svamp-cli 0.2.223-canary.2 → 0.2.223

package/bin/skills/loop/bin/channel-core.mjs

@@ -1,161 +0,0 @@
-#!/usr/bin/env node
-// channel-core.mjs — transport-agnostic core for Channels (external / agent-to-agent
-// inbound endpoints). Project-folder config + identity resolution + default XML
-// template + skill generation. Used by both the HTTP and Hypha transports.
-// See docs/channels-design.md.
-import { mkdirSync, writeFileSync, renameSync, readdirSync, readFileSync, rmSync, existsSync } from 'node:fs';
-import { join } from 'node:path';
-import { randomBytes } from 'node:crypto';
-import { renderTemplate } from './routine-core.mjs';
-
-const genId = () => 'c_' + randomBytes(5).toString('hex');
-const genKey = () => 'ck_' + randomBytes(18).toString('base64url');
-
-// Default message template: XML carrying provenance so the agent always knows
-// who sent it, through which channel, and whether the identity is verified.
-export const DEFAULT_TEMPLATE =
-`<inbound-message from="\${sender.name}" sender-type="\${sender.kind}" verified="\${sender.verified}" channel="\${channel.name}" call-id="\${call.id}" at="\${now}">
-\${body.message}
-</inbound-message>`;
-
-// ---- store (project folder: <dir>/.svamp/channels/<id>.json) ------------
-export class ChannelStore {
-  constructor(projectDir) { this.dir = join(projectDir, '.svamp', 'channels'); mkdirSync(this.dir, { recursive: true }); }
-  _path(id) { return join(this.dir, `${id}.json`); }
-  list() {
-    return readdirSync(this.dir).filter((f) => f.endsWith('.json')).map((f) => {
-      try { return JSON.parse(readFileSync(join(this.dir, f), 'utf8')); } catch { return null; }
-    }).filter(Boolean);
-  }
-  get(id) { try { return JSON.parse(readFileSync(this._path(id), 'utf8')); } catch { return null; } }
-  save(channel) {
-    const c = { enabled: true, bind: 'active', template: DEFAULT_TEMPLATE, action: { kind: 'message' },
-      identity: { mode: 'per-key', callers: [] }, last_calls: [], ...channel };
-    if (!c.id) c.id = genId();
-    const errs = validateChannel(c);
-    if (errs.length) throw new Error('invalid channel: ' + errs.join('; '));
-    const tmp = this._path(c.id) + '.tmp';
-    writeFileSync(tmp, JSON.stringify(c, null, 2));
-    renameSync(tmp, this._path(c.id));
-    return c;
-  }
-  remove(id) { const p = this._path(id); if (existsSync(p)) { rmSync(p); return true; } return false; }
-  addCaller(id, name, kind = 'agent') {
-    const c = this.get(id); if (!c) return null;
-    c.identity.callers = c.identity.callers || [];
-    const caller = { name, kind, key: genKey() };
-    c.identity.callers.push(caller);
-    this.save(c);
-    return caller;
-  }
-  recordCall(id, entry) {
-    const c = this.get(id); if (!c) return null;
-    c.last_calls = [{ at: new Date().toISOString(), ...entry }, ...(c.last_calls || [])].slice(0, 30);
-    return this.save(c);
-  }
-}
-
-export function validateChannel(c) {
-  const errs = [];
-  if (!c || typeof c !== 'object') return ['channel must be an object'];
-  if (!c.name) errs.push('name required');
-  const m = c.identity?.mode;
-  if (!['per-key', 'caller-supplied', 'fixed'].includes(m)) errs.push('identity.mode must be per-key|caller-supplied|fixed');
-  if (m === 'fixed' && !c.identity.fixed?.name) errs.push('identity.fixed.name required for fixed mode');
-  if (!['message', 'loop'].includes(c.action?.kind)) errs.push('action.kind must be message|loop');
-  if (c.bind !== 'active' && !(c.bind && c.bind.tag) && !(c.bind && c.bind.session)) errs.push('bind must be "active", {tag}, or {session}');
-  // Security: a keyless/open channel + loop action = unauthenticated task injection.
-  if (c.action?.kind === 'loop' && m === 'caller-supplied' && !c.identity?.shared_key)
-    errs.push('a caller-supplied channel without a shared_key may not use a loop action (unauthenticated task injection)');
-  // Defense-in-depth: single-line, no XML metachars on operator-set strings that
-  // land in the trust tag and/or the served skill markdown (frontmatter breakout).
-  const unsafe = /[<>"'&\r\n]/;
-  if (unsafe.test(c.name || '')) errs.push('name must be single-line and not contain < > " \' &');
-  if (c.description && unsafe.test(c.description)) errs.push('description must be single-line and not contain < > " \' &');
-  if (c.skill?.name && unsafe.test(c.skill.name)) errs.push('skill.name must be single-line and not contain < > " \' &');
-  if (c.skill?.description && unsafe.test(c.skill.description)) errs.push('skill.description must be single-line and not contain < > " \' &');
-  if (m === 'fixed' && c.identity.fixed?.name && unsafe.test(c.identity.fixed.name)) errs.push('identity.fixed.name must not contain < > " \' & or newlines');
-  for (const cl of (c.identity?.callers || [])) if (unsafe.test(cl.name || '')) errs.push(`caller name "${cl.name}" must not contain < > " ' & or newlines`);
-  return errs;
-}
-
-// ---- identity resolution ------------------------------------------------
-// Returns { sender:{name,kind,verified} } or { error } (401/403-ish).
