file exceeds ${maxBytes} bytes: ${filePath}`);
   }
-  const handle = await open(filePath, constants2.O_RDONLY | NOFOLLOW);
+  const handle = await open(filePath, constants3.O_RDONLY | NOFOLLOW);
   try {
     const after = await handle.stat();
     assertRegularFile(after, filePath);
@@ -10032,12 +10318,12 @@ async function readCodexQuota(options) {
 
 // src/quota/cursor.ts
 import { lstat as lstat3 } from "node:fs/promises";
-import { join as join21 } from "node:path";
+import { join as join25 } from "node:path";
 var ENDPOINT3 = "https://cursor.com/api/usage-summary";
 var ACCESS_TOKEN_KEY = "cursorAuth/accessToken";
 function cursorDatabasePath(platform3, home) {
   if (platform3 === "darwin") {
-    return join21(
+    return join25(
       home,
       "Library",
       "Application Support",
@@ -10048,7 +10334,7 @@ function cursorDatabasePath(platform3, home) {
     );
   }
   if (platform3 === "win32") {
-    return join21(
+    return join25(
       home,
       "AppData",
       "Roaming",
@@ -10058,7 +10344,7 @@ function cursorDatabasePath(platform3, home) {
       "state.vscdb"
     );
   }
-  return join21(home, ".config", "Cursor", "User", "globalStorage", "state.vscdb");
+  return join25(home, ".config", "Cursor", "User", "globalStorage", "state.vscdb");
 }
 var CURSOR_PLANS = {
   pro: "Pro",
@@ -10230,10 +10516,10 @@ async function readCursorQuota(options) {
 // src/quota/local-credentials.ts
 var KEYCHAIN_SERVICE = "Claude Code-credentials";
 function claudeCredentialPath(home) {
-  return join22(home, ".claude", ".credentials.json");
+  return join26(home, ".claude", ".credentials.json");
 }
 function codexAuthPath(home) {
-  return join22(home, ".codex", "auth.json");
+  return join26(home, ".codex", "auth.json");
 }
 function unknown2(vendor, observedAt) {
   return {
@@ -10252,7 +10538,7 @@ var LocalCredentialsSource = class {
   options;
   id = "local_credentials";
   async read(signal) {
-    const home = this.options.home ?? homedir8();
+    const home = this.options.home ?? homedir9();
     const platform3 = this.options.platform ?? process.platform;
     const fetchImpl = this.options.fetch ?? globalThis.fetch;
     const now = this.options.now ?? Date.now;
@@ -10385,7 +10671,7 @@ var QuotaPoller = class {
 
 // src/rpc/server.ts
 import { timingSafeEqual } from "node:crypto";
-import { chmodSync as chmodSync2, rmSync as rmSync13 } from "node:fs";
+import { chmodSync as chmodSync3, rmSync as rmSync14 } from "node:fs";
 import { createServer as createServer2 } from "node:net";
 import {
   createMessageConnection as createMessageConnection2,
@@ -10426,13 +10712,13 @@ var RpcServer = class {
   sockets = /* @__PURE__ */ new Set();
   async listen() {
     const { socketPath } = this.options;
-    rmSync13(socketPath, { force: true });
+    rmSync14(socketPath, { force: true });
     const server = createServer2((socket) => this.accept(socket));
     await new Promise((resolve12, reject) => {
       server.once("error", reject);
       server.listen(socketPath, () => resolve12());
     });
-    chmodSync2(socketPath, 384);
+    chmodSync3(socketPath, 384);
     this.server = server;
   }
   accept(socket) {
@@ -10499,7 +10785,7 @@ var RpcServer = class {
       this.server.close(() => resolve12());
     });
     this.server = null;
-    rmSync13(this.options.socketPath, { force: true });
+    rmSync14(this.options.socketPath, { force: true });
   }
 };
 
@@ -10562,12 +10848,12 @@ var RunJournal = class {
 };
 
 // src/runs/check.ts
-import { execa as execa10 } from "execa";
+import { execa as execa11 } from "execa";
 async function fixedCheckSnapshot(repoPath, worktree, sha) {
   if (!/^[a-f0-9]{40}$/.test(sha))
     throw new Error("Check requires an exact candidate SHA");
   const gitDir = await worktreeGitDir(repoPath, worktree);
-  const git2 = async (...args) => (await execa10(
+  const git2 = async (...args) => (await execa11(
     "git",
     [
       "-c",
@@ -10722,15 +11008,15 @@ function createRunMasker(secrets) {
 
 // src/runs/supervisor.ts
 import { createHash as createHash4, randomUUID as randomUUID5 } from "node:crypto";
-import { join as join24, resolve as resolve10 } from "node:path";
-import { execa as execa12 } from "execa";
+import { join as join28, resolve as resolve10 } from "node:path";
+import { execa as execa13 } from "execa";
 
 // src/agents/checkpoint.ts
-import { mkdtempSync as mkdtempSync6, rmSync as rmSync14, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdtempSync as mkdtempSync7, rmSync as rmSync15, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join23 } from "node:path";
+import { join as join27 } from "node:path";
 import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
-import { execa as execa11 } from "execa";
+import { execa as execa12 } from "execa";
 var CheckpointRecoveryError = class extends Error {
