@aspectlylabs/mikka 0.0.96 → 0.0.109

package/cli.js

@@ -4437,7 +4437,7 @@ import { join as join4 } from "node:path";
 // package.json
 var package_default = {
   name: "@mikka/daemon",
-  version: "0.0.96",
+  version: "0.0.109",
   description: "Local Mikka daemon: runs agents through the user's own CLIs",
   type: "module",
   private: true,
@@ -4496,7 +4496,7 @@ var package_default = {
   engines: {
     node: ">=24"
   },
-  gitHead: "3b9c8125df35c63178333a7a0320a9f9ac5b7e5e"
+  gitHead: "2675c9f904834c207516585c65544830763423d7"
 };
 
 // src/paths.ts
@@ -6111,6 +6111,17 @@ function isInside(parent, child) {
   const rel = relative2(parent, child);
   return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
 }
+var configWriters = /* @__PURE__ */ new Map();
+function withRepoConfig(repoPath, work) {
+  const key2 = resolve4(repoPath);
+  const result = (configWriters.get(key2) ?? Promise.resolve()).then(work, work);
+  const settled = result.then(() => void 0, () => void 0);
+  configWriters.set(key2, settled);
+  void settled.then(() => {
+    if (configWriters.get(key2) === settled) configWriters.delete(key2);
+  });
+  return result;
+}
 var WorktreeManager = class {
   constructor(root, retainResources = false) {
     this.root = root;
@@ -6138,16 +6149,19 @@ var WorktreeManager = class {
     const path = this.pathFor(runId);
     if (existsSync3(join7(path, ".git"))) return path;
     mkdirSync5(this.root, { recursive: true });
-    await simpleGit(repoPath).raw([
-      "worktree",
-      "add",
-      "-B",
-      runBranch(runId),
-      path,
-      // The base branch comes from the server: never let it read as an option.
-      "--end-of-options",
-      baseBranch
-    ]);
+    await withRepoConfig(
+      repoPath,
+      () => simpleGit(repoPath).raw([
+        "worktree",
+        "add",
+        "-B",
+        runBranch(runId),
+        path,
+        // The base branch comes from the server: never let it read as an option.
+        "--end-of-options",
+        baseBranch
+      ])
+    );
     return path;
   }
   /**
@@ -6312,8 +6326,10 @@ var WorktreeManager = class {
       branches.push(branch);
     }
     if (path) await this.removePath(path, repoPath);
-    for (const branch of branches)
-      await git2.raw(["branch", "-D", "--", branch]).catch(() => void 0);
+    await withRepoConfig(repoPath, async () => {
+      for (const branch of branches)
+        await git2.raw(["branch", "-D", "--", branch]).catch(() => void 0);
+    });
     return true;
   }
   /**
@@ -7603,14 +7619,14 @@ sandbox_mode = "read-only"
 import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "node:crypto";
 import {
   chmodSync as chmodSync5,
-  existsSync as existsSync8,
+  existsSync as existsSync9,
   mkdirSync as mkdirSync17,
   readFileSync as readFileSync12,
-  rmSync as rmSync18,
+  rmSync as rmSync19,
   realpathSync as realpathSync13
 } from "node:fs";
 import { arch, hostname, platform as platform2 } from "node:os";
-import { join as join32 } from "node:path";
+import { join as join33 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/adapters/claude.ts
@@ -9818,31 +9834,49 @@ var MockAdapter = class {
 };
 
 // src/agents/verify.ts
-import { mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync5, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync12, mkdtempSync as mkdtempSync5, realpathSync as realpathSync10, rmSync as rmSync11 } from "node:fs";
 import { join as join19 } from "node:path";
 var OUTPUT_TAIL = 4e3;
+var SETUP_ATTEMPTS = 3;
 async function runVerify(sandbox, options) {
   mkdirSync12(options.tmpRoot, { recursive: true, mode: 448 });
   const tmpDir = mkdtempSync5(join19(realpathSync10(options.tmpRoot), "verify-"));
-  const child = await spawnCli(sandbox, ["/bin/sh", "-c", options.command], {
-    cwd: options.worktree,
-    env: { ...options.env, TMPDIR: tmpDir },
-    policy: {
-      allowWrite: options.readOnly ? [tmpDir] : [options.worktree, tmpDir],
-      denyWrite: [
-        join19(options.worktree, ".git"),
-        ...options.readOnly ? [options.worktree] : []
-      ],
-      denyRead: [
-        ...credentialDenyRead(null),
-        ...daemonSecrets(options.privateDir)
-      ],
-      allowDomains: [...options.networkAllow ?? []]
-    },
-    pidFile: options.pidFile,
-    // Every verify of this run carries the temp root in its profile.
