svamp-cli 0.2.176 → 0.2.178

package/dist/{serveCommands-Crb8ENkv.mjs → serveCommands-BFWBxK8L.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-DGkX7Kcr.mjs');
+  const { connectAndGetMachine } = await import('./commands-MjIkmrmC.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-DGkX7Kcr.mjs');
+  const { connectAndGetMachine } = await import('./commands-MjIkmrmC.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-DGkX7Kcr.mjs');
+  const { connectAndGetMachine } = await import('./commands-MjIkmrmC.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-DGkX7Kcr.mjs');
+  const { connectAndGetMachine } = await import('./commands-MjIkmrmC.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-DGkX7Kcr.mjs');
+  const { connectAndGetMachine } = await import('./commands-MjIkmrmC.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-DQByExEO.mjs → serveManager-DXm1bdoU.mjs}

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-BmpyfykC.mjs';
+import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-B-1WDymr.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -733,7 +733,7 @@ class ServeManager {
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Bm7BrLan.mjs');
+      const { FrpcTunnel } = await import('./frpc-D4x74mG6.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-B4L2zR2U.mjs → sideband-Da1VG2iq.mjs}

@@ -1,4 +1,4 @@
-import { z as READ_ONLY_TOOLS, A as loadMachineContext, B as buildMachineInstructions, C as machineToolsForRole, D as buildMachineTools } from './run-BmpyfykC.mjs';
+import { R as READ_ONLY_TOOLS, y as loadMachineContext, z as buildMachineInstructions, A as machineToolsForRole, B as buildMachineTools } from './run-B-1WDymr.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.176",
+  "version": "0.2.178",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist bin/skills && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/loop bin/skills/loop && cp -r ../../skills/crew bin/skills/crew && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-loop-activation.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-routine.mjs && npx tsx test/test-routine-rpc.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-loop-activation.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",

