svamp-cli 0.1.63 → 0.1.65

package/dist/agentCommands-C6iGblcL.mjs

@@ -0,0 +1,156 @@
+import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import os from 'node:os';
+
+const SVAMP_HOME = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+function getConfigPath(sessionId) {
+  const cwd = process.cwd();
+  return join(cwd, ".svamp", sessionId, "config.json");
+}
+function readConfig(configPath) {
+  try {
+    if (existsSync(configPath)) return JSON.parse(readFileSync(configPath, "utf-8"));
+  } catch {
+  }
+  return {};
+}
+function writeConfig(configPath, config) {
+  mkdirSync(dirname(configPath), { recursive: true });
+  const tmp = configPath + ".tmp";
+  writeFileSync(tmp, JSON.stringify(config, null, 2));
+  renameSync(tmp, configPath);
+}
+async function connectAndEmit(event) {
+  const ENV_FILE = join(SVAMP_HOME, ".env");
+  if (existsSync(ENV_FILE)) {
+    const lines = readFileSync(ENV_FILE, "utf-8").split("\n");
+    for (const line of lines) {
+      const m = line.match(/^([A-Z_]+)=(.*)/);
+      if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^["']|["']$/g, "");
+    }
+  }
+  const serverUrl = process.env.HYPHA_SERVER_URL;
+  const token = process.env.HYPHA_TOKEN;
+  if (!serverUrl || !token) {
+    console.error('No Hypha credentials. Run "svamp login" first.');
+    process.exit(1);
+  }
+  const origLog = console.log;
+  const origWarn = console.warn;
+  const origInfo = console.info;
+  console.log = () => {
+  };
+  console.warn = () => {
+  };
+  console.info = () => {
+  };
+  let server;
+  try {
+    const mod = await import('hypha-rpc');
+    const connectToServer = mod.connectToServer || mod.default?.connectToServer;
+    server = await connectToServer({ server_url: serverUrl, token, name: "svamp-agent-emit" });
+  } catch (err) {
+    console.log = origLog;
+    console.warn = origWarn;
+    console.info = origInfo;
+    console.error(`Failed to connect to Hypha: ${err.message}`);
+    process.exit(1);
+  }
+  console.log = origLog;
+  console.warn = origWarn;
+  console.info = origInfo;
+  await server.emit({ ...event, to: "*" });
+  await server.disconnect();
+}
+async function sessionSetTitle(title) {
+  const sessionId = process.env.SVAMP_SESSION_ID;
+  if (!sessionId) {
+    console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
+    process.exit(1);
+  }
+  const configPath = getConfigPath(sessionId);
+  const config = readConfig(configPath);
+  config.title = title.trim();
+  writeConfig(configPath, config);
+  console.log(`Session title set: "${title.trim()}"`);
+}
+async function sessionSetLink(url, label) {
+  const sessionId = process.env.SVAMP_SESSION_ID;
+  if (!sessionId) {
+    console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
+    process.exit(1);
+  }
+  const resolvedLabel = label?.trim() || (() => {
+    try {
+      return new URL(url).hostname;
+    } catch {
+      return "View";
+    }
+  })();
+  const configPath = getConfigPath(sessionId);
+  const config = readConfig(configPath);
+  config.session_link = { url: url.trim(), label: resolvedLabel };
+  writeConfig(configPath, config);
+  console.log(`Session link set: "${resolvedLabel}" \u2192 ${url.trim()}`);
+}
+async function sessionNotify(message, level = "info") {
+  const sessionId = process.env.SVAMP_SESSION_ID;
+  if (!sessionId) {
+    console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
+    process.exit(1);
+  }
+  await connectAndEmit({
+    type: "svamp:session-notify",
+    data: { sessionId, message, level, timestamp: Date.now() }
+  });
+  console.log(`Notification sent [${level}]: ${message}`);
+}
+async function sessionBroadcast(action, args) {
+  const sessionId = process.env.SVAMP_SESSION_ID;
+  if (!sessionId) {
+    console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
+    process.exit(1);
+  }
+  let payload = { action };
+  if (action === "open-canvas") {
+    const url = args[0];
+    if (!url) {
+      console.error("Usage: svamp session broadcast open-canvas <url> [label]");
+      process.exit(1);
+    }
+    const label = args[1] || (() => {
+      try {
+        return new URL(url).hostname;
+      } catch {
+        return "View";
+      }
+    })();
+    payload = { action, url, label };
+  } else if (action === "close-canvas") ; else if (action === "toast") {
+    const message = args[0];
+    if (!message) {
+      console.error("Usage: svamp session broadcast toast <message>");
+      process.exit(1);
+    }
+    payload = { action, message };
+  } else {
+    console.error(`Unknown broadcast action: ${action}`);
+    console.error("Available actions: open-canvas, close-canvas, toast");
+    process.exit(1);
+  }
+  await connectAndEmit({
+    type: "svamp:session-broadcast",
+    data: { sessionId, ...payload }
+  });
+  console.log(`Broadcast sent: ${action}`);
+}
+async function machineNotify(message, level = "info") {
+  const machineId = process.env.SVAMP_MACHINE_ID;
+  await connectAndEmit({
+    type: "svamp:machine-notify",
+    data: { machineId, message, level, timestamp: Date.now() }
+  });
+  console.log(`Machine notification sent [${level}]: ${message}`);
+}
+
+export { machineNotify, sessionBroadcast, sessionNotify, sessionSetLink, sessionSetTitle };

