svamp-cli 0.1.64 → 0.1.66

package/dist/{commands-Brx7D-77.mjs → commands-Dpc6QK0m.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { resolve, join } from 'node:path';
 import os from 'node:os';
-import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-BImPgXHd.mjs';
+import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-BDmLH9T8.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-BImPgXHd.mjs';
+export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-BDmLH9T8.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-Dg0hQJRC.mjs → package-CSFQKq7F.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.1.64";
+var version = "0.1.66";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -19,7 +19,7 @@ var exports$1 = {
 var scripts = {
 	build: "rm -rf dist && tsc --noEmit && pkgroll",
 	typecheck: "tsc --noEmit",
-	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs",
+	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs",
 	"test:hypha": "node --no-warnings test/test-hypha-service.mjs",
 	dev: "tsx src/cli.ts",
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",

package/dist/{run-BImPgXHd.mjs → run-BDmLH9T8.mjs}

@@ -385,21 +385,22 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const machineOwner = currentMetadata.sharing?.owner;
         const isSharedUser = callerEmail && machineOwner && callerEmail.toLowerCase() !== machineOwner.toLowerCase();
         if (isSharedUser) {
-          const machineUser = currentMetadata.sharing?.allowedUsers?.find(
-            (u) => u.email.toLowerCase() === callerEmail.toLowerCase()
-          );
-          const callerRole = machineUser?.role || "interact";
           const sharing = {
             enabled: true,
-            owner: machineOwner,
+            owner: callerEmail,
+            // spawning user owns their session
             allowedUsers: [
-              ...options.sharing?.allowedUsers || [],
+              // Machine owner gets admin access (can monitor/control sessions on their machine)
               {
-                email: callerEmail,
-                role: callerRole,
+                email: machineOwner,
+                role: "admin",
                 addedAt: Date.now(),
                 addedBy: "machine-auto"
-              }
+              },
+              // Preserve any explicitly requested allowedUsers (e.g. additional collaborators)
+              ...(options.sharing?.allowedUsers || []).filter(
+                (u) => u.email.toLowerCase() !== machineOwner.toLowerCase()
+              )
             ]
           };
           options = { ...options, sharing };
@@ -419,16 +420,11 @@ async function registerMachineService(server, machineId, metadata, daemonState,
               ...options,
               securityContext: mergeSecurityContexts(machineCtx, options.securityContext)
             };
-            if (machineCtx.role && options.sharing?.enabled) {
-              const user = options.sharing.allowedUsers?.find(
-                (u) => u.email.toLowerCase() === callerEmail.toLowerCase()
-              );
-              if (user && !user.role) {
-                user.role = machineCtx.role;
-              }
-            }
           }
         }
+        if (options.injectPlatformGuidance === void 0 && currentMetadata.injectPlatformGuidance !== void 0) {
+          options = { ...options, injectPlatformGuidance: currentMetadata.injectPlatformGuidance };
+        }
         const result = await handlers.spawnSession({
           ...options,
           machineId
@@ -486,7 +482,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         metadataVersion++;
         savePersistedMachineMetadata(metadata.svampHomeDir, {
           sharing: currentMetadata.sharing,
-          securityContextConfig: currentMetadata.securityContextConfig
+          securityContextConfig: currentMetadata.securityContextConfig,
+          injectPlatformGuidance: currentMetadata.injectPlatformGuidance
         });
         notifyListeners({
           type: "update-machine",
@@ -546,7 +543,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         metadataVersion++;
         savePersistedMachineMetadata(metadata.svampHomeDir, {
           sharing: currentMetadata.sharing,
-          securityContextConfig: currentMetadata.securityContextConfig
+          securityContextConfig: currentMetadata.securityContextConfig,
+          injectPlatformGuidance: currentMetadata.injectPlatformGuidance
         });
         notifyListeners({
           type: "update-machine",
@@ -567,7 +565,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         metadataVersion++;
         savePersistedMachineMetadata(metadata.svampHomeDir, {
           sharing: currentMetadata.sharing,
-          securityContextConfig: currentMetadata.securityContextConfig
+          securityContextConfig: currentMetadata.securityContextConfig,
+          injectPlatformGuidance: currentMetadata.injectPlatformGuidance
         });
         notifyListeners({
           type: "update-machine",
@@ -3754,13 +3753,17 @@ async function verifyNonoIsolation(binaryPath) {
       "-s",
       "--allow",
       workDir,
-      "--allow-cwd",
+      // NOTE: Do NOT add --allow-cwd here. If the daemon's CWD happens to be
+      // $HOME (common when started interactively), --allow-cwd would grant
+      // access to $HOME, allowing the probe file write to succeed and making
+      // verification incorrectly fail ("file leaked to host filesystem").
