@aspectlylabs/mikka 0.0.9 → 0.0.11

package/client.js

@@ -2843,6 +2843,7 @@ var heartbeatResultSchema = z13.object({
   cloudCredential: z13.string().regex(/^orv_[A-Za-z0-9_-]{43}$/).optional()
 });
 var RUN_CHECKPOINT_MAX_BYTES = 8 * 1024 * 1024;
+var RUN_CHECKPOINT_RECOVERY_MAX_AGE_MS = 30 * 6e4;
 var runCheckpointSchema = z13.object({
   /** The commit the run's worktree started from. */
   baseCommit: z13.string().regex(/^[0-9a-f]{40,64}$/),
@@ -2854,7 +2855,9 @@ var runCheckpointSchema = z13.object({
   patch: z13.string().max(Math.ceil(RUN_CHECKPOINT_MAX_BYTES * 4 / 3) + 4),
   /** Files the patch touches. */
   files: z13.number().int().nonnegative(),
-  takenAt: isoTime
+  takenAt: isoTime,
+  /** The latest tree could not be checkpointed; it supersedes older patches. */
+  unavailableReason: z13.literal("too_large").optional()
 });
 var setupRecipeSchema = z13.object({
   /** Paths relative to the main checkout copied into each new worktree. */
@@ -2959,6 +2962,12 @@ var runAssignmentSchema = z13.object({
    * one, and the run goes ahead without it.
    */
   mcp: z13.object({ url: z13.url(), token: z13.string().min(1).max(200), mailbox: z13.literal(true).optional() }).optional(),
+  /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
+  github: z13.object({
+    endpoint: z13.url(),
+    repository: z13.string().regex(/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/),
+    branch: z13.string().regex(/^mikka\/[a-z0-9-]+-[1-9][0-9]*$/)
+  }).strict().optional(),
   /** Question continuation must not silently open a different session. */
   /**
    * What the orchestrator dispatched this run for (ADR 0023). `plan` writes a
@@ -2971,11 +2980,14 @@ var runAssignmentSchema = z13.object({
    * branch, so nothing the earlier run left uncommitted is lost.
    */
   continuesRunId: id.optional(),
+  /** A same-device retry with no usable snapshot must reuse its real worktree. */
+  requireWorktreeContinuation: z13.literal(true).optional(),
   /**
    * The latest checkpoint of the attempt this run takes over after its
    * machine went offline. Used only for a new worktree (another machine, or
    * the earlier worktree is gone): it starts at `baseCommit` (the base
-   * branch when that commit is not here) with the patch applied.
+   * commit with the patch applied. Missing or unusable recovery data blocks
+   * the attempt rather than silently starting again from the base branch.
    */
   resumeFrom: runCheckpointSchema.optional(),
   /**
@@ -3621,7 +3633,7 @@ import { join } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.9",
+  version: "0.0.11",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3645,14 +3657,15 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
     "test:changed": "vitest run --changed origin/main --passWithNoTests",
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
-    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts"
+    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3679,7 +3692,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "c00e7bfb748f5e9bf2ee344e5c031b4a6ac0fed6"
+  gitHead: "375d670937ca06c53e47f336870481d38520c1fe"
 };
 