package/dist/{api-Cegey1dh.mjs → api-BRbsyqJ4.mjs}

@@ -29,14 +29,21 @@ function requireSandboxApiEnv() {
   }
   return env;
 }
-async function sandboxFetch(env, path, init) {
+async function sandboxFetch(env, path, init, timeoutMs = 3e4) {
   const url = `${env.apiUrl.replace(/\/+$/, "")}${path}`;
   const headers = {
     "Authorization": `Bearer ${env.apiKey}`,
     "Content-Type": "application/json",
     ...init?.headers || {}
   };
-  const res = await fetch(url, { ...init, headers });
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let res;
+  try {
+    res = await fetch(url, { ...init, headers, signal: controller.signal });
+  } finally {
+    clearTimeout(timer);
+  }
   if (!res.ok) {
     const body = await res.text().catch(() => "");
     let detail = body;

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { b as stopDaemon, s as startDaemon, d as daemonStatus } from './run-BaMf-bAo.mjs';
+import { b as stopDaemon, s as startDaemon, d as daemonStatus } from './run-DPhSmbr1.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -106,10 +106,10 @@ async function main() {
   } else if (subcommand === "skills") {
     await handleSkillsCommand();
   } else if (subcommand === "service" || subcommand === "svc") {
-    const { handleServiceCommand } = await import('./commands-dm3PSNsk.mjs');
+    const { handleServiceCommand } = await import('./commands-CF32XIau.mjs');
     await handleServiceCommand();
   } else if (subcommand === "process" || subcommand === "proc") {
-    const { processCommand } = await import('./commands-3Zu9sCxa.mjs');
+    const { processCommand } = await import('./commands-Dc_6JdE_.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -127,7 +127,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-7U32bRBY.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-CvCDrFPH.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -136,7 +136,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-COqTRwXb.mjs');
+  const { runInteractive } = await import('./run-DTwMJ7dx.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -181,7 +181,7 @@ async function handleAgentCommand() {
     return;
   }
   if (agentArgs[0] === "list") {
-    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.i; });
+    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.i; });
     console.log("Known agents:");
     for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
       console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
@@ -193,7 +193,7 @@ async function handleAgentCommand() {
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
     return;
   }
-  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.i; });
+  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.i; });
   let cwd = process.cwd();
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
@@ -217,12 +217,12 @@ async function handleAgentCommand() {
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
   let backend;
   if (KNOWN_MCP_AGENTS[config.agentName]) {
-    const { CodexMcpBackend } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.j; });
+    const { CodexMcpBackend } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.j; });
     backend = new CodexMcpBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.h; });
-    const { GeminiTransport } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.G; });
-    const { DefaultTransport } = await import('./run-BaMf-bAo.mjs').then(function (n) { return n.D; });
+    const { AcpBackend } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.h; });
+    const { GeminiTransport } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.G; });
+    const { DefaultTransport } = await import('./run-DPhSmbr1.mjs').then(function (n) { return n.D; });
     const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : new DefaultTransport(config.agentName);
     backend = new AcpBackend({
       agentName: config.agentName,
@@ -340,7 +340,7 @@ async function handleSessionCommand() {
     printSessionHelp();
     return;
   }
-  const { sessionList, sessionSpawn, sessionStop, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionRalphStart, sessionRalphCancel, sessionRalphStatus, sessionQueueAdd, sessionQueueList, sessionQueueClear } = await import('./commands-BRow9cGp.mjs');
+  const { sessionList, sessionSpawn, sessionStop, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionRalphStart, sessionRalphCancel, sessionRalphStatus, sessionQueueAdd, sessionQueueList, sessionQueueClear } = await import('./commands-FAWhkKtz.mjs');
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -400,7 +400,7 @@ async function handleSessionCommand() {
         allowDomain.push(sessionArgs[++i]);
       }
     }
-    const { parseShareArg } = await import('./commands-BRow9cGp.mjs');
+    const { parseShareArg } = await import('./commands-FAWhkKtz.mjs');