-    marker: realpathSync10(options.tmpRoot)
-  });
+  const deadline = Date.now() + options.timeoutMs;
+  try {
+    for (let attempt = 1; ; attempt++) {
+      const started = join19(tmpDir, `.started-${attempt}`);
+      const result = await attemptVerify(sandbox, options, tmpDir, started, deadline - Date.now());
+      if (result.exitCode === 0 || result.timedOut || options.signal?.aborted || existsSync5(started) || attempt >= SETUP_ATTEMPTS)
+        return result;
+    }
+  } finally {
+    rmSync11(tmpDir, { recursive: true, force: true });
+  }
+}
+async function attemptVerify(sandbox, options, tmpDir, started, timeoutMs) {
+  const child = await spawnCli(
+    sandbox,
+    ["/bin/sh", "-c", ': > "$0" && exec /bin/sh -c "$1"', started, options.command],
+    {
+      cwd: options.worktree,
+      env: { ...options.env, TMPDIR: tmpDir },
+      policy: {
+        allowWrite: options.readOnly ? [tmpDir] : [options.worktree, tmpDir],
+        denyWrite: [
+          join19(options.worktree, ".git"),
+          ...options.readOnly ? [options.worktree] : []
+        ],
+        denyRead: [
+          ...credentialDenyRead(null),
+          ...daemonSecrets(options.privateDir)
+        ],
+        allowDomains: [...options.networkAllow ?? []]
+      },
+      pidFile: options.pidFile,
+      // Every verify of this run carries the temp root in its profile.
+      marker: realpathSync10(options.tmpRoot)
+    }
+  );
   child.process.stdin.end();
   let output = "";
   for (const stream of [child.process.stdout, child.process.stderr]) {
@@ -9855,7 +9889,7 @@ async function runVerify(sandbox, options) {
   const timer = setTimeout(() => {
     timedOut = true;
     void child.kill();
-  }, options.timeoutMs);
+  }, Math.max(0, timeoutMs));
   const abort = () => void child.kill();
   options.signal?.addEventListener("abort", abort, { once: true });
   try {
@@ -9871,7 +9905,6 @@ async function runVerify(sandbox, options) {
       ].join("\n")
     };
   } finally {
-    rmSync11(tmpDir, { recursive: true, force: true });
     clearTimeout(timer);
     options.signal?.removeEventListener("abort", abort);
   }
@@ -10415,7 +10448,7 @@ async function detectHarnesses() {
 }
 
 // src/sandbox-tools.ts
-import { chmodSync as chmodSync2, existsSync as existsSync5, lstatSync as lstatSync8, mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync6, readdirSync as readdirSync5, renameSync as renameSync2, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { chmodSync as chmodSync2, existsSync as existsSync6, lstatSync as lstatSync8, mkdirSync as mkdirSync13, mkdtempSync as mkdtempSync6, readdirSync as readdirSync5, renameSync as renameSync2, rmSync as rmSync12, writeFileSync as writeFileSync7 } from "node:fs";
 import { join as join23 } from "node:path";
 import { execa as execa10 } from "execa";
 var TOOLS = [
@@ -10499,11 +10532,11 @@ LD_LIBRARY_PATH=${shellQuote2(libDir)} exec ${shellQuote2(join23(realDir, tool2.
   renameSync2(launcher, join23(binDir, tool2.command));
 }
 function moveSharedLibraries(directory, libDir) {
-  if (!existsSync5(directory)) return;
+  if (!existsSync6(directory)) return;
   for (const entry of readdirSync5(directory)) {
     const path = join23(directory, entry);
     if (lstatSync8(path).isDirectory()) moveSharedLibraries(path, libDir);
-    else if (entry.includes(".so") && !existsSync5(join23(libDir, entry))) renameSync2(path, join23(libDir, entry));
+    else if (entry.includes(".so") && !existsSync6(join23(libDir, entry))) renameSync2(path, join23(libDir, entry));
   }
 }
 function shellQuote2(value) {
@@ -11811,6 +11844,47 @@ async function fixedCheckSnapshot(repoPath, worktree, sha) {
   return { sha, tree: await git2("rev-parse", `${sha}^{tree}`) };
 }
 
+// src/run-scratch.ts
+import { rmSync as rmSync15 } from "node:fs";
+import { join as join27 } from "node:path";
+
+// src/credential-globs.ts
+var CLOUD_WORKER_STATE_DIR = "/home/mikka-runner/.mikka/worker/adapters";
+var RUN_CREDENTIAL_PATHS = [
+  // GitHub token config and gh wrapper (agents/github-runtime.ts).
+  "github",
+  // Coding-CLI homes inside a run: only placeholders today, but a real login must never be kept.
+  "runtime-home/.claude/.credentials.json",
+  "runtime-home/.codex/auth.json",
+  // Per-run harness homes on a device runner (agents/harness-home.ts).