package/bin/skills/loop/bin/routine-cli.mjs

@@ -1,121 +0,0 @@
-#!/usr/bin/env node
-// routine-cli.mjs — manage + run routines.
-//   add/list/remove/enable/disable/run-now  — CRUD + manual fire
-//   serve [--port N]                         — scheduler tick + webhook HTTP server
-//
-// Delivery uses the svamp CLI: a fired routine becomes a message (or loop
-// kickoff) into the bound session via `svamp session send`.
-import { execFileSync } from 'node:child_process';
-import { createServer } from 'node:http';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { RoutineStore } from './routine-store.mjs';
-import { RoutineRunner } from './routine-runner.mjs';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-const LOOP_INIT = join(HERE, 'loop-init.mjs');
-
-function parseArgs(argv) {
-  const a = { _: [] };
-  for (let i = 0; i < argv.length; i++) {
-    const t = argv[i];
-    if (t.startsWith('--')) a[t.slice(2)] = (argv[i + 1] && !argv[i + 1].startsWith('--')) ? argv[++i] : true;
-    else a._.push(t);
-  }
-  return a;
-}
-
-// ---- real delivery via svamp CLI ---------------------------------------
-async function cliDeliver({ routine, resolved }) {
-  const sid = routine.session_id;
-  if (resolved.kind === 'message') {
-    execFileSync('svamp', ['session', 'send', sid, resolved.text], { stdio: 'pipe' });
-    return;
-  }
-  // loop action: set up the loop in the project dir, then kick the session.
-  const dir = routine.action.loop?.dir || routine.dir;
-  if (dir) {
-    const initArgs = [LOOP_INIT, resolve(dir), '--task', resolved.task || routine.action.loop?.task || '(task)'];
-    if (routine.action.loop?.oracle) initArgs.push('--oracle', routine.action.loop.oracle);
-    initArgs.push('--evaluator', routine.action.loop?.evaluator || 'off');
-    execFileSync(process.execPath, initArgs, { stdio: 'pipe' });
-  }
-  execFileSync('svamp', ['session', 'send', sid,
-    `Begin the loop (LOOP MODE). Task: ${resolved.task}. Iterate until the gate lets you stop.`], { stdio: 'pipe' });
-}
-
-function buildRoutineFromArgs(a) {
-  const r = { session_id: a.session, name: a.name || 'routine', overlap: a.overlap || 'queue' };
-  if (a.schedule) r.trigger = { type: 'schedule', cron: a.schedule, missed: a.missed || 'skip', tz: a.tz };
-  else if (a.webhook || a.api) r.trigger = { type: a.api ? 'api' : 'webhook', methods: a.get ? ['GET'] : ['GET', 'POST'], public: !!a.public };
-  else r.trigger = { type: 'manual' };
-  if (a.loop) r.action = { kind: 'loop', task_template: a.task || '', loop: { dir: a.dir, oracle: a.oracle, evaluator: a.evaluator || 'off' } };
-  else r.action = { kind: 'message', template: a.message || a.task || 'run' };
-  return r;
-}
-
-async function main() {
-  const a = parseArgs(process.argv.slice(2));
-  const cmd = a._[0];
-  const store = new RoutineStore();
-  const runner = new RoutineRunner({ store, deliver: cliDeliver, log: console.error });
-
-  switch (cmd) {
-    case 'add': {
-      if (!a.session) { console.error('--session <id> required'); process.exit(1); }
-      const r = store.save(buildRoutineFromArgs(a));
-      console.log(`✅ added routine ${r.id} (${r.name}) trigger=${r.trigger.type} action=${r.action.kind}`);
-      if (r.trigger.key) console.log(`   webhook key: ${r.trigger.key}`);
-      break;
-    }
-    case 'list': {
-      const rs = store.list();
-      if (a.json) { console.log(JSON.stringify(rs, null, 2)); break; }
-      if (!rs.length) { console.log('(no routines)'); break; }
-      for (const r of rs) console.log(`${r.enabled ? '●' : '○'} ${r.id}  ${r.name}  [${r.trigger.type}${r.trigger.cron ? ' ' + r.trigger.cron : ''}] -> ${r.action.kind}  session=${r.session_id}`);
-      break;
-    }
-    case 'remove': ok(store.remove(a._[1]), `removed ${a._[1]}`); break;
-    case 'enable': store.setEnabled(a._[1], true); console.log(`enabled ${a._[1]}`); break;
-    case 'disable': store.setEnabled(a._[1], false); console.log(`disabled ${a._[1]}`); break;
-    case 'run-now': console.log(JSON.stringify(await runner.runNow(a._[1], {}), null, 2)); break;
-    case 'serve': await serve(runner, store, Number(a.port) || 8722); break;
-    default:
-      console.log(`usage: routine-cli <add|list|remove|enable|disable|run-now|serve>
-  add --session <id> --name <n> [--schedule "*/5 * * * *" [--missed catchup]] [--webhook|--api [--get] [--public]] (--message "..." | --loop --dir <path> --task "..." [--oracle "cmd"])
-  serve [--port 8722]`);
-  }
-  function ok(c, m) { console.log(c ? '✅ ' + m : '✗ ' + m); }
-}
-
-async function serve(runner, store, port) {
-  // catch up missed schedules, then tick every 20s (per-minute dedupe inside).
-  await runner.catchUp(new Date(Date.now() - 24 * 3600 * 1000), new Date());
-  const timer = setInterval(() => { runner.tick(new Date()).catch((e) => console.error('tick error', e)); }, 20000);
-
-  const server = createServer((req, res) => {
-    const u = new URL(req.url, `http://localhost:${port}`);
-    if (u.pathname === '/' || u.pathname === '/health') { res.writeHead(200).end('routines ok'); return; }
-    const m = u.pathname.match(/^\/routine\/([\w.-]+)$/);
-    if (!m) { res.writeHead(404).end('not found'); return; }
-    const id = m[1];
-    const key = u.searchParams.get('key');
-    const query = Object.fromEntries(u.searchParams.entries());
-    let chunks = '';
-    req.on('data', (c) => { chunks += c; if (chunks.length > 1e6) req.destroy(); });
-    req.on('end', async () => {
-      let body = {}; try { body = chunks ? JSON.parse(chunks) : {}; } catch {}
-      const result = await runner.webhook(id, { key, method: req.method, body, query });
-      res.writeHead(result.status || 200, { 'content-type': 'application/json' }).end(JSON.stringify(result));
-    });
-  });
-  server.listen(port, () => {
-    console.log(`🪝 routine server on http://localhost:${port}`);
-    console.log(`   webhook URL pattern: http://localhost:${port}/routine/<id>?key=<key>`);
-    console.log(`   expose publicly:  svamp service expose routines --port ${port}`);
-    console.log(`   scheduler: ticking every 20s`);
-  });
-  process.on('SIGINT', () => { clearInterval(timer); server.close(); process.exit(0); });
-}
-
-main().catch((e) => { console.error(e); process.exit(1); });