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -484,7 +484,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-BRow9cGp.mjs');
+    const { sessionApprove } = await import('./commands-FAWhkKtz.mjs');
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -494,7 +494,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-BRow9cGp.mjs');
+    const { sessionDeny } = await import('./commands-FAWhkKtz.mjs');
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -524,6 +524,40 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     await sessionRalphStatus(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "set-title") {
+    const title = sessionArgs[1];
+    if (!title) {
+      console.error("Usage: svamp session set-title <title>");
+      process.exit(1);
+    }
+    const { sessionSetTitle } = await import('./agentCommands-C6iGblcL.mjs');
+    await sessionSetTitle(title);
+  } else if (sessionSubcommand === "set-link") {
+    const url = sessionArgs[1];
+    if (!url) {
+      console.error("Usage: svamp session set-link <url> [label]");
+      process.exit(1);
+    }
+    const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
+    const { sessionSetLink } = await import('./agentCommands-C6iGblcL.mjs');
+    await sessionSetLink(url, label);
+  } else if (sessionSubcommand === "notify") {
+    const message = sessionArgs[1];
+    if (!message) {
+      console.error("Usage: svamp session notify <message> [--level info|warning|error]");
+      process.exit(1);
+    }
+    const level = parseFlagStr("--level") || "info";
+    const { sessionNotify } = await import('./agentCommands-C6iGblcL.mjs');
+    await sessionNotify(message, level);
+  } else if (sessionSubcommand === "broadcast") {
+    const action = sessionArgs[1];
+    if (!action) {
+      console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
+      process.exit(1);
+    }
+    const { sessionBroadcast } = await import('./agentCommands-C6iGblcL.mjs');
+    await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "queue") {
     const queueSubcmd = sessionArgs[1];
     if (queueSubcmd === "add") {
@@ -563,7 +597,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-BRow9cGp.mjs');
+    const { machineShare } = await import('./commands-FAWhkKtz.mjs');
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -593,7 +627,7 @@ async function handleMachineCommand() {
     }
     await machineShare(machineId, { add, remove, list, configPath, showConfig });
   } else if (machineSubcommand === "exec") {
-    const { machineExec } = await import('./commands-BRow9cGp.mjs');
+    const { machineExec } = await import('./commands-FAWhkKtz.mjs');
     let machineId;
     let cwd;
     const cmdParts = [];
@@ -613,7 +647,7 @@ async function handleMachineCommand() {
     }
     await machineExec(machineId, command, cwd);
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-BRow9cGp.mjs');
+    const { machineInfo } = await import('./commands-FAWhkKtz.mjs');
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -621,8 +655,22 @@ async function handleMachineCommand() {
       }
     }
     await machineInfo(machineId);
+  } else if (machineSubcommand === "notify") {
+    const message = machineArgs[1];
+    if (!message) {
+      console.error("Usage: svamp machine notify <message> [--level info|warning|error]");
+      process.exit(1);
+    }
+    let level = "info";
+    for (let i = 2; i < machineArgs.length; i++) {
+      if (machineArgs[i] === "--level" && i + 1 < machineArgs.length) {
+        level = machineArgs[++i];
+      }
+    }
+    const { machineNotify } = await import('./agentCommands-C6iGblcL.mjs');
+    await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-BRow9cGp.mjs');
+    const { machineLs } = await import('./commands-FAWhkKtz.mjs');
     let machineId;
     let showHidden = false;
     let path;
@@ -650,7 +698,7 @@ async function handleSkillsCommand() {
     printSkillsHelp();
     return;
   }
-  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-6EyqaoCp.mjs');
+  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-UFi0_ESV.mjs');
   if (skillsSubcommand === "find" || skillsSubcommand === "search") {
     const query = skillsArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
     if (!query) {
@@ -1021,6 +1069,11 @@ Usage:
   svamp skills find <query>    Search the skills marketplace
   svamp skills install <n>     Install a skill from the marketplace
   svamp skills --help          Show all skill commands
+  svamp process apply <f.yaml>  Create/update a supervised process (idempotent)
+  svamp process list           List supervised processes
+  svamp process start <name>   Start or create a process
+  svamp process logs <name>    Show process log output
+  svamp process --help         Show all process commands
   svamp service expose <name>  Expose a service from this sandbox
   svamp service list           List service groups
   svamp service --help         Show all service commands