   constructor(message) {
     super(message);
@@ -10775,12 +11061,12 @@ async function takeCheckpoint(options) {
 }
 async function applyCheckpoint(options) {
   const git2 = await pinnedGit(options.repoPath, options.worktree);
-  const dir = mkdtempSync6(join23(tmpdir2(), "mikka-checkpoint-"));
-  const file = join23(dir, "checkpoint.patch");
+  const dir = mkdtempSync7(join27(tmpdir2(), "mikka-checkpoint-"));
+  const file = join27(dir, "checkpoint.patch");
   try {
     const patch = gunzipSync2(Buffer.from(options.checkpoint.patch, "base64"));
     if (!patch.length && options.checkpoint.files === 0) return true;
-    writeFileSync7(file, patch);
+    writeFileSync8(file, patch);
     for (const args of [
       ["apply", "--binary", "--whitespace=nowarn", file],
       ["apply", "--binary", "--3way", "--whitespace=nowarn", file]
@@ -10793,11 +11079,11 @@ async function applyCheckpoint(options) {
     }
     return false;
   } finally {
-    rmSync14(dir, { recursive: true, force: true });
+    rmSync15(dir, { recursive: true, force: true });
   }
 }
 async function hasCommit(repoPath, commit) {
-  return execa11(
+  return execa12(
     "git",
     ["-c", "core.hooksPath=/dev/null", "cat-file", "-e", `${commit}^{commit}`],
     { cwd: repoPath, stdin: "ignore" }
@@ -12014,7 +12300,7 @@ var RunSupervisor = class {
         if (!this.deps.adapterStateDir || assignment.harness === "mock" || !session.sessionId || resuming && session.sessionId !== entry.sessionId || assignment.requireSessionResume && session.sessionId !== assignment.resumeSessionId)
           throw new Error("Skill mount requires the actual original harness session");
         verifySkillAssignment(assignment);
-        const file = join24(
+        const file = join28(
           runPaths(this.deps.adapterStateDir, runId).runDir,
           SKILLS_DIR,
           skillSlug(assignment.skills[0].name),
@@ -12247,7 +12533,7 @@ function stopReasonOf(event, run2) {
   return event.outcome === "failed" ? "error" : "turn_ended";
 }
 async function unsandboxedVerify(run2) {
-  const result = await execa12(run2.command, {
+  const result = await execa13(run2.command, {
     shell: true,
     cwd: run2.worktree,
     env: buildChildEnv(),
@@ -12290,10 +12576,10 @@ var SessionRejectedError = class extends DaemonError {
 
 // src/repositories.ts
 import { createHash as createHash5, randomUUID as randomUUID6 } from "node:crypto";
-import { existsSync as existsSync5, lstatSync as lstatSync8, mkdirSync as mkdirSync14, readdirSync as readdirSync5, realpathSync as realpathSync11, renameSync as renameSync2, rmSync as rmSync15 } from "node:fs";
-import { dirname as dirname11, join as join25, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync6, lstatSync as lstatSync9, mkdirSync as mkdirSync15, readdirSync as readdirSync7, realpathSync as realpathSync11, renameSync as renameSync3, rmSync as rmSync16 } from "node:fs";
+import { dirname as dirname11, join as join29, resolve as resolve11 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
-import { execa as execa13 } from "execa";
+import { execa as execa14 } from "execa";
 import lockfile2 from "proper-lockfile";
 var RepositoryCache = class {
   constructor(root, allowFile = daemonTestMode(process.env), retainResources = false) {
@@ -12319,19 +12605,19 @@ var RepositoryCache = class {
     const release = await this.lock(path, signal);
     try {
       signal?.throwIfAborted();
-      const git2 = (args, cwd) => execa13("git", [
+      const git2 = (args, cwd) => execa14("git", [
         ...FETCH_GIT,
         "-c",
         `protocol.file.allow=${this.allowFile ? "always" : "never"}`,
         ...args
       ], { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }, stdin: "ignore", timeout: FETCH_TIMEOUT_MS, cancelSignal: signal, killDescendants: true });
-      if (!existsSync5(path)) {
+      if (!existsSync6(path)) {
         const temporary = `${path}.clone-${randomUUID6()}`;
         try {
           await git2(["clone", "--no-checkout", "--no-hardlinks", "--no-recurse-submodules", "--", remote, temporary]);
-          renameSync2(temporary, path);
+          renameSync3(temporary, path);
         } finally {
-          if (!this.retainResources) rmSync15(temporary, { recursive: true, force: true });
+          if (!this.retainResources) rmSync16(temporary, { recursive: true, force: true });
         }
       } else {
         this.assertClone(path);
@@ -12351,36 +12637,36 @@ var RepositoryCache = class {
       await assertBranchName(baseBranch);
       return `origin/${baseBranch}`;
     }
-    const { stdout } = await execa13("git", [...FETCH_GIT, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: path, stdin: "ignore" });
+    const { stdout } = await execa14("git", [...FETCH_GIT, "symbolic-ref", "--short", "refs/remotes/origin/HEAD"], { cwd: path, stdin: "ignore" });