-export function resolveSender(channel, { key, from, hyphaUser, hyphaWorkspace, hyphaAnonymous } = {}) {
-  const id = channel.identity || {};
-  // Hypha-authenticated caller: honored ONLY when the channel EXPLICITLY opts in
-  // via a non-empty hypha_allow (deny-by-default — never allow-all when unset, and
-  // never override a configured per-key/fixed mode). ANONYMOUS Hypha callers are
-  // NOT verified identities, so they never take this branch (even with '*').
-  if (hyphaUser && !hyphaAnonymous && Array.isArray(id.hypha_allow) && id.hypha_allow.length) {
-    if (id.hypha_allow.includes('*') || id.hypha_allow.includes(hyphaUser) || (hyphaWorkspace && id.hypha_allow.includes(hyphaWorkspace)))
-      return { sender: { name: hyphaUser, kind: 'agent', verified: true } };
-    return { error: 'caller not in hypha_allow' };
-  }
-  if (id.mode === 'fixed') return { sender: { ...id.fixed, verified: true } };
-  if (id.mode === 'per-key') {
-    const caller = (id.callers || []).find((c) => c.key && c.key === key);
-    if (!caller) return { error: 'invalid or missing key' };
-    return { sender: { name: caller.name, kind: caller.kind, verified: true } };
-  }
-  if (id.mode === 'caller-supplied') {
-    if (id.shared_key && key !== id.shared_key) return { error: 'invalid key' };
-    return { sender: { name: from || 'anonymous', kind: 'user', verified: false } };
-  }
-  return { error: 'unsupported identity mode' };
-}
-
-// ---- render the injected message ----------------------------------------
-// XML-escape EVERY interpolated value. The <inbound-message from=… verified=…>
-// tag is the agent's entire trust signal, and from/message are caller-controlled
-// — without escaping a caller could forge verified="true" or inject a second tag
-// (provenance forgery / tag breakout). Escaping neutralizes < > " ' &.
-const MAX_BODY = 16 * 1024;
-export function xmlEscape(s) {
-  return String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;').replace(/'/g, '&#39;');
-}
-// Strip control chars (incl. newlines) — for single-line ATTRIBUTE values, so an
-// attacker-controlled name can't smuggle extra lines into the trust header.
-const stripControl = (s) => String(s ?? '').replace(/[\x00-\x1f\x7f]/g, ' ');
-export function renderMessage(channel, { sender = {}, body = {}, query = {}, callId, now }) {
-  const obj = (v) => (typeof v === 'object' && v !== null ? JSON.stringify(v) : v);
-  const escVal = (v) => xmlEscape(obj(v));                 // element content (multi-line ok)
-  const escAttr = (v) => xmlEscape(stripControl(obj(v)));  // attribute position (single-line)
-  const bodyEsc = {};
-  for (const [k, v] of Object.entries(body)) bodyEsc[k] = k === 'message' ? escVal(String(v ?? '').slice(0, MAX_BODY)) : escAttr(v);
-  const queryEsc = {};
-  for (const [k, v] of Object.entries(query)) if (k !== 'key') queryEsc[k] = escAttr(v); // never echo the secret
-  const ctx = {
-    sender: { name: escAttr(sender.name), kind: escAttr(sender.kind), verified: sender.verified === true },
-    body: bodyEsc, query: queryEsc,
-    channel: { name: escAttr(channel.name), id: escAttr(channel.id) },
-    call: { id: escAttr(callId) }, now: escAttr(now || new Date().toISOString()),
-  };
-  return renderTemplate(channel.template || DEFAULT_TEMPLATE, ctx);
-}
-
-// ---- skill (how external agents call this channel) ----------------------
-export function generateSkillBody(channel, urlBase) {
-  const url = `${urlBase || 'https://<svamp-tunnel>'}/channel/${channel.id}`;
-  return `---
-name: ${channel.skill?.name || channel.name}
-description: ${channel.skill?.description || channel.description || `Send a message to the "${channel.name}" channel.`}
----
-# ${channel.name}
-${channel.description || ''}
-
-This is a self-contained guide for messaging another agent. Share this skill
-(or its URL, \`${url}/skill.md\`) with an agent and it will know how to reach me.