package/dist/{commands-dm3PSNsk.mjs → commands-CF32XIau.mjs}

@@ -1,4 +1,4 @@
-import { createServiceGroup, listServiceGroups, getServiceGroup, deleteServiceGroup, addBackend, removeBackend, addPort, removePort, renameSubdomain, getSandboxEnv } from './api-Cegey1dh.mjs';
+import { createServiceGroup, listServiceGroups, getServiceGroup, deleteServiceGroup, addBackend, removeBackend, addPort, removePort, renameSubdomain, getSandboxEnv } from './api-BRbsyqJ4.mjs';
 
 function getFlag(args, flag) {
   const idx = args.indexOf(flag);
@@ -296,7 +296,7 @@ Service is live:`);
       }
     } else {
       console.log(`No SANDBOX_ID detected \u2014 starting reverse tunnel.`);
-      const { runTunnel } = await import('./tunnel-dl6vFKgd.mjs');
+      const { runTunnel } = await import('./tunnel-C3UsqTxi.mjs');
       await runTunnel(name, ports);
     }
   } catch (err) {
@@ -312,7 +312,7 @@ async function serviceTunnel(args) {
     console.error("Usage: svamp service tunnel <name> --port <port> [--port <port2>]");
     process.exit(1);
   }
-  const { runTunnel } = await import('./tunnel-dl6vFKgd.mjs');
+  const { runTunnel } = await import('./tunnel-C3UsqTxi.mjs');
   await runTunnel(name, ports);
 }
 async function handleServiceCommand() {

package/dist/{commands-3Zu9sCxa.mjs → commands-Dc_6JdE_.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-BRow9cGp.mjs';
+import { connectAndGetMachine } from './commands-FAWhkKtz.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-BaMf-bAo.mjs';
+import './run-DPhSmbr1.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-BRow9cGp.mjs → commands-FAWhkKtz.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { resolve, join } from 'node:path';
 import os from 'node:os';
-import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-BaMf-bAo.mjs';
+import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-DPhSmbr1.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-6EyqaoCp.mjs → commands-UFi0_ESV.mjs}