package/bin/skills/loop/bin/routine-runner.mjs

@@ -1,125 +0,0 @@
-#!/usr/bin/env node
-// routine-runner.mjs — fires routines (schedule tick / webhook / manual),
-// applies overlap + missed-run policies, and delivers the resolved action
-// (message | loop) via an injectable `deliver` fn. Pure logic; the actual
-// CLI delivery + timer + HTTP server live in routine-cli.mjs.
-import { cronMatches, renderTemplate, nextFire, inZone } from './routine-core.mjs';
-
-const minuteKey = (d) => `${d.getFullYear()}-${d.getMonth()}-${d.getDate()}-${d.getHours()}-${d.getMinutes()}`;
-
-export class RoutineRunner {
-  /** @param {{store, deliver:(ctx)=>Promise<any>, now?:()=>Date, onReplace?:(id)=>void, log?:Function}} o */
-  constructor({ store, deliver, now = () => new Date(), onReplace, log = () => {} }) {
-    this.store = store; this.deliver = deliver; this.now = now; this.onReplace = onReplace; this.log = log;
-    this.active = new Set();           // routine ids with an in-flight loop run
-    this._firedMinute = new Map();     // id -> minuteKey (in-memory dedupe within a process)
-  }
-
-  resolveAction(routine, payload = {}) {
-    const ctx = { ...payload, now: this.now().toISOString(), routine: { id: routine.id, name: routine.name } };
-    const a = routine.action;
-    if (a.kind === 'message') return { kind: 'message', text: renderTemplate(a.template, ctx) };
-    const task = renderTemplate(a.task_template || a.loop?.task || '', ctx);
-    return { kind: 'loop', task, loop: a.loop };
-  }
-
-  markDone(id) { this.active.delete(id); }
-
-  /** Deliveries counted today via a dedicated counter (NOT derived from the
-   * capped last_runs audit, which would undercount past 20 runs/day). */
-  _deliveredToday(routine) {
-    const today = this.now().toDateString();
-    return routine.daily && routine.daily.date === today ? routine.daily.n : 0;
-  }
-
-  /** Core fire path with overlap + daily-cap policy. via = 'schedule'|'webhook'|'api'|'manual'.
-   * NOTE: `active` guards genuinely CONCURRENT in-flight deliveries only — the runner
-   * cannot observe a spawned loop's full duration (delivery is fire-and-forget), so it
-   * is cleared once delivery returns. True loop-duration overlap needs a loop-state
-   * signal (future). `replace` calls onReplace (best-effort) then proceeds. */
-  async fire(routine, payload = {}, via = 'manual') {
-    if (!routine.enabled) return { skipped: 'disabled' };
-    // Defense-in-depth (also enforced at validate time): never run a loop action
-    // from a public/keyless webhook (unauthenticated task injection).
-    if (routine.action?.kind === 'loop' && (routine.trigger?.type === 'webhook' || routine.trigger?.type === 'api') && routine.trigger?.public)
-      return { skipped: 'forbidden (public webhook + loop)' };
-    const today = this.now().toDateString();
-    // Reserve a daily slot SYNCHRONOUSLY (before any await) so concurrent fires
-    // serialize on the JS event loop and cannot all read n=0 and over-deliver.
-    const r0 = this.store.get(routine.id) || routine;
-    const usedToday = (r0.daily && r0.daily.date === today) ? r0.daily.n : 0;
-    if (routine.daily_cap && usedToday >= routine.daily_cap) {
-      this.store.recordRun(routine.id, { via, delivered: routine.action.kind, outcome: 'skipped (daily cap)' });
-      return { skipped: 'daily_cap' };
-    }
-    if (this.active.has(routine.id)) {
-      if (routine.overlap === 'skip') { this.store.recordRun(routine.id, { via, delivered: routine.action.kind, outcome: 'skipped (busy)' }); return { skipped: 'busy' }; }
