svamp-cli 0.2.235 → 0.2.236

package/dist/{agentCommands-CQYzhyOV.mjs → agentCommands-Mim66pYY.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from '
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { requireNotSandboxed } from './sandboxDetect-DNTcbgWD.mjs';
-import { A as shortId } from './run-CVg6eagc.mjs';
+import { A as shortId } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -96,7 +96,7 @@ async function sessionSetTitle(title) {
 }
 async function sessionSetProjectDescription(description) {
   const dir = process.cwd();
-  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.a9; });
+  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.a9; });
   const desc = sanitizeDescription(description, 240);
   if (!desc) {
     console.error("Project description is empty.");
@@ -327,7 +327,7 @@ async function sessionBroadcast(action, args) {
   console.log(`Broadcast sent: ${action}`);
 }
 async function connectToMachineService() {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   return connectAndGetMachine();
 }
 function buildInboxMessage(args) {
@@ -405,7 +405,7 @@ async function inboxSend(targetSessionId, opts) {
     console.error("Message body is required.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndResolveSession } = await import('./commands-C07RBbtJ.mjs');
   let server;
   try {
     const { targetId, messageId } = await inboxSendCore(
@@ -459,7 +459,7 @@ async function inboxReply(messageId, body) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndResolveSession } = await import('./commands-C07RBbtJ.mjs');
   const { server: localServer, machine: localMachine } = await connectToMachineService();
   let localDisconnected = false;
   const disconnectLocal = async () => {