@@ -9,6 +9,18 @@ const SKILLS_DIR = join(os__default.homedir(), ".claude", "skills");
 function getArtifactBaseUrl() {
   return `${SKILLS_SERVER}/${SKILLS_WORKSPACE}/artifacts`;
 }
+async function fetchWithTimeout(url, options = {}, timeoutMs = 3e4) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    return await fetch(url, { ...options, signal: controller.signal });
+  } catch (err) {
+    if (err.name === "AbortError") throw new Error(`Request timed out after ${timeoutMs}ms: ${url}`);
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
 function parseFrontmatter(content) {
   const match = content.match(/^---\s*\n([\s\S]*?)\n---/);
   if (!match) return null;
@@ -54,7 +66,7 @@ async function searchSkills(query) {
   const base = getArtifactBaseUrl();
   const filters = encodeURIComponent(JSON.stringify({ type: "skill" }));
   const url = `${base}/${SKILLS_COLLECTION}/children?keywords=${encodeURIComponent(query)}&filters=${filters}&limit=50`;
-  const resp = await fetch(url);
+  const resp = await fetchWithTimeout(url);
   if (!resp.ok) {
     if (resp.status === 404) return [];
     throw new Error(`Search failed: ${resp.status} ${resp.statusText}`);
@@ -65,7 +77,7 @@ async function searchSkills(query) {
 async function getSkillInfo(skillAlias) {
   const base = getArtifactBaseUrl();
   const url = `${base}/${skillAlias}`;
-  const resp = await fetch(url);
+  const resp = await fetchWithTimeout(url);
   if (!resp.ok) {
     if (resp.status === 404) return null;
     throw new Error(`Get skill failed: ${resp.status} ${resp.statusText}`);
@@ -77,7 +89,7 @@ async function listSkillFiles(skillAlias, dir = "") {
   const base = getArtifactBaseUrl();
   const pathPart = dir ? `/${dir}/` : "/";
   const url = `${base}/${skillAlias}/files${pathPart}`;
-  const resp = await fetch(url);
+  const resp = await fetchWithTimeout(url);
   if (!resp.ok) {
     throw new Error(`List files failed: ${resp.status} ${resp.statusText}`);
   }
@@ -87,7 +99,7 @@ async function listSkillFiles(skillAlias, dir = "") {
 async function downloadSkillFile(skillAlias, filePath) {
   const base = getArtifactBaseUrl();
   const url = `${base}/${skillAlias}/files/${filePath}`;
-  const resp = await fetch(url, { redirect: "follow" });
+  const resp = await fetchWithTimeout(url, { redirect: "follow" }, 6e4);
   if (!resp.ok) {
     throw new Error(`Download failed for ${filePath}: ${resp.status} ${resp.statusText}`);
   }
@@ -221,6 +233,10 @@ async function skillsInstall(skillName, opts) {
     try {
       const content = await downloadSkillFile(skillName, filePath);
       const localPath = join(targetDir, filePath);
+      if (!localPath.startsWith(targetDir + "/")) {
+        errors.push(`  ${filePath}: path outside skill directory (blocked)`);
+        continue;
+      }
       fs.mkdirSync(join(localPath, ".."), { recursive: true });
       fs.writeFileSync(localPath, content, "utf-8");
       downloaded++;
@@ -229,12 +245,10 @@ async function skillsInstall(skillName, opts) {
     }
   }
   if (errors.length > 0) {
-    console.error(`Warning: ${errors.length} file(s) failed to download:`);
-    errors.forEach((e) => console.error(e));
-  }
-  if (downloaded === 0) {
     fs.rmSync(targetDir, { recursive: true, force: true });
-    console.error("Failed to download any files. Installation aborted.");
+    console.error(`Installation failed \u2014 ${errors.length} file(s) could not be downloaded:`);
+    errors.forEach((e) => console.error(e));
+    console.error("Partial installation cleaned up. Run the command again to retry.");
     process.exit(1);
   }
   const skillMdPath = join(targetDir, "SKILL.md");
@@ -383,25 +397,35 @@ async function skillsPublish(skillPath, opts) {
   }
   let artifactId;
   let isUpdate = false;
+  let existingArtifact = null;
   try {
-    const existing = await am.read({
+    existingArtifact = await am.read({
       artifact_id: `${SKILLS_WORKSPACE}/${manifest.name}`,
       _rkwargs: true
     });
-    artifactId = existing.id;
+  } catch {
+  }
+  if (existingArtifact) {
+    artifactId = existingArtifact.id;
     isUpdate = true;
     console.log(`Updating existing skill "${manifest.name}"...`);
-    await am.edit({
-      artifact_id: artifactId,
-      manifest: {
-        name: manifest.name,
-        description: manifest.description,
-        ...manifest.metadata && { metadata: manifest.metadata }
-      },
-      stage: true,
-      _rkwargs: true
-    });
-  } catch {
+    try {
+      await am.edit({
+        artifact_id: artifactId,
+        manifest: {
+          name: manifest.name,
+          description: manifest.description,
+          ...manifest.metadata && { metadata: manifest.metadata }
+        },
+        stage: true,
+        _rkwargs: true
+      });
+    } catch (err) {
+      console.error(`Failed to stage skill artifact for editing: ${err.message}`);
+      await server.disconnect();
+      process.exit(1);
+    }
+  } else {
     try {
       const created = await am.create({
         alias: manifest.name,
@@ -441,11 +465,11 @@ async function skillsPublish(skillPath, opts) {
         uploadErrors.push(`${relPath}: failed to get upload URL`);
         continue;
       }
-      const resp = await fetch(putUrl, {
+      const resp = await fetchWithTimeout(putUrl, {
         method: "PUT",
         body: content,
         headers: { "Content-Type": "application/octet-stream" }
-      });
+      }, 12e4);
       if (!resp.ok) {
         uploadErrors.push(`${relPath}: upload returned ${resp.status}`);
         continue;

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-BaMf-bAo.mjs';
+export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-DPhSmbr1.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-7U32bRBY.mjs → package-CvCDrFPH.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.1.63";
+var version = "0.1.65";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -19,7 +19,7 @@ var exports$1 = {
 var scripts = {
 	build: "rm -rf dist && tsc --noEmit && pkgroll",
 	typecheck: "tsc --noEmit",
-	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-tunnel-proxy.mjs",
+	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs",
 	"test:hypha": "node --no-warnings test/test-hypha-service.mjs",
 	dev: "tsx src/cli.ts",
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",