-      if (routine.overlap === 'replace') { try { this.onReplace?.(routine.id); } catch {} }
-      // 'queue'/'replace' -> proceed
-    }
-    this.active.add(routine.id);
-    if (routine.daily_cap) { r0.daily = { date: today, n: usedToday + 1 }; this.store.save(r0); } // reserve
-    const resolved = this.resolveAction(routine, payload);
-    let outcome = 'delivered';
-    try {
-      await this.deliver({ routine, action: routine.action, resolved, payload, via });
-    } catch (e) {
-      outcome = 'error: ' + (e?.message || e);
-      if (routine.daily_cap) { const rb = this.store.get(routine.id); if (rb?.daily?.date === today && rb.daily.n > 0) { rb.daily.n -= 1; this.store.save(rb); } } // roll back reservation
-    } finally { this.active.delete(routine.id); }
-    const r = this.store.get(routine.id) || routine;
-    r.last_fired_at = this.now().toISOString();
-    r.last_runs = [{ firedAt: r.last_fired_at, via, delivered: resolved.kind, outcome }, ...(r.last_runs || [])].slice(0, 20);
-    this.store.save(r);
-    return { fired: true, via, resolved, outcome };
-  }
-
-  /** Schedule tick — fire any matching schedule routine once per minute. */
-  async tick(date = this.now()) {
-    const results = [];
-    for (const r of this.store.list()) {
-      if (!r.enabled || r.trigger?.type !== 'schedule') continue;
-      if (!cronMatches(r.trigger.cron, inZone(date, r.trigger.tz))) continue;
-      const mk = minuteKey(date);
-      if (this._firedMinute.get(r.id) === mk) continue; // already fired this minute
-      this._firedMinute.set(r.id, mk);
-      results.push({ id: r.id, ...(await this.fire(r, { tick: date.toISOString() }, 'schedule')) });
-    }
-    return results;
-  }
-
-  /** Webhook/api fire: validate key + method, then fire with payload. */
-  async webhook(id, { key, method = 'POST', body = {}, query = {} } = {}) {
-    const r = this.store.get(id);
-    if (!r) return { status: 404, error: 'routine not found' };
-    if (r.trigger?.type !== 'webhook' && r.trigger?.type !== 'api') return { status: 400, error: 'not a webhook routine' };
-    if (!r.enabled) return { status: 409, error: 'routine disabled' };
-    if (!r.trigger.public && r.trigger.key && key !== r.trigger.key) return { status: 401, error: 'bad key' };
-    const methods = r.trigger.methods || ['GET', 'POST'];
-    if (!methods.includes(method)) return { status: 405, error: 'method not allowed' };
-    const res = await this.fire(r, { body, query }, r.trigger.type);
-    return { status: 200, ...res };
-  }
-
-  async runNow(id, payload = {}) {
-    const r = this.store.get(id);
-    if (!r) return { error: 'not found' };
-    return this.fire(r, payload, 'manual');
-  }
-
-  /** On startup, fire schedule routines whose time was missed while down (catchup). */
-  async catchUp(sinceDate, nowDate = this.now()) {
-    const results = [];
-    for (const r of this.store.list()) {
-      if (!r.enabled || r.trigger?.type !== 'schedule' || r.trigger.missed !== 'catchup') continue;
-      const deadlineMs = (r.trigger.deadline_sec || 3600) * 1000;
-      const since = new Date(Math.max(sinceDate.getTime(), nowDate.getTime() - deadlineMs));
-      const due = nextFire(r.trigger.cron, since, r.trigger.tz);   // first scheduled time after `since` (in the routine's tz)
-      if (due && due <= nowDate) {
-        const last = r.last_fired_at ? new Date(r.last_fired_at) : new Date(0);
-        if (last < due) results.push({ id: r.id, ...(await this.fire(r, { catchup: due.toISOString() }, 'schedule')) });
-      }
-    }
-    return results;
-  }
-}