     if (!stdout.startsWith("origin/")) throw new Error("Repository default branch unavailable");
     return stdout.trim();
   }
   /** Cache paths for retention/orphan cleanup; never consult user checkouts. */
   paths() {
     const visit = (path) => {
-      if (!existsSync5(path) || lstatSync8(path).isSymbolicLink()) return [];
-      if (existsSync5(join25(path, ".git"))) {
+      if (!existsSync6(path) || lstatSync9(path).isSymbolicLink()) return [];
+      if (existsSync6(join29(path, ".git"))) {
         this.assertClone(path);
         return [path];
       }
-      return readdirSync5(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join25(path, entry.name)) : []);
+      return readdirSync7(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join29(path, entry.name)) : []);
     };
     return visit(resolve11(this.root));
   }
   ensureParents(path) {
-    mkdirSync14(this.root, { recursive: true, mode: 448 });
-    if (lstatSync8(this.root).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
+    mkdirSync15(this.root, { recursive: true, mode: 448 });
+    if (lstatSync9(this.root).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
     const root = realpathSync11(this.root);
     let current = resolve11(this.root);
     for (const part of path.slice(current.length + 1).split("/").filter(Boolean)) {
-      current = join25(current, part);
-      if (existsSync5(current) && lstatSync8(current).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
-      mkdirSync14(current, { recursive: true, mode: 448 });
+      current = join29(current, part);
+      if (existsSync6(current) && lstatSync9(current).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
+      mkdirSync15(current, { recursive: true, mode: 448 });
       if (!isInside(root, realpathSync11(current))) throw new Error("Repository cache escapes its directory");
     }
   }
   assertClone(path) {
-    if (lstatSync8(path).isSymbolicLink() || !lstatSync8(join25(path, ".git")).isDirectory() || lstatSync8(join25(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
+    if (lstatSync9(path).isSymbolicLink() || !lstatSync9(join29(path, ".git")).isDirectory() || lstatSync9(join29(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
     if (!isInside(realpathSync11(this.root), realpathSync11(path))) throw new Error("Repository cache escapes its directory");
   }
   async lock(path, signal) {
@@ -12401,16 +12687,16 @@ var RepositoryCache = class {
 import { execFile as execFile5, spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import {
-  existsSync as existsSync6,
-  lstatSync as lstatSync9,
-  mkdirSync as mkdirSync15,
-  mkdtempSync as mkdtempSync7,
-  readdirSync as readdirSync6,
+  existsSync as existsSync7,
+  lstatSync as lstatSync10,
+  mkdirSync as mkdirSync16,
+  mkdtempSync as mkdtempSync8,
+  readdirSync as readdirSync8,
   realpathSync as realpathSync12,
-  rmSync as rmSync16
+  rmSync as rmSync17
 } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter as delimiter2, dirname as dirname12, join as join27 } from "node:path";
+import { delimiter as delimiter4, dirname as dirname12, join as join31 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { promisify as promisify5 } from "node:util";
 
@@ -12420,7 +12706,7 @@ import { chmod, mkdtemp, rm as rm2 } from "node:fs/promises";
 import { createServer as createServer3, request as httpRequest } from "node:http";
 import { connect, isIP as isIP3 } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join26 } from "node:path";
+import { join as join30 } from "node:path";
 
 // ../../lib/search/url-policy.ts
 import { BlockList, isIP as isIP2 } from "node:net";
@@ -12489,9 +12775,9 @@ function endToEndHeaders(input) {
 }
 async function startPublicEgress(options) {
   options.signal.throwIfAborted();
-  const directory = await mkdtemp(join26(tmpdir3(), "mikka-egress-"));
+  const directory = await mkdtemp(join30(tmpdir3(), "mikka-egress-"));
   await chmod(directory, 448);
-  const socketPath = join26(directory, "egress.sock");
+  const socketPath = join30(directory, "egress.sock");
   const lifetime = new AbortController();
   const signal = AbortSignal.any([options.signal, lifetime.signal]);
   const sockets = /* @__PURE__ */ new Set();
@@ -12648,8 +12934,8 @@ async function createHostedBotRunner(host) {
   }).catch(() => {
     throw unavailable2();
   });
-  const resources = join27(host.stateDir, "native-resources");
-  mkdirSync15(resources, { recursive: true, mode: 448 });
+  const resources = join31(host.stateDir, "native-resources");
+  mkdirSync16(resources, { recursive: true, mode: 448 });
   const removeResource = async (file, record) => {
     if (!/^mikka-native-(?:verify-)?[a-f0-9-]{36}$/.test(record.name) || !/^[a-f0-9-]{36}$/.test(record.nonce))
       throw unavailable2();