-
-**Hypha RPC (preferred, verified identity — no key needed):**
-\`get_service("<ws>/<machine>:channels").send({ channel: "${channel.id}", message: "..." })\`
-
-**HTTP:** \`POST ${url}\` with header \`Authorization: Bearer <your-key>\`
-Body: \`{ "message": "<your message>", "from": "<your name>" }\`
-
-Your identity is attached automatically; the receiving agent sees an
-\`<inbound-message from="...">\` tag. Keep messages self-contained.`;
-}
-
-export { genId, genKey };

package/bin/skills/loop/bin/channel-server.mjs

@@ -1,151 +0,0 @@
-#!/usr/bin/env node
-// channel-server.mjs — serve a project's Channels over BOTH transports:
-//   • Hypha RPC: registers a `channels` service (type svamp-channels) with
-//     list/describe/send; caller identity = verified context.user.
-//   • HTTP: POST /channel/<id> (Bearer key), GET /channel/<id>[/skill.md].
-// Delivery: renders the channel template and injects it into the bound session
-// via `svamp session send`. Config from the project folder (.svamp/channels/).
-//
-// Env: CHANNEL_PROJECT_DIR (default cwd), CHANNEL_SESSION (default bind target),
-//      CHANNEL_HTTP_PORT (default 8733), CHANNEL_URL_BASE (for skill URLs),
-//      HYPHA_SERVER_URL / HYPHA_TOKEN / HYPHA_WORKSPACE (from ~/.hypha/.env).
-import { execFileSync } from 'node:child_process';
-import { createServer } from 'node:http';
-import { resolve, dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { randomBytes } from 'node:crypto';
-import { ChannelStore, resolveSender, renderMessage, generateSkillBody, validateChannel } from './channel-core.mjs';
-import { renderTemplate } from './routine-core.mjs';
-
-const LOOP_INIT = join(dirname(fileURLToPath(import.meta.url)), 'loop-init.mjs');
-
-const PROJECT = resolve(process.env.CHANNEL_PROJECT_DIR || process.cwd());
-const DEFAULT_SESSION = process.env.CHANNEL_SESSION || null;
-const URL_BASE = process.env.CHANNEL_URL_BASE || `http://localhost:${process.env.CHANNEL_HTTP_PORT || 8733}`;
-const store = new ChannelStore(PROJECT);
-const callId = () => 'call_' + randomBytes(5).toString('hex');
-
-// svamp binary (override for repo build, e.g. SVAMP_BIN="node …/dist/cli.js").
-const SVAMP = (process.env.SVAMP_BIN || 'svamp').split(' ');
-
-function targetSession(channel) {
-  if (channel.bind && channel.bind.session) return channel.bind.session;   // explicit pin (standalone)
-  return DEFAULT_SESSION;   // 'active' resolution is the daemon's job; standalone uses the configured session
-}
-
-// Inject the channel message as a PLAIN user message (`session send --plain`) so
-// the agent sees a single `<inbound-message>` provenance tag — not the inbox
-// `<svamp-message>` envelope. (Daemon-native channels do this in-process.)
-async function deliver(channel, sender, body, query) {
-  const sid = targetSession(channel);
-  if (!sid) return { ok: false, error: 'no bound session (set CHANNEL_SESSION or channel.bind.session)' };
-  const id = callId();
-  try {
-    if (channel.action?.kind === 'loop') {
-      // Start a loop in the bound session's project dir, seeded by the caller's
-      // request. (Loop-action channels require auth — validateChannel forbids the
-      // keyless caller-supplied case — so the caller-influenced task is gated.)
-      // CAVEAT: the Stop-GATE only enforces if the session's Claude process started
-      // AFTER the .claude/settings.json hooks existed (hooks load at startup). When
-      // we loop-init an ALREADY-RUNNING session, the gate isn't active for that
-      // process, so the kickoff is self-contained (task + read-LOOP.md + iterate)
-      // and the work still gets done; full gate enforcement needs a fresh/restarted
-      // session (which daemon-native delivery would do). We mark status accordingly.
-      const dir = resolve(channel.action.loop?.dir || PROJECT);
-      const ctx = { sender, body, query, channel: { name: channel.name, id: channel.id }, call: { id }, now: new Date().toISOString() };
-      const task = (channel.action.task_template ? renderTemplate(channel.action.task_template, ctx) : body.message) || '(task from channel)';
-      const labelled = `[via channel "${channel.name}" from ${sender.name}${sender.verified ? '' : ' (unverified)'}] ${task}`;
-      const initArgs = [LOOP_INIT, dir, '--task', labelled];
-      const oracle = channel.action.loop?.oracle;
-      if (oracle) initArgs.push('--oracle', oracle);
-      initArgs.push('--evaluator', channel.action.loop?.evaluator || 'off');
-      execFileSync(process.execPath, initArgs, { stdio: 'pipe' });
-      // Self-contained kickoff (works whether or not the Stop hook is active on the
-      // running process): the task + how to verify + iterate.