package/dist/{auth-DJJDXcNo.mjs → auth-BSYtbITx.mjs}

@@ -1,4 +1,4 @@
-import { P as resolveModel } from './run-CVg6eagc.mjs';
+import { P as resolveModel } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run-CVg6eagc.mjs';
+import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run--5q3ieqY.mjs';
 import { ensureSupervisorViaServiceManager, LAUNCHD_LABEL } from './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';
@@ -34,7 +34,7 @@ const subcommand = args[0];
 let daemonSubcommand = args[1];
 async function main() {
   try {
-    const { getLoadedConfig } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.af; });
+    const { getLoadedConfig } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.af; });
     getLoadedConfig();
   } catch {
   }
@@ -51,7 +51,7 @@ async function main() {
         console.error(`svamp daemon restart: ${err.message || err}`);
         process.exit(1);
       }
-      const { restartDaemon } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ah; });
+      const { restartDaemon } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ah; });
       await restartDaemon();
       process.exit(0);
     }
@@ -344,7 +344,7 @@ async function main() {
       console.error("svamp service: Service commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServiceCommand } = await import('./commands-pUbnaaJb.mjs');
+    const { handleServiceCommand } = await import('./commands-zeaF9f5w.mjs');
     await handleServiceCommand();
   } else if (subcommand === "serve") {
     const { isSandboxed: isSandboxedServe } = await import('./sandboxDetect-DNTcbgWD.mjs');
@@ -352,7 +352,7 @@ async function main() {
       console.error("svamp serve: Serve commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServeCommand } = await import('./serveCommands-dQo7QYhs.mjs');
+    const { handleServeCommand } = await import('./serveCommands-CNXAhbi8.mjs');
     await handleServeCommand();
     process.exit(0);
   } else if (subcommand === "process" || subcommand === "proc") {
@@ -361,7 +361,7 @@ async function main() {
       console.error("svamp process: Process commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { processCommand } = await import('./commands-DjVnwCLk.mjs');
+    const { processCommand } = await import('./commands-DUBpnJY3.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -375,18 +375,18 @@ async function main() {
     }), machineId);
     process.exit(0);
   } else if (subcommand === "issue" || subcommand === "issues") {
-    const { issueCommand } = await import('./commands-BrkFOjiN.mjs');
+    const { issueCommand } = await import('./commands-D8a4f-BY.mjs');
     await issueCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "workflow" || subcommand === "workflows") {
-    const { workflowCommand } = await import('./commands-BhP_0oWb.mjs');
+    const { workflowCommand } = await import('./commands-C221nXts.mjs');
     await workflowCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "wise-agent" || subcommand === "wise") {
     await handleWiseAgentCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "feature" || subcommand === "crew") {
-    const { crewCommand } = await import('./commands-C8eSHhho.mjs');
+    const { crewCommand } = await import('./commands-BaJRyJnJ.mjs');
     await crewCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "--help" || subcommand === "-h") {
@@ -394,7 +394,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-ChjZJIJr.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-oE0HJeDM.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -403,7 +403,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-Dt0YoXZ-.mjs');
+  const { runInteractive } = await import('./run-MOBlMV11.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -448,7 +448,7 @@ async function handleAgentCommand() {
     return;
   }
   if (agentArgs[0] === "list") {
-    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ac; });
+    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ac; });
     console.log("Known agents:");
     for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
       console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
@@ -460,7 +460,7 @@ async function handleAgentCommand() {
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
     return;
   }
-  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ac; });
+  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ac; });
   let cwd = process.cwd();
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
@@ -484,12 +484,12 @@ async function handleAgentCommand() {
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
   let backend;
   if (KNOWN_MCP_AGENTS[config.agentName]) {
-    const { CodexMcpBackend } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ad; });
+    const { CodexMcpBackend } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ad; });
     backend = new CodexMcpBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ab; });
-    const { GeminiTransport } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ae; });
-    const { DefaultTransport } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.aa; });
+    const { AcpBackend } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ab; });
+    const { GeminiTransport } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ae; });