 // src/paths.ts

package/github-credentials.mjs

@@ -0,0 +1,94 @@
+// Run-local credentials only. The App key and the daemon's credentials never
+// enter this process. stdout in `git` mode is the git credential protocol.
+import { readFile, writeFile, rename, lstat } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { spawn } from 'node:child_process'
+import { pathToFileURL } from 'node:url'
+
+const MAX_CACHE_AGE = 50 * 60_000
+
+export function matchesGitRepository(input, repository) {
+  return input.protocol === 'https' && input.host === 'github.com' &&
+    [repository, `${repository}.git`].some(path => input.path?.toLowerCase() === path.toLowerCase())
+}
+
+export async function getRunGitHubToken(config, { fetcher = fetch, now = Date.now, minValidityMs = 60_000 } = {}) {
+  const cachePath = `${config.file}.cache`
+  try {
+    const stat = await lstat(cachePath)
+    if (stat.isFile() && (stat.mode & 0o077) === 0) {
+      const cached = JSON.parse(await readFile(cachePath, 'utf8'))
+      if (cached.repository === config.repository && cached.token &&
+        cached.createdAt <= now() && now() - cached.createdAt < MAX_CACHE_AGE && Date.parse(cached.expiresAt) - now() > minValidityMs) return cached.token
+    }
+  } catch { /* No reusable run-local token. */ }
+  const response = await fetcher(config.endpoint, {
+    method: 'POST', redirect: 'error', cache: 'no-store',
+    headers: { authorization: `Bearer ${config.runToken}` }, signal: AbortSignal.timeout(15_000),
+  })
+  if (!response.ok) throw new Error('Run GitHub credentials unavailable')
+  const result = await response.json()
+  if (result.repository?.toLowerCase() !== config.repository.toLowerCase() || typeof result.token !== 'string' || !result.token ||
+    !Number.isFinite(Date.parse(result.expiresAt)) || Date.parse(result.expiresAt) - now() <= minValidityMs) throw new Error('Invalid run GitHub credentials')
+  const temporary = `${cachePath}.${randomUUID()}`
+  await writeFile(temporary, JSON.stringify({ ...result, createdAt: now() }), { mode: 0o600, flag: 'wx' })
+  await rename(temporary, cachePath)
+  return result.token
+}
+
+const WATCH_SEGMENT_MS = 40 * 60_000
+
+function cli(config, args, token, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(config.gh, args, {
+      env: { ...process.env, GH_HOST: 'github.com', GH_TOKEN: token, GITHUB_TOKEN: '', GH_ENTERPRISE_TOKEN: '', GITHUB_ENTERPRISE_TOKEN: '', GH_PROMPT_DISABLED: '1' },
+      stdio: 'inherit',
+    })
+    let timedOut = false, hardStop
+    const timer = timeoutMs ? setTimeout(() => {
+      timedOut = true
+      child.kill('SIGTERM')
+      hardStop = setTimeout(() => child.kill('SIGKILL'), 2000)
+      hardStop.unref()
+    }, timeoutMs) : undefined
+    timer?.unref()
+    const clear = () => { clearTimeout(timer); clearTimeout(hardStop) }
+    child.on('error', () => { clear(); reject(new Error('GitHub CLI could not start')) })
+    child.on('close', code => { clear(); resolve({ code: code ?? 1, timedOut }) })
+  })
+}
+
+/** Native gh owns check semantics, output and --required/--fail-fast flags.
+ * Renew only the read-only watch process before its token can expire. This
+ * also works with gh versions predating `pr checks --json` support. */
+export async function runGh(config, args, deps = {}) {
+  const watch = args[0] === 'pr' && args[1] === 'checks' && args.includes('--watch')
+  const token = deps.token ?? (minValidityMs => getRunGitHubToken(config, { minValidityMs }))
+  const invoke = deps.invoke ?? ((args, token, timeoutMs) => cli(config, args, token, timeoutMs))
+  for (;;) {
+    const credential = await token(watch ? WATCH_SEGMENT_MS + 60_000 : 60_000)
+    const result = await invoke(args, credential, watch ? WATCH_SEGMENT_MS : undefined)
+    if (!watch || !result.timedOut) return result.code
+  }
+}
+
+async function main() {
+  const [mode, file, ...args] = process.argv.slice(2)
+  const config = { ...JSON.parse(await readFile(file, 'utf8')), file }
+  if (mode === 'git') {
+    if (args[0] !== 'get') return
+    let text = ''
+    for await (const chunk of process.stdin) {
+      text += chunk
+      if (text.length > 8192) throw new Error('Invalid git credential request')
+    }
+    const input = Object.fromEntries(text.trim().split('\n').map(line => { const index = line.indexOf('='); return [line.slice(0, index), line.slice(index + 1)] }))
+    if (!matchesGitRepository(input, config.repository)) return
+    process.stdout.write(`username=x-access-token\npassword=${await getRunGitHubToken(config)}\n\n`)
+  } else if (mode === 'gh') process.exitCode = await runGh(config, args)
+  else throw new Error('Invalid credential helper mode')
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main().catch(() => { process.stderr.write('Mikka GitHub credentials or CI status unavailable.\n'); process.exitCode = 1 })
+}