+  "codex-home/auth.json",
+  "native-home/.claude/.credentials.json",
+  "native-home/.codex/auth.json"
+];
+function runCredentialGlobs(stateDir) {
+  return [
+    ...RUN_CREDENTIAL_PATHS.map((path) => `${stateDir}/runs/*/${path}`),
+    // Live native subscription brokers (subscription-native-broker.ts).
+    `${stateDir}/native-brokers/*`
+  ];
+}
+var SNAPSHOT_CREDENTIAL_GLOBS = [
+  "/root/.claude/.credentials.json",
+  "/root/.codex/auth.json",
+  "/home/*/.claude/.credentials.json",
+  "/home/*/.codex/auth.json",
+  "/home/*/.config/gh/hosts.yml",
+  "/home/*/.git-credentials",
+  "/root/.git-credentials",
+  ...runCredentialGlobs(CLOUD_WORKER_STATE_DIR)
+];
+
+// src/run-scratch.ts
+function removeRunCredentials(stateDir, runId) {
+  const { runDir } = runPaths(stateDir, runId);
+  for (const path of RUN_CREDENTIAL_PATHS) rmSync15(join27(runDir, path), { recursive: true, force: true });
+}
+
 // src/secret-mask.ts
 import { gunzipSync, gzipSync } from "node:zlib";
 var MASK_MIN_LENGTH = 8;
@@ -11942,13 +12016,13 @@ function createRunMasker(secrets) {
 
 // src/runs/supervisor.ts
 import { createHash as createHash4, randomUUID as randomUUID6 } from "node:crypto";
-import { join as join28, resolve as resolve10 } from "node:path";
+import { join as join29, resolve as resolve10 } from "node:path";
 import { execa as execa13 } from "execa";
 
 // src/agents/checkpoint.ts
-import { mkdtempSync as mkdtempSync7, rmSync as rmSync15, writeFileSync as writeFileSync8 } from "node:fs";
+import { mkdtempSync as mkdtempSync7, rmSync as rmSync16, writeFileSync as writeFileSync8 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 import { gunzipSync as gunzipSync2, gzipSync as gzipSync2 } from "node:zlib";
 import { execa as execa12 } from "execa";
 var CheckpointRecoveryError = class extends Error {
@@ -11995,8 +12069,8 @@ async function takeCheckpoint(options) {
 }
 async function applyCheckpoint(options) {
   const git2 = await pinnedGit(options.repoPath, options.worktree);
-  const dir = mkdtempSync7(join27(tmpdir2(), "mikka-checkpoint-"));
-  const file = join27(dir, "checkpoint.patch");
+  const dir = mkdtempSync7(join28(tmpdir2(), "mikka-checkpoint-"));
+  const file = join28(dir, "checkpoint.patch");
   try {
     const patch = gunzipSync2(Buffer.from(options.checkpoint.patch, "base64"));
     if (!patch.length && options.checkpoint.files === 0) return true;
@@ -12013,7 +12087,7 @@ async function applyCheckpoint(options) {
     }
     return false;
   } finally {
-    rmSync15(dir, { recursive: true, force: true });
+    rmSync16(dir, { recursive: true, force: true });
   }
 }
 async function hasCommit(repoPath, commit) {
@@ -12821,6 +12895,13 @@ var RunSupervisor = class {
     const run2 = this.active.get(runId);
     if (run2) void this.closeMailbox(run2).catch(() => this.deps.log.warn("Run mailbox shutdown failed"));
     this.leases.delete(runId);
+    if (this.deps.adapterStateDir) {
+      try {
+        removeRunCredentials(this.deps.adapterStateDir, runId);
+      } catch (err) {
+        this.deps.log.warn({ run_id: runId, err }, "run credential cleanup failed");
+      }
+    }
     this.deps.outbox.compact(runId).catch((err) => {
       this.deps.log.error({ run_id: runId, err }, "outbox compaction failed");
     });
@@ -13234,7 +13315,7 @@ var RunSupervisor = class {
         if (!this.deps.adapterStateDir || assignment.harness === "mock" || !session.sessionId || resuming && session.sessionId !== entry.sessionId || assignment.requireSessionResume && session.sessionId !== assignment.resumeSessionId)
           throw new Error("Skill mount requires the actual original harness session");
         verifySkillAssignment(assignment);
-        const file = join28(
+        const file = join29(
           runPaths(this.deps.adapterStateDir, runId).runDir,
           SKILLS_DIR,
           skillSlug(assignment.skills[0].name),
@@ -13498,8 +13579,8 @@ function fixedCandidateCheck(assignment) {
 
 // src/repositories.ts
 import { createHash as createHash5, randomUUID as randomUUID7 } from "node:crypto";
-import { existsSync as existsSync6, lstatSync as lstatSync9, mkdirSync as mkdirSync15, readdirSync as readdirSync7, realpathSync as realpathSync11, renameSync as renameSync3, rmSync as rmSync16 } from "node:fs";
-import { dirname as dirname11, join as join29, resolve as resolve11 } from "node:path";
+import { existsSync as existsSync7, lstatSync as lstatSync9, mkdirSync as mkdirSync15, readdirSync as readdirSync7, realpathSync as realpathSync11, renameSync as renameSync3, rmSync as rmSync17 } from "node:fs";
+import { dirname as dirname11, join as join30, resolve as resolve11 } from "node:path";
