svamp-cli 0.1.94 → 0.1.96

package/dist/{agentCommands-Cz70sSe9.mjs → agentCommands-CJNxmnV5.mjs}

@@ -1,6 +1,7 @@
 import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import os from 'node:os';
+import { requireNotSandboxed } from './sandboxDetect-BWA3zQlA.mjs';
 
 const SVAMP_HOME = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
 function getConfigPath(sessionId) {
@@ -94,6 +95,7 @@ async function sessionSetLink(url, label) {
   console.log(`Session link set: "${resolvedLabel}" \u2192 ${url.trim()}`);
 }
 async function sessionNotify(message, level = "info") {
+  requireNotSandboxed("session notify");
   const sessionId = process.env.SVAMP_SESSION_ID;
   if (!sessionId) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
@@ -106,6 +108,7 @@ async function sessionNotify(message, level = "info") {
   console.log(`Notification sent [${level}]: ${message}`);
 }
 async function sessionBroadcast(action, args) {
+  requireNotSandboxed("session broadcast");
   const sessionId = process.env.SVAMP_SESSION_ID;
   if (!sessionId) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
@@ -145,10 +148,11 @@ async function sessionBroadcast(action, args) {
   console.log(`Broadcast sent: ${action}`);
 }
 async function connectToMachineService() {
-  const { connectAndGetMachine } = await import('./commands-Be7nMudu.mjs');
+  const { connectAndGetMachine } = await import('./commands-CFQRfeSs.mjs');
   return connectAndGetMachine();
 }
 async function inboxSend(targetSessionId, opts) {
+  requireNotSandboxed("inbox send");
   const sessionId = process.env.SVAMP_SESSION_ID;
   if (!sessionId) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
@@ -161,7 +165,7 @@ async function inboxSend(targetSessionId, opts) {
   }
   const { server, machine } = await connectToMachineService();
   try {
-    const { resolveSessionId } = await import('./commands-Be7nMudu.mjs');
+    const { resolveSessionId } = await import('./commands-CFQRfeSs.mjs');
     const sessions = await machine.listSessions();
     const match = resolveSessionId(sessions, targetSessionId);
     const fullTargetId = match.sessionId;
@@ -184,6 +188,7 @@ async function inboxSend(targetSessionId, opts) {
   }
 }
 async function inboxList(opts) {
+  requireNotSandboxed("inbox list");
   const sessionId = process.env.SVAMP_SESSION_ID;
   if (!sessionId) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
@@ -214,6 +219,7 @@ async function inboxList(opts) {
   }
 }
 async function inboxReply(messageId, body) {
+  requireNotSandboxed("inbox reply");
   const sessionId = process.env.SVAMP_SESSION_ID;
   if (!sessionId) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
@@ -252,6 +258,7 @@ async function inboxReply(messageId, body) {
   }
 }
 async function machineNotify(message, level = "info") {
+  requireNotSandboxed("machine notify");
   const machineId = process.env.SVAMP_MACHINE_ID;
   await connectAndEmit({
     type: "svamp:machine-notify",