+      // We already grant --allow workDir explicitly, so --allow-cwd is redundant.
       "--trust-override",
       "--",
       "sh",
       "-c",
       testScript
-    ], { timeout: 15e3 });
+    ], { timeout: 15e3, cwd: workDir });
     return parseIsolationTestOutput(stdout, probeFile);
   } catch (e) {
     return { passed: false, error: e.message };
@@ -4408,6 +4411,83 @@ class ProcessSupervisor {
 
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = dirname(__filename$1);
+const CLAUDE_SKILLS_DIR = join(os__default.homedir(), ".claude", "skills");
+async function installSkillFromEndpoint(name, baseUrl) {
+  const resp = await fetch(baseUrl, { signal: AbortSignal.timeout(15e3) });
+  if (!resp.ok) throw new Error(`HTTP ${resp.status} from ${baseUrl}`);
+  const index = await resp.json();
+  const files = index.files || [];
+  if (files.length === 0) throw new Error(`Skill index at ${baseUrl} has no files`);
+  const targetDir = join(CLAUDE_SKILLS_DIR, name);
+  mkdirSync(targetDir, { recursive: true });
+  for (const filePath of files) {
+    if (!filePath) continue;
+    const url = `${baseUrl}${filePath}`;
+    const fileResp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+    if (!fileResp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${fileResp.status}`);
+    const content = await fileResp.text();
+    const localPath = join(targetDir, filePath);
+    if (!localPath.startsWith(targetDir + "/")) continue;
+    mkdirSync(dirname(localPath), { recursive: true });
+    writeFileSync(localPath, content, "utf-8");
+  }
+}
+async function installSkillFromMarketplace(name) {
+  const BASE = `https://hypha.aicell.io/hypha-cloud/artifacts/${name}`;
+  async function collectFiles(dir = "") {
+    const url = dir ? `${BASE}/files/${dir}` : `${BASE}/files/`;
+    const resp = await fetch(url, { signal: AbortSignal.timeout(15e3) });
+    if (!resp.ok) throw new Error(`HTTP ${resp.status} listing files`);
+    const data = await resp.json();
+    const items = Array.isArray(data) ? data : data.items || [];
+    const result = [];
+    for (const item of items) {
+      const itemPath = dir ? `${dir}/${item.name}` : item.name;
+      if (item.type === "directory") {
+        result.push(...await collectFiles(itemPath));
+      } else {
+        result.push(itemPath);
+      }
+    }
+    return result;
+  }
+  const files = await collectFiles();
+  if (files.length === 0) throw new Error(`Skill ${name} has no files in marketplace`);
+  const targetDir = join(CLAUDE_SKILLS_DIR, name);
+  mkdirSync(targetDir, { recursive: true });
+  for (const filePath of files) {
+    const url = `${BASE}/files/${filePath}`;
+    const resp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+    if (!resp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${resp.status}`);
+    const content = await resp.text();
+    const localPath = join(targetDir, filePath);
+    if (!localPath.startsWith(targetDir + "/")) continue;
+    mkdirSync(dirname(localPath), { recursive: true });
+    writeFileSync(localPath, content, "utf-8");
+  }
+}
+async function ensureAutoInstalledSkills(logger) {
+  const tasks = [
+    {
+      name: "svamp",
+      install: () => installSkillFromMarketplace("svamp")
+    },
+    {
+      name: "hypha",
+      install: () => installSkillFromEndpoint("hypha", "https://hypha.aicell.io/ws/agent-skills/")
+    }
+  ];
+  for (const task of tasks) {
+    const targetDir = join(CLAUDE_SKILLS_DIR, task.name);
+    if (existsSync$1(targetDir)) continue;
+    try {
+      await task.install();
+      logger.log(`[skills] Auto-installed: ${task.name}`);
+    } catch (err) {
+      logger.log(`[skills] Auto-install of "${task.name}" failed (non-fatal): ${err.message}`);
+    }
+  }
+}
 function loadEnvFile(path) {
   if (!existsSync$1(path)) return false;
   const lines = readFileSync$1(path, "utf-8").split("\n");
@@ -5172,6 +5252,8 @@ async function startDaemon(options) {
   let server = null;
   const supervisor = new ProcessSupervisor(join(SVAMP_HOME, "processes"));
   await supervisor.init();
+  ensureAutoInstalledSkills(logger).catch(() => {
+  });
   try {
     logger.log("Connecting to Hypha server...");
     server = await connectToHypha({
@@ -5328,7 +5410,12 @@ async function startDaemon(options) {
           sharing: options2.sharing,
