svamp-cli 0.2.195 → 0.2.197

package/dist/{run-DiCtjIs5.mjs → run-B3fosGEs.mjs}

@@ -1,15 +1,15 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os$1, { homedir as homedir$1 } from 'os';
 import fs, { mkdir as mkdir$1, readdir as readdir$1, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
-import { readFileSync as readFileSync$1, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, renameSync as renameSync$1, existsSync as existsSync$1, realpathSync, rmSync as rmSync$1, copyFileSync, unlinkSync as unlinkSync$1, readdirSync as readdirSync$1, watch, rmdirSync } from 'fs';
-import path__default, { join as join$1, resolve, dirname as dirname$1, basename as basename$1 } from 'path';
+import { readFileSync as readFileSync$1, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, renameSync as renameSync$1, existsSync as existsSync$1, realpathSync as realpathSync$1, rmSync as rmSync$1, copyFileSync, unlinkSync as unlinkSync$1, readdirSync as readdirSync$1, watch, rmdirSync } from 'fs';
+import path__default, { join as join$1, resolve as resolve$1, dirname as dirname$1, basename as basename$1 } from 'path';
 import { fileURLToPath } from 'url';
 import { execFile, spawn as spawn$1, execSync as execSync$1, spawnSync } from 'child_process';
 import { randomUUID as randomUUID$1 } from 'crypto';
 import { randomBytes, createHash, randomUUID } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync, readdirSync, writeFileSync, renameSync, rmSync, appendFileSync, unlinkSync } from 'node:fs';
+import { existsSync, readFileSync, realpathSync, readdirSync, statSync, mkdirSync, writeFileSync, renameSync, rmSync, appendFileSync, unlinkSync } from 'node:fs';
 import { exec, execSync, spawn, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
-import { join, basename, dirname } from 'node:path';
+import { extname, resolve, join, sep, basename, dirname } from 'node:path';
 import { EventEmitter } from 'node:events';
 import os, { homedir, platform } from 'node:os';
 import { ndJsonStream, ClientSideConnection } from '@agentclientprotocol/sdk';
@@ -1233,6 +1233,155 @@ function renderTemplate(template, ctx) {
   });
 }
 
+const HARD_MAX_BYTES = 25 * 1024 * 1024;
+const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
+const DEFAULT_MAX_COUNT = 100;
+const DEFAULT_ALLOWED_EXT = [
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".bmp",
+  ".svg",
+  ".pdf",
+  ".txt",
+  ".md",
+  ".csv",
+  ".json",
+  ".log",
+  ".yaml",
+  ".yml"
+];
+function uploadEnabled(c) {
+  return !!(c && c.upload && c.upload.enabled === true);
+}
+function effectiveUploadConfig(c) {
+  const u = c.upload || {};
+  const maxBytes = Math.min(
+    typeof u.maxBytes === "number" && u.maxBytes > 0 ? u.maxBytes : DEFAULT_MAX_BYTES,
+    HARD_MAX_BYTES
+  );
+  const maxCount = typeof u.maxCount === "number" && u.maxCount > 0 ? Math.floor(u.maxCount) : DEFAULT_MAX_COUNT;
+  const allowedExt = Array.isArray(u.allowedExt) ? u.allowedExt.map((e) => String(e).toLowerCase().trim()).filter(Boolean) : DEFAULT_ALLOWED_EXT;
+  return { ...u, maxBytes, maxCount, allowedExt };
+}
+function validateUploadConfig(c) {
+  const u = c.upload;
+  if (u == null) return [];
+  if (typeof u !== "object") return ["upload must be an object"];
+  const errs = [];
+  if (u.enabled != null && typeof u.enabled !== "boolean") errs.push("upload.enabled must be a boolean");
+  if (u.maxBytes != null && (typeof u.maxBytes !== "number" || u.maxBytes <= 0)) errs.push("upload.maxBytes must be a positive number");
+  if (u.maxCount != null && (typeof u.maxCount !== "number" || u.maxCount <= 0)) errs.push("upload.maxCount must be a positive number");
+  if (u.allowedExt != null && !Array.isArray(u.allowedExt)) errs.push("upload.allowedExt must be an array of extensions");