-      const kickoff = `🔁 Loop request via channel "${channel.name}".\nRead LOOP.md and work the task below until it is genuinely complete${oracle ? ` and the oracle passes: \`${oracle}\`` : ''}. Update LOOP.md progress as you go.\n\nTask: ${labelled}`;
-      execFileSync(SVAMP[0], [...SVAMP.slice(1), 'session', 'send', sid, kickoff, '--plain'], { stdio: 'pipe' });
-      store.recordCall(channel.id, { sender: sender.name, verified: sender.verified, callId: id, outcome: 'loop-started' });
-      return { ok: true, call_id: id, status: 'loop-started' };
-    }
-    const message = renderMessage(channel, { sender, body, query, callId: id });
-    execFileSync(SVAMP[0], [...SVAMP.slice(1), 'session', 'send', sid, message, '--plain'], { stdio: 'pipe' });
-    store.recordCall(channel.id, { sender: sender.name, verified: sender.verified, callId: id, outcome: 'delivered' });
-    return { ok: true, call_id: id, status: 'accepted' };
-  } catch (e) {
-    store.recordCall(channel.id, { sender: sender.name, verified: sender.verified, callId: id, outcome: 'error' });
-    return { ok: false, error: String(e?.message || e) };
-  }
-}
-
-const channelView = (c) => ({ id: c.id, name: c.name, description: c.description, identity: { mode: c.identity?.mode }, action: c.action?.kind });
-
-// ── Hypha RPC service ────────────────────────────────────────────────────
-async function registerHypha() {
-  const token = process.env.HYPHA_TOKEN;
-  const serverUrl = process.env.HYPHA_SERVER_URL || 'https://hypha.aicell.io';
-  if (!token) { console.error('[channels] no HYPHA_TOKEN — skipping Hypha registration (HTTP only)'); return null; }
-  const { hyphaWebsocketClient } = await import('hypha-rpc');
-  const server = await hyphaWebsocketClient.connectToServer({ server_url: serverUrl, token, workspace: process.env.HYPHA_WORKSPACE || undefined, logger: null });
-  const svc = await server.registerService({
-    id: 'channels',
-    name: 'Svamp Channels',
-    type: 'svamp-channels',
-    config: { visibility: 'public', require_context: true },
-    async list() { return store.list().filter((c) => c.enabled !== false).map(channelView); },
-    async describe(kwargs = {}) {
-      const c = store.get(kwargs.channel); if (!c) return { error: 'not found' };
-      return { ...channelView(c), skill: { body: generateSkillBody(c, URL_BASE) } };
-    },
-    async send(kwargs = {}, context) {
-      const c = store.get(kwargs.channel);
-      if (!c || c.enabled === false) return { error: 'channel not found' };
-      const user = context?.user?.email || context?.user?.id;
-      const r = resolveSender(c, { hyphaUser: user, hyphaAnonymous: context?.user?.is_anonymous === true, hyphaWorkspace: context?.ws || context?.user?.scope?.current_workspace, from: kwargs.from });
-      if (r.error) return { error: r.error };
-      return deliver(c, r.sender, { message: kwargs.message }, {});
-    },
-  });
-  console.log(`[channels] registered Hypha service: ${svc.id} (type svamp-channels)`);
-  return server;
-}
-
-// ── HTTP transport ───────────────────────────────────────────────────────
-function startHttp(port) {
-  const server = createServer((req, res) => {
-    const u = new URL(req.url, URL_BASE);
-    if (u.pathname === '/' || u.pathname === '/health') { res.writeHead(200).end('channels ok'); return; }
-    if (u.pathname === '/channels') {
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(store.list().filter(c => c.enabled !== false).map(channelView)));
-      return;
-    }
-    let m = u.pathname.match(/^\/channel\/([\w.-]+)\/skill\.md$/);
-    if (m) { const c = store.get(m[1]); if (!c) { res.writeHead(404).end('not found'); return; }
-      res.writeHead(200, { 'content-type': 'text/markdown' }).end(generateSkillBody(c, URL_BASE)); return; }
-    m = u.pathname.match(/^\/channel\/([\w.-]+)$/);
-    if (!m) { res.writeHead(404).end('not found'); return; }
-    const c = store.get(m[1]);
-    if (!c || c.enabled === false) { res.writeHead(404, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'channel not found' })); return; }
-    if (req.method === 'GET' && !u.searchParams.get('message')) {
-      res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify({ ...channelView(c), skill_url: `${URL_BASE}/channel/${c.id}/skill.md` })); return;
-    }
-    let chunks = '';
-    req.on('data', (d) => { chunks += d; if (chunks.length > 1e6) req.destroy(); });
-    req.on('end', async () => {
-      let body = {}; try { body = chunks ? JSON.parse(chunks) : {}; } catch {}
-      const key = (req.headers.authorization || '').replace(/^Bearer\s+/i, '') || u.searchParams.get('key');
-      const message = body.message ?? u.searchParams.get('message');
-      const r = resolveSender(c, { key, from: body.from || u.searchParams.get('from') });
-      if (r.error) { res.writeHead(401, { 'content-type': 'application/json' }).end(JSON.stringify({ error: r.error })); return; }
-      const out = await deliver(c, r.sender, { message }, Object.fromEntries(u.searchParams));
-      res.writeHead(out.ok ? 200 : 500, { 'content-type': 'application/json' }).end(JSON.stringify(out));
-    });
-  });
-  server.listen(port, () => console.log(`[channels] HTTP on ${URL_BASE} (POST /channel/<id>)`));
-  return server;
-}
-
-const port = Number(process.env.CHANNEL_HTTP_PORT) || 8733;
-const http = startHttp(port);
-const hyphaServer = await registerHypha().catch((e) => { console.error('[channels] Hypha registration failed:', e?.message || e); return null; });
-console.log(`[channels] serving ${store.list().length} channel(s) from ${PROJECT}`);
-process.on('SIGINT', () => { http.close(); hyphaServer?.disconnect?.(); process.exit(0); });

package/bin/skills/loop/bin/inject-loop.mjs

@@ -1,90 +0,0 @@
-#!/usr/bin/env node
-// inject-loop.mjs — Claude Code `SessionStart` / `UserPromptSubmit` hook.