           securityContext: options2.securityContext,
           tags: options2.tags,
-          parentSessionId: options2.parentSessionId
+          parentSessionId: options2.parentSessionId,
+          ...options2.parentSessionId && (() => {
+            const parentTracked = Array.from(pidToTrackedSession.values()).find((t) => t.svampSessionId === options2.parentSessionId);
+            return parentTracked?.directory ? { parentSessionPath: parentTracked.directory } : {};
+          })(),
+          ...options2.injectPlatformGuidance !== void 0 && { injectPlatformGuidance: options2.injectPlatformGuidance }
         };
         let claudeProcess = null;
         const allPersisted = loadPersistedSessions();
@@ -5338,11 +5425,15 @@ async function startDaemon(options) {
         let lastSpawnMeta = persisted?.spawnMeta || {};
         let sessionWasProcessing = !!options2.wasProcessing;
         let lastAssistantText = "";
+        let spawnHasReceivedInit = false;
         const signalProcessing = (processing) => {
           sessionService.sendKeepAlive(processing);
           const newState = processing ? "running" : "idle";
           if (sessionMetadata.lifecycleState !== newState) {
             sessionMetadata = { ...sessionMetadata, lifecycleState: newState };
+            if (!processing) {
+              sessionMetadata = { ...sessionMetadata, unread: true };
+            }
             sessionService.updateMetadata(sessionMetadata);
           }
         };
@@ -5449,6 +5540,7 @@ async function startDaemon(options) {
             shell: process.platform === "win32"
           });
           claudeProcess = child;
+          spawnHasReceivedInit = false;
           logger.log(`[Session ${sessionId}] Claude PID: ${child.pid}, stdin: ${!!child.stdin}, stdout: ${!!child.stdout}, stderr: ${!!child.stderr}`);
           child.stdin?.on("error", (err) => {
             logger.log(`[Session ${sessionId}] Claude stdin error: ${err.message}`);
@@ -5807,7 +5899,9 @@ The automated loop has finished. Review the progress above and let me know if yo
                   }
                   userMessagePending = false;
                   if (msg.session_id) {
-                    const isConversationClear = claudeResumeId && msg.session_id !== claudeResumeId;
+                    const isResumeFailure = !spawnHasReceivedInit && claudeResumeId && msg.session_id !== claudeResumeId;
+                    const isConversationClear = spawnHasReceivedInit && claudeResumeId && msg.session_id !== claudeResumeId;
+                    spawnHasReceivedInit = true;
                     claudeResumeId = msg.session_id;
                     sessionMetadata = { ...sessionMetadata, claudeSessionId: msg.session_id };
                     sessionService.updateMetadata(sessionMetadata);
@@ -5825,7 +5919,9 @@ The automated loop has finished. Review the progress above and let me know if yo
                       });
                       artifactSync.scheduleDebouncedSync(sessionId, getSessionDir(directory, sessionId), sessionMetadata, machineId);
                     }
-                    if (isConversationClear) {
+                    if (isResumeFailure) {
+                      logger.log(`[Session ${sessionId}] Resume failed \u2014 Claude started fresh session (tried: ${persisted?.claudeResumeId ?? "unknown"}, got: ${msg.session_id})`);
+                    } else if (isConversationClear) {
                       logger.log(`[Session ${sessionId}] Conversation cleared (/clear) \u2014 new Claude session: ${msg.session_id}`);
                       sessionService.clearMessages();
                       sessionService.pushMessage(
@@ -5957,7 +6053,7 @@ The automated loop has finished. Review the progress above and let me know if yo
             isRestartingClaude = false;
           }
         };
-        if (sessionMetadata.sharing?.enabled && isolationCapabilities.preferred) {
+        if (sessionMetadata.sharing?.enabled) {
           try {
             stagedCredentials = await stageCredentialsForSharing(sessionId);
             logger.log(`[Session ${sessionId}] Credentials staged at ${stagedCredentials.homePath}`);
@@ -6954,7 +7050,7 @@ The automated loop has finished. Review the progress above and let me know if yo