 import { setTimeout as delay2 } from "node:timers/promises";
 import { execa as execa14 } from "execa";
 import lockfile2 from "proper-lockfile";
@@ -13526,33 +13607,36 @@ var RepositoryCache = class {
     this.ensureParents(dirname11(path));
     const release = await this.lock(path, signal);
     try {
-      signal?.throwIfAborted();
-      const git2 = (args, cwd) => execa14("git", [
-        ...FETCH_GIT,
-        "-c",
-        `protocol.file.allow=${this.allowFile ? "always" : "never"}`,
-        ...args
-      ], { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }, stdin: "ignore", timeout: FETCH_TIMEOUT_MS, cancelSignal: signal, killDescendants: true });
-      if (!existsSync6(path)) {
-        const temporary = `${path}.clone-${randomUUID7()}`;
-        try {
-          await git2(["clone", "--no-checkout", "--no-hardlinks", "--no-recurse-submodules", "--", remote, temporary]);
-          renameSync3(temporary, path);
-        } finally {
-          if (!this.retainResources) rmSync16(temporary, { recursive: true, force: true });
-        }
-      } else {
-        this.assertClone(path);
-        await git2(["remote", "set-url", "origin", remote], path);
-        await git2(["fetch", ...this.retainResources ? [] : ["--prune"], "--no-tags", "--no-recurse-submodules", "--no-write-fetch-head", "origin"], path);
-      }
-      this.assertClone(path);
-      await git2(["remote", "set-head", "origin", "-a"], path);
-      return path;
+      return await withRepoConfig(path, () => this.update(path, remote, signal));
     } finally {
       await release();
     }
   }
+  async update(path, remote, signal) {
+    signal?.throwIfAborted();
+    const git2 = (args, cwd) => execa14("git", [
+      ...FETCH_GIT,
+      "-c",
+      `protocol.file.allow=${this.allowFile ? "always" : "never"}`,
+      ...args
+    ], { cwd, env: { ...process.env, GIT_TERMINAL_PROMPT: "0" }, stdin: "ignore", timeout: FETCH_TIMEOUT_MS, cancelSignal: signal, killDescendants: true });
+    if (!existsSync7(path)) {
+      const temporary = `${path}.clone-${randomUUID7()}`;
+      try {
+        await git2(["clone", "--no-checkout", "--no-hardlinks", "--no-recurse-submodules", "--", remote, temporary]);
+        renameSync3(temporary, path);
+      } finally {
+        if (!this.retainResources) rmSync17(temporary, { recursive: true, force: true });
+      }
+    } else {
+      this.assertClone(path);
+      await git2(["remote", "set-url", "origin", remote], path);
+      await git2(["fetch", ...this.retainResources ? [] : ["--prune"], "--no-tags", "--no-recurse-submodules", "--no-write-fetch-head", "origin"], path);
+    }
+    this.assertClone(path);
+    await git2(["remote", "set-head", "origin", "-a"], path);
+    return path;
+  }
   async baseRef(remoteUrl, baseBranch) {
     const path = this.pathFor(remoteUrl);
     if (baseBranch && baseBranch !== "HEAD") {
@@ -13566,12 +13650,12 @@ var RepositoryCache = class {
   /** Cache paths for retention/orphan cleanup; never consult user checkouts. */
   paths() {
     const visit = (path) => {
-      if (!existsSync6(path) || lstatSync9(path).isSymbolicLink()) return [];
-      if (existsSync6(join29(path, ".git"))) {
+      if (!existsSync7(path) || lstatSync9(path).isSymbolicLink()) return [];
+      if (existsSync7(join30(path, ".git"))) {
         this.assertClone(path);
         return [path];
       }
-      return readdirSync7(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join29(path, entry.name)) : []);
+      return readdirSync7(path, { withFileTypes: true }).flatMap((entry) => entry.isDirectory() && !entry.name.endsWith(".lock") && !entry.name.includes(".clone-") ? visit(join30(path, entry.name)) : []);
     };
     return visit(resolve11(this.root));
   }
@@ -13581,14 +13665,14 @@ var RepositoryCache = class {
     const root = realpathSync11(this.root);
     let current = resolve11(this.root);
     for (const part of path.slice(current.length + 1).split("/").filter(Boolean)) {
-      current = join29(current, part);
-      if (existsSync6(current) && lstatSync9(current).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
+      current = join30(current, part);
+      if (existsSync7(current) && lstatSync9(current).isSymbolicLink()) throw new Error("Repository cache contains a symlink");
       mkdirSync15(current, { recursive: true, mode: 448 });
       if (!isInside(root, realpathSync11(current))) throw new Error("Repository cache escapes its directory");
     }
   }
   assertClone(path) {
-    if (lstatSync9(path).isSymbolicLink() || !lstatSync9(join29(path, ".git")).isDirectory() || lstatSync9(join29(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