+    const { DefaultTransport } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.aa; });
     const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : new DefaultTransport(config.agentName);
     backend = new AcpBackend({
       agentName: config.agentName,
@@ -616,7 +616,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
   }
-  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-BMCNLXjz.mjs');
+  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-C07RBbtJ.mjs');
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -684,7 +684,7 @@ async function handleSessionCommand() {
         allowDomain.push(sessionArgs[++i]);
       }
     }
-    const { parseShareArg } = await import('./commands-BMCNLXjz.mjs');
+    const { parseShareArg } = await import('./commands-C07RBbtJ.mjs');
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -772,7 +772,7 @@ async function handleSessionCommand() {
       console.error("  Rewinds history: rewrites the message + drops everything after it, then restarts Claude.");
       process.exit(1);
     }
-    const { sessionEditMessage } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionEditMessage } = await import('./commands-C07RBbtJ.mjs');
     await sessionEditMessage(sessionArgs[1], sessionArgs[2], sessionArgs[3], targetMachineId);
   } else if (sessionSubcommand === "refine") {
     if (!sessionArgs[1] || !sessionArgs[2]) {
@@ -780,7 +780,7 @@ async function handleSessionCommand() {
       console.error("  Asks the agent to revise its latest reply in place (no extra round).");
       process.exit(1);
     }
-    const { sessionRefineLastReply } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionRefineLastReply } = await import('./commands-C07RBbtJ.mjs');
     await sessionRefineLastReply(sessionArgs[1], sessionArgs[2], targetMachineId);
   } else if (sessionSubcommand === "undo-edit" || sessionSubcommand === "undo") {
     if (!sessionArgs[1]) {
@@ -788,7 +788,7 @@ async function handleSessionCommand() {
       console.error("  Reverts the most recent edit/refine, restoring the pre-edit history.");
       process.exit(1);
     }
-    const { sessionUndoEdit } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionUndoEdit } = await import('./commands-C07RBbtJ.mjs');
     await sessionUndoEdit(sessionArgs[1], targetMachineId);
   } else if (sessionSubcommand === "query") {
     const dir = sessionArgs[1];
@@ -798,7 +798,7 @@ async function handleSessionCommand() {
       console.error("  Spawns a stateless Claude session in <directory>, sends <prompt>, prints the answer, then deletes the session.");
       process.exit(1);
     }
-    const { sessionQuery } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionQuery } = await import('./commands-C07RBbtJ.mjs');
     await sessionQuery(dir, prompt, targetMachineId, {
       timeout: parseFlagInt("--timeout"),
       json: hasFlag("--json"),
@@ -831,7 +831,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionApprove } = await import('./commands-C07RBbtJ.mjs');
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -841,7 +841,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-BMCNLXjz.mjs');
+    const { sessionDeny } = await import('./commands-C07RBbtJ.mjs');
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -886,7 +886,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-title <title>");
       process.exit(1);
     }
-    const { sessionSetTitle } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { sessionSetTitle } = await import('./agentCommands-Mim66pYY.mjs');
     await sessionSetTitle(title);
   } else if (sessionSubcommand === "set-project-description" || sessionSubcommand === "set-project") {
     const desc = sessionArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
@@ -894,7 +894,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-project-description <text>");
       process.exit(1);
     }
-    const { sessionSetProjectDescription } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { sessionSetProjectDescription } = await import('./agentCommands-Mim66pYY.mjs');
     await sessionSetProjectDescription(desc);
   } else if (sessionSubcommand === "set-link") {
     const url = sessionArgs[1];
@@ -903,11 +903,11 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
-    const { sessionSetLink } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { sessionSetLink } = await import('./agentCommands-Mim66pYY.mjs');
     await sessionSetLink(url, label);
   } else if (sessionSubcommand === "link") {
     const op = sessionArgs[1];
-    const lm = await import('./agentCommands-CQYzhyOV.mjs');
+    const lm = await import('./agentCommands-Mim66pYY.mjs');
     if (op === "add") {
       const url = sessionArgs[2];
       if (!url || url.startsWith("--")) {
@@ -942,7 +942,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const level = parseFlagStr("--level") || "info";
-    const { sessionNotify } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { sessionNotify } = await import('./agentCommands-Mim66pYY.mjs');
     await sessionNotify(message, level);
   } else if (sessionSubcommand === "broadcast") {
     const action = sessionArgs[1];
@@ -950,7 +950,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
       process.exit(1);
     }