+  if (u.allowedMime != null && !Array.isArray(u.allowedMime)) errs.push("upload.allowedMime must be an array of mime types");
+  if (u.dir != null) {
+    if (typeof u.dir !== "string") errs.push("upload.dir must be a string");
+    else if (u.dir.startsWith("/") || u.dir.startsWith("\\") || /(^|[\\/])\.\.([\\/]|$)/.test(u.dir) || u.dir.includes("\0"))
+      errs.push('upload.dir must be a project-relative path without ".." traversal');
+  }
+  return errs;
+}
+const CONTROL_CHARS = /[\x00-\x1f\x7f]/;
+function sanitizeFilename(raw) {
+  const input = String(raw ?? "").trim();
+  if (!input) return { error: "filename required" };
+  if (input.length > 200) return { error: "filename too long (max 200 chars)" };
+  if (CONTROL_CHARS.test(input)) return { error: "filename contains control characters" };
+  if (input.includes("\0")) return { error: "filename contains null byte" };
+  if (input.includes("/") || input.includes("\\")) return { error: "filename must not contain path separators" };
+  if (input.includes("..")) return { error: 'filename must not contain ".."' };
+  const name = basename(input);
+  if (!name || name === "." || name === "..") return { error: "invalid filename" };
+  if (name.startsWith(".")) return { error: "filename must not start with a dot" };
+  if (!/^[A-Za-z0-9 ._-]+$/.test(name)) return { error: "filename has disallowed characters (use letters, digits, space, . _ -)" };
+  return { name };
+}
+function validateUpload(input) {
+  const { projectDir, channel, bytes, contentType } = input;
+  if (!uploadEnabled(channel)) return { error: "uploads are not enabled on this channel" };
+  const cfg = effectiveUploadConfig(channel);
+  const fn = sanitizeFilename(input.filename);
+  if (fn.error || !fn.name) return { error: fn.error || "invalid filename" };
+  const name = fn.name;
+  if (!Number.isFinite(bytes) || bytes < 0) return { error: "invalid file size" };
+  if (bytes === 0) return { error: "empty file" };
+  if (bytes > cfg.maxBytes) return { error: `file too large (${bytes} bytes > ${cfg.maxBytes} limit)` };
+  const ext = extname(name).toLowerCase();
+  if (!ext) return { error: "file has no extension" };
+  if (!cfg.allowedExt.includes(ext)) return { error: `file type not allowed: ${ext} (allowed: ${cfg.allowedExt.join(", ") || "none"})` };
+  if (Array.isArray(cfg.allowedMime) && cfg.allowedMime.length) {
+    const ct = String(contentType || "").toLowerCase().split(";")[0].trim();
+    if (!ct) return { error: "content-type required (channel restricts MIME types)" };
+    if (!cfg.allowedMime.map((m) => String(m).toLowerCase().trim()).includes(ct))
+      return { error: `mime type not allowed: ${ct}` };
+  }
+  let projectReal;
+  try {
+    projectReal = realpathSync(projectDir);
+  } catch {
+    projectReal = resolve(projectDir);
+  }
+  const relDir = cfg.dir && String(cfg.dir).trim() ? String(cfg.dir).trim() : join(".svamp", "channels", "uploads", String(channel.id || "unknown"));
+  const destDir = resolve(projectReal, relDir);
+  if (destDir !== projectReal && !destDir.startsWith(projectReal + sep))
+    return { error: "upload destination escapes the project folder" };
+  const fullPath = join(destDir, name);
+  if (fullPath !== destDir && !fullPath.startsWith(destDir + sep))
+    return { error: "upload path escapes the destination directory" };
+  try {
+    if (existsSync(destDir)) {
+      const count = readdirSync(destDir).filter((f) => {
+        try {
+          return statSync(join(destDir, f)).isFile();
+        } catch {
+          return false;
+        }
+      }).length;
+      if (count >= cfg.maxCount) return { error: `upload limit reached (${cfg.maxCount} files)` };
+    }
+  } catch {
+  }
+  return { target: { destDir, name, fullPath } };