@@ -12669,9 +12955,9 @@ async function createHostedBotRunner(host) {
       if (record.state === "created" && /No such (?:container|object)/i.test(
         String(error.stderr)
       )) {
-        if (record.assets?.startsWith(join27(host.stateDir, "native-verify-git-")))
-          rmSync16(record.assets, { recursive: true, force: true });
-        rmSync16(file, { force: true });
+        if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
+          rmSync17(record.assets, { recursive: true, force: true });
+        rmSync17(file, { force: true });
         return;
       }
       throw new Error("native_runtime_cleanup_unconfirmed");
@@ -12680,13 +12966,13 @@ async function createHostedBotRunner(host) {
     if (labels?.["com.mikka.native.resource"] !== record.nonce || record.id && record.id !== id4)
       throw unavailable2();
     await exec3("docker", ["rm", "-f", id4], { env: bareEnv, timeout: 3e4 });
-    if (record.assets?.startsWith(join27(host.stateDir, "native-verify-git-")))
-      rmSync16(record.assets, { recursive: true, force: true });
-    rmSync16(file, { force: true });
+    if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
+      rmSync17(record.assets, { recursive: true, force: true });
+    rmSync17(file, { force: true });
   };
-  for (const name of readdirSync6(resources))
+  for (const name of readdirSync8(resources))
     if (name.endsWith(".json")) {
-      const file = join27(resources, name);
+      const file = join31(resources, name);
       const record = readJson(file);
       if (!record) throw unavailable2();
       await removeResource(file, record);
@@ -12697,7 +12983,7 @@ async function createHostedBotRunner(host) {
     const bundled = createRequire(
       require2.resolve("@anthropic-ai/claude-agent-sdk")
     );
-    claude ??= join27(
+    claude ??= join31(
       dirname12(
         bundled.resolve(
           "@anthropic-ai/claude-agent-sdk-linux-x64/package.json"
@@ -12707,13 +12993,13 @@ async function createHostedBotRunner(host) {
     );
   } catch {
   }
-  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter2).map((dir) => join27(dir, "codex")).find((path) => existsSync6(path));
+  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter4).map((dir) => join31(dir, "codex")).find((path) => existsSync7(path));
   const binaries = { codex, claude_code: claude };
   for (const kind of ["codex", "claude_code"])
     if (binaries[kind]) {
       try {
         binaries[kind] = realpathSync12(binaries[kind]);
-        if (!lstatSync9(binaries[kind]).isFile()) delete binaries[kind];
+        if (!lstatSync10(binaries[kind]).isFile()) delete binaries[kind];
       } catch {
         delete binaries[kind];
       }
@@ -12721,12 +13007,12 @@ async function createHostedBotRunner(host) {
   if (!binaries.codex && !binaries.claude_code) throw unavailable2();
   const command = async (worktree, script, readOnly, timeoutMs, signal) => {
     const name = `mikka-native-verify-${randomUUID7()}`;
-    const file = join27(resources, name + ".json");
+    const file = join31(resources, name + ".json");
     const resource = { name, nonce: randomUUID7(), state: "creating" };
     const timing = { createMs: 0, runMs: 0 };
     let phase = "create";
     let began = performance.now();
-    const gitCopy = mkdtempSync7(join27(host.stateDir, "native-verify-git-"));
+    const gitCopy = mkdtempSync8(join31(host.stateDir, "native-verify-git-"));
     resource.assets = gitCopy;
     try {
       const cwd = realpathSync12(worktree);
@@ -12742,7 +13028,7 @@ async function createHostedBotRunner(host) {
           "--no-checkout",
           "--",
           cwd,
-          join27(gitCopy, "repo")
+          join31(gitCopy, "repo")
         ],
         {
           env: {
@@ -12757,8 +13043,8 @@ async function createHostedBotRunner(host) {
           maxBuffer: 1024 * 1024
         }
       );
-      const safeGit = join27(gitCopy, "repo", ".git");
-      const protectedGit = lstatSync9(join27(cwd, ".git")).isFile() ? join27(cwd, ".git") : safeGit;
+      const safeGit = join31(gitCopy, "repo", ".git");
+      const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : safeGit;
       writeJsonAtomic(file, resource);
       const created = await exec3(
         "docker",
@@ -12845,8 +13131,8 @@ async function createHostedBotRunner(host) {
         timing
       };
     } finally {
-      if (existsSync6(file)) await removeResource(file, resource);
-      else rmSync16(gitCopy, { recursive: true, force: true });
+      if (existsSync7(file)) await removeResource(file, resource);
+      else rmSync17(gitCopy, { recursive: true, force: true });
     }
   };
   return {
@@ -12862,7 +13148,7 @@ async function createHostedBotRunner(host) {
         throw unavailable2();
       const name = `mikka-native-${randomUUID7()}`;
