svamp-cli 0.1.75 → 0.1.78

package/dist/{run-lhAjX4NB.mjs → run-DsXDjwLW.mjs}

@@ -1,7 +1,7 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os__default from 'os';
 import fs, { mkdir as mkdir$1, readdir, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
 import { readFileSync as readFileSync$1, mkdirSync, writeFileSync, renameSync, existsSync as existsSync$1, copyFileSync, unlinkSync, watch, rmdirSync } from 'fs';
-import path, { join, dirname, resolve, basename } from 'path';
+import path__default, { join, dirname, resolve, basename } from 'path';
 import { fileURLToPath } from 'url';
 import { spawn as spawn$1 } from 'child_process';
 import { randomUUID as randomUUID$1 } from 'crypto';
@@ -309,18 +309,6 @@ async function getPtyModule() {
 function generateTerminalId() {
   return `term-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`;
 }
-const ALLOWED_CONTROL_CHARS = /* @__PURE__ */ new Set([7, 8, 9, 10, 11, 12, 13, 27]);
-function filterForXterm(text) {
-  if (!text) return text;
-  let result = "";
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code >= 32 && code <= 126 || ALLOWED_CONTROL_CHARS.has(code) || code > 127) {
-      result += text[i];
-    }
-  }
-  return result;
-}
 function getMachineMetadataPath(svampHomeDir) {
   return join(svampHomeDir, "machine-metadata.json");
 }
@@ -705,43 +693,78 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const cwd = params.cwd || getHomedir();
         const shell = params.shell || process.env.SHELL || "bash";
         const sessionId = generateTerminalId();
+        const cleanEnv = { ...process.env };
+        const claudeEnvVars = Object.keys(cleanEnv).filter(
+          (k) => k.startsWith("CLAUDE_") || k.startsWith("MCP_") || k === "ANTHROPIC_API_KEY"
+        );
+        for (const k of claudeEnvVars) delete cleanEnv[k];
         const ptyProcess = pty.spawn(shell, [], {
           name: "xterm-256color",
           cols,
           rows,
           cwd,
-          env: { ...process.env, TERM: "xterm-256color" }
+          env: {
+            ...cleanEnv,
+            TERM: "xterm-256color"
+          }
         });
+        if (shell.endsWith("zsh")) {
+          ptyProcess.write("unsetopt PROMPT_SP\n");
+          ptyProcess.write("clear\n");
+        }
         const session = {
           id: sessionId,
           pty: ptyProcess,
-          listeners: [],
+          outputBuffer: [],
+          exited: false,
           cols,
           rows,
           createdAt: Date.now(),
           cwd
         };
         terminalSessions.set(sessionId, session);
-        ptyProcess.onData((data) => {
-          const filtered = filterForXterm(data);
-          if (!filtered) return;
-          const update = { type: "output", content: filtered, sessionId };
-          for (const listener of session.listeners) {
-            try {
-              listener(update);
-            } catch {
-            }
+        let outputBatch = "";
+        let outputTimer = null;
+        const flushOutput = () => {
+          outputTimer = null;
+          if (!outputBatch) return;
+          const batch = outputBatch;
+          outputBatch = "";
+          session.outputBuffer.push(batch);
+          if (session.outputBuffer.length > 1e3) {
+            session.outputBuffer.splice(0, session.outputBuffer.length - 500);
           }
+          try {
+            server.emit({
+              type: "svamp:terminal-output",
+              data: { type: "output", content: batch, sessionId },
+              to: "*"
+            });
+          } catch {
+          }
+        };
+        ptyProcess.onData((data) => {
+          if (!data) return;
+          outputBatch += data;
+          if (!outputTimer) outputTimer = setTimeout(flushOutput, 16);
         });
         ptyProcess.onExit(({ exitCode, signal }) => {
-          const update = { type: "exit", content: "", sessionId, exitCode, signal };
-          for (const listener of session.listeners) {
-            try {
-              listener(update);
-            } catch {
-            }
+          session.exited = true;
+          session.exitCode = exitCode;
+          session.exitSignal = signal;
+          try {
+            server.emit({
+              type: "svamp:terminal-output",
+              data: { type: "exit", content: "", sessionId, exitCode, signal },
+              to: "*"
+            });
+          } catch {
           }
-          terminalSessions.delete(sessionId);
+          setTimeout(() => {
+            if (terminalSessions.has(sessionId)) {
+              terminalSessions.delete(sessionId);
+            }
+          }, 6e4);
         });
         return { sessionId, cols, rows };
       },
@@ -764,23 +787,34 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         return { success: true };
       },
       /**
-       * Attach to a terminal session for real-time output streaming.