+}
+function writeUpload(projectDir, target, data) {
+  mkdirSync(target.destDir, { recursive: true });
+  let finalName = target.name;
+  let finalPath = target.fullPath;
+  if (existsSync(finalPath)) {
+    const ext = extname(target.name);
+    const stem = target.name.slice(0, target.name.length - ext.length);
+    finalName = `${stem}-${randomBytes(3).toString("hex")}${ext}`;
+    finalPath = join(target.destDir, finalName);
+  }
+  const tmp = finalPath + ".tmp-" + randomBytes(4).toString("hex");
+  writeFileSync(tmp, data);
+  renameSync(tmp, finalPath);
+  let projectReal;
+  try {
+    projectReal = realpathSync(projectDir);
+  } catch {
+    projectReal = resolve(projectDir);
+  }
+  const relPath = finalPath.startsWith(projectReal + sep) ? finalPath.slice(projectReal.length + 1) : finalPath;
+  return { name: finalName, relPath, fullPath: finalPath, bytes: data.length };
+}
+function decodeBase64Capped(b64, maxBytes) {
+  const s = String(b64 ?? "");
+  if (!s) return { error: "empty file content" };
+  if (s.length > Math.ceil(maxBytes / 3) * 4 + 16) return { error: `file too large (exceeds ${maxBytes} byte limit)` };
+  let data;
+  try {
+    data = Buffer.from(s, "base64");
+  } catch {
+    return { error: "invalid base64 content" };
+  }
+  if (!data.length) return { error: "invalid or empty base64 content" };
+  if (data.length > maxBytes) return { error: `file too large (${data.length} bytes > ${maxBytes} limit)` };
+  return { data };
+}
+
 const genId = () => "c_" + randomBytes(5).toString("hex");
 const genKey = () => "ck_" + randomBytes(18).toString("base64url");
 const DEFAULT_TEMPLATE = `<inbound-message from="\${sender.name}" sender-type="\${sender.kind}" verified="\${sender.verified}" channel="\${channel.name}" call-id="\${call.id}" at="\${now}">
@@ -1268,6 +1417,7 @@ function validateChannel(c) {
   if (c.skill?.description && unsafe.test(c.skill.description)) errs.push(`skill.description must be single-line and not contain < > " ' &`);
   if (m === "fixed" && c.identity.fixed?.name && unsafe.test(c.identity.fixed.name)) errs.push(`identity.fixed.name must not contain < > " ' & or newlines`);
   for (const cl of c.identity?.callers || []) if (unsafe.test(cl.name || "")) errs.push(`caller name "${cl.name}" must not contain < > " ' & or newlines`);
+  errs.push(...validateUploadConfig(c));
   return errs;
 }
 function normalizeBind(c) {
@@ -1377,6 +1527,7 @@ function generateSkillBody(channel, ctx) {
   const gw = ctx?.channelsServiceId ? gatewayBase(svc, base) : `${base}/<workspace>/services/<machine>:channels`;
   const skillUrl = `${gw}/skill?channel=${channel.id}`;
   const sendUrl = `${gw}/send`;
+  const uploadUrl = `${gw}/upload`;
   const key = ctx?.key || "<your-key>";
   const isAgent = channel.action?.kind === "agent";
   const isQueue = channel.reply?.mode === "queue";
@@ -1422,6 +1573,47 @@ to \`send()\`. The reply is then delivered straight to **your session's inbox**
 channel's outbox and you must poll \`receive()\` (above) for it \u2014 it will **not** appear
 in your inbox.` : "";
   const rpcAuthNote = hyphaOpen ? `Your verified Hypha identity is accepted \u2014 no key needed.` : `Uses your verified Hypha identity.`;
+  const uploadSection = uploadEnabled(channel) ? (() => {
+    const u = effectiveUploadConfig(channel);
+    const mb = (u.maxBytes / (1024 * 1024)).toFixed(u.maxBytes % (1024 * 1024) === 0 ? 0 : 1);
+    const exts = u.allowedExt.join(", ") || "(none)";
+    const mimeLine = Array.isArray(u.allowedMime) && u.allowedMime.length ? `
+- **Allowed MIME types:** ${u.allowedMime.join(", ")}` : "";
+    return `
+
+## Uploading a file
+This channel **accepts file uploads** (server-validated, deny-by-default elsewhere).