-// Injects the current LOOP.md plus the loop protocol so every iteration starts
-// from the latest task/plan/progress without any daemon re-injection.
-import { readFileSync, writeFileSync, renameSync, existsSync } from 'node:fs';
-import { dirname, join, resolve, relative } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-// Resolve the loop home from the per-process env (SVAMP_SESSION_ID + CLAUDE_PROJECT_DIR)
-// so a hook in the SHARED .claude/settings.json injects each session's OWN LOOP.md.
-// Fallback (manual/standalone): the parent of this copied bin/ dir.
-const SID = process.env.SVAMP_SESSION_ID || null;
-const PROJECT_ENV = process.env.CLAUDE_PROJECT_DIR || null;
-const LOOP_DIR = (SID && PROJECT_ENV) ? join(PROJECT_ENV, '.svamp', SID, 'loop') : resolve(HERE, '..');
-
-function readJSON(p, f) { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return f; } }
-const cfg = readJSON(join(LOOP_DIR, 'loop.config.json'), null);
-const state = readJSON(join(LOOP_DIR, 'loop-state.json'), { active: false });
-if (!cfg || state.active === false) process.exit(0); // no active loop -> inject nothing
-
-// Self-heal the Stop gate (#0072). This hook runs on every SessionStart/UserPromptSubmit while a
-// loop is active, so it's the reliable place to GUARANTEE the gate is installed: in a shared working
-// tree another tool/agent can rewrite .claude/settings.json and silently drop the Stop hook, which
-// would let the loop end without the completion gate ever firing. If the loop's own stop-gate.mjs is
-// missing from settings.hooks.Stop, re-install all four loop hooks (idempotent; merges, never clobbers
-// unrelated settings). BIN points at THIS session's copied bin/, so each session heals its own gate.
-function ensureLoopHooks() {
-  try {
-    const settingsPath = join(PROJECT_ENV || resolve(LOOP_DIR, '..', '..', '..'), '.claude', 'settings.json');
-    const binDir = join(LOOP_DIR, 'bin');
-    const node = process.execPath;
-    const cmd = (script) => `"${node}" "${join(binDir, script)}"`;
-    const stopGate = join(binDir, 'stop-gate.mjs');
-    if (!existsSync(stopGate)) return; // can't heal what isn't copied; loop-init owns first install
-    let settings = {};
-    if (existsSync(settingsPath)) { try { settings = JSON.parse(readFileSync(settingsPath, 'utf8')); } catch { settings = {}; } }
-    const hooks = settings.hooks || {};
-    // Is THIS loop's stop-gate present anywhere under hooks.Stop?
-    const stopOk = Array.isArray(hooks.Stop) && hooks.Stop.some((g) =>
-      Array.isArray(g?.hooks) && g.hooks.some((h) => typeof h?.command === 'string' && h.command.includes(stopGate)));
-    if (stopOk) return; // gate intact — nothing to do
-    // Re-install the loop hook set (same shape loop-init writes).
-    hooks.SessionStart = [{ hooks: [{ type: 'command', command: cmd('inject-loop.mjs') }] }];
-    hooks.UserPromptSubmit = [{ hooks: [{ type: 'command', command: cmd('inject-loop.mjs') }] }];
-    hooks.Stop = [{ hooks: [{ type: 'command', command: cmd('stop-gate.mjs') }] }];
-    hooks.PreCompact = [{ hooks: [{ type: 'command', command: cmd('precompact.mjs') }] }];
-    settings.hooks = hooks;
-    const tmp = settingsPath + '.tmp';
-    writeFileSync(tmp, JSON.stringify(settings, null, 2));
-    renameSync(tmp, settingsPath);
-    process.stderr.write('[loop] re-installed missing Stop gate into .claude/settings.json (#0072 self-heal)\n');
-  } catch { /* best-effort; never block injection on a heal failure */ }
-}
-ensureLoopHooks();
-
-const PROJECT = (typeof cfg.project_dir === 'string' && cfg.project_dir)
-  || process.env.CLAUDE_PROJECT_DIR || resolve(LOOP_DIR, '..', '..', '..');
-
-// LOOP.md now lives inside the (session-scoped) loop dir.