package/bin/skills/loop/bin/routine-store.mjs

@@ -1,49 +0,0 @@
-#!/usr/bin/env node
-// routine-store.mjs — persistence + CRUD for routine specs.
-// Specs live as JSON files under a routines dir (default ~/.svamp/routines/),
-// one file per routine, atomic writes, restored on restart.
-import { mkdirSync, writeFileSync, renameSync, readdirSync, readFileSync, rmSync, existsSync } from 'node:fs';
-import { homedir } from 'node:os';
-import { join } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { validateRoutine } from './routine-core.mjs';
-
-export function defaultRoutinesDir() {
-  return process.env.SVAMP_ROUTINES_DIR || join(homedir(), '.svamp', 'routines');
-}
-const genId = () => 'rt_' + randomBytes(5).toString('hex');
-const genKey = () => randomBytes(18).toString('base64url');
-
-export class RoutineStore {
-  constructor(dir = defaultRoutinesDir()) { this.dir = dir; mkdirSync(dir, { recursive: true }); }
-  _path(id) { return join(this.dir, `${id}.json`); }
-
-  list() {
-    return readdirSync(this.dir).filter((f) => f.endsWith('.json')).map((f) => {
-      try { return JSON.parse(readFileSync(join(this.dir, f), 'utf8')); } catch { return null; }
-    }).filter(Boolean);
-  }
-  get(id) { try { return JSON.parse(readFileSync(this._path(id), 'utf8')); } catch { return null; } }
-
-  /** Create/update. Assigns id, key (for webhook/api), defaults; validates. */
-  save(routine) {
-    const r = { overlap: 'queue', enabled: true, last_runs: [], ...routine };
-    if (!r.id) r.id = genId();
-    if ((r.trigger?.type === 'webhook' || r.trigger?.type === 'api') && !r.trigger.key) r.trigger.key = genKey();
-    const errs = validateRoutine(r);
-    if (errs.length) throw new Error('invalid routine: ' + errs.join('; '));
-    const tmp = this._path(r.id) + '.tmp';
-    writeFileSync(tmp, JSON.stringify(r, null, 2));
-    renameSync(tmp, this._path(r.id));
-    return r;
-  }
-  remove(id) { const p = this._path(id); if (existsSync(p)) { rmSync(p); return true; } return false; }
-  setEnabled(id, enabled) { const r = this.get(id); if (!r) return null; r.enabled = enabled; return this.save(r); }
-
-  /** Append a capped run-history entry. */
-  recordRun(id, entry) {
-    const r = this.get(id); if (!r) return null;
-    r.last_runs = [{ firedAt: new Date().toISOString(), ...entry }, ...(r.last_runs || [])].slice(0, 20);
-    return this.save(r);
-  }
-}

package/bin/skills/loop/routines.process.yaml

@@ -1,20 +0,0 @@
-# Supervised routine server — run the scheduler + webhook dispatcher persistently.
-#   svamp process apply skills/loop/routines.process.yaml
-#   svamp service expose routines --port 8722   # public capability URLs
-# Adjust the absolute path to wherever the loop skill is installed.
-id: routines
-name: routines
-command: node
-args:
-  - "/Users/weio/workspace/hypha-cloud/skills/loop/bin/routine-cli.mjs"
-  - "serve"
-  - "--port"
-  - "8722"
-workdir: /Users/weio/workspace/hypha-cloud
-env:
-  SVAMP_ROUTINES_DIR: "/Users/weio/.svamp/routines"
-keepAlive: true
-probe:
-  type: http
-  port: 8722
-  path: /health