+Send the file base64-encoded; the server validates it and saves it into the session's
+project folder, returning the saved relative path. Reference that path in a follow-up
+\`send()\` so the agent knows what you uploaded.
+
+**Limits (enforced server-side):**
+- **Max size:** ${mb} MiB per file
+- **Max files retained:** ${u.maxCount}
+- **Allowed extensions:** ${exts}${mimeLine}
+- Filenames are sanitized to a safe basename \u2014 no paths, no \`..\` traversal.
+
+### Hypha RPC
+\`\`\`js
+const res = await get_service("${svc}").upload({
+  channel: "${channel.id}",
+  filename: "report.pdf",
+  content_base64: "<base64 of the file bytes>",
+  content_type: "application/pdf",
+  from: "your-name"${rSession ? `,
+  session: "${rSession}"` : ""}${hyphaOpen ? "" : `,
+  key: "${key}"`}
+});
+// \u2192 { ok: true, name, path, bytes }
+\`\`\`
+
+### HTTP
+\`\`\`bash
+curl -X POST "${uploadUrl}" \\
+  -H 'Content-Type: application/json' \\
+  -d '{"kwargs": {"channel": "${channel.id}", "filename": "report.pdf", "content_base64": "<base64>", "content_type": "application/pdf", "from": "your-name", "key": "${key}"}}'
+\`\`\``;
+  })() : "";
   return `---
 name: ${name}
 description: ${desc}
@@ -1454,7 +1646,7 @@ curl -X POST "${sendUrl}" \\
   -d '{"kwargs": {"channel": "${channel.id}", "message": "your message here", "from": "your-name", "key": "${key}"${sessionKv}}}'
 \`\`\`
 
-Always-current copy of this skill (all ids filled in): ${skillUrl}${queueSection}`;
+Always-current copy of this skill (all ids filled in): ${skillUrl}${uploadSection}${queueSection}`;
 }
 
 function resolveSender(channel, input = {}) {
@@ -2720,7 +2912,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-WpRu5zE_.mjs');
+        const { FrpcTunnel } = await import('./frpc-BgabHfqV.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3167,7 +3359,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-B9uONcBg.mjs');
+          const { toolsForRole } = await import('./sideband-BtZMx9Af.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3266,7 +3458,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-B3uk2hcj.mjs');
+    const { queryCore } = await import('./commands-Bxb8oEBa.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -3371,6 +3563,44 @@ ${d?.error || "not found"}`;
           }
           await new Promise((resolve) => setTimeout(resolve, 500));
         }
+      },
+      // Safety-restricted file upload (#0093). Deny-by-default: only channels whose
+      // config sets upload.enabled accept files. The upload is a pure, validated file
+      // write into the channel's project folder — no agent run — so we do NOT spawn a
+      // stateless one-shot; we resolve the channel + dir from disk and write directly,
+      // which works whether or not a live session hosts the channel. All safety checks
+      // (filename/size/extension/MIME/count/path-confinement) live in channel/upload.ts.