-const loopPath = join(LOOP_DIR, cfg.loop_file || 'LOOP.md');
-let loopMd = '';
-if (existsSync(loopPath)) loopMd = readFileSync(loopPath, 'utf8');
-
-const evaluatorOn = cfg.evaluator?.enabled !== false;
-const oracleCmd = cfg.oracle?.command || cfg.oracle?.test || cfg.oracle?.build || cfg.oracle || null;
-// Paths the agent must use, expressed relative to where it runs (PROJECT).
-const LOOPMD_REL = relative(PROJECT, loopPath) || 'LOOP.md';
-const VERDICT_REL = relative(PROJECT, join(LOOP_DIR, 'evaluator-verdict.json')) || join(LOOP_DIR, 'evaluator-verdict.json');
-const STATEFP_REL = relative(PROJECT, join(LOOP_DIR, 'bin', 'state-fp.mjs')) || join(LOOP_DIR, 'bin', 'state-fp.mjs');
-
-const protocol = `# 🔁 LOOP MODE IS ACTIVE
-
-You are running inside a loop. Each turn is one iteration. Work toward completing the task described in LOOP.md below. You CANNOT end the loop by simply saying you are done — a Stop gate independently re-checks the exit conditions and will send you back to work if they are not met.
-
-Your LOOP.md (durable memory) is at \`${LOOPMD_REL}\` — read and update it there.
-
-**Exit conditions (all must hold before the loop ends):**
-${oracleCmd ? `1. The oracle command must pass: \`${oracleCmd}\` (exit 0). The gate runs this itself — do not fake it.\n` : '1. (No oracle configured.)\n'}${evaluatorOn ? `2. An INDEPENDENT evaluator must judge the work \"done\". Before you finish: spawn a fresh subagent (Task tool) named/acting as \`loop-evaluator\` with a skeptical reviewer prompt; give it ONLY the goal (from LOOP.md), the current diff, and the oracle output. Have IT decide. Then record its verdict to \`${VERDICT_REL}\`:\n   {"verdict":"done"|"continue","reason":"...","guidance":"...","state_fp":"<output of: node ${STATEFP_REL}>"}\n   Do NOT grade your own work — the verdict must come from the subagent, and it is only valid for the exact code state it reviewed.\n` : ''}
-
-**Each iteration:** read LOOP.md → make real progress on the task → update the Progress section of LOOP.md → run/verify the oracle → (if you believe it's done) get the evaluator verdict → end your turn to be re-checked. Keep LOOP.md current; it is your durable memory across iterations and restarts.
-
----
-## LOOP.md (${LOOPMD_REL})
-${loopMd || '(LOOP.md not found — create it with the task and a Progress section.)'}
-`;
-
-// SessionStart/UserPromptSubmit: stdout is added to the model's context.
-process.stdout.write(protocol);
-process.exit(0);

package/bin/skills/loop/bin/loop-init.mjs

@@ -1,194 +0,0 @@
-#!/usr/bin/env node
-// loop-init.mjs — project the loop config into Claude Code's native files.
-// Generates, in a target project dir, a SESSION-SCOPED loop home:
-//   .svamp/<sessionId>/loop/{LOOP.md,loop.config.json,loop-state.json,bin/*}
-//   .claude/settings.json hooks (Stop gate + LOOP.md injection),
-//   and (optional) .claude/agents/loop-evaluator.md.
-// Session-scoping keeps sibling sessions in the same working dir from colliding.
-// Usage:
-//   node loop-init.mjs <dir> --task "..." [--criteria "..."] [--oracle "cmd"]
-//        [--max N] [--evaluator on|off] [--model NAME] [--loop-file LOOP.md]
-import { mkdirSync, writeFileSync, copyFileSync, readFileSync, existsSync, chmodSync, rmSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const HERE = dirname(fileURLToPath(import.meta.url));
-
-function parseArgs(argv) {
-  const a = { _: [] };
-  for (let i = 0; i < argv.length; i++) {
-    const t = argv[i];
-    if (t.startsWith('--')) { a[t.slice(2)] = (argv[i + 1] && !argv[i + 1].startsWith('--')) ? argv[++i] : true; }
-    else a._.push(t);
-  }
-  return a;
-}
-const args = parseArgs(process.argv.slice(2));
-const dir = resolve(args._[0] || process.cwd());
-const loopFile = args['loop-file'] || 'LOOP.md';
-const oracle = typeof args.oracle === 'string' ? args.oracle : null;
-// #0156: default max_iterations to 10000 — a high but FINITE default suitable for long-running tasks,
-// configurable both here (--max N) and AFTER the loop starts (the limit-only modify-in-place path:
-// `svamp session loop <id> --max N` / the Issues-page loop banner). An explicit --max overrides it;
-// clearing it (∞, governed by a token-rate budget) is still available via the UI.
-const max = args.max ? Number(args.max) : 10000;
-const evaluatorOn = args.evaluator !== 'off';
-const model = typeof args.model === 'string' ? args.model : null;
-const taskProvided = typeof args.task === 'string';
-const task = taskProvided ? args.task : '(describe the task here)';
-const criteria = typeof args.criteria === 'string' ? args.criteria : null;
-// Owning session id, stamped into loop-state.json so the daemon can scope
-// "loop active" (auto-approve / AskUserQuestion auto-dismiss / loop resume) to the
-// session that started the loop instead of every session sharing this directory.