package/http-link.js

@@ -3251,6 +3251,8 @@ var heartbeatResultSchema = z17.object({
   cloudCredential: z17.string().regex(/^orv_[A-Za-z0-9_-]{43}$/).optional()
 });
 var RUN_CHECKPOINT_MAX_BYTES = 8 * 1024 * 1024;
+var RECOVERY_WORKTREE_HEADER = "x-mikka-recovery-worktree";
+var RUN_CHECKPOINT_RECOVERY_MAX_AGE_MS = 30 * 6e4;
 var runCheckpointSchema = z17.object({
   /** The commit the run's worktree started from. */
   baseCommit: z17.string().regex(/^[0-9a-f]{40,64}$/),
@@ -3262,7 +3264,9 @@ var runCheckpointSchema = z17.object({
   patch: z17.string().max(Math.ceil(RUN_CHECKPOINT_MAX_BYTES * 4 / 3) + 4),
   /** Files the patch touches. */
   files: z17.number().int().nonnegative(),
-  takenAt: isoTime
+  takenAt: isoTime,
+  /** The latest tree could not be checkpointed; it supersedes older patches. */
+  unavailableReason: z17.literal("too_large").optional()
 });
 var setupRecipeSchema = z17.object({
   /** Paths relative to the main checkout copied into each new worktree. */
@@ -3368,6 +3372,12 @@ var runAssignmentSchema = z17.object({
    * one, and the run goes ahead without it.
    */
   mcp: z17.object({ url: z17.url(), token: z17.string().min(1).max(200), mailbox: z17.literal(true).optional() }).optional(),
+  /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
+  github: z17.object({
+    endpoint: z17.url(),
+    repository: z17.string().regex(/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/),
+    branch: z17.string().regex(/^mikka\/[a-z0-9-]+-[1-9][0-9]*$/)
+  }).strict().optional(),
   /** Question continuation must not silently open a different session. */
   /**
    * What the orchestrator dispatched this run for (ADR 0023). `plan` writes a
@@ -3380,11 +3390,14 @@ var runAssignmentSchema = z17.object({
    * branch, so nothing the earlier run left uncommitted is lost.
    */
   continuesRunId: id2.optional(),
+  /** A same-device retry with no usable snapshot must reuse its real worktree. */
+  requireWorktreeContinuation: z17.literal(true).optional(),
   /**
    * The latest checkpoint of the attempt this run takes over after its
    * machine went offline. Used only for a new worktree (another machine, or
    * the earlier worktree is gone): it starts at `baseCommit` (the base
-   * branch when that commit is not here) with the patch applied.
+   * commit with the patch applied. Missing or unusable recovery data blocks
+   * the attempt rather than silently starting again from the base branch.
    */
   resumeFrom: runCheckpointSchema.optional(),
   /**
@@ -3921,7 +3934,7 @@ var InvalidIdError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.9",
+  version: "0.0.11",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3945,14 +3958,15 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
     "test:changed": "vitest run --changed origin/main --passWithNoTests",
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
-    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts"
+    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3979,7 +3993,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "c00e7bfb748f5e9bf2ee344e5c031b4a6ac0fed6"
+  gitHead: "375d670937ca06c53e47f336870481d38520c1fe"
 };
 
 // src/paths.ts
@@ -4299,6 +4313,7 @@ var HttpServerLink = class {
           [CLIENT_VERSION_HEADER]: this.clientVersion,
           [SKILL_ARTIFACT_HEADER]: "1",
           [REPO_ORIGIN_HEADER]: "1",
+          [RECOVERY_WORKTREE_HEADER]: "1",
           ...token ? { authorization: `Bearer ${token}` } : {},
           ...this.protectionBypass ? { "x-vercel-protection-bypass": this.protectionBypass } : {}
         },