+      upload: async (kwargs = {}, context) => {
+        trackInbound();
+        if (!kwargs.channel) return { error: MISSING_CHANNEL_HINT };
+        const found = readChannelFromDisk(kwargs.channel);
+        if (!found) return { error: "channel not found" };
+        const { c, dir } = found;
+        if (!uploadEnabled(c)) return { error: "uploads are not enabled on this channel" };
+        const u = context?.user;
+        const r = resolveSender(c, {
+          key: kwargs.key,
+          from: kwargs.from,
+          hyphaUser: u && u.is_anonymous !== true ? u.email || u.id : void 0,
+          hyphaAnonymous: u?.is_anonymous === true,
+          hyphaWorkspace: u?.scope?.current_workspace
+        });
+        if (r.error || !r.sender) return { error: r.error || "unauthorized" };
+        const cfg = effectiveUploadConfig(c);
+        const dec = decodeBase64Capped(kwargs.content_base64, cfg.maxBytes);
+        if (dec.error || !dec.data) return { error: dec.error || "invalid content" };
+        const v = validateUpload({ projectDir: dir, channel: c, filename: kwargs.filename, bytes: dec.data.length, contentType: kwargs.content_type });
+        if (v.error || !v.target) return { error: v.error || "upload rejected" };
+        try {
+          const saved = writeUpload(dir, v.target, dec.data);
+          try {
+            new ChannelStore(dir).recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId: "up_" + Math.random().toString(16).slice(2, 10), outcome: "uploaded" });
+          } catch {
+          }
+          return { ok: true, name: saved.name, path: saved.relPath, bytes: saved.bytes };
+        } catch (e) {
+          return { ok: false, error: e?.message || String(e) };
+        }
       }
     },
     { overwrite: true }
@@ -3536,6 +3766,32 @@ function applyInboxClear(inbox, opts) {
   return { kept, removed: inbox.length - kept.length };
 }
 
+function inboxFilePath(projectDir, sessionId) {
+  return join(projectDir, ".svamp", sessionId, "inbox.json");
+}
+function loadInbox(projectDir, sessionId) {
+  try {
+    const p = inboxFilePath(projectDir, sessionId);
+    if (!existsSync(p)) return [];
+    const data = JSON.parse(readFileSync(p, "utf8"));
+    if (Array.isArray(data)) return data;
+    if (data && Array.isArray(data.messages)) return data.messages;
+    return [];
+  } catch {
+    return [];
+  }
+}
+function saveInbox(projectDir, sessionId, inbox) {
+  try {
+    const p = inboxFilePath(projectDir, sessionId);
+    mkdirSync(dirname(p), { recursive: true });
+    const tmp = `${p}.tmp-${process.pid}`;
+    writeFileSync(tmp, JSON.stringify(inbox));
+    renameSync(tmp, p);
+  } catch {
+  }
+}
+
 function envInt(name, fallback) {
   const raw = process.env[name];
   if (raw === void 0 || raw === "") return fallback;
@@ -3760,7 +4016,9 @@ var claudeAuth = /*#__PURE__*/Object.freeze({
 
 const PARTICIPANTS_CHANNEL_ID = "sys-participants";
 function channelPublicView(c) {
-  return { id: c.id, name: c.name, description: c.description, identity: { mode: c.identity?.mode }, action: c.action?.kind, bind: c.bind };
+  const u = c.upload;
+  const upload = u && u.enabled === true ? { enabled: true, ...typeof u.maxBytes === "number" ? { maxBytes: u.maxBytes } : {}, ...Array.isArray(u.allowedExt) ? { allowedExt: u.allowedExt } : {} } : void 0;
+  return { id: c.id, name: c.name, description: c.description, identity: { mode: c.identity?.mode }, action: c.action?.kind, bind: c.bind, ...upload ? { upload } : {} };
 }
 function isStructuredMessage(msg) {
   return !!(msg.from || msg.fromSession || msg.subject || msg.replyTo || msg.threadId || msg.channel);
@@ -3933,9 +4191,16 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     mode: "remote",
     time: Date.now()
   };
-  const inbox = [];
+  const inbox = loadInbox(metadata.path || process.cwd(), sessionId);
   const INBOX_MAX = 100;
+  const persistInbox = () => {
+    try {
+      saveInbox(metadata.path || process.cwd(), sessionId, inbox);
+    } catch {
+    }
+  };
   const syncInboxToMetadata = () => {
+    persistInbox();
     metadata.inbox = inbox.map((m) => ({
       messageId: m.messageId,
       body: m.body,
@@ -4554,6 +4819,40 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
         return { ok: false, call_id: callId, status: "error", error: e?.message || String(e) };
       }
     },
+    // Safety-restricted file upload (#0093). Deny-by-default: a channel accepts
+    // uploads ONLY when its config sets upload.enabled. Auth = the channel's OWN
+    // identity policy (resolveSender), same as channelSend. All validation is
+    // server-side (channel/upload.ts): filename sanitization (no traversal),
+    // size cap, extension/MIME allowlist, file-count cap, path confinement.