-       * The onData callback receives { type: 'output'|'exit', content, sessionId }.
+       * Read buffered output from a terminal session (polling).
+       * Returns { output, exited, exitCode? }. Drains the buffer.
        */
-      terminalAttach: async (params, context) => {
+      terminalRead: async (params, context) => {
         authorizeRequest(context, currentMetadata.sharing, "admin");
         const session = terminalSessions.get(params.sessionId);
         if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
-        if (typeof params.onData !== "function") throw new Error("onData callback is required");
-        session.listeners.push(params.onData);
-        return { success: true, cols: session.cols, rows: session.rows };
+        const output = session.outputBuffer.splice(0).join("");
+        const result = {
+          output,
+          exited: session.exited
+        };
+        if (session.exited) {
+          result.exitCode = session.exitCode;
+          result.exitSignal = session.exitSignal;
+          if (!output) terminalSessions.delete(params.sessionId);
+        }
+        return result;
       },
-      /** Stop (kill) a terminal session. */
+      /** Stop (kill) a terminal session. Idempotent — returns success even if already gone. */
       terminalStop: async (params, context) => {
         authorizeRequest(context, currentMetadata.sharing, "admin");
         const session = terminalSessions.get(params.sessionId);
-        if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
-        session.pty.kill();
+        if (!session) return { success: true };
+        try {
+          session.pty.kill();
+        } catch {
+        }
         terminalSessions.delete(params.sessionId);
         return { success: true };
       },
@@ -792,9 +826,23 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           cols: s.cols,
           rows: s.rows,
           cwd: s.cwd,
-          createdAt: s.createdAt
+          createdAt: s.createdAt,
+          exited: s.exited
         }));
       },
+      /** Reattach to an existing terminal session. Returns buffered output for scrollback replay. */
+      terminalReattach: async (params, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const session = terminalSessions.get(params.sessionId);
+        if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
+        const scrollback = session.outputBuffer.join("");
+        if (params.cols && params.rows) {
+          session.pty.resize(params.cols, params.rows);
+          session.cols = params.cols;
+          session.rows = params.rows;
+        }
+        return { sessionId: session.id, cols: session.cols, rows: session.rows, scrollback, exited: session.exited };
+      },
       // Machine-level directory listing (read-only, view role)
       listDirectory: async (path, options, context) => {
         authorizeRequest(context, currentMetadata.sharing, "view");
@@ -926,6 +974,48 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const { deleteServiceGroup } = await import('./api-BRbsyqJ4.mjs');
         return deleteServiceGroup(params.name);
       },
+      // ── Tunnel management ────────────────────────────────────────────
+      /** Start a reverse tunnel for a service group (local/cloud machine). */
+      tunnelStart: async (params, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const tunnels = handlers.tunnels;
+        if (!tunnels) throw new Error("Tunnel management not available");
+        if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
+        const { TunnelClient } = await import('./tunnel-BDKdemh0.mjs');
+        const client = new TunnelClient({
+          name: params.name,
+          ports: params.ports,
+          maxReconnectAttempts: 0,
+          // infinite for daemon
+          onError: (err) => console.error(`[TUNNEL] ${params.name}: ${err.message}`),