-const sessionId = typeof args.session === 'string' ? args.session
-  : (typeof process.env.SVAMP_SESSION_ID === 'string' && process.env.SVAMP_SESSION_ID) ? process.env.SVAMP_SESSION_ID
-  : null;
-// #0166: hooks-only mode — install the gate scripts + MERGE the hooks into settings.json, but DON'T
-// create a loop (no config/state/LOOP.md/evaluator). Run at SESSION SPAWN so the Stop-gate hook is
-// loaded before any loop exists; the hooks no-op while no loop is active (stop-gate: `!cfg` → allow).
-// This is what makes loop start/stop/config-update SEAMLESS — the daemon never restarts Claude to load
-// the hook. Idempotent + safe to call on every spawn (it does NOT touch an existing loop's state).
-const hooksOnly = args['hooks-only'] === true || args['hooks-only'] === 'true';
-
-// Session-scoped loop home so sessions sharing a working dir never collide:
-//   <dir>/.svamp/<sessionId>/loop/   (falls back to <dir>/.svamp/loop/ with no session).
-// The Claude Code hook DEFINITIONS still live in <dir>/.claude/settings.json (that is
-// Claude Code's own config), but the loop's state + memory now live under .svamp.
-const loopDir = sessionId ? join(dir, '.svamp', sessionId, 'loop') : join(dir, '.svamp', 'loop');
-const binDir = join(loopDir, 'bin');
-mkdirSync(binDir, { recursive: true });
-mkdirSync(join(dir, '.claude', 'agents'), { recursive: true });
-
-// Re-arm cleanly: a NEW loop must NOT inherit the PREVIOUS loop's evaluator verdict or
-// history. A verdict is task+instance specific, but its freshness fingerprint only covers
-// the work tree (state-fp excludes LOOP.md + .svamp/). So a stale {verdict:done, state_fp}
-// left by a finished loop would FALSE-CLOSE a fresh loop at iteration 0 whenever the tree
-// is unchanged between loops. Always clear them so a new loop requires its own fresh verdict.
-// #0166: hooks-only NEVER re-arms — it must not disturb an existing loop's verdict/history/state.
-if (!hooksOnly) {
-  rmSync(join(loopDir, 'evaluator-verdict.json'), { force: true });
-  rmSync(join(loopDir, 'history.jsonl'), { force: true });
-}
-
-// 1. Copy hook scripts so the project is self-contained.
-for (const f of ['state-fp.mjs', 'stop-gate.mjs', 'inject-loop.mjs', 'loop-status.mjs', 'precompact.mjs']) {
-  const dest = join(binDir, f);
-  copyFileSync(join(HERE, f), dest);
-  try { chmodSync(dest, 0o755); } catch {}
-}
-
-// #0166: steps 2-4 CREATE/refresh the loop — skipped in hooks-only mode (the spawn pre-install only
-// installs the dormant gate). The copy-scripts (1) + hooks (5) below always run.
-if (!hooksOnly) {
-// 2. loop.config.json
-const config = {
-  loop_file: loopFile,
-  // The repo/working root — copied hook scripts (which live under .svamp/<sid>/loop/bin
-  // and resolve their own dir relatively) read this to run the oracle + fingerprint the
-  // work product, since their depth no longer encodes the project root.
-  project_dir: dir,
-  // The success contract — the "until" the loop gate runs against. Read by the daemon
-  // to populate the loop verdict event (legacy wire type: supervision:verdict).
-  ...(criteria ? { criteria: criteria.trim() } : {}),
-  oracle: oracle ? { command: oracle, timeout_sec: 600 } : null,
-  evaluator: { enabled: evaluatorOn, model },
-  max_iterations: max,
-  budget: (args['max-runtime'] || args['max-tokens'] || args['max-tokens-per-hour']) ? {
-    ...(args['max-runtime'] ? { max_runtime_sec: Number(args['max-runtime']) } : {}),
-    ...(args['max-tokens'] ? { max_tokens: Number(args['max-tokens']) } : {}),
-    // #0156: a ROLLING token-rate cap (tokens per the last hour) — the primary limiter for a
-    // long-running loop. The gate sums only the last hour's transcript usage and stalls if over.
-    ...(args['max-tokens-per-hour'] ? { max_tokens_per_hour: Number(args['max-tokens-per-hour']) } : {}),
-  } : undefined,
-};
-writeFileSync(join(loopDir, 'loop.config.json'), JSON.stringify(config, null, 2));
-
-// 3. loop-state.json (machine state, daemon/gate-owned)
-writeFileSync(join(loopDir, 'loop-state.json'), JSON.stringify({
-  active: true, iteration: 0, phase: 'running', started_at: new Date().toISOString(),
-  ...(sessionId ? { session_id: sessionId } : {}),
-}, null, 2));
-
-// 4. LOOP.md (agent + human editable) — lives inside the session-scoped loop dir
-// so two sessions in one working dir keep separate memory. Write it when a task is
-// provided (a fresh loop-start must NOT inherit a previous loop's task left over in the
-// same session dir), or when none exists yet. Only a hand-authored LOOP.md with NO
-// --task passed is preserved (standalone "I pre-wrote the task" case).