package/bin/skills/loop/test/test-routine-engine.mjs

@@ -1,122 +0,0 @@
-#!/usr/bin/env node
-// Deterministic tests for routine-store + routine-runner (mock delivery, fake clock).
-import { mkdtempSync, rmSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { RoutineStore } from '../bin/routine-store.mjs';
-import { RoutineRunner } from '../bin/routine-runner.mjs';
-
-let pass = 0, fail = 0;
-function ok(c, m) { if (c) { pass++; console.log(`  ✓ ${m}`); } else { fail++; console.log(`  ✗ ${m}`); } }
-const D = (y, mo, d, h, mi) => new Date(y, mo - 1, d, h, mi, 0, 0);
-
-const dirs = [];
-function freshStore() { const dir = mkdtempSync(join(tmpdir(), 'routines-')); dirs.push(dir); return new RoutineStore(dir); }
-
-try {
-  console.log('store');
-  { const s = freshStore();
-    const r = s.save({ session_id: 's1', name: 'hook', trigger: { type: 'webhook' }, action: { kind: 'message', template: 'hi ${body.x}' } });
-    ok(r.id?.startsWith('rt_'), 'save assigns id');
-    ok(typeof r.trigger.key === 'string' && r.trigger.key.length > 10, 'webhook routine gets a capability key');
-    ok(s.get(r.id).name === 'hook', 'get round-trips');
-    ok(s.list().length === 1, 'list returns saved routine');
-    s.setEnabled(r.id, false); ok(s.get(r.id).enabled === false, 'setEnabled persists');
-    ok(s.remove(r.id) === true && s.list().length === 0, 'remove deletes'); }
-
-  console.log('resolveAction (templating)');
-  { const s = freshStore();
-    const runner = new RoutineRunner({ store: s, deliver: async () => {}, now: () => D(2026, 6, 10, 9, 0) });
-    const msg = s.save({ session_id: 's', name: 'm', trigger: { type: 'manual' }, action: { kind: 'message', template: 'PR ${body.pr}' } });
-    ok(runner.resolveAction(msg, { body: { pr: 7 } }).text === 'PR 7', 'message action templated');
-    const lp = s.save({ session_id: 's', name: 'l', trigger: { type: 'webhook' }, action: { kind: 'loop', task_template: 'fix ${body.issue}' } });
-    const r = runner.resolveAction(lp, { body: { issue: 'X' } });
-    ok(r.kind === 'loop' && r.task === 'fix X', 'loop action task templated'); }
-
-  console.log('schedule tick (fire once per minute)');
-  { const s = freshStore();
-    let clock = D(2026, 6, 10, 9, 5);
-    const calls = [];
-    const runner = new RoutineRunner({ store: s, deliver: async (c) => calls.push(c), now: () => clock });
-    s.save({ session_id: 's', name: 'poll', trigger: { type: 'schedule', cron: '*/5 * * * *' }, action: { kind: 'message', template: 'tick' } });
-    await runner.tick(D(2026, 6, 10, 9, 3)); ok(calls.length === 0, 'no fire at non-matching minute 9:03');
-    await runner.tick(D(2026, 6, 10, 9, 5)); ok(calls.length === 1, 'fires at matching minute 9:05');
-    await runner.tick(D(2026, 6, 10, 9, 5)); ok(calls.length === 1, 'does not double-fire same minute');
-    await runner.tick(D(2026, 6, 10, 9, 10)); ok(calls.length === 2, 'fires again next matching minute');
-    ok(s.list()[0].last_runs.length === 2, 'run history recorded'); }
-
-  console.log('overlap policy (concurrent in-flight guard)');
-  { const s = freshStore();
-    const calls = []; let release; const gate = new Promise((r) => { release = r; });
-    const runner = new RoutineRunner({ store: s, deliver: async () => { calls.push(1); await gate; } });
-    const r = s.save({ session_id: 's', name: 'l', overlap: 'skip', trigger: { type: 'manual' }, action: { kind: 'loop', task_template: 'go' } });
-    const p1 = runner.fire(s.get(r.id), {}, 'manual');          // enters deliver, holds active
-    await new Promise((res) => setTimeout(res, 10));
-    const res2 = await runner.fire(s.get(r.id), {}, 'manual');  // concurrent -> skipped
-    ok(res2.skipped === 'busy' && calls.length === 1, 'overlap=skip skips a concurrent fire');
-    release(); await p1;                                         // first delivery completes -> active cleared
-    const res3 = await runner.fire(s.get(r.id), {}, 'manual');
-    ok(res3.fired && calls.length === 2, 'fires again once the in-flight delivery completes (no permanent skip)'); }
-
-  console.log('webhook dispatch + key/method checks');
-  { const s = freshStore();
-    const calls = [];
-    const runner = new RoutineRunner({ store: s, deliver: async (c) => calls.push(c) });