     const defaultHomeDir = existsSync$1("/data") ? "/data" : os__default.homedir();
     const persistedMachineMeta = loadPersistedMachineMetadata(SVAMP_HOME);
     if (persistedMachineMeta) {
-      logger.log(`Restored machine metadata (sharing=${!!persistedMachineMeta.sharing}, securityContextConfig=${!!persistedMachineMeta.securityContextConfig})`);
+      logger.log(`Restored machine metadata (sharing=${!!persistedMachineMeta.sharing}, securityContextConfig=${!!persistedMachineMeta.securityContextConfig}, injectPlatformGuidance=${persistedMachineMeta.injectPlatformGuidance})`);
     }
     const machineMetadata = {
       host: os__default.hostname(),
@@ -6965,9 +7061,10 @@ The automated loop has finished. Review the progress above and let me know if yo
       svampLibDir: join(__dirname$1, ".."),
       displayName: process.env.SVAMP_DISPLAY_NAME || void 0,
       isolationCapabilities,
-      // Restore persisted sharing & security context config
+      // Restore persisted sharing, security context config, and platform guidance flag
       ...persistedMachineMeta?.sharing && { sharing: persistedMachineMeta.sharing },
-      ...persistedMachineMeta?.securityContextConfig && { securityContextConfig: persistedMachineMeta.securityContextConfig }
+      ...persistedMachineMeta?.securityContextConfig && { securityContextConfig: persistedMachineMeta.securityContextConfig },
+      ...persistedMachineMeta?.injectPlatformGuidance !== void 0 && { injectPlatformGuidance: persistedMachineMeta.injectPlatformGuidance }
     };
     const initialDaemonState = {
       status: "running",

package/dist/{run-C7VxH4X8.mjs → run-ez-QlRKy.mjs}

@@ -2,7 +2,7 @@ import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(im
 import os from 'node:os';
 import { join, resolve } from 'node:path';
 import { mkdirSync, writeFileSync, existsSync, unlinkSync, readFileSync, watch } from 'node:fs';
-import { c as connectToHypha, a as registerSessionService } from './run-BImPgXHd.mjs';
+import { c as connectToHypha, a as registerSessionService } from './run-BDmLH9T8.mjs';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';

package/dist/storageCommands-CKhntx1P.mjs

@@ -0,0 +1,154 @@
+import { getSandboxEnv } from './api-BRbsyqJ4.mjs';
+
+async function adminFetch(path, method = "GET", body) {
+  const env = getSandboxEnv();
+  if (!env.apiKey) {
+    throw new Error('No API credentials. Run "svamp login" or set SANDBOX_API_KEY.');
+  }
+  const url = `${env.apiUrl.replace(/\/+$/, "")}${path}`;
+  const res = await fetch(url, {
+    method,
+    headers: {
+      "Authorization": `Bearer ${env.apiKey}`,
+      "Content-Type": "application/json"
+    },
+    ...{}
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => "");
+    throw new Error(`HTTP ${res.status} ${method} ${path}: ${text}`);
+  }
+  return res.json();
+}
+function fmtAge(ts) {
+  if (!ts) return "?";
+  try {
+    const dt = /^\d+$/.test(ts) ? new Date(parseInt(ts, 10) * 1e3) : new Date(ts);
+    const secs = (Date.now() - dt.getTime()) / 1e3;
+    const d = Math.floor(secs / 86400);
+    const h = Math.floor(secs % 86400 / 3600);
+    return d > 0 ? `${d}d ${h}h ago` : `${h}h ago`;
+  } catch {
+    return ts;
+  }
+}
+function pad(s, n) {
+  return s.length >= n ? s : s + " ".repeat(n - s.length);
+}
+async function storageList() {
+  const data = await adminFetch("/admin/storage/pvcs");
+  const pvcs = data.pvcs ?? [];
+  if (!pvcs.length) {
+    console.log("No managed PVCs found.");
+    return;
+  }
+  console.log("");
+  console.log(`${pad("NAMESPACE", 36)}${pad("SIZE", 9)}${pad("STATUS", 9)}${pad("CREATED", 20)}ORPHANED`);
+  console.log("\u2500".repeat(90));
+  for (const p of pvcs.sort((a, b) => a.namespace.localeCompare(b.namespace))) {
+    const orphan = p.orphaned_at ? `\u26A0  ${fmtAge(p.orphaned_at)}` : "\u2014";
+    console.log(`${pad(p.namespace, 36)}${pad(p.capacity ?? "?", 9)}${pad(p.status ?? "?", 9)}${pad(fmtAge(p.created_at), 20)}${orphan}`);
+  }
+  console.log(`
+Total: ${data.count} PVC(s)`);
+}
+async function storageOrphans(mark = false) {
+  const data = await adminFetch(`/admin/orphaned-pvcs?dry_run=${mark ? "false" : "true"}`);
+  const orphans = data.orphaned_pvcs ?? [];
+  if (!orphans.length) {
+    console.log("\u2705  No orphaned PVCs found.");
+    return;
+  }
+  console.log(`