-    const { sessionBroadcast } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { sessionBroadcast } = await import('./agentCommands-Mim66pYY.mjs');
     await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "inbox") {
     const inboxSubcmd = sessionArgs[1];
@@ -961,7 +961,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId) {
-        const { inboxSend } = await import('./agentCommands-CQYzhyOV.mjs');
+        const { inboxSend } = await import('./agentCommands-Mim66pYY.mjs');
         await inboxSend(sessionArgs[2], {
           body: sessionArgs[3],
           subject: parseFlagStr("--subject"),
@@ -976,7 +976,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
       if (agentSessionId && !sessionArgs[2]) {
-        const { inboxList } = await import('./agentCommands-CQYzhyOV.mjs');
+        const { inboxList } = await import('./agentCommands-Mim66pYY.mjs');
         await inboxList({
           unread: hasFlag("--unread"),
           limit: parseFlagInt("--limit"),
@@ -998,7 +998,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId && !sessionArgs[3]) {
-        const { inboxList } = await import('./agentCommands-CQYzhyOV.mjs');
+        const { inboxList } = await import('./agentCommands-Mim66pYY.mjs');
         await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
       } else if (sessionArgs[3]) {
         await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
@@ -1008,7 +1008,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "reply") {
       if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
-        const { inboxReply } = await import('./agentCommands-CQYzhyOV.mjs');
+        const { inboxReply } = await import('./agentCommands-Mim66pYY.mjs');
         await inboxReply(sessionArgs[2], sessionArgs[3]);
       } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
         await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
@@ -1046,7 +1046,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-BMCNLXjz.mjs');
+    const { machineShare } = await import('./commands-C07RBbtJ.mjs');
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -1097,14 +1097,14 @@ async function handleMachineCommand() {
       process.exit(1);
     }
     if (all) {
-      const { fleetExec } = await import('./fleet-DYoCJTed.mjs');
+      const { fleetExec } = await import('./fleet-b5DdOH8i.mjs');
       await fleetExec(command, { cwd });
     } else {
-      const { machineExec } = await import('./commands-BMCNLXjz.mjs');
+      const { machineExec } = await import('./commands-C07RBbtJ.mjs');
       await machineExec(machineId, command, cwd);
     }
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-BMCNLXjz.mjs');
+    const { machineInfo } = await import('./commands-C07RBbtJ.mjs');
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -1124,10 +1124,10 @@ async function handleMachineCommand() {
         level = machineArgs[++i];
       }
     }
-    const { machineNotify } = await import('./agentCommands-CQYzhyOV.mjs');
+    const { machineNotify } = await import('./agentCommands-Mim66pYY.mjs');
     await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-BMCNLXjz.mjs');
+    const { machineLs } = await import('./commands-C07RBbtJ.mjs');
     let machineId;
     let showHidden = false;
     let path;
@@ -1183,20 +1183,20 @@ Examples:
   };
   const hasFlag = (name) => fleetArgs.includes(`--${name}`);
   if (sub === "status") {
-    const { fleetStatus } = await import('./fleet-DYoCJTed.mjs');
+    const { fleetStatus } = await import('./fleet-b5DdOH8i.mjs');
     await fleetStatus();
   } else if (sub === "upgrade-claude") {
-    const { fleetUpgradeClaude } = await import('./fleet-DYoCJTed.mjs');
+    const { fleetUpgradeClaude } = await import('./fleet-b5DdOH8i.mjs');
     await fleetUpgradeClaude({ version: flag("version", "-v") });
   } else if (sub === "upgrade-svamp") {
-    const { fleetUpgradeSvamp } = await import('./fleet-DYoCJTed.mjs');
+    const { fleetUpgradeSvamp } = await import('./fleet-b5DdOH8i.mjs');
     await fleetUpgradeSvamp({ version: flag("version", "-v"), excludeSelf: hasFlag("exclude-self") });
   } else if (sub === "daemon-restart") {
-    const { fleetDaemonRestart } = await import('./fleet-DYoCJTed.mjs');
+    const { fleetDaemonRestart } = await import('./fleet-b5DdOH8i.mjs');
     await fleetDaemonRestart({ graceful: !hasFlag("cleanup") });
   } else if (sub === "push-skill") {
     const name = fleetArgs[1];
-    const { fleetPushSkill } = await import('./fleet-DYoCJTed.mjs');
+    const { fleetPushSkill } = await import('./fleet-b5DdOH8i.mjs');
     await fleetPushSkill(name);
   } else {
     console.error(`Unknown fleet subcommand: ${sub}`);
@@ -1212,7 +1212,7 @@ async function handleSkillsCommand() {
     await printSkillsHelp();
     return;
   }
-  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-B9uukn75.mjs');
+  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-DUz_h3Ol.mjs');
   if (skillsSubcommand === "find" || skillsSubcommand === "search") {
     const query = skillsArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
     if (!query) {
@@ -1259,7 +1259,7 @@ async function loginToHypha() {
     process.exit(1);
   }
   const anchor = anchorArg.replace(/\/+$/, "");
-  const { loadInstanceConfig } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.af; });
+  const { loadInstanceConfig } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.af; });
   let cfg = null;
   try {
     cfg = await loadInstanceConfig({ anchor, force: true });
@@ -1370,7 +1370,7 @@ async function logoutFromHypha() {
   } catch {
   }
   try {
-    const { clearInstanceConfigCache } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.af; });
+    const { clearInstanceConfigCache } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.af; });
     clearInstanceConfigCache();
   } catch {
   }
@@ -1708,7 +1708,7 @@ async function applyClaudeAuthFlags(argv) {
       "--use-hypha-proxy, --use-claude-login, and --anthropic-base-url/--anthropic-api-key are mutually exclusive"
     );
   }
-  const mod = await import('./run-CVg6eagc.mjs').then(function (n) { return n.a8; });
+  const mod = await import('./run--5q3ieqY.mjs').then(function (n) { return n.a8; });
   if (hasHypha) {
     let url;
     const hyphaIdx = argv.indexOf("--use-hypha-proxy");
@@ -1762,7 +1762,7 @@ async function applyDaemonShareFlag(argv) {
     }
   }
   if (collected.length === 0) return;
-  const { updateEnvFile } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.a8; });
+  const { updateEnvFile } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.a8; });
   const seen = /* @__PURE__ */ new Set();
   const deduped = collected.filter((e) => {
     const k = e.toLowerCase();
@@ -1795,7 +1795,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const message = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAskCli } = await import('./commands-BMCNLXjz.mjs');
+    const { wiseAskCli } = await import('./commands-C07RBbtJ.mjs');
     await wiseAskCli(machineId, message, sessionId, { json });
     return;
   }
@@ -1807,7 +1807,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { runWiseVoiceCli } = await import('./headlessCli-BJt2EMMB.mjs');
+    const { runWiseVoiceCli } = await import('./headlessCli-BESypdgg.mjs');
     await runWiseVoiceCli({ voice: valueOf(["--voice"]), wakeKeywordPath: valueOf(["--wake"]), model: valueOf(["--model"]) });
     return;
   }
@@ -1825,7 +1825,7 @@ async function handleWiseAgentCommand(rest) {
     const mode = valueOf(["--mode"]);
     const mission = valueOf(["--mission"]);
     const url = rest.slice(1).find((a) => /^https?:\/\//.test(a)) || "";
-    const { wiseJoinMeetingCli } = await import('./commands-BMCNLXjz.mjs');
+    const { wiseJoinMeetingCli } = await import('./commands-C07RBbtJ.mjs');
     await wiseJoinMeetingCli(machineId, url, sessionId, { json, mode, mission });
     return;
   }
@@ -1837,7 +1837,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseLeaveMeetingCli } = await import('./commands-BMCNLXjz.mjs');
+    const { wiseLeaveMeetingCli } = await import('./commands-C07RBbtJ.mjs');
     await wiseLeaveMeetingCli(valueOf(["--machine", "-m"]), valueOf(["--session", "-s"]), { json: rest.includes("--json") });
     return;
   }
@@ -1861,7 +1861,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const text = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAnnounceCli } = await import('./commands-BMCNLXjz.mjs');
+    const { wiseAnnounceCli } = await import('./commands-C07RBbtJ.mjs');
     await wiseAnnounceCli(machineId, text, sessionId, { json });
     return;
   }
@@ -1873,7 +1873,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseMeetingsCli } = await import('./commands-BMCNLXjz.mjs');
+    const { wiseMeetingsCli } = await import('./commands-C07RBbtJ.mjs');
     await wiseMeetingsCli(valueOf(["--machine", "-m"]), { json: rest.includes("--json") });
     return;
   }
@@ -1923,7 +1923,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   const authArgs = rest.slice(1);
-  const mod = await import('./auth-DJJDXcNo.mjs');
+  const mod = await import('./auth-BSYtbITx.mjs');
   let action;
   try {
     action = mod.parseWiseAgentAuthArgs(authArgs);
@@ -1933,7 +1933,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   if (action) {
-    const { updateEnvFile } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.a8; });
+    const { updateEnvFile } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.a8; });
     const updates = mod.buildWiseAgentEnvUpdates(action);
     updateEnvFile(updates);
     for (const [k, v] of Object.entries(updates)) {
@@ -1947,7 +1947,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
 }
 async function handleDaemonAuthCommand(argv) {
   const sub = (argv[0] || "status").toLowerCase();
-  const mod = await import('./run-CVg6eagc.mjs').then(function (n) { return n.a8; });
+  const mod = await import('./run--5q3ieqY.mjs').then(function (n) { return n.a8; });
   if (sub === "--help" || sub === "-h" || sub === "help") {
     console.log(`
 svamp daemon auth \u2014 Configure how Claude subprocesses authenticate
@@ -2261,7 +2261,7 @@ Examples:
 async function printSkillsHelp() {
   let browseUrl = "<HYPHA_SERVER_URL>/<workspace>/artifacts/marketplace (set HYPHA_SERVER_URL)";
   try {
-    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run-CVg6eagc.mjs').then(function (n) { return n.ag; });
+    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run--5q3ieqY.mjs').then(function (n) { return n.ag; });
     browseUrl = `${getArtifactBaseUrl()}/${getSkillsCollectionName()}`;
   } catch {
   }

package/dist/{commands-C8eSHhho.mjs → commands-BaJRyJnJ.mjs}

@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-BMCNLXjz.mjs';
+import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-C07RBbtJ.mjs';
 import { execSync } from 'node:child_process';
-import { u as updateIssue, q as addComment, t as addIssue, A as shortId } from './run-CVg6eagc.mjs';
+import { u as updateIssue, q as addComment, t as addIssue, A as shortId } from './run--5q3ieqY.mjs';
 import 'node:os';
 import 'os';
 import 'fs/promises';

package/dist/{commands-BMCNLXjz.mjs → commands-C07RBbtJ.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { basename, resolve, join, isAbsolute } from 'node:path';
 import os from 'node:os';
-import { Q as formatHandle, T as normalizeAllowedUser, U as loadSecurityContextConfig, V as resolveSecurityContext, W as buildSecurityContextFromFlags, X as mergeSecurityContexts, c as connectToHypha, Y as buildSessionShareUrl, Z as computeOutboundHop, A as shortId, _ as registerAwaitingReply, $ as buildMachineShareUrl, a0 as parseHandle, a1 as handleMatchesMetadata } from './run-CVg6eagc.mjs';
+import { Q as formatHandle, T as normalizeAllowedUser, U as loadSecurityContextConfig, V as resolveSecurityContext, W as buildSecurityContextFromFlags, X as mergeSecurityContexts, c as connectToHypha, Y as buildSessionShareUrl, Z as computeOutboundHop, A as shortId, _ as registerAwaitingReply, $ as buildMachineShareUrl, a0 as parseHandle, a1 as handleMatchesMetadata } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-BhP_0oWb.mjs → commands-C221nXts.mjs}

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { m as resolveProjectRoot } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot } from './run--5q3ieqY.mjs';
 import { c as workflowSteps, s as setWorkflowEnabled, i as isWorkflowEnabled, r as removeWorkflow, g as getWorkflow, l as listWorkflows, a as saveWorkflow, b as rawWorkflow } from './store-BTs0H_y0.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{commands-BrkFOjiN.mjs → commands-D8a4f-BY.mjs}

@@ -1,7 +1,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { m as resolveProjectRoot, w as searchIssues, v as listIssues, o as resumeIssue, p as pauseIssue, q as addComment, u as updateIssue, n as getIssue, x as isVisibleTo, z as summarize, t as addIssue } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot, w as searchIssues, v as listIssues, o as resumeIssue, p as pauseIssue, q as addComment, u as updateIssue, n as getIssue, x as isVisibleTo, z as summarize, t as addIssue } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-DjVnwCLk.mjs → commands-DUBpnJY3.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-BMCNLXjz.mjs';
+import { connectAndGetMachine } from './commands-C07RBbtJ.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-CVg6eagc.mjs';
+import './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-B9uukn75.mjs → commands-DUz_h3Ol.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { F as parseFrontmatter, G as getSkillsServer, H as getSkillsWorkspaceName, I as getSkillsCollectionName, J as fetchWithTimeout, K as searchSkills, L as SKILLS_DIR, M as getSkillInfo, N as downloadSkillFile, O as listSkillFiles } from './run-CVg6eagc.mjs';
+import { F as parseFrontmatter, G as getSkillsServer, H as getSkillsWorkspaceName, I as getSkillsCollectionName, J as fetchWithTimeout, K as searchSkills, L as SKILLS_DIR, M as getSkillInfo, N as downloadSkillFile, O as listSkillFiles } from './run--5q3ieqY.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{commands-pUbnaaJb.mjs → commands-zeaF9f5w.mjs}

@@ -58,7 +58,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+    const { runFrpcTunnel } = await import('./frpc-CoFt3YiO.mjs');
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -68,7 +68,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -90,7 +90,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-CQYzhyOV.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-Mim66pYY.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -136,7 +136,7 @@ async function serviceServe(args) {
     };
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    const { runFrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+    const { runFrpcTunnel } = await import('./frpc-CoFt3YiO.mjs');
     await runFrpcTunnel(name, [caddyPort]);
   } catch (err) {
     console.error(`Error serving directory: ${err.message}`);
@@ -145,7 +145,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+    const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -185,7 +185,7 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+    const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });

package/dist/{fleet-DYoCJTed.mjs → fleet-b5DdOH8i.mjs}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { c as connectToHypha } from './run-CVg6eagc.mjs';
-import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-VIupR1NK.mjs';
+import { c as connectToHypha } from './run--5q3ieqY.mjs';
+import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-ivV7xAp3.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{frpc-D3UoKvqr.mjs → frpc-CoFt3YiO.mjs}

@@ -4,7 +4,7 @@ import { mkdirSync, writeFileSync, unlinkSync, existsSync, chmodSync, readFileSy
 import { join } from 'path';
 import { homedir, platform, arch } from 'os';
 import { randomUUID, createHash } from 'crypto';
-import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-CVg6eagc.mjs';
+import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run--5q3ieqY.mjs';
 import 'fs/promises';
 import 'url';
 import 'node:crypto';

package/dist/{headlessCli-BJt2EMMB.mjs → headlessCli-BESypdgg.mjs}

@@ -1,5 +1,5 @@
-import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run-CVg6eagc.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-Bt0Y2j3D.mjs';
+import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run--5q3ieqY.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-C3srx9Jx.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-CVg6eagc.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-ChjZJIJr.mjs → package-oE0HJeDM.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.235";
+var version = "0.2.236";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";

package/dist/{pinnedClaudeCode-VIupR1NK.mjs → pinnedClaudeCode-ivV7xAp3.mjs}

@@ -3,6 +3,20 @@ import { promisify } from 'node:util';
 
 const PINNED_CLAUDE_CODE_VERSION = "2.1.195";
 const exec = promisify(exec$1);
+let _reconcile = null;
+function beginClaudeVersionReconcile(log) {
+  if (_reconcile) return;
+  _reconcile = ensureClaudeCodeVersion(log).catch((e) => {
+    log(`[claude-version] check failed: ${e?.message || e}`);
+  });
+}
+function awaitClaudeVersionReady(timeoutMs = 6e4) {
+  if (!_reconcile) return Promise.resolve();
+  return Promise.race([
+    _reconcile.then(() => void 0),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs))
+  ]);
+}
 async function readClaudeVersion() {
   try {
     const { stdout } = await exec("claude --version", { timeout: 1e4 });
@@ -55,4 +69,4 @@ async function ensureClaudeCodeVersion(log, pinned = PINNED_CLAUDE_CODE_VERSION,
   return { kind: "installed", from: current, to: after ?? pinned };
 }
 
-export { PINNED_CLAUDE_CODE_VERSION, ensureClaudeCodeVersion };
+export { PINNED_CLAUDE_CODE_VERSION, awaitClaudeVersionReady, beginClaudeVersionReconcile, ensureClaudeCodeVersion };

package/dist/{rpc-DPWxDUve.mjs → rpc-BPCA-q42.mjs}

@@ -1,4 +1,4 @@
-import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-DaRTfCjS.mjs → rpc-Def2Apuq.mjs}

@@ -1,6 +1,6 @@
-import { m as resolveProjectRoot } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot } from './run--5q3ieqY.mjs';
 import { g as getWorkflow, s as setWorkflowEnabled, r as removeWorkflow, a as saveWorkflow, b as rawWorkflow, l as listWorkflows } from './store-BTs0H_y0.mjs';
-import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-DxBjBflT.mjs';
+import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-Bfr7UIzR.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-CVg6eagc.mjs → run--5q3ieqY.mjs}

@@ -116,6 +116,12 @@ function resolveRoleLevel(sharing, userEmail) {
   }
   return level;
 }
+function roleAtLeast(role, min) {
+  if (!role) return false;
+  const have = ROLE_HIERARCHY[role];
+  const need = ROLE_HIERARCHY[min];
+  return typeof have === "number" && typeof need === "number" && have >= need;
+}
 function levelToRole(level) {
   const entry = Object.entries(ROLE_HIERARCHY).find(([, v]) => v === level);
   return entry?.[0] ?? null;
@@ -2934,7 +2940,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+        const { FrpcTunnel } = await import('./frpc-CoFt3YiO.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3114,8 +3120,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // require a signed-in, non-anonymous user so the daemon isn't an open
       // OpenAI relay. (No context at all = internal call → allowed.)
       wiseCreateEphemeralToken: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use WISE voice." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: WISE voice requires interact access to this machine." };
         }
         const resolved = resolveModel({ provider: "openai" }, process.env);
         const misconfig = describeMisconfiguration(resolved);
@@ -3135,7 +3141,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // the realtime WISE voice loop (connected to this session's WISE agent).
       // sessionId set = attached to that session; omitted = global.
       wiseJoinMeeting: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in to launch a meeting agent." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: launching a meeting agent requires interact access to this machine." };
         const parsed = parseMeetingUrl(params?.meetingUrl || "");
         if (!parsed) return { success: false, error: "Unrecognized meeting link (supports Zoom, Google Meet, Teams)." };
         const base = (process.env.SVAMP_VEXA_API_URL || "").replace(/\/$/, "");
@@ -3216,7 +3222,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         }
       },
       wiseLeaveMeeting: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: managing a meeting agent requires interact access to this machine." };
         const k = params?.sessionId || (params?.platform && params?.nativeId ? `global:${params.nativeId}` : "");
         const rec = k ? activeMeetingAgents.get(k) : void 0;
         const platform = params?.platform || rec?.platform;
@@ -3233,7 +3239,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         }
       },
       // Drives the title-bar "WISE in a meeting" indicator (poll per session).
-      wiseMeetingStatus: async (params) => {
+      wiseMeetingStatus: async (params, context) => {
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "view")) {
+          return { active: false, error: "Not authorized to view meeting status on this machine." };
+        }
         if (params?.sessionId) {
           const rec = activeMeetingAgents.get(params.sessionId);
           let transcript = [];
@@ -3250,7 +3259,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // (running inside its session) calls `svamp wise announce "<update>"` when work
       // is done so the room hears about it; this POSTs to the bot's Vexa chat endpoint.
       wiseAnnounce: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in to announce into a meeting." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: announcing into a meeting requires interact access to this machine." };
         const text = (params?.text || "").trim();
         if (!text) return { success: false, error: "Nothing to announce: provide text." };
         let rec = params?.sessionId ? activeMeetingAgents.get(params.sessionId) : void 0;
@@ -3284,8 +3293,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // which has no key post-Option-A and hits CORS/"Load failed" calling OpenAI direct.
       wiseSummarize: async (params, context) => {
         trackInbound();
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use WISE." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: WISE requires interact access to this machine." };
         }
         const text = (params?.text || "").trim();
         if (!text) return { success: true, answer: "(nothing to summarize)" };
@@ -3336,8 +3345,8 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       // Option A. The browser uses the returned ephemeral secret for its WebRTC leg.
       wiseMintTranscriptionToken: async (params, context) => {
         trackInbound();
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use dictation." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: dictation requires interact access to this machine." };
         }
         const resolved = resolveModel({ provider: "openai" }, process.env);
         const misconfig = describeMisconfiguration(resolved);
@@ -3382,7 +3391,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-Bt0Y2j3D.mjs');
+          const { toolsForRole } = await import('./sideband-C3srx9Jx.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3481,7 +3490,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-BMCNLXjz.mjs');
+    const { queryCore } = await import('./commands-C07RBbtJ.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -3651,6 +3660,7 @@ ${d?.error || "not found"}`;
       });
     },
     getLastInboundRpcAt: () => lastInboundRpcAt,
+    getCurrentMetadata: () => currentMetadata,
     setHandlers: (newHandlers) => {
       handlers = newHandlers;
     },
@@ -4849,7 +4859,10 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       if (meetingActivity.length > 80) meetingActivity.splice(0, meetingActivity.length - 80);
       return { ok: true };
     },
-    getMeetingActivity: async () => ({ activity: meetingActivity.slice(-40) }),
+    getMeetingActivity: async (context) => {
+      authorizeRequest(context, metadata.sharing, "view");
+      return { activity: meetingActivity.slice(-40) };
+    },
     channelDescribe: async (id) => {
       const c = channelStore.get(id);
       if (!c || c.enabled === false || c.system) return { error: "not found" };
@@ -6085,19 +6098,23 @@ var projectInfo = /*#__PURE__*/Object.freeze({
 });
 
 async function registerDebugService(server, machineId, deps) {
+  const authorize = (context, role) => authorizeRequest(context, deps.getSharing?.(), role);
   const serviceInfo = await server.registerService(
     {
       id: `svamp-debug-${machineId}`,
       name: `Svamp Debug ${machineId.slice(0, 8)}`,
       type: "svamp-debug",
-      config: { visibility: "unlisted" },
+      // require_context: true → Hypha injects the caller context as the last arg of every
+      // method, which the authorize() gate below enforces. 'unlisted' only hides discovery.
+      config: { visibility: "unlisted", require_context: true },
       healthCheck: async () => ({
         ok: true,
         machineId,
         uptime: process.uptime(),
         timestamp: Date.now()
       }),
-      getSessionStates: async () => {
+      getSessionStates: async (context) => {