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { b as stopDaemon, s as startDaemon, d as daemonStatus } from './run-B1p0kGdr.mjs';
+import { b as stopDaemon, s as startDaemon, d as daemonStatus } from './run-DxZEyfKG.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -204,14 +204,34 @@ async function main() {
   } else if (subcommand === "session") {
     await handleSessionCommand();
   } else if (subcommand === "machine") {
+    const { isSandboxed } = await import('./sandboxDetect-BWA3zQlA.mjs');
+    if (isSandboxed()) {
+      console.error("svamp machine: Machine commands are not available in sandboxed sessions.");
+      process.exit(1);
+    }
     await handleMachineCommand();
   } else if (subcommand === "skills") {
+    const { isSandboxed } = await import('./sandboxDetect-BWA3zQlA.mjs');
+    if (isSandboxed()) {
+      console.error("svamp skills: Skills commands are not available in sandboxed sessions.");
+      process.exit(1);
+    }
     await handleSkillsCommand();
   } else if (subcommand === "service" || subcommand === "svc") {
+    const { isSandboxed } = await import('./sandboxDetect-BWA3zQlA.mjs');
+    if (isSandboxed()) {
+      console.error("svamp service: Service commands are not available in sandboxed sessions.");
+      process.exit(1);
+    }
     const { handleServiceCommand } = await import('./commands-BYbuedOK.mjs');
     await handleServiceCommand();
   } else if (subcommand === "process" || subcommand === "proc") {
-    const { processCommand } = await import('./commands-DUkN2-4K.mjs');
+    const { isSandboxed: isSandboxedProc } = await import('./sandboxDetect-BWA3zQlA.mjs');
+    if (isSandboxedProc()) {
+      console.error("svamp process: Process commands are not available in sandboxed sessions.");
+      process.exit(1);
+    }
+    const { processCommand } = await import('./commands-D1hYL4Vi.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -229,7 +249,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-6Vk_An57.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-YOLex1RV.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -238,7 +258,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-HWBNSz_5.mjs');
+  const { runInteractive } = await import('./run-jvUqdZAp.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -283,7 +303,7 @@ async function handleAgentCommand() {
     return;
   }
   if (agentArgs[0] === "list") {
-    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.i; });
+    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.i; });
     console.log("Known agents:");
     for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
       console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
@@ -295,7 +315,7 @@ async function handleAgentCommand() {
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
     return;
   }
-  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.i; });
+  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.i; });
   let cwd = process.cwd();
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
@@ -319,12 +339,12 @@ async function handleAgentCommand() {
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
   let backend;
   if (KNOWN_MCP_AGENTS[config.agentName]) {
-    const { CodexMcpBackend } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.j; });
+    const { CodexMcpBackend } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.j; });
     backend = new CodexMcpBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.h; });
-    const { GeminiTransport } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.G; });
-    const { DefaultTransport } = await import('./run-B1p0kGdr.mjs').then(function (n) { return n.D; });
+    const { AcpBackend } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.h; });
+    const { GeminiTransport } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.G; });
+    const { DefaultTransport } = await import('./run-DxZEyfKG.mjs').then(function (n) { return n.D; });
     const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : new DefaultTransport(config.agentName);
     backend = new AcpBackend({
       agentName: config.agentName,
@@ -442,7 +462,16 @@ async function handleSessionCommand() {
     printSessionHelp();
     return;
   }
-  const { sessionList, sessionSpawn, sessionStop, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionRalphStart, sessionRalphCancel, sessionRalphStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-Be7nMudu.mjs');
+  const SANDBOX_SAFE_SESSION_CMDS = /* @__PURE__ */ new Set(["set-title", "set-link"]);
+  if (!SANDBOX_SAFE_SESSION_CMDS.has(sessionSubcommand)) {
+    const { isSandboxed } = await import('./sandboxDetect-BWA3zQlA.mjs');
+    if (isSandboxed()) {
+      console.error(`svamp session ${sessionSubcommand}: This command is not available in sandboxed sessions.`);
+      console.error("Available commands: set-title, set-link");
+      process.exit(1);
+    }
+  }
+  const { sessionList, sessionSpawn, sessionStop, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionRalphStart, sessionRalphCancel, sessionRalphStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-CFQRfeSs.mjs');
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -502,7 +531,7 @@ async function handleSessionCommand() {