+    if (lstatSync9(path).isSymbolicLink() || !lstatSync9(join30(path, ".git")).isDirectory() || lstatSync9(join30(path, ".git")).isSymbolicLink()) throw new Error("Repository cache is not a standard clone");
     if (!isInside(realpathSync11(this.root), realpathSync11(path))) throw new Error("Repository cache escapes its directory");
   }
   async lock(path, signal) {
@@ -13609,16 +13693,16 @@ var RepositoryCache = class {
 import { execFile as execFile5, spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID8 } from "node:crypto";
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   lstatSync as lstatSync10,
   mkdirSync as mkdirSync16,
   mkdtempSync as mkdtempSync8,
   readdirSync as readdirSync8,
   realpathSync as realpathSync12,
-  rmSync as rmSync17
+  rmSync as rmSync18
 } from "node:fs";
 import { createRequire } from "node:module";
-import { delimiter as delimiter4, dirname as dirname12, join as join31 } from "node:path";
+import { delimiter as delimiter4, dirname as dirname12, join as join32 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import { promisify as promisify5 } from "node:util";
 
@@ -13628,7 +13712,7 @@ import { chmod, mkdtemp, rm as rm2 } from "node:fs/promises";
 import { createServer as createServer3, request as httpRequest } from "node:http";
 import { connect, isIP as isIP3 } from "node:net";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 
 // ../../lib/search/url-policy.ts
 import { BlockList, isIP as isIP2 } from "node:net";
@@ -13697,9 +13781,9 @@ function endToEndHeaders(input) {
 }
 async function startPublicEgress(options) {
   options.signal.throwIfAborted();
-  const directory = await mkdtemp(join30(tmpdir3(), "mikka-egress-"));
+  const directory = await mkdtemp(join31(tmpdir3(), "mikka-egress-"));
   await chmod(directory, 448);
-  const socketPath = join30(directory, "egress.sock");
+  const socketPath = join31(directory, "egress.sock");
   const lifetime = new AbortController();
   const signal = AbortSignal.any([options.signal, lifetime.signal]);
   const sockets = /* @__PURE__ */ new Set();
@@ -13856,7 +13940,7 @@ async function createHostedBotRunner(host) {
   }).catch(() => {
     throw unavailable2();
   });
-  const resources = join31(host.stateDir, "native-resources");
+  const resources = join32(host.stateDir, "native-resources");
   mkdirSync16(resources, { recursive: true, mode: 448 });
   const removeResource = async (file, record) => {
     if (!/^mikka-native-(?:verify-)?[a-f0-9-]{36}$/.test(record.name) || !/^[a-f0-9-]{36}$/.test(record.nonce))
@@ -13877,9 +13961,9 @@ async function createHostedBotRunner(host) {
       if (record.state === "created" && /No such (?:container|object)/i.test(
         String(error.stderr)
       )) {
-        if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
-          rmSync17(record.assets, { recursive: true, force: true });
-        rmSync17(file, { force: true });
+        if (record.assets?.startsWith(join32(host.stateDir, "native-verify-git-")))
+          rmSync18(record.assets, { recursive: true, force: true });
+        rmSync18(file, { force: true });
         return;
       }
       throw new Error("native_runtime_cleanup_unconfirmed");
@@ -13888,13 +13972,13 @@ async function createHostedBotRunner(host) {
     if (labels?.["com.mikka.native.resource"] !== record.nonce || record.id && record.id !== id4)
       throw unavailable2();
     await exec3("docker", ["rm", "-f", id4], { env: bareEnv, timeout: 3e4 });
-    if (record.assets?.startsWith(join31(host.stateDir, "native-verify-git-")))
-      rmSync17(record.assets, { recursive: true, force: true });
-    rmSync17(file, { force: true });
+    if (record.assets?.startsWith(join32(host.stateDir, "native-verify-git-")))
+      rmSync18(record.assets, { recursive: true, force: true });
+    rmSync18(file, { force: true });
   };
   for (const name of readdirSync8(resources))
     if (name.endsWith(".json")) {
-      const file = join31(resources, name);
+      const file = join32(resources, name);
       const record = readJson(file);
       if (!record) throw unavailable2();
       await removeResource(file, record);
@@ -13905,7 +13989,7 @@ async function createHostedBotRunner(host) {
     const bundled = createRequire(
       require2.resolve("@anthropic-ai/claude-agent-sdk")
     );
-    claude ??= join31(
+    claude ??= join32(
       dirname12(
         bundled.resolve(
           "@anthropic-ai/claude-agent-sdk-linux-x64/package.json"
@@ -13915,7 +13999,7 @@ async function createHostedBotRunner(host) {
     );
   } catch {
   }
-  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter4).map((dir) => join31(dir, "codex")).find((path) => existsSync7(path));