+          onConnect: () => console.log(`[TUNNEL] ${params.name}: connected`),
+          onDisconnect: () => console.log(`[TUNNEL] ${params.name}: disconnected, reconnecting...`)
+        });
+        await client.connect();
+        tunnels.set(params.name, client);
+        return { name: params.name, ports: params.ports, ...client.status };
+      },
+      /** Stop a tunnel. */
+      tunnelStop: async (params, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const tunnels = handlers.tunnels;
+        if (!tunnels) throw new Error("Tunnel management not available");
+        const client = tunnels.get(params.name);
+        if (!client) throw new Error(`Tunnel '${params.name}' not found`);
+        client.destroy();
+        tunnels.delete(params.name);
+        return { name: params.name, stopped: true };
+      },
+      /** List active tunnels with health status. */
+      tunnelList: async (context) => {
+        authorizeRequest(context, currentMetadata.sharing, "view");
+        const tunnels = handlers.tunnels;
+        if (!tunnels) return [];
+        return Array.from(tunnels.entries()).map(([name, client]) => ({
+          name,
+          ...client.status
+        }));
+      },
       // WISE voice — create ephemeral token for OpenAI Realtime API
       wiseCreateEphemeralToken: async (params, context) => {
         authorizeRequest(context, currentMetadata.sharing, "interact");
@@ -999,6 +1089,28 @@ async function registerMachineService(server, machineId, metadata, daemonState,
   };
 }
 
+function isStructuredMessage(msg) {
+  return !!(msg.from && msg.subject);
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function formatInboxMessageXml(msg) {
+  if (!isStructuredMessage(msg)) return msg.body;
+  const attrs = [`message-id="${escapeXml(msg.messageId)}"`];
+  if (msg.from) attrs.push(`from="${escapeXml(msg.from)}"`);
+  if (msg.fromSession) attrs.push(`from-session="${escapeXml(msg.fromSession)}"`);
+  if (msg.to) attrs.push(`to="${escapeXml(msg.to)}"`);
+  if (msg.subject) attrs.push(`subject="${escapeXml(msg.subject)}"`);
+  if (msg.urgency) attrs.push(`urgency="${msg.urgency}"`);
+  if (msg.replyTo) attrs.push(`reply-to="${escapeXml(msg.replyTo)}"`);
+  if (msg.cc && msg.cc.length > 0) attrs.push(`cc="${msg.cc.map(escapeXml).join(",")}"`);
+  if (msg.threadId) attrs.push(`thread-id="${escapeXml(msg.threadId)}"`);
+  attrs.push(`timestamp="${msg.timestamp}"`);
+  return `<svamp-message ${attrs.join(" ")}>
+${msg.body}
+</svamp-message>`;
+}
 function loadMessages(messagesDir, sessionId) {
   const filePath = join$1(messagesDir, "messages.jsonl");
   if (!existsSync(filePath)) return [];
@@ -1040,6 +1152,8 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     mode: "remote",
     time: Date.now()
   };
+  const inbox = [];
+  const INBOX_MAX = 100;
   const listeners = [];
   const removeListener = (listener, reason) => {
     const idx = listeners.indexOf(listener);
@@ -1308,10 +1422,10 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       if (!callbacks.onListDirectory) throw new Error("listDirectory not supported");
       return await callbacks.onListDirectory(path);
     },
-    bash: async (command, cwd, context) => {
+    bash: async (command, cwd, timeout, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onBash) throw new Error("bash not supported");
-      return await callbacks.onBash(command, cwd);
+      return await callbacks.onBash(command, cwd, timeout);
     },
     ripgrep: async (args, cwd, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
@@ -1357,7 +1471,8 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       callbacks.onSharingUpdate?.(newSharing);
       return { success: true, sharing: newSharing };
     },
-    /** Update security context and restart the agent process with new rules */
+    /** Update security context and restart the agent process with new rules.