+    channelUpload: async (params, context) => {
+      const c = channelStore.get(params.channel);
+      if (!c || c.enabled === false) return { error: "channel not found" };
+      if (!uploadEnabled(c)) return { error: "uploads are not enabled on this channel" };
+      const u = context?.user;
+      const r = resolveSender(c, {
+        key: params.key,
+        from: params.from,
+        hyphaUser: u && u.is_anonymous !== true ? u.email || u.id : void 0,
+        hyphaAnonymous: u?.is_anonymous === true,
+        hyphaWorkspace: u?.scope?.current_workspace
+      });
+      if (r.error || !r.sender) return { error: r.error || "unauthorized" };
+      const cfg2 = effectiveUploadConfig(c);
+      const dec = decodeBase64Capped(params.content_base64, cfg2.maxBytes);
+      if (dec.error || !dec.data) return { error: dec.error || "invalid content" };
+      const v = validateUpload({ projectDir: metadata.path, channel: c, filename: params.filename, bytes: dec.data.length, contentType: params.content_type });
+      if (v.error || !v.target) return { error: v.error || "upload rejected" };
+      const callId = "call_" + randomUUID().slice(0, 10);
+      try {
+        const saved = writeUpload(metadata.path, v.target, dec.data);
+        channelStore.recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId, outcome: "uploaded" });
+        syncChannelsToMetadata();
+        return { ok: true, name: saved.name, path: saved.relPath, bytes: saved.bytes };
+      } catch (e) {
+        channelStore.recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId, outcome: "error" });
+        return { ok: false, error: e?.message || String(e) };
+      }
+    },
     // Agent/owner answers a queued (async) channel message → channel outbox, addressed
     // to the original external caller. Routed here by `inbox reply` for channel-origin
     // inbox messages (which carry channelId + correlationId + from). Owner-gated since
@@ -8047,9 +8346,9 @@ var GeminiTransport$1 = /*#__PURE__*/Object.freeze({
 function resolveTranscriptPath(cwd, claudeSessionId) {
   let real;
   try {
-    real = realpathSync(cwd);
+    real = realpathSync$1(cwd);
   } catch {
-    real = resolve(cwd);
+    real = resolve$1(cwd);
   }
   const projectId = real.replace(/[^a-zA-Z0-9-]/g, "-");
   const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || join$1(os$1.homedir(), ".claude");
@@ -11631,7 +11930,7 @@ async function startDaemon(options) {
     saveExposedTunnels(list);
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-WpRu5zE_.mjs');
+    const { FrpcTunnel } = await import('./frpc-BgabHfqV.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -11651,7 +11950,7 @@ async function startDaemon(options) {
     return tunnel;
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
-  const { ServeManager } = await import('./serveManager-C2ykbnxd.mjs');
+  const { ServeManager } = await import('./serveManager-CCslS9Yt.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
@@ -13516,11 +13815,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DgV6_G_Q.mjs');
+              const { issueRpc } = await import('./rpc-C35Y8Vto.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-CvpwmghB.mjs');
+              const { workflowRpc } = await import('./rpc-DlM7ml1e.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -13537,23 +13836,23 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onReadFile: async (path) => {
-              const resolvedPath = resolve(directory, path);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, path);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               return await readSessionFileBase64(resolvedPath);
             },
             onWriteFile: async (path, content) => {
-              const resolvedPath = resolve(directory, path);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, path);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               await fs.mkdir(dirname$1(resolvedPath), { recursive: true });
               await fs.writeFile(resolvedPath, Buffer.from(content, "base64"));
             },
             onListDirectory: async (path) => {
-              const resolvedDir = resolve(directory, path || ".");
-              if (sessionMetadata.securityContext && resolvedDir !== resolve(directory) && !resolvedDir.startsWith(resolve(directory) + "/")) {
+              const resolvedDir = resolve$1(directory, path || ".");
+              if (sessionMetadata.securityContext && resolvedDir !== resolve$1(directory) && !resolvedDir.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               const entries = await fs.readdir(resolvedDir, { withFileTypes: true });
@@ -13591,8 +13890,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                   return null;
                 }
               }
-              const resolvedPath = resolve(directory, treePath);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, treePath);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               const tree = await buildTree(resolvedPath, basename$1(resolvedPath), 0);
@@ -14030,11 +14329,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DgV6_G_Q.mjs');