       const nonce = randomUUID7();
-      const resourceFile = join27(resources, name + ".json");
+      const resourceFile = join31(resources, name + ".json");
       const resource = { name, nonce, state: "creating" };
       const lifetime = new AbortController();
       let closed = false;
@@ -12901,7 +13187,7 @@ async function createHostedBotRunner(host) {
           void brokerClosed.catch(() => void 0);
           try {
             await creating?.catch(() => void 0);
-            if (existsSync6(resourceFile)) await removeResource(resourceFile, resource);
+            if (existsSync7(resourceFile)) await removeResource(resourceFile, resource);
           } finally {
             try {
               await brokerClosed;
@@ -12934,11 +13220,11 @@ async function createHostedBotRunner(host) {
           return current;
         };
         const paths = runPaths(host.stateDir, assignment.runId);
-        mkdirSync15(paths.runDir, { recursive: true, mode: 448 });
-        const shadow = join27(paths.runDir, "runtime-git");
-        const emptyHome = join27(paths.runDir, "git-bootstrap-home");
-        mkdirSync15(emptyHome, { recursive: true, mode: 448 });
-        if (!existsSync6(shadow))
+        mkdirSync16(paths.runDir, { recursive: true, mode: 448 });
+        const shadow = join31(paths.runDir, "runtime-git");
+        const emptyHome = join31(paths.runDir, "git-bootstrap-home");
+        mkdirSync16(emptyHome, { recursive: true, mode: 448 });
+        if (!existsSync7(shadow))
           await exec3(
             "git",
             [
@@ -12967,9 +13253,9 @@ async function createHostedBotRunner(host) {
             }
           );
         await live();
-        if (!lstatSync9(shadow).isDirectory() || !lstatSync9(join27(shadow, ".git")).isDirectory() || !realpathSync12(shadow).startsWith(realpathSync12(paths.runDir) + "/"))
+        if (!lstatSync10(shadow).isDirectory() || !lstatSync10(join31(shadow, ".git")).isDirectory() || !realpathSync12(shadow).startsWith(realpathSync12(paths.runDir) + "/"))
           throw unavailable2();
-        const ledger = join27(
+        const ledger = join31(
           host.stateDir,
           "native-ledgers",
           assignment.runId + ".json"
@@ -12986,15 +13272,15 @@ async function createHostedBotRunner(host) {
           modelId: first.modelId
         };
         const previous = readJson(ledger);
-        if (existsSync6(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
+        if (existsSync7(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
           throw unavailable2();
-        mkdirSync15(dirname12(ledger), { recursive: true, mode: 448 });
+        mkdirSync16(dirname12(ledger), { recursive: true, mode: 448 });
         const record = async (sessionId) => {
           assertOpen();
           writeJsonAtomic(ledger, { scope, sessionId });
         };
         brokerStarting = createNativeSubscriptionBroker({
-          root: join27(host.stateDir, "native-brokers"),
+          root: join31(host.stateDir, "native-brokers"),
           revision,
           check,
           worker: {
@@ -13021,7 +13307,7 @@ async function createHostedBotRunner(host) {
         });
         const readyBroker = await brokerStarting;
         await live();
-        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter2).map((dir) => join27(dir, "gh")).find((file) => existsSync6(file)) : void 0;
+        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter4).map((dir) => join31(dir, "gh")).find((file) => existsSync7(file)) : void 0;
         if (options.github && !githubCli) throw new Error("Install GitHub CLI (gh) in the cloud worker image");
         const githubDomains = options.github ? ["github.com", "api.github.com", new URL(options.github.endpoint).host] : [];
         const egressMaximum = runDomains(runPolicy(options.policy), [...options.networkAllow ?? [], ...githubDomains]);
@@ -13038,8 +13324,8 @@ async function createHostedBotRunner(host) {
         }
         const cwd = realpathSync12(options.cwd);
         const runDir = realpathSync12(paths.runDir);
-        const protectedGit = lstatSync9(join27(cwd, ".git")).isFile() ? join27(cwd, ".git") : join27(shadow, ".git");
-        if (!lstatSync9(runDir).isDirectory() || !runDir.startsWith(realpathSync12(host.stateDir) + "/runs/")) {
+        const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : join31(shadow, ".git");
+        if (!lstatSync10(runDir).isDirectory() || !runDir.startsWith(realpathSync12(host.stateDir) + "/runs/")) {
           await close();
           throw unavailable2();
         }
@@ -13092,7 +13378,7 @@ async function createHostedBotRunner(host) {
           `${MCP_SERVER_SCRIPT}:${MCP_SERVER_SCRIPT}:ro`,
           ...githubCli ? ["-v", `${githubCli}:/usr/local/bin/mikka-gh:ro`, "-v", `${GITHUB_CREDENTIAL_SCRIPT}:${GITHUB_CREDENTIAL_SCRIPT}:ro`] : [],