+\u26A0   ${orphans.length} orphaned PVC(s) (namespace has no running pods):
+`);
+  console.log(`${pad("NAMESPACE", 36)}${pad("SIZE", 9)}${pad("MARKED", 9)}ORPHANED FOR`);
+  console.log("\u2500".repeat(72));
+  for (const o of orphans) {
+    const age = o.orphaned_for || (o.marked ? "?" : "not marked");
+    console.log(`${pad(o.namespace, 36)}${pad(o.storage ?? "?", 9)}${pad(o.marked ? "yes" : "no", 9)}${age}`);
+  }
+  if (!mark) {
+    console.log("\nTip: pass --mark to start the retention clock on unmarked orphans.");
+  }
+  console.log("\nTo delete: svamp machine storage delete <namespace>");
+}
+async function storageMarkOrphan(namespace) {
+  const data = await adminFetch(`/admin/storage/mark-orphan/${namespace}`, "POST");
+  if (data.marked) {
+    console.log(`\u2705  PVC for '${namespace}' marked as orphaned.`);
+    console.log(`    To delete: svamp machine storage delete ${namespace}`);
+  } else {
+    console.log(`\u2139   PVC for '${namespace}' was already marked or not found.`);
+  }
+}
+async function storageUnmarkOrphan(namespace) {
+  const data = await adminFetch(`/admin/storage/unmark-orphan/${namespace}`, "POST");
+  if (data.unmarked) {
+    console.log(`\u2705  Orphan mark removed from '${namespace}'.`);
+  } else {
+    console.log(`\u2139   PVC for '${namespace}' was not marked or not found.`);
+  }
+}
+async function storageDelete(namespace) {
+  const readline = await import('readline');
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const ask = (q) => new Promise((res) => rl.question(q, res));
+  try {
+    const data2 = await adminFetch("/admin/storage/pvcs");
+    const pvc = (data2.pvcs ?? []).find((p) => p.namespace === namespace);
+    if (!pvc) {
+      console.error(`No PVC found for namespace '${namespace}'.`);
+      rl.close();
+      process.exit(1);
+    }
+    console.log(`
+\u26A0   Namespace:  ${pvc.namespace}`);
+    console.log(`    Size:       ${pvc.capacity ?? "?"}`);
+    console.log(`    Created:    ${fmtAge(pvc.created_at)}`);
+    if (pvc.orphaned_at) console.log(`    Orphaned:   ${fmtAge(pvc.orphaned_at)}`);
+  } catch {
+  }
+  console.log("\n\u26A0   PERMANENTLY deleting this PVC will IRREVERSIBLY destroy all user data.\n");
+  const a1 = (await ask(`Type the namespace name to confirm: `)).trim();
+  if (a1 !== namespace) {
+    console.log("Confirmation mismatch \u2014 aborted.");
+    rl.close();
+    return;
+  }
+  const a2 = (await ask(`Type it again to double-confirm: `)).trim();
+  rl.close();
+  if (a2 !== namespace) {
+    console.log("Confirmation mismatch \u2014 aborted.");
+    return;
+  }
+  const data = await adminFetch(`/admin/storage/pvc/${namespace}`, "DELETE");
+  if (data.deleted) {
+    console.log(`\u2705  PVC for '${namespace}' permanently deleted.`);
+  } else {
+    console.log(`\u2139   PVC for '${namespace}' was not found or already deleted.`);
+  }
+}
+function printStorageHelp() {
+  console.log(`
+svamp machine storage \u2014 sandbox PVC lifecycle management (admin only)
+
+Usage:
+  svamp machine storage list                  List all PVCs with status
+  svamp machine storage orphans [--mark]      Show PVCs with no active namespace
+  svamp machine storage mark-orphan <ns>      Flag a PVC as orphaned (no deletion)
+  svamp machine storage unmark-orphan <ns>    Remove orphan flag
+  svamp machine storage delete <ns>           Permanently delete a PVC (double confirmation)
+
+Environment:
+  SANDBOX_API_URL   Sandbox API base URL (default: https://agent-sandbox.aicell.io)
+  SANDBOX_API_KEY   Admin API key (or use HYPHA_TOKEN from svamp login)
+
+Safety rules:
+  - Automated systems NEVER delete PVCs
+  - delete requires typing the namespace name twice
+  - delete checks for running pods and refuses if any are active
+`);
+}
+
+export { printStorageHelp, storageDelete, storageList, storageMarkOrphan, storageOrphans, storageUnmarkOrphan };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "svamp-cli",
-  "version": "0.1.64",
-  "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
+  "version": "0.1.66",
+  "description": "Svamp CLI \u2014 AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
   "type": "module",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs",
+    "test": "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",