+              const { issueRpc } = await import('./rpc-C35Y8Vto.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-CvpwmghB.mjs');
+              const { workflowRpc } = await import('./rpc-DlM7ml1e.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -14051,23 +14350,23 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onReadFile: async (path) => {
-              const resolvedPath = resolve(directory, path);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, path);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               return await readSessionFileBase64(resolvedPath);
             },
             onWriteFile: async (path, content) => {
-              const resolvedPath = resolve(directory, path);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, path);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               await fs.mkdir(dirname$1(resolvedPath), { recursive: true });
               await fs.writeFile(resolvedPath, Buffer.from(content, "base64"));
             },
             onListDirectory: async (path) => {
-              const resolvedDir = resolve(directory, path || ".");
-              if (sessionMetadata.securityContext && resolvedDir !== resolve(directory) && !resolvedDir.startsWith(resolve(directory) + "/")) {
+              const resolvedDir = resolve$1(directory, path || ".");
+              if (sessionMetadata.securityContext && resolvedDir !== resolve$1(directory) && !resolvedDir.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               const entries = await fs.readdir(resolvedDir, { withFileTypes: true });
@@ -14105,8 +14404,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                   return null;
                 }
               }
-              const resolvedPath = resolve(directory, treePath);
-              if (sessionMetadata.securityContext && resolvedPath !== resolve(directory) && !resolvedPath.startsWith(resolve(directory) + "/")) {
+              const resolvedPath = resolve$1(directory, treePath);
+              if (sessionMetadata.securityContext && resolvedPath !== resolve$1(directory) && !resolvedPath.startsWith(resolve$1(directory) + "/")) {
                 throw new Error("Path outside working directory");
               }
               const tree = await buildTree(resolvedPath, basename$1(resolvedPath), 0);
@@ -14524,7 +14823,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
     const channelHttpPort = Number(process.env.SVAMP_CHANNEL_HTTP_PORT) || 0;
     if (channelHttpPort > 0) {
       try {
-        const { createChannelHttpServer } = await import('./httpServer-Cf54pQ77.mjs');
+        const { createChannelHttpServer } = await import('./httpServer-B1KVQJfm.mjs');
         const channelHttpServer = createChannelHttpServer({
           getSessionIds: () => {
             const ids = [];
@@ -14789,7 +15088,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-D8Xj2_vB.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-B3hBIkt8.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();

package/dist/{run-D79u_Ud4.mjs → run-DtTnHqcs.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a1 as applyClaudeProxyEnv, a2 as composeSessionId, a3 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a4 as generateHookSettings } from './run-DiCtjIs5.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a1 as applyClaudeProxyEnv, a2 as composeSessionId, a3 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a4 as generateHookSettings } from './run-B3fosGEs.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{scheduler-D8Xj2_vB.mjs → scheduler-B3hBIkt8.mjs}

@@ -1,5 +1,5 @@
 import { spawn } from 'node:child_process';
-import { m as resolveProjectRoot, w as cronMatches } from './run-DiCtjIs5.mjs';
+import { m as resolveProjectRoot, w as cronMatches } from './run-B3fosGEs.mjs';
 import { l as listWorkflows, i as isWorkflowEnabled, c as workflowCrons, w as workflowSteps } from './store-DEZ8e-uE.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{serveCommands-Bc9DXaQv.mjs → serveCommands-Bj2aEfKX.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-B3uk2hcj.mjs');
+  const { connectAndGetMachine } = await import('./commands-Bxb8oEBa.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-B3uk2hcj.mjs');
+  const { connectAndGetMachine } = await import('./commands-Bxb8oEBa.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-B3uk2hcj.mjs');
+  const { connectAndGetMachine } = await import('./commands-Bxb8oEBa.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-B3uk2hcj.mjs');
+  const { connectAndGetMachine } = await import('./commands-Bxb8oEBa.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-B3uk2hcj.mjs');
+  const { connectAndGetMachine } = await import('./commands-Bxb8oEBa.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-C2ykbnxd.mjs → serveManager-CCslS9Yt.mjs}

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-DiCtjIs5.mjs';
+import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-B3fosGEs.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -733,7 +733,7 @@ class ServeManager {
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-WpRu5zE_.mjs');
+      const { FrpcTunnel } = await import('./frpc-BgabHfqV.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,