           "-v",
-          `${join27(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join27(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
+          `${join31(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join31(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
           "-v",
           `${readyBroker.socket}:/run/mikka-native.sock:ro`,
           ...computerGrant ? [
@@ -13135,13 +13421,13 @@ async function createHostedBotRunner(host) {
         }
         const spawnHosted = (config) => {
           assertOpen();
-          const home = join27(runDir, "runtime-home");
-          mkdirSync15(home, { recursive: true, mode: 448 });
+          const home = join31(runDir, "runtime-home");
+          mkdirSync16(home, { recursive: true, mode: 448 });
           const env = {
             ...config.env,
             HOME: kind === "claude_code" ? config.env.HOME ?? home : home,
-            PATH: `${options.github ? join27(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
-            GIT_DIR: join27(shadow, ".git"),
+            PATH: `${options.github ? join31(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
+            GIT_DIR: join31(shadow, ".git"),
             GIT_WORK_TREE: cwd,
             GIT_CONFIG_GLOBAL: "/dev/null",
             GIT_CONFIG_SYSTEM: "/dev/null",
@@ -13160,7 +13446,7 @@ async function createHostedBotRunner(host) {
             signal: AbortSignal.any([lifetime.signal, ...config.signal ? [config.signal] : []])
           });
           child.stdin.write(
-            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join27(runDir, "github", "bin") } : {} }) + "\n"
+            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join31(runDir, "github", "bin") } : {} }) + "\n"
           );
           return child;
         };
@@ -13295,7 +13581,7 @@ import {
   createHash as createHash7,
   timingSafeEqual as timingSafeEqual2
 } from "node:crypto";
-import { chmodSync as chmodSync3 } from "node:fs";
+import { chmodSync as chmodSync4 } from "node:fs";
 import { createServer as createServer4 } from "node:net";
 
 // src/computer/driver.mjs
@@ -13545,7 +13831,7 @@ var ComputerBroker = class {
       else this.server.listen(this.socketPath, resolve12);
     });
     if (this.transport === "tcp") this.socketPath = `tcp://127.0.0.1:${this.server.address().port}`;
-    else chmodSync3(this.socketPath, 384);
+    else chmodSync4(this.socketPath, 384);
   }
   request(token, value, signal) {
     const grant = this.grants.get(token);
@@ -13769,6 +14055,11 @@ function loadDeviceFile(raw) {
   }
   return file;
 }
+var HARNESS_RESCAN_MS = 5 * 6e4;
+var SANDBOX_REPAIR_RETRY_MS = 60 * 6e4;
+function missingToolsUnchanged(issue) {
+  return !issue?.missing.length || missingSandboxTools().length === issue.missing.length;
+}
 var Daemon = class {
   constructor(options) {
     this.options = options;
@@ -13840,8 +14131,8 @@ var Daemon = class {
   }
   async startInternal() {
     const { paths } = this;
-    mkdirSync16(paths.dataDir, { recursive: true, mode: 448 });
-    if (process.platform !== "win32") chmodSync4(paths.dataDir, 448);
+    mkdirSync17(paths.dataDir, { recursive: true, mode: 448 });
+    if (process.platform !== "win32") chmodSync5(paths.dataDir, 448);
     this.releaseLock = await acquireLock(
       paths.dataDir,
       paths.lock,
@@ -13854,7 +14145,7 @@ var Daemon = class {
     if (this.options.credential)
       this.saveDevice({ credential: this.options.credential });
     this.journal = new RunJournal(paths.journal);
-    this.captureUploader = new CaptureUploader((runId) => join28(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join28(paths.dataDir, "capture-pending"));
+    this.captureUploader = new CaptureUploader((runId) => join32(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join32(paths.dataDir, "capture-pending"));
     this.outbox = new Outbox(
       paths.outbox,
       this.options.link,
@@ -13871,7 +14162,7 @@ var Daemon = class {
     if (this.localComputerDriver && this.options.link.syncComputerReviews && this.options.link.localComputerAuthority) {
       this.localComputerBroker = new ComputerBroker({
         driver: this.localComputerDriver,
-        socketPath: join28(paths.dataDir, "local-computer.sock"),
+        socketPath: join32(paths.dataDir, "local-computer.sock"),
         transport: "tcp",
         permitted: (runId) => {
           const assignment = this.journal.get(runId)?.assignment;
@@ -13913,7 +14204,7 @@ var Daemon = class {
       };
       this.cloudComputerBroker = new ComputerBroker({
         driver,
-        socketPath: join28(paths.dataDir, "computer.sock"),
+        socketPath: join32(paths.dataDir, "computer.sock"),
         permitted: (runId) => {
           const entry = this.journal.get(runId);