+  const codex = host.binaries?.codex ?? (process.env.PATH ?? "").split(delimiter4).map((dir) => join32(dir, "codex")).find((path) => existsSync8(path));
   const binaries = { codex, claude_code: claude };
   for (const kind of ["codex", "claude_code"])
     if (binaries[kind]) {
@@ -13929,12 +14013,12 @@ async function createHostedBotRunner(host) {
   if (!binaries.codex && !binaries.claude_code) throw unavailable2();
   const command = async (worktree, script, readOnly, timeoutMs, signal) => {
     const name = `mikka-native-verify-${randomUUID8()}`;
-    const file = join31(resources, name + ".json");
+    const file = join32(resources, name + ".json");
     const resource = { name, nonce: randomUUID8(), state: "creating" };
     const timing = { createMs: 0, runMs: 0 };
     let phase = "create";
     let began = performance.now();
-    const gitCopy = mkdtempSync8(join31(host.stateDir, "native-verify-git-"));
+    const gitCopy = mkdtempSync8(join32(host.stateDir, "native-verify-git-"));
     resource.assets = gitCopy;
     try {
       const cwd = realpathSync12(worktree);
@@ -13950,7 +14034,7 @@ async function createHostedBotRunner(host) {
           "--no-checkout",
           "--",
           cwd,
-          join31(gitCopy, "repo")
+          join32(gitCopy, "repo")
         ],
         {
           env: {
@@ -13965,8 +14049,8 @@ async function createHostedBotRunner(host) {
           maxBuffer: 1024 * 1024
         }
       );
-      const safeGit = join31(gitCopy, "repo", ".git");
-      const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : safeGit;
+      const safeGit = join32(gitCopy, "repo", ".git");
+      const protectedGit = lstatSync10(join32(cwd, ".git")).isFile() ? join32(cwd, ".git") : safeGit;
       writeJsonAtomic(file, resource);
       const created = await exec3(
         "docker",
@@ -14053,8 +14137,8 @@ async function createHostedBotRunner(host) {
         timing
       };
     } finally {
-      if (existsSync7(file)) await removeResource(file, resource);
-      else rmSync17(gitCopy, { recursive: true, force: true });
+      if (existsSync8(file)) await removeResource(file, resource);
+      else rmSync18(gitCopy, { recursive: true, force: true });
     }
   };
   return {
@@ -14070,7 +14154,7 @@ async function createHostedBotRunner(host) {
         throw unavailable2();
       const name = `mikka-native-${randomUUID8()}`;
       const nonce = randomUUID8();
-      const resourceFile = join31(resources, name + ".json");
+      const resourceFile = join32(resources, name + ".json");
       const resource = { name, nonce, state: "creating" };
       const lifetime = new AbortController();
       let closed = false;
@@ -14109,12 +14193,13 @@ async function createHostedBotRunner(host) {
           void brokerClosed.catch(() => void 0);
           try {
             await creating?.catch(() => void 0);
-            if (existsSync7(resourceFile)) await removeResource(resourceFile, resource);
+            if (existsSync8(resourceFile)) await removeResource(resourceFile, resource);
           } finally {
             try {
               await brokerClosed;
             } finally {
               offRevoke();
+              removeRunCredentials(host.stateDir, assignment.runId);
             }
           }
         });
@@ -14143,10 +14228,10 @@ async function createHostedBotRunner(host) {
         };
         const paths = runPaths(host.stateDir, assignment.runId);
         mkdirSync16(paths.runDir, { recursive: true, mode: 448 });
-        const shadow = join31(paths.runDir, "runtime-git");
-        const emptyHome = join31(paths.runDir, "git-bootstrap-home");
+        const shadow = join32(paths.runDir, "runtime-git");
+        const emptyHome = join32(paths.runDir, "git-bootstrap-home");
         mkdirSync16(emptyHome, { recursive: true, mode: 448 });
-        if (!existsSync7(shadow))
+        if (!existsSync8(shadow))
           await exec3(
             "git",
             [
@@ -14175,9 +14260,9 @@ async function createHostedBotRunner(host) {
             }
           );
         await live();
-        if (!lstatSync10(shadow).isDirectory() || !lstatSync10(join31(shadow, ".git")).isDirectory() || !realpathSync12(shadow).startsWith(realpathSync12(paths.runDir) + "/"))
+        if (!lstatSync10(shadow).isDirectory() || !lstatSync10(join32(shadow, ".git")).isDirectory() || !realpathSync12(shadow).startsWith(realpathSync12(paths.runDir) + "/"))
           throw unavailable2();
-        const ledger = join31(
+        const ledger = join32(
           host.stateDir,
           "native-ledgers",
           assignment.runId + ".json"
@@ -14194,7 +14279,7 @@ async function createHostedBotRunner(host) {