         allowDomain.push(sessionArgs[++i]);
       }
     }
-    const { parseShareArg } = await import('./commands-Be7nMudu.mjs');
+    const { parseShareArg } = await import('./commands-CFQRfeSs.mjs');
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -588,7 +617,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-Be7nMudu.mjs');
+    const { sessionApprove } = await import('./commands-CFQRfeSs.mjs');
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -598,7 +627,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-Be7nMudu.mjs');
+    const { sessionDeny } = await import('./commands-CFQRfeSs.mjs');
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -634,7 +663,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-title <title>");
       process.exit(1);
     }
-    const { sessionSetTitle } = await import('./agentCommands-Cz70sSe9.mjs');
+    const { sessionSetTitle } = await import('./agentCommands-CJNxmnV5.mjs');
     await sessionSetTitle(title);
   } else if (sessionSubcommand === "set-link") {
     const url = sessionArgs[1];
@@ -643,7 +672,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
-    const { sessionSetLink } = await import('./agentCommands-Cz70sSe9.mjs');
+    const { sessionSetLink } = await import('./agentCommands-CJNxmnV5.mjs');
     await sessionSetLink(url, label);
   } else if (sessionSubcommand === "notify") {
     const message = sessionArgs[1];
@@ -652,7 +681,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const level = parseFlagStr("--level") || "info";
-    const { sessionNotify } = await import('./agentCommands-Cz70sSe9.mjs');
+    const { sessionNotify } = await import('./agentCommands-CJNxmnV5.mjs');
     await sessionNotify(message, level);
   } else if (sessionSubcommand === "broadcast") {
     const action = sessionArgs[1];
@@ -660,7 +689,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
       process.exit(1);
     }
-    const { sessionBroadcast } = await import('./agentCommands-Cz70sSe9.mjs');
+    const { sessionBroadcast } = await import('./agentCommands-CJNxmnV5.mjs');
     await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "inbox") {
     const inboxSubcmd = sessionArgs[1];
@@ -671,7 +700,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId) {
-        const { inboxSend } = await import('./agentCommands-Cz70sSe9.mjs');
+        const { inboxSend } = await import('./agentCommands-CJNxmnV5.mjs');
         await inboxSend(sessionArgs[2], {
           body: sessionArgs[3],
           subject: parseFlagStr("--subject"),
@@ -686,7 +715,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
       if (agentSessionId && !sessionArgs[2]) {
-        const { inboxList } = await import('./agentCommands-Cz70sSe9.mjs');
+        const { inboxList } = await import('./agentCommands-CJNxmnV5.mjs');
         await inboxList({
           unread: hasFlag("--unread"),
           limit: parseFlagInt("--limit"),
@@ -708,7 +737,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId && !sessionArgs[3]) {
-        const { inboxList } = await import('./agentCommands-Cz70sSe9.mjs');
+        const { inboxList } = await import('./agentCommands-CJNxmnV5.mjs');
         await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
       } else if (sessionArgs[3]) {
         await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
@@ -718,7 +747,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "reply") {
       if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
-        const { inboxReply } = await import('./agentCommands-Cz70sSe9.mjs');
+        const { inboxReply } = await import('./agentCommands-CJNxmnV5.mjs');
         await inboxReply(sessionArgs[2], sessionArgs[3]);
       } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
         await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
@@ -754,7 +783,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-Be7nMudu.mjs');
+    const { machineShare } = await import('./commands-CFQRfeSs.mjs');
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -784,7 +813,7 @@ async function handleMachineCommand() {
     }
     await machineShare(machineId, { add, remove, list, configPath, showConfig });
   } else if (machineSubcommand === "exec") {
-    const { machineExec } = await import('./commands-Be7nMudu.mjs');
+    const { machineExec } = await import('./commands-CFQRfeSs.mjs');
     let machineId;
     let cwd;
     const cmdParts = [];
@@ -804,7 +833,7 @@ async function handleMachineCommand() {
     }
     await machineExec(machineId, command, cwd);
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-Be7nMudu.mjs');
+    const { machineInfo } = await import('./commands-CFQRfeSs.mjs');
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -824,10 +853,10 @@ async function handleMachineCommand() {
         level = machineArgs[++i];
       }
     }
-    const { machineNotify } = await import('./agentCommands-Cz70sSe9.mjs');
+    const { machineNotify } = await import('./agentCommands-CJNxmnV5.mjs');
     await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-Be7nMudu.mjs');
+    const { machineLs } = await import('./commands-CFQRfeSs.mjs');
     let machineId;
     let showHidden = false;
     let path;