           return Boolean(!this.stopped && this.registered && entry?.assignment.computer && this.supervisor?.computerRunAllowed(runId));
@@ -14036,7 +14327,7 @@ var Daemon = class {
           worktree,
           tree,
           github: { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId },
-          privateDir: join28(paths.adapterState, "pids"),
+          privateDir: join32(paths.adapterState, "pids"),
           ...hosted ? { hosted: true } : {},
           env: githubReceiptEnvironment()
         }) : publishRun({
@@ -14077,17 +14368,16 @@ var Daemon = class {
     if (this.stopped) throw new Error("daemon stopped during startup");
     const detected = hosted ? hosted.harnesses.map((harness) => ({ harness, installed: true, version: null, subscriptionBroker: true, ...this.cloudComputerBroker ? { computerBroker: true } : {} })) : this.options.harnesses ?? await detectHarnesses();
     if (this.stopped) throw new Error("daemon stopped during startup");
-    const runApprovalTransport = typeof this.options.link.prepareRunToolApproval === "function";
-    const localIsolation = this.ownedSandbox !== null && this.sandbox === this.ownedSandbox;
-    this.harnesses = detected.filter((info) => this.adapters.has(info.harness)).map((info) => ({
+    if (!hosted && !this.options.harnesses) this.harnessPrint = harnessFingerprint();
+    this.harnesses = [...detected.filter((info) => this.adapters.has(info.harness)).map((info) => ({
       ...info,
       // Local enforcement requires the successful owned SRT probe. Hosted
       // enforcement uses its existing network-none/read-only Docker boundary
       // and gate-bound broker/container teardown; general egress stays outside
       // that ceiling. Codex also verifies its pinned interface at initialize.
-      toolApproval: runApprovalTransport && (hosted || localIsolation && (info.harness === "claude_code" || info.harness === "codex" && /(?:^|[ /])0\.163\.0(?:$|[ ();])/.test(info.version ?? ""))) ? true : void 0,
+      toolApproval: this.supportsToolApproval(info),
       coordinator: hosted ? false : coordinatorCapable(info)
-    }));
+    })), ...this.sandboxBlockedHarnesses(detected)];
     await this.supervisor.resumeAll();
     if (!hosted && this.options.quotaSource !== null) {
       this.quota = new QuotaPoller(
@@ -14271,6 +14561,58 @@ var Daemon = class {
     }
     return acted;
   }
+  supportsToolApproval(info) {
+    if (typeof this.options.link.prepareRunToolApproval !== "function") return void 0;
+    if (this.options.hostedSubscriptions) return true;
+    if (this.ownedSandbox === null || this.sandbox !== this.ownedSandbox) return void 0;
+    return info.harness === "claude_code" || info.harness === "codex" && codexSupportsRunApproval(info.version) ? true : void 0;
+  }
+  /** Report a CLI the daemon cannot run as present but not installed, so no run is pinned here. */
+  sandboxBlockedHarnesses(detected) {
+    const issue = this.sandboxIssue;
+    if (!issue) return [];
+    return detected.filter((info) => info.installed && !this.adapters.has(info.harness)).map((info) => ({
+      harness: info.harness,
+      installed: false,
+      version: info.version,
+      sandboxBlocked: { missing: issue.missing }
+    }));
+  }
+  async redetectHarnesses() {
+    const repairing = this.sandboxIssue?.missing.length;
+    if (this.sandboxIssue && repairing) {
+      this.lastSandboxRepair = Date.now();
+      this.sandboxIssue = { missing: await ensureSandboxTools({ dataDir: this.paths.dataDir, log: this.log }) };
+    }
+    const detected = await detectHarnesses();
+    this.harnessPrint = harnessFingerprint();
+    this.harnesses = [...detected.filter((info) => this.adapters.has(info.harness)).map((info) => {
+      return { ...info, toolApproval: this.supportsToolApproval(info), coordinator: coordinatorCapable(info) };
+    }), ...this.sandboxBlockedHarnesses(detected)];
+    if (repairing && this.sandboxIssue?.missing.length === 0) {
+      this.startMaintenance(() => restartService(false, () => {
+      }, void 0, () => !this.stopped));
+    }
+  }
+  /** Notice an agent installed after startup, or retry a failed tool download, without spawning anything per tick. */
+  rescanHarnesses() {
+    const now = Date.now();
+    if (this.options.hostedSubscriptions || this.options.harnesses || this.rescanning || now - this.lastHarnessScan < HARNESS_RESCAN_MS) return;
+    this.lastHarnessScan = now;
+    const retryRepair = Boolean(this.sandboxIssue?.missing.length) && now - this.lastSandboxRepair >= SANDBOX_REPAIR_RETRY_MS;
+    if (harnessFingerprint() === this.harnessPrint && !retryRepair && missingToolsUnchanged(this.sandboxIssue)) return;
+    this.rescanning = true;
+    void this.redetectHarnesses().then(() => this.syncWithServer()).catch((err) => {
+      this.log.warn({ err }, "harness rescan failed");