           modelId: first.modelId
         };
         const previous = readJson(ledger);
-        if (existsSync7(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
+        if (existsSync8(ledger) && (!previous || JSON.stringify(previous.scope) !== JSON.stringify(scope) || typeof previous.sessionId !== "string"))
           throw unavailable2();
         mkdirSync16(dirname12(ledger), { recursive: true, mode: 448 });
         const record = async (sessionId) => {
@@ -14202,7 +14287,7 @@ async function createHostedBotRunner(host) {
           writeJsonAtomic(ledger, { scope, sessionId });
         };
         brokerStarting = createNativeSubscriptionBroker({
-          root: join31(host.stateDir, "native-brokers"),
+          root: join32(host.stateDir, "native-brokers"),
           revision,
           check,
           worker: {
@@ -14229,7 +14314,7 @@ async function createHostedBotRunner(host) {
         });
         const readyBroker = await brokerStarting;
         await live();
-        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter4).map((dir) => join31(dir, "gh")).find((file) => existsSync7(file)) : void 0;
+        const githubCli = options.github ? (process.env.PATH ?? "").split(delimiter4).map((dir) => join32(dir, "gh")).find((file) => existsSync8(file)) : void 0;
         if (options.github && !githubCli) throw new Error("Install GitHub CLI (gh) in the cloud worker image");
         const githubDomains = options.github ? ["github.com", "api.github.com", new URL(options.github.endpoint).host] : [];
         const egressMaximum = runDomains(runPolicy(options.policy), [...options.networkAllow ?? [], ...githubDomains]);
@@ -14246,7 +14331,7 @@ async function createHostedBotRunner(host) {
         }
         const cwd = realpathSync12(options.cwd);
         const runDir = realpathSync12(paths.runDir);
-        const protectedGit = lstatSync10(join31(cwd, ".git")).isFile() ? join31(cwd, ".git") : join31(shadow, ".git");
+        const protectedGit = lstatSync10(join32(cwd, ".git")).isFile() ? join32(cwd, ".git") : join32(shadow, ".git");
         if (!lstatSync10(runDir).isDirectory() || !runDir.startsWith(realpathSync12(host.stateDir) + "/runs/")) {
           await close();
           throw unavailable2();
@@ -14300,7 +14385,7 @@ async function createHostedBotRunner(host) {
           `${MCP_SERVER_SCRIPT}:${MCP_SERVER_SCRIPT}:ro`,
           ...githubCli ? ["-v", `${githubCli}:/usr/local/bin/mikka-gh:ro`, "-v", `${GITHUB_CREDENTIAL_SCRIPT}:${GITHUB_CREDENTIAL_SCRIPT}:ro`] : [],
           "-v",
-          `${join31(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join31(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
+          `${join32(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:${join32(dirname12(MCP_SERVER_SCRIPT), "capture-copy.mjs")}:ro`,
           "-v",
           `${readyBroker.socket}:/run/mikka-native.sock:ro`,
           ...computerGrant ? [
@@ -14343,13 +14428,13 @@ async function createHostedBotRunner(host) {
         }
         const spawnHosted = (config) => {
           assertOpen();
-          const home = join31(runDir, "runtime-home");
+          const home = join32(runDir, "runtime-home");
           mkdirSync16(home, { recursive: true, mode: 448 });
           const env = {
             ...config.env,
             HOME: kind === "claude_code" ? config.env.HOME ?? home : home,
-            PATH: `${options.github ? join31(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
-            GIT_DIR: join31(shadow, ".git"),
+            PATH: `${options.github ? join32(runDir, "github", "bin") + ":" : ""}/usr/local/bin:/usr/bin:/bin`,
+            GIT_DIR: join32(shadow, ".git"),
             GIT_WORK_TREE: cwd,
             GIT_CONFIG_GLOBAL: "/dev/null",
             GIT_CONFIG_SYSTEM: "/dev/null",
@@ -14368,7 +14453,7 @@ async function createHostedBotRunner(host) {
             signal: AbortSignal.any([lifetime.signal, ...config.signal ? [config.signal] : []])
           });
           child.stdin.write(
-            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join31(runDir, "github", "bin") } : {} }) + "\n"
+            JSON.stringify({ kind, args: config.args, cwd, env: task.env, publicEgress: Boolean(egress), ...options.github ? { githubBin: join32(runDir, "github", "bin") } : {} }) + "\n"
           );
           return child;
         };
@@ -15067,7 +15152,7 @@ var Daemon = class {
     if (this.options.credential)
       this.saveDevice({ credential: this.options.credential });
     this.journal = new RunJournal(paths.journal);