-const loopPath = join(loopDir, loopFile);
-if (taskProvided || !existsSync(loopPath)) {
-  writeFileSync(loopPath, `# Loop Task
-
-## Task
-${task}
-
-## Success criteria
-${criteria
-  ? criteria.split('\n').map((l) => l.trim()).filter(Boolean).map((l) => (l.startsWith('-') ? l : `- ${l}`)).join('\n')
-  : '- (define objective success criteria)'}
-${oracle ? `- The oracle passes: \`${oracle}\`` : ''}
-- An independent evaluator confirms the work is genuinely complete.
-
-## Plan
-- (the agent fills this in)
-
-## Progress
-- (the agent appends iteration notes here; this is durable memory)
-`);
-}
-} // end if(!hooksOnly): loop creation (config/state/LOOP.md)
-
-// 5. .claude/settings.json hooks — ALWAYS install/refresh the gate so it's loaded at the next Claude
-// start (pre-installed at spawn via hooks-only, so loop start/stop/config never needs a restart).
-// #0166: MERGE, don't clobber — preserve any user-defined hooks for these events; only replace OUR
-// own prior entry (matched by the loop script name) so re-running can't duplicate it.
-const settingsPath = join(dir, '.claude', 'settings.json');
-let settings = {};
-if (existsSync(settingsPath)) { try { settings = JSON.parse(readFileSync(settingsPath, 'utf8')); } catch {} }
-const node = process.execPath;
-const cmd = (script) => `"${node}" "${join(binDir, script)}"`;
-settings.hooks = settings.hooks || {};
-const mergeHook = (event, script) => {
-  const existing = Array.isArray(settings.hooks[event]) ? settings.hooks[event] : [];
-  // Drop any prior group that points at one of OUR loop scripts (so we refresh, never duplicate),
-  // keeping all user-defined groups for this event intact.
-  const others = existing.filter((g) => !(Array.isArray(g?.hooks) && g.hooks.some(
-    (h) => typeof h?.command === 'string' && /loop[\\/](bin[\\/])?(inject-loop|stop-gate|precompact)\.mjs/.test(h.command))));
-  settings.hooks[event] = [...others, { hooks: [{ type: 'command', command: cmd(script) }] }];
-};
-mergeHook('SessionStart', 'inject-loop.mjs');
-mergeHook('UserPromptSubmit', 'inject-loop.mjs');
-mergeHook('Stop', 'stop-gate.mjs');
-mergeHook('PreCompact', 'precompact.mjs');
-writeFileSync(settingsPath, JSON.stringify(settings, null, 2));
-
-// 6. Evaluator agent (materialized) — optional (skipped in hooks-only: no loop yet)
-if (!hooksOnly && evaluatorOn) {
-  const fm = ['---', 'name: loop-evaluator',
-    'description: Skeptical independent reviewer that decides if a loop task is genuinely complete.',
-    'tools: Read, Bash, Grep, Glob', ...(model ? [`model: ${model}`] : []), '---', ''].join('\n');
-  writeFileSync(join(dir, '.claude', 'agents', 'loop-evaluator.md'), fm +
-`You are an INDEPENDENT, skeptical reviewer. You did NOT write the code under review.
-
-You are given: the task/goal (from LOOP.md), the current diff, and the oracle output.
-Decide whether the work is GENUINELY and COMPLETELY done — default to "continue" on any doubt.
-
-Check:
-- Does it actually satisfy every success criterion in LOOP.md (not just look plausible)?
-- Does the oracle genuinely pass, and does it actually cover the requirement?
-- Edge cases, stubbed/faked functionality, regressions.
-- If this loop works an ISSUE BACKLOG: is EACH issue closed this round genuinely resolved by the real change? A green oracle only means "no open issues", not that each closed issue actually works — reject "done" if any was closed without real resolution.
-- HOLISTIC, from the USER's perspective: re-read the ORIGINAL request behind each closed issue (not just its triaged title) and the OVERALL project goal, and confirm we delivered what the user actually wanted end-to-end — INCLUDING that the change was built / published / deployed wherever the request implied it, not merely committed. Reject "done" if the project goal isn't genuinely met from the user's point of view, even when no issues remain open.
-
-Return ONLY a JSON object:
-{"verdict":"done"|"continue","reason":"<concise>","guidance":"<what to fix if continue>"}
-Be strict. A false "done" is far worse than one more iteration.
-`);
-}
-
-console.log(`✅ loop initialised in ${dir}
-  loop dir  : ${loopDir}
-  task file : ${join(loopDir, loopFile)}
-  oracle    : ${oracle || '(none)'}
-  evaluator : ${evaluatorOn ? 'on' + (model ? ` (${model})` : '') : 'off'}
-  max iters : ${max}
-  hooks     : SessionStart, UserPromptSubmit, Stop  (.claude/settings.json)`);