package/dist/{commands-Be7nMudu.mjs → commands-CFQRfeSs.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { resolve, join } from 'node:path';
 import os from 'node:os';
-import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-B1p0kGdr.mjs';
+import { l as loadSecurityContextConfig, e as resolveSecurityContext, f as buildSecurityContextFromFlags, m as mergeSecurityContexts, c as connectToHypha } from './run-DxZEyfKG.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-DUkN2-4K.mjs → commands-D1hYL4Vi.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-Be7nMudu.mjs';
+import { connectAndGetMachine } from './commands-CFQRfeSs.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-B1p0kGdr.mjs';
+import './run-DxZEyfKG.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-B1p0kGdr.mjs';
+export { c as connectToHypha, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, a as registerSessionService, s as startDaemon, b as stopDaemon } from './run-DxZEyfKG.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-6Vk_An57.mjs → package-YOLex1RV.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.1.94";
+var version = "0.1.96";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -19,7 +19,7 @@ var exports$1 = {
 var scripts = {
 	build: "rm -rf dist && tsc --noEmit && pkgroll",
 	typecheck: "tsc --noEmit",
-	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-session-rpc-dispatch.mjs",
+	test: "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs",
 	"test:hypha": "node --no-warnings test/test-hypha-service.mjs",
 	dev: "tsx src/cli.ts",
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",