-    this.captureUploader = new CaptureUploader((runId) => join32(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join32(paths.dataDir, "capture-pending"));
+    this.captureUploader = new CaptureUploader((runId) => join33(runPaths(paths.adapterState, runId).runDir, CAPTURES_DIR), this.options.link, this.log, join33(paths.dataDir, "capture-pending"));
     this.outbox = new Outbox(
       paths.outbox,
       this.options.link,
@@ -15084,7 +15169,7 @@ var Daemon = class {
     if (this.localComputerDriver && this.options.link.syncComputerReviews && this.options.link.localComputerAuthority) {
       this.localComputerBroker = new ComputerBroker({
         driver: this.localComputerDriver,
-        socketPath: join32(paths.dataDir, "local-computer.sock"),
+        socketPath: join33(paths.dataDir, "local-computer.sock"),
         transport: "tcp",
         permitted: (runId) => {
           const assignment = this.journal.get(runId)?.assignment;
@@ -15126,7 +15211,7 @@ var Daemon = class {
       };
       this.cloudComputerBroker = new ComputerBroker({
         driver,
-        socketPath: join32(paths.dataDir, "computer.sock"),
+        socketPath: join33(paths.dataDir, "computer.sock"),
         permitted: (runId) => {
           const entry = this.journal.get(runId);
           return Boolean(!this.stopped && this.registered && entry?.assignment.computer && this.supervisor?.computerRunAllowed(runId));
@@ -15249,7 +15334,7 @@ var Daemon = class {
           worktree,
           tree,
           github: { ...assignment.github, runToken: assignment.mcp.token, issueId: assignment.issueId },
-          privateDir: join32(paths.adapterState, "pids"),
+          privateDir: join33(paths.adapterState, "pids"),
           ...hosted ? { hosted: true } : {},
           env: githubReceiptEnvironment()
         }) : publishRun({
@@ -15543,7 +15628,7 @@ var Daemon = class {
   }
   async createAgentSandbox() {
     if (this.options.agentSandbox !== void 0) return this.options.agentSandbox;
-    const missing = await ensureSandboxTools({ dataDir: this.paths.dataDir, log: this.log });
+    const missing = daemonTestMode(process.env) ? missingSandboxTools() : await ensureSandboxTools({ dataDir: this.paths.dataDir, log: this.log });
     if (!SandboxRuntime.supported()) {
       this.log.warn({ missing }, "agent sandbox unavailable: platform or dependencies unsupported");
       this.sandboxIssue = { missing };
@@ -15587,11 +15672,11 @@ var Daemon = class {
       return runVerify(sandbox, {
         command,
         worktree: realpathSync13(worktree),
-        tmpRoot: join32(this.paths.adapterState, "verify", runId),
+        tmpRoot: join33(this.paths.adapterState, "verify", runId),
         privateDir: paths.privateDir,
         pidFile: paths.pidFile.replace(/\.pgid$/, ".verify.pgid"),
         networkAllow: repo.networkAllow,
-        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join32(paths.runDir, "handoff.json") },
+        env: { ...buildChildEnv(), MIKKA_HANDOFF_FILE: join33(paths.runDir, "handoff.json") },
         timeoutMs,
         signal,
         readOnly
@@ -15636,7 +15721,7 @@ var Daemon = class {
     void this.stop().finally(() => this.options.onLockLost?.(error));
   }
   ensureSecret() {
-    if (existsSync8(this.paths.secret)) {
+    if (existsSync9(this.paths.secret)) {
       return readFileSync12(this.paths.secret, "utf8").trim();
     }
     const secret = randomBytes3(32).toString("hex");
@@ -15748,7 +15833,7 @@ var Daemon = class {
           setImmediate(() => {
             void this.stop().then(() => uninstallService(() => {
               this.saveDevice({ credential: void 0 });
-              rmSync18(this.paths.secret, { force: true });
+              rmSync19(this.paths.secret, { force: true });
             })).catch(() => {
               this.options.onDrained?.();
             });
@@ -16073,7 +16158,7 @@ var Daemon = class {
       if (!job || controller.signal.aborted) return;
       await runNativeCoordinatorJob(job, {
         deviceId,
-        stateDir: join32(this.paths.dataDir, "coordinator"),
+        stateDir: join33(this.paths.dataDir, "coordinator"),
         link,
         signal: controller.signal,
         sandbox,
@@ -16116,7 +16201,7 @@ var Daemon = class {
         }, void 0, () => !this.stopped);
       });
     } else if (!this.updateCheck && !this.updateVersion) {
-      this.updateCheck = checkLatestVersion(join32(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
+      this.updateCheck = checkLatestVersion(join33(this.paths.dataDir, "auto-update.json"), DAEMON_VERSION, runtime).then((version) => {
         this.updateVersion = version;
       }).catch(() => {
         this.log.warn("Daemon automatic update check failed");