package/login.js

@@ -2839,6 +2839,7 @@ var heartbeatResultSchema = z13.object({
   cloudCredential: z13.string().regex(/^orv_[A-Za-z0-9_-]{43}$/).optional()
 });
 var RUN_CHECKPOINT_MAX_BYTES = 8 * 1024 * 1024;
+var RUN_CHECKPOINT_RECOVERY_MAX_AGE_MS = 30 * 6e4;
 var runCheckpointSchema = z13.object({
   /** The commit the run's worktree started from. */
   baseCommit: z13.string().regex(/^[0-9a-f]{40,64}$/),
@@ -2850,7 +2851,9 @@ var runCheckpointSchema = z13.object({
   patch: z13.string().max(Math.ceil(RUN_CHECKPOINT_MAX_BYTES * 4 / 3) + 4),
   /** Files the patch touches. */
   files: z13.number().int().nonnegative(),
-  takenAt: isoTime
+  takenAt: isoTime,
+  /** The latest tree could not be checkpointed; it supersedes older patches. */
+  unavailableReason: z13.literal("too_large").optional()
 });
 var setupRecipeSchema = z13.object({
   /** Paths relative to the main checkout copied into each new worktree. */
@@ -2955,6 +2958,12 @@ var runAssignmentSchema = z13.object({
    * one, and the run goes ahead without it.
    */
   mcp: z13.object({ url: z13.url(), token: z13.string().min(1).max(200), mailbox: z13.literal(true).optional() }).optional(),
+  /** Agent-owned GitHub delivery; the same run token exchanges short-lived credentials. */
+  github: z13.object({
+    endpoint: z13.url(),
+    repository: z13.string().regex(/^[a-z0-9_.-]+\/[a-z0-9_.-]+$/),
+    branch: z13.string().regex(/^mikka\/[a-z0-9-]+-[1-9][0-9]*$/)
+  }).strict().optional(),
   /** Question continuation must not silently open a different session. */
   /**
    * What the orchestrator dispatched this run for (ADR 0023). `plan` writes a
@@ -2967,11 +2976,14 @@ var runAssignmentSchema = z13.object({
    * branch, so nothing the earlier run left uncommitted is lost.
    */
   continuesRunId: id.optional(),
+  /** A same-device retry with no usable snapshot must reuse its real worktree. */
+  requireWorktreeContinuation: z13.literal(true).optional(),
   /**
    * The latest checkpoint of the attempt this run takes over after its
    * machine went offline. Used only for a new worktree (another machine, or
    * the earlier worktree is gone): it starts at `baseCommit` (the base
-   * branch when that commit is not here) with the patch applied.
+   * commit with the patch applied. Missing or unusable recovery data blocks
+   * the attempt rather than silently starting again from the base branch.
    */
   resumeFrom: runCheckpointSchema.optional(),
   /**
@@ -3628,7 +3640,7 @@ var ServerUnreachableError = class extends DaemonError {
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.9",
+  version: "0.0.11",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -3652,14 +3664,15 @@ var package_default = {
     daemon: "tsx bin/mikka.ts daemon",
     dev: "tsx watch bin/mikka.ts daemon --dev --server memory",
     typecheck: "tsgo --noEmit -p tsconfig.json",
-    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity",
+    test: "vitest run && pnpm test:mailbox-cli && pnpm test:repository-identity && pnpm test:github-credentials",
     "test:mailbox-cli": "node --import tsx --test --test-timeout=60000 test/run-mailbox.node-test.ts",
     "codex:types": 'codex app-server generate-ts --out "${TMPDIR:-/tmp}/mikka-codex-types" && echo "Generated; compare v2/ with src/adapters/codex-protocol.ts"',
     "test:real": "MIKKA_REAL_AGENTS=${MIKKA_REAL_AGENTS:-claude_code,codex,cursor} vitest run test/real-agents.test.ts",
     "test:changed": "vitest run --changed origin/main --passWithNoTests",
     build: "node scripts/build.mjs",
     "test:package": "node --test test/package.test.mjs",
-    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts"
+    "test:repository-identity": "node --experimental-strip-types --test test/repository-identity-pure.node-test.ts",
+    "test:github-credentials": "node --test test/github-credentials.node-test.mjs"
   },
   dependencies: {
     "@agentclientprotocol/sdk": "1.9.0",
@@ -3686,7 +3699,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "c00e7bfb748f5e9bf2ee344e5c031b4a6ac0fed6"
+  gitHead: "375d670937ca06c53e47f336870481d38520c1fe"
 };
 
 // src/paths.ts