package/dist/{run-B1p0kGdr.mjs → run-DxZEyfKG.mjs}

@@ -1,5 +1,5 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os__default from 'os';
-import fs, { mkdir as mkdir$1, readdir, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
+import fs, { mkdir as mkdir$1, readdir as readdir$1, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
 import { readFileSync as readFileSync$1, mkdirSync, writeFileSync, renameSync, existsSync as existsSync$1, copyFileSync, unlinkSync, watch, rmdirSync } from 'fs';
 import path__default, { join, dirname, resolve, basename } from 'path';
 import { fileURLToPath } from 'url';
@@ -15,7 +15,7 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js';
 import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 import { ElicitRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { z } from 'zod';
-import { mkdir, rm, chmod, access, mkdtemp, copyFile, writeFile } from 'node:fs/promises';
+import { mkdir, rm, chmod, access, mkdtemp, copyFile, writeFile, stat, readdir } from 'node:fs/promises';
 import { promisify } from 'node:util';
 
 let connectToServerFn = null;
@@ -381,12 +381,42 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       config: { visibility: "unlisted", require_context: true },
       // Machine info
       getMachineInfo: async (context) => {
-        authorizeRequest(context, currentMetadata.sharing, "view");
+        let hasMachineAccess = false;
+        try {
+          authorizeRequest(context, currentMetadata.sharing, "view");
+          hasMachineAccess = true;
+        } catch {
+        }
+        if (hasMachineAccess) {
+          return {
+            machineId,
+            metadata: currentMetadata,
+            metadataVersion,
+            daemonState: currentDaemonState,
+            daemonStateVersion
+          };
+        }
+        const sessionIds = handlers.getSessionIds?.() || [];
+        let hasSessionAccess = false;
+        for (const sid of sessionIds) {
+          const rpc = handlers.getSessionRPCHandlers?.(sid);
+          if (!rpc) continue;
+          try {
+            await rpc.getMetadata(context);
+            hasSessionAccess = true;
+            break;
+          } catch {
+          }
+        }
+        if (!hasSessionAccess) {
+          throw new Error("Access denied: no machine or session-level access");
+        }
+        const { sharing: _s, securityContextConfig: _sc, ...safeMetadata } = currentMetadata;
         return {
           machineId,
-          metadata: currentMetadata,
+          metadata: safeMetadata,
           metadataVersion,
-          daemonState: currentDaemonState,
+          daemonState: { status: currentDaemonState.status },
           daemonStateVersion
         };
       },
@@ -400,16 +430,42 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         };
       },
       // List active sessions on this machine
+      // If machine sharing grants access, return all. Otherwise return only
+      // sessions whose own sharing config grants access to this user.
       listSessions: async (context) => {
-        authorizeRequest(context, currentMetadata.sharing, "view");
-        return handlers.getTrackedSessions();
+        let hasMachineAccess = false;
+        try {
+          authorizeRequest(context, currentMetadata.sharing, "view");
+          hasMachineAccess = true;
+        } catch {
+        }
+        const tracked = handlers.getTrackedSessions();
+        if (hasMachineAccess) return tracked;
+        const result = [];
+        for (const t of tracked) {
+          const rpc = handlers.getSessionRPCHandlers?.(t.sessionId);
+          if (!rpc) continue;
+          try {
+            const meta = await rpc.getMetadata(context);
+            result.push(t);
+          } catch {
+          }
+        }
+        return result;
       },
       /**
        * Get summary info for all sessions (metadata, agent state, activity).
        * Replaces the need to discover and query N individual session services.
+       * For session-shared users (no machine-level access), only returns
+       * sessions whose sharing config grants them access.
        */
       getSessions: async (context) => {
-        authorizeRequest(context, currentMetadata.sharing, "view");
+        let hasMachineAccess = false;
+        try {
+          authorizeRequest(context, currentMetadata.sharing, "view");
+          hasMachineAccess = true;
+        } catch {
+        }
         const sessionIds = handlers.getSessionIds?.() || [];
         const sessions = [];
         for (const sid of sessionIds) {
@@ -446,11 +502,21 @@ async function registerMachineService(server, machineId, metadata, daemonState,
        * eliminating the need for per-session Hypha service registration.
        */
       sessionRPC: async (sessionId, method, kwargs, context) => {
-        authorizeRequest(context, currentMetadata.sharing, "view");
         const rpc = handlers.getSessionRPCHandlers?.(sessionId);
         if (!rpc) {
           throw new Error(`Session ${sessionId} not found on this machine`);
         }
+        try {
+          authorizeRequest(context, currentMetadata.sharing, "view");
+        } catch (machineErr) {
+          try {
+            const meta = await rpc.getMetadata(context);
+            const sessionSharing = meta?.metadata?.sharing;
+            authorizeRequest(context, sessionSharing, "view");
+          } catch {
+            throw machineErr;
+          }
+        }
         const handler = rpc[method];
         if (typeof handler !== "function") {
           throw new Error(`Unknown session method: ${method}`);
@@ -466,11 +532,21 @@ async function registerMachineService(server, machineId, metadata, daemonState,
        * Delegates to the session store's registerListener.
        */
       registerSessionListener: async (sessionId, callback, context) => {
-        authorizeRequest(context, currentMetadata.sharing, "view");
         const rpc = handlers.getSessionRPCHandlers?.(sessionId);
         if (!rpc) {
           throw new Error(`Session ${sessionId} not found on this machine`);
         }
+        try {
+          authorizeRequest(context, currentMetadata.sharing, "view");
+        } catch (machineErr) {
+          try {
+            const meta = await rpc.getMetadata(context);
+            const sessionSharing = meta?.metadata?.sharing;
+            authorizeRequest(context, sessionSharing, "view");
+          } catch {
+            throw machineErr;
+          }
+        }
         return await rpc.registerListener(callback, context);
       },
       // Spawn a new session
@@ -4343,6 +4419,12 @@ async function stageCredentialsForSharing(sessionId) {
     } catch {
     }
   }
+  const realSkillsDir = join$1(realClaudeDir, "skills");
+  const stagedSkillsDir = join$1(stagedClaudeDir, "skills");
+  try {
+    await copyDirRecursive(realSkillsDir, stagedSkillsDir);
+  } catch {
+  }
   return {
     homePath: tmpHome,
     env: { HOME: tmpHome },
@@ -4359,6 +4441,21 @@ function sanitizeEnvForSharing(env) {
   }
   return sanitized;
 }
+async function copyDirRecursive(src, dest) {
+  const srcStat = await stat(src);
+  if (!srcStat.isDirectory()) return;
+  await mkdir(dest, { recursive: true });
+  const entries = await readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = join$1(src, entry.name);
+    const destPath = join$1(dest, entry.name);
+    if (entry.isDirectory()) {
+      await copyDirRecursive(srcPath, destPath);
+    } else if (entry.isFile()) {
+      await copyFile(srcPath, destPath);
+    }
+  }
+}
 