+     *  Pass '__disable__' sentinel (from frontend) or null to disable isolation entirely. */
     updateSecurityContext: async (newSecurityContext, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (metadata.sharing && context?.user?.email && metadata.sharing.owner && context.user.email.toLowerCase() !== metadata.sharing.owner.toLowerCase()) {
@@ -1366,14 +1481,15 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       if (!callbacks.onUpdateSecurityContext) {
         throw new Error("Security context updates are not supported for this session");
       }
-      metadata = { ...metadata, securityContext: newSecurityContext };
+      const resolvedContext = newSecurityContext === "__disable__" ? null : newSecurityContext;
+      metadata = { ...metadata, securityContext: resolvedContext };
       metadataVersion++;
       notifyListeners({
         type: "update-session",
         sessionId,
         metadata: { value: metadata, version: metadataVersion }
       });
-      return await callbacks.onUpdateSecurityContext(newSecurityContext);
+      return await callbacks.onUpdateSecurityContext(resolvedContext);
     },
     /** Apply a new system prompt and restart the agent process */
     applySystemPrompt: async (prompt, context) => {
@@ -1383,6 +1499,43 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       }
       return await callbacks.onApplySystemPrompt(prompt);
     },
+    // ── Inbox ──
+    sendInboxMessage: async (message, context) => {
+      authorizeRequest(context, metadata.sharing, "interact");
+      inbox.push(message);
+      while (inbox.length > INBOX_MAX) inbox.shift();
+      callbacks.onInboxMessage?.(message);
+      notifyListeners({ type: "inbox-update", sessionId, message });
+      return { success: true, messageId: message.messageId };
+    },
+    getInbox: async (opts, context) => {
+      authorizeRequest(context, metadata.sharing, "view");
+      let result = [...inbox];
+      if (opts?.unread) result = result.filter((m) => !m.read);
+      result.sort((a, b) => b.timestamp - a.timestamp);
+      if (opts?.limit && opts.limit > 0) result = result.slice(0, opts.limit);
+      return { messages: result, total: inbox.length };
+    },
+    markInboxRead: async (messageId, context) => {
+      authorizeRequest(context, metadata.sharing, "interact");
+      const msg = inbox.find((m) => m.messageId === messageId);
+      if (!msg) return { success: false, error: "Message not found" };
+      msg.read = true;
+      notifyListeners({ type: "inbox-update", sessionId, message: msg });
+      return { success: true };
+    },
+    clearInbox: async (opts, context) => {
+      authorizeRequest(context, metadata.sharing, "admin");
+      if (opts?.all) {
+        inbox.length = 0;
+      } else {
+        for (let i = inbox.length - 1; i >= 0; i--) {
+          if (inbox[i].read) inbox.splice(i, 1);
+        }
+      }
+      notifyListeners({ type: "inbox-update", sessionId, cleared: true });
+      return { success: true, remaining: inbox.length };
+    },
     // ── Listener Registration ──
     registerListener: async (callback, context) => {
       authorizeRequest(context, metadata.sharing, "view");
@@ -4167,6 +4320,8 @@ function sanitizeEnvForSharing(env) {
 const DEFAULT_PROBE_INTERVAL_S = 10;
 const DEFAULT_PROBE_TIMEOUT_S = 5;
 const DEFAULT_PROBE_FAILURE_THRESHOLD = 3;
+const MAX_RESTART_DELAY_S = 300;
+const BACKOFF_RESET_WINDOW_MS = 6e4;
 const MAX_LOG_LINES = 300;
 class ProcessSupervisor {
   entries = /* @__PURE__ */ new Map();
@@ -4364,7 +4519,7 @@ class ProcessSupervisor {
     for (const file of files) {
       if (!file.endsWith(".json")) continue;
       try {
-        const raw = await readFile(path.join(this.persistDir, file), "utf-8");
+        const raw = await readFile(path__default.join(this.persistDir, file), "utf-8");
         const spec = JSON.parse(raw);
         const entry = this.makeEntry(spec);
         this.entries.set(spec.id, entry);
@@ -4385,14 +4540,14 @@ class ProcessSupervisor {
     }
   }
   async persistSpec(spec) {
-    const filePath = path.join(this.persistDir, `${spec.id}.json`);