-    const r = s.save({ session_id: 's', name: 'wh', trigger: { type: 'webhook', methods: ['POST'] }, action: { kind: 'message', template: 'got ${body.v}' } });
-    const key = s.get(r.id).trigger.key;
-    ok((await runner.webhook(r.id, { key: 'wrong', method: 'POST' })).status === 401, 'bad key -> 401');
-    ok((await runner.webhook(r.id, { key, method: 'GET' })).status === 405, 'disallowed method -> 405');
-    const good = await runner.webhook(r.id, { key, method: 'POST', body: { v: 42 } });
-    ok(good.status === 200 && good.resolved.text === 'got 42', 'good webhook delivers templated message');
-    s.setEnabled(r.id, false);
-    ok((await runner.webhook(r.id, { key, method: 'POST' })).status === 409, 'disabled -> 409'); }
-
-  console.log('catch-up missed schedule');
-  { const s = freshStore();
-    const calls = [];
-    const now = D(2026, 6, 10, 9, 30);
-    const runner = new RoutineRunner({ store: s, deliver: async (c) => calls.push(c), now: () => now });
-    s.save({ session_id: 's', name: 'daily', trigger: { type: 'schedule', cron: '0 9 * * *', missed: 'catchup', deadline_sec: 7200 }, action: { kind: 'message', template: 'good morning' } });
-    await runner.catchUp(D(2026, 6, 10, 8, 0), now); ok(calls.length === 1, 'catch-up fires the missed 09:00 run');
-    await runner.catchUp(D(2026, 6, 10, 8, 0), now); ok(calls.length === 1, 'catch-up does not re-fire once recorded'); }
-
-  console.log('daily cap');
-  { const s = freshStore(); const calls = []; const now = D(2026, 6, 10, 9, 0);
-    const runner = new RoutineRunner({ store: s, deliver: async (c) => calls.push(c), now: () => now });
-    const r = s.save({ session_id: 's', name: 'capped', daily_cap: 2, trigger: { type: 'manual' }, action: { kind: 'message', template: 'x' } });
-    await runner.fire(s.get(r.id), {}, 'manual');
-    await runner.fire(s.get(r.id), {}, 'manual');
-    const third = await runner.fire(s.get(r.id), {}, 'manual');
-    ok(calls.length === 2, 'daily_cap=2 delivers exactly twice');
-    ok(third.skipped === 'daily_cap', 'third fire skipped by daily cap'); }
-
-  console.log('fire-time public+loop guard (#8)');
-  { const s = freshStore(); const calls = [];
-    const runner = new RoutineRunner({ store: s, deliver: async () => calls.push(1) });
-    // hand-built (bypasses save validation, simulating a legacy/pre-guard stored routine)
-    const res = await runner.fire({ id: 'x', enabled: true, trigger: { type: 'webhook', public: true }, action: { kind: 'loop', task_template: 't' } }, {}, 'webhook');
-    ok(res.skipped?.includes('forbidden') && calls.length === 0, 'public webhook + loop action refused at fire time'); }
-
-  console.log('daily_cap under concurrency (#9 reserve-before-await)');
-  { const s = freshStore(); const calls = []; let release; const gate = new Promise((r) => { release = r; });
-    const runner = new RoutineRunner({ store: s, deliver: async () => { calls.push(1); await gate; } });
-    const r = s.save({ session_id: 's', name: 'cap', daily_cap: 2, trigger: { type: 'manual' }, action: { kind: 'message', template: 'x' } });
-    const fires = Promise.all([0, 1, 2, 3, 4].map(() => runner.fire(s.get(r.id), {}, 'manual')));
-    await new Promise((res) => setTimeout(res, 20));
-    release(); await fires;
-    ok(calls.length === 2, `5 concurrent fires respect daily_cap=2 (delivered ${calls.length})`); }
-
-  console.log('catch-up honors timezone (#10)');
-  { const s = freshStore();
-    const now = new Date('2026-06-10T13:30:00Z'); // 09:30 EDT
-    const calls = [];
-    const runner = new RoutineRunner({ store: s, deliver: async () => calls.push(1), now: () => now });
-    s.save({ session_id: 's', name: 'tzd', trigger: { type: 'schedule', cron: '0 9 * * *', tz: 'America/New_York', missed: 'catchup', deadline_sec: 7200 }, action: { kind: 'message', template: 'gm' } });
-    await runner.catchUp(new Date('2026-06-10T12:00:00Z'), now);
-    ok(calls.length === 1, 'catch-up fires the missed 09:00-America/New_York run (tz-aware)'); }
-
-  console.log(`\n${fail === 0 ? '✅' : '❌'} ${pass} passed, ${fail} failed`);
-  process.exit(fail === 0 ? 0 : 1);
-} finally {
-  for (const d of dirs) { try { rmSync(d, { recursive: true, force: true }); } catch {} }
-}