+    }).finally(() => {
+      this.rescanning = false;
+    });
+  }
+  harnessPrint = "";
+  lastHarnessScan = Date.now();
+  lastSandboxRepair = Date.now();
+  rescanning = false;
+  sandboxIssue = null;
   sandbox = null;
   ownedSandbox = null;
   /** The agent sandbox (one per daemon), or null where there is none. */
@@ -14279,8 +14621,10 @@ var Daemon = class {
   }
   async createAgentSandbox() {
     if (this.options.agentSandbox !== void 0) return this.options.agentSandbox;
+    const missing = await ensureSandboxTools({ dataDir: this.paths.dataDir, log: this.log });
     if (!SandboxRuntime.supported()) {
-      this.log.warn("agent sandbox unavailable: platform or dependencies unsupported");
+      this.log.warn({ missing }, "agent sandbox unavailable: platform or dependencies unsupported");
+      this.sandboxIssue = { missing };
       return null;
     }
     const sandbox = new SandboxRuntime(async ({ host }) => {
@@ -14297,6 +14641,7 @@ var Daemon = class {
       return sandbox;
     } catch (err) {
       this.log.warn({ err }, "agent sandbox unavailable");
+      this.sandboxIssue = { missing: [] };
       if (!this.options.retainResources) await sandbox.reset().catch((resetError) => {
         this.log.warn({ err: resetError }, "agent sandbox cleanup failed");
       });
@@ -14320,11 +14665,11 @@ var Daemon = class {
       return runVerify(sandbox, {
         command,
         worktree: realpathSync13(worktree),
-        tmpRoot: join28(this.paths.adapterState, "verify", runId),
+        tmpRoot: join32(this.paths.adapterState, "verify", runId),
         privateDir: paths.privateDir,
         pidFile: paths.pidFile.replace(/\.pgid$/, ".verify.pgid"),
         networkAllow: repo.networkAllow,
-        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join28(paths.runDir, "handoff.json") },
+        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join32(paths.runDir, "handoff.json") },
         timeoutMs,
         signal,
         readOnly
@@ -14369,8 +14714,8 @@ var Daemon = class {
     void this.stop().finally(() => this.options.onLockLost?.(error));
   }
   ensureSecret() {
-    if (existsSync7(this.paths.secret)) {
-      return readFileSync11(this.paths.secret, "utf8").trim();
+    if (existsSync8(this.paths.secret)) {
+      return readFileSync12(this.paths.secret, "utf8").trim();
     }
     const secret = randomBytes3(32).toString("hex");
     writeFileAtomic(this.paths.secret, `${secret}
@@ -14467,6 +14812,7 @@ var Daemon = class {
         this.revokeLocalComputerGrants();
         this.registered = false;
       }
+      this.rescanHarnesses();
       const command = deviceCommands?.[0];
       if (command?.kind === "uninstall") {
         this.draining = true;
@@ -14480,7 +14826,7 @@ var Daemon = class {
           setImmediate(() => {
             void this.stop().then(() => uninstallService(() => {
               this.saveDevice({ credential: void 0 });
-              rmSync17(this.paths.secret, { force: true });
+              rmSync18(this.paths.secret, { force: true });
             })).catch(() => {
               this.options.onDrained?.();
             });
@@ -14492,11 +14838,7 @@ var Daemon = class {
         if (command.kind === "redetect" || this.maintenanceIdle()) {
           try {
             if (command.kind === "redetect") {
-              const detected = await detectHarnesses();
-              this.harnesses = detected.filter((info) => this.adapters.has(info.harness)).map((info) => {
-                const previous = this.harnesses.find((old) => old.harness === info.harness && old.version === info.version);
-                return { ...info, toolApproval: previous?.toolApproval, coordinator: coordinatorCapable(info) };
-              });
+              await this.redetectHarnesses();
               this.saveDevice({ completedDeviceCommands: [command.id], failedDeviceCommands: [] });
               void this.syncWithServer().catch(() => void 0);
             } else {
@@ -14809,7 +15151,7 @@ var Daemon = class {
       if (!job || controller.signal.aborted) return;
       await runNativeCoordinatorJob(job, {
         deviceId,
-        stateDir: join28(this.paths.dataDir, "coordinator"),
+        stateDir: join32(this.paths.dataDir, "coordinator"),
         link,
         signal: controller.signal,
         sandbox,
@@ -14852,7 +15194,7 @@ var Daemon = class {
         }, void 0, () => !this.stopped);
       });
     } else if (!this.updateCheck && !this.updateVersion) {
-      this.updateCheck = checkLatestVersion(join28(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
+      this.updateCheck = checkLatestVersion(join32(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
         this.updateVersion = version;
       }).catch(() => {
         this.log.warn("Daemon automatic update check failed");