+    const filePath = path__default.join(this.persistDir, `${spec.id}.json`);
     const tmpPath = filePath + ".tmp";
     await writeFile$1(tmpPath, JSON.stringify(spec, null, 2), "utf-8");
     await rename(tmpPath, filePath);
   }
   async deleteSpec(id) {
     try {
-      await unlink(path.join(this.persistDir, `${id}.json`));
+      await unlink(path__default.join(this.persistDir, `${id}.json`));
     } catch {
     }
   }
@@ -4498,8 +4653,19 @@ class ProcessSupervisor {
       state.status = "failed";
       return;
     }
-    const delayMs = spec.restartDelay * 1e3;
-    console.log(`[SUPERVISOR] Scheduling restart of '${spec.name}' in ${delayMs}ms (restart #${state.restartCount + 1})`);
+    const uptime = state.startedAt ? Date.now() - state.startedAt : 0;
+    const baseDelay = spec.restartDelay * 1e3;
+    let delayMs;
+    if (uptime > BACKOFF_RESET_WINDOW_MS) {
+      state.restartCount = 0;
+      delayMs = baseDelay;
+    } else {
+      const backoffExponent = Math.min(state.restartCount, 10);
+      delayMs = Math.min(baseDelay * Math.pow(2, backoffExponent), MAX_RESTART_DELAY_S * 1e3);
+      const jitter = (Math.random() * 0.2 - 0.1) * delayMs;
+      delayMs = Math.max(baseDelay, Math.round(delayMs + jitter));
+    }
+    console.log(`[SUPERVISOR] Scheduling restart of '${spec.name}' in ${delayMs}ms (restart #${state.restartCount + 1}, uptime=${Math.round(uptime / 1e3)}s)`);
     entry.restartTimer = setTimeout(() => {
       if (entry.stopping) return;
       state.restartCount++;
@@ -5537,6 +5703,7 @@ async function startDaemon(options) {
   let server = null;
   const supervisor = new ProcessSupervisor(join(SVAMP_HOME, "processes"));
   await supervisor.init();
+  const tunnels = /* @__PURE__ */ new Map();
   ensureAutoInstalledSkills(logger).catch(() => {
   });
   preventMachineSleep(logger);
@@ -5657,6 +5824,7 @@ async function startDaemon(options) {
           });
         }, buildIsolationConfig2 = function(dir) {
           if (!options2.forceIsolation && !sessionMetadata.sharing?.enabled) return null;
+          if (sessionMetadata.securityContext === null) return null;
           const method = isolationCapabilities.preferred;
           if (!method) return null;
           const detail = isolationCapabilities.details[method];
@@ -5676,7 +5844,7 @@ async function startDaemon(options) {
           if (sessionMetadata.sharing?.enabled && stagedCredentials) {
             config.credentialStagingPath = stagedCredentials.homePath;
           }
-          const activeSecurityContext = sessionMetadata.securityContext || options2.securityContext;
+          const activeSecurityContext = sessionMetadata.securityContext ?? options2.securityContext;
           if (activeSecurityContext) {
             config = applySecurityContext(config, activeSecurityContext);
           }
@@ -6335,6 +6503,7 @@ The automated loop has finished. Review the progress above and let me know if yo
                 logger.log(`[Session ${sessionId}] Retrying startup without --resume`);
                 sessionMetadata = { ...sessionMetadata, lifecycleState: "running" };
                 sessionService.updateMetadata(sessionMetadata);
+                sessionService.sendKeepAlive(true);
                 spawnClaude(startupRetryMessage);
                 return;
               }
@@ -6391,6 +6560,7 @@ The automated loop has finished. Review the progress above and let me know if yo
             }
             if (claudeResumeId) {
               spawnClaude(void 0, { permissionMode: currentPermissionMode });
+              sessionService.updateMetadata(sessionMetadata);
               logger.log(`[Session ${sessionId}] Claude respawned with --resume ${claudeResumeId}`);
               return { success: true, message: "Claude process restarted successfully." };
             } else {
@@ -6596,6 +6766,25 @@ The automated loop has finished. Review the progress above and let me know if yo
               logger.log(`[Session ${sessionId}] Kill session requested`);
               stopSession(sessionId);
             },
+            onInboxMessage: (message) => {
+              if (trackedSession?.stopped) return;
+              logger.log(`[Session ${sessionId}] Inbox message received (urgency: ${message.urgency || "normal"}, from: ${message.from || "unknown"})`);
+              if (message.urgency === "urgent") {
+                const formatted = formatInboxMessageXml(message);
+                logger.log(`[Session ${sessionId}] Delivering urgent inbox message to agent`);
+                if (!claudeProcess || claudeProcess.exitCode !== null) {
+                  spawnClaude(formatted);
+                } else {
+                  const stdinMsg = JSON.stringify({
+                    type: "user",
+                    message: { role: "user", content: formatted }
+                  });
+                  claudeProcess.stdin?.write(stdinMsg + "\n");
+                }
+                signalProcessing(true);
+                sessionWasProcessing = true;
+              }
+            },
             onMetadataUpdate: (newMeta) => {
               const prevRalphLoop = sessionMetadata.ralphLoop;
               sessionMetadata = {
@@ -6625,11 +6814,12 @@ The automated loop has finished. Review the progress above and let me know if yo
             onUpdateConfig: (patch) => {
               writeSvampConfigPatch(patch);
             },
-            onBash: async (command, cwd) => {
-              logger.log(`[Session ${sessionId}] Bash: ${command} (cwd: ${cwd || directory})`);
+            onBash: async (command, cwd, timeout) => {
+              const execTimeout = timeout || 12e4;
+              logger.log(`[Session ${sessionId}] Bash: ${command} (cwd: ${cwd || directory}, timeout: ${execTimeout}ms)`);
               const { exec } = await import('child_process');
               return new Promise((resolve2) => {
-                exec(command, { cwd: cwd || directory, timeout: 3e4, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+                exec(command, { cwd: cwd || directory, timeout: execTimeout, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
                   if (err) {
                     resolve2({ success: false, stdout: stdout || "", stderr: stderr || err.message, exitCode: err.code ?? 1 });
                   } else {
@@ -6938,6 +7128,7 @@ The automated loop has finished. Review the progress above and let me know if yo
               }
               sessionMetadata = { ...sessionMetadata, lifecycleState: "running" };
               sessionService.updateMetadata(sessionMetadata);
+              sessionService.sendKeepAlive(true);
               agentBackend.sendPrompt(sessionId, text).catch((err) => {
                 logger.error(`[${agentName} Session ${sessionId}] Error sending prompt:`, err);
                 if (!acpStopped) {
@@ -6999,6 +7190,25 @@ The automated loop has finished. Review the progress above and let me know if yo
               logger.log(`[${agentName} Session ${sessionId}] Kill session requested`);
               stopSession(sessionId);
             },
+            onInboxMessage: (message) => {
+              if (acpStopped) return;
+              logger.log(`[${agentName} Session ${sessionId}] Inbox message received (urgency: ${message.urgency || "normal"}, from: ${message.from || "unknown"})`);
+              if (message.urgency === "urgent" && acpBackendReady) {
+                const formatted = formatInboxMessageXml(message);
+                logger.log(`[${agentName} Session ${sessionId}] Delivering urgent inbox message to agent`);
+                sessionMetadata = { ...sessionMetadata, lifecycleState: "running" };
+                sessionService.updateMetadata(sessionMetadata);
+                sessionService.sendKeepAlive(true);
+                agentBackend.sendPrompt(sessionId, formatted).catch((err) => {
+                  logger.error(`[${agentName} Session ${sessionId}] Error delivering urgent inbox message: ${err.message}`);
+                  if (!acpStopped) {
+                    sessionMetadata = { ...sessionMetadata, lifecycleState: "idle" };
+                    sessionService.updateMetadata(sessionMetadata);
+                    sessionService.sendSessionEnd();
+                  }
+                });
+              }
+            },
             onMetadataUpdate: (newMeta) => {
               const prevRalphLoop = sessionMetadata.ralphLoop;
               sessionMetadata = {
@@ -7038,10 +7248,11 @@ The automated loop has finished. Review the progress above and let me know if yo
             onUpdateConfig: (patch) => {
               writeSvampConfigPatchAcp(patch);
             },
-            onBash: async (command, cwd) => {
+            onBash: async (command, cwd, timeout) => {
+              const execTimeout = timeout || 12e4;
               const { exec } = await import('child_process');
               return new Promise((resolve2) => {
-                exec(command, { cwd: cwd || directory, timeout: 3e4, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+                exec(command, { cwd: cwd || directory, timeout: execTimeout, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
                   if (err) {
                     resolve2({ success: false, stdout: stdout || "", stderr: stderr || err.message, exitCode: err.code ?? 1 });
                   } else {
@@ -7492,7 +7703,8 @@ The automated loop has finished. Review the progress above and let me know if yo
           }
           return ids;
         },
-        supervisor
+        supervisor,
+        tunnels
       }
     );
     logger.log(`Machine service registered: svamp-machine-${machineId}`);
@@ -7691,7 +7903,6 @@ The automated loop has finished. Review the progress above and let me know if yo
     console.log(`  Log file: ${logger.logFilePath}`);
     const HEARTBEAT_INTERVAL_MS = 1e4;
     const PING_TIMEOUT_MS = 6e4;
-    const MAX_FAILURES = 60;
     const POST_RECONNECT_GRACE_MS = 2e4;
     let heartbeatRunning = false;
     let lastReconnectAt = 0;
@@ -7762,7 +7973,7 @@ The automated loop has finished. Review the progress above and let me know if yo
             if (consecutiveHeartbeatFailures === 1) {
               logger.log(`Ping failed: ${err.message}`);
             } else if (consecutiveHeartbeatFailures % 6 === 0) {
-              logger.log(`Connection down for ${consecutiveHeartbeatFailures * HEARTBEAT_INTERVAL_MS / 1e3}s (${consecutiveHeartbeatFailures}/${MAX_FAILURES})`);
+              logger.log(`Connection down for ${consecutiveHeartbeatFailures * HEARTBEAT_INTERVAL_MS / 1e3}s (${consecutiveHeartbeatFailures} failures, retrying indefinitely)`);
             }
             if (consecutiveHeartbeatFailures === 1 || consecutiveHeartbeatFailures % 3 === 0) {
               const conn = server.rpc?._connection;
@@ -7775,17 +7986,19 @@ The automated loop has finished. Review the progress above and let me know if yo
                 }
               }
               if (conn?._reader) {
-                logger.log("Aborting stale HTTP stream to trigger reconnection");
+                logger.log("Cancelling stale HTTP stream reader to trigger reconnection");
                 try {
                   conn._reader.cancel?.("Stale connection");
                 } catch {
                 }
+              } else if (conn?._abort_controller) {
+                logger.log("Aborting stale HTTP stream to trigger reconnection");
+                try {
+                  conn._abort_controller.abort();
+                } catch {
+                }
               }
             }
-            if (consecutiveHeartbeatFailures >= MAX_FAILURES) {
-              logger.log(`Heartbeat failed ${MAX_FAILURES} times. Shutting down.`);
-              requestShutdown("heartbeat-timeout", err.message);
-            }
           }
         }
       } finally {
@@ -7870,6 +8083,11 @@ The automated loop has finished. Review the progress above and let me know if yo
       }
       await supervisor.stopAll().catch(() => {
       });
+      for (const [name, client] of tunnels) {
+        client.destroy();
+        logger.log(`Tunnel '${name}' destroyed`);
+      }
+      tunnels.clear();
       artifactSync.destroy();
       try {
         await server.disconnect();
@@ -7880,8 +8098,11 @@ The automated loop has finished. Review the progress above and let me know if yo
     };
     const shutdownReq = await resolvesWhenShutdownRequested;
     await cleanup(shutdownReq.source);
-    if (process.env.SVAMP_SUPERVISED === "1" && shutdownReq.source === "version-update") {
-      process.exit(1);
+    if (process.env.SVAMP_SUPERVISED === "1") {
+      const intentionalSources = ["os-signal", "os-signal-cleanup", "hypha-app"];
+      if (!intentionalSources.includes(shutdownReq.source)) {
+        process.exit(1);
+      }
     }
     process.exit(0);
   } catch (error) {
@@ -7897,33 +8118,97 @@ The automated loop has finished. Review the progress above and let me know if yo
   }
 }
 async function stopDaemon(options) {
+  const signal = options?.cleanup ? "SIGUSR1" : "SIGTERM";
+  const mode = options?.cleanup ? "cleanup (sessions will be stopped)" : "quick (sessions preserved for auto-restore)";
+  const pidsToSignal = [];
+  const supervisorPidFile = join(SVAMP_HOME, "supervisor.pid");
+  try {
+    if (existsSync$1(supervisorPidFile)) {
+      const supervisorPid = parseInt(readFileSync$1(supervisorPidFile, "utf-8").trim(), 10);
+      if (supervisorPid && !isNaN(supervisorPid)) {
+        try {
+          process.kill(supervisorPid, 0);
+          pidsToSignal.push(supervisorPid);
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
   const state = readDaemonStateFile();
-  if (!state) {
+  if (state) {
+    try {
+      process.kill(state.pid, 0);
+      if (!pidsToSignal.includes(state.pid)) {
+        pidsToSignal.push(state.pid);
+      }
+    } catch {
+    }
+  }
+  if (pidsToSignal.length === 0) {
+    try {
+      const { execSync } = await import('child_process');
+      const pgrepOutput = execSync(
+        'pgrep -f "svamp daemon start-(supervised|sync)" 2>/dev/null || true',
+        { encoding: "utf-8" }
+      ).trim();
+      if (pgrepOutput) {
+        for (const line of pgrepOutput.split("\n")) {
+          const pid = parseInt(line.trim(), 10);
+          if (pid && !isNaN(pid) && pid !== process.pid) {
+            pidsToSignal.push(pid);
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  if (pidsToSignal.length === 0) {
     console.log("No daemon running");
+    cleanupDaemonStateFile();
     return;
   }
-  const signal = options?.cleanup ? "SIGUSR1" : "SIGTERM";
-  const mode = options?.cleanup ? "cleanup (sessions will be stopped)" : "quick (sessions preserved for auto-restore)";
-  try {
-    process.kill(state.pid, 0);
-    process.kill(state.pid, signal);
-    console.log(`Sent ${signal} to daemon PID ${state.pid} \u2014 ${mode}`);
-    for (let i = 0; i < 100; i++) {
-      await new Promise((r) => setTimeout(r, 100));
+  for (const pid of pidsToSignal) {
+    try {
+      process.kill(pid, signal);
+      console.log(`Sent ${signal} to PID ${pid} \u2014 ${mode}`);
+    } catch {
+      console.log(`PID ${pid} already gone`);
+    }
+  }
+  pidsToSignal[0];
+  for (let i = 0; i < 100; i++) {
+    await new Promise((r) => setTimeout(r, 100));
+    const anyAlive = pidsToSignal.some((pid) => {
       try {
-        process.kill(state.pid, 0);
+        process.kill(pid, 0);
+        return true;
+      } catch {
+        return false;
+      }
+    });
+    if (!anyAlive) {
+      console.log("Daemon stopped");
+      cleanupDaemonStateFile();
+      try {
+        if (existsSync$1(supervisorPidFile)) await import('fs').then((fs2) => fs2.promises.unlink(supervisorPidFile));
       } catch {
-        console.log("Daemon stopped");
-        cleanupDaemonStateFile();
-        return;
       }
+      return;
+    }
+  }
+  console.log("Daemon did not stop in time, sending SIGKILL");
+  for (const pid of pidsToSignal) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
     }
-    console.log("Daemon did not stop in time, sending SIGKILL");
-    process.kill(state.pid, "SIGKILL");
-  } catch {
-    console.log("Daemon is not running (stale state file)");
   }
   cleanupDaemonStateFile();
+  try {
+    if (existsSync$1(supervisorPidFile)) await import('fs').then((fs2) => fs2.promises.unlink(supervisorPidFile));
+  } catch {
+  }
 }
 function daemonStatus() {
   const state = readDaemonStateFile();