 const DEFAULT_PROBE_INTERVAL_S = 10;
 const DEFAULT_PROBE_TIMEOUT_S = 5;
@@ -4554,7 +4651,7 @@ class ProcessSupervisor {
   async loadAll() {
     let files;
     try {
-      files = await readdir(this.persistDir);
+      files = await readdir$1(this.persistDir);
     } catch {
       return;
     }
@@ -6837,6 +6934,7 @@ The automated loop has finished. Review the progress above and let me know if yo
               logger.log(`[Session ${sessionId}] Inbox message received (urgency: ${message.urgency || "normal"}, from: ${message.from || "unknown"})`);
               const formatted = formatInboxMessageXml(message);
               sessionService.pushMessage(formatted, "user");
+              sessionService.markInboxRead(message.messageId);
               if (message.urgency === "urgent") {
                 logger.log(`[Session ${sessionId}] Delivering urgent inbox message to agent`);
                 if (!claudeProcess || claudeProcess.exitCode !== null) {
@@ -7262,6 +7360,7 @@ The automated loop has finished. Review the progress above and let me know if yo
               logger.log(`[${agentName} Session ${sessionId}] Inbox message received (urgency: ${message.urgency || "normal"}, from: ${message.from || "unknown"})`);
               const formatted = formatInboxMessageXml(message);
               sessionService.pushMessage(formatted, "user");
+              sessionService.markInboxRead(message.messageId);
               if (message.urgency === "urgent" && acpBackendReady) {
                 logger.log(`[${agentName} Session ${sessionId}] Delivering urgent inbox message to agent`);
                 sessionMetadata = { ...sessionMetadata, lifecycleState: "running" };

package/dist/{run-HWBNSz_5.mjs → run-jvUqdZAp.mjs}

@@ -2,7 +2,7 @@ import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(im
 import os from 'node:os';
 import { join, resolve } from 'node:path';
 import { mkdirSync, writeFileSync, existsSync, unlinkSync, readFileSync, watch } from 'node:fs';
-import { c as connectToHypha, a as registerSessionService } from './run-B1p0kGdr.mjs';
+import { c as connectToHypha, a as registerSessionService } from './run-DxZEyfKG.mjs';
 import { createServer } from 'node:http';
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';

package/dist/sandboxDetect-BWA3zQlA.mjs

@@ -0,0 +1,27 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import os from 'node:os';
+
+function isSandboxed() {
+  if (!process.env.SVAMP_SESSION_ID) return false;
+  if (process.env.HYPHA_TOKEN) return false;
+  const svampHome = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+  const envFile = join(svampHome, ".env");
+  try {
+    if (existsSync(envFile)) {
+      const content = readFileSync(envFile, "utf-8");
+      if (content.includes("HYPHA_TOKEN=")) return false;
+    }
+  } catch {
+  }
+  return true;
+}
+const SANDBOX_BLOCKED_MSG = "This command is not available in sandboxed sessions. Available commands: set-title, set-link";
+function requireNotSandboxed(commandName) {
+  if (isSandboxed()) {
+    console.error(`${commandName}: ${SANDBOX_BLOCKED_MSG}`);
+    process.exit(1);
+  }
+}
+
+export { SANDBOX_BLOCKED_MSG, isSandboxed, requireNotSandboxed };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.1.94",
+  "version": "0.1.96",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-session-rpc-dispatch.mjs",
+    "test": "npx tsx test/test-authorize.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-ralph-loop.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-ralph-loop-integration.mjs && npx tsx test/test-ralph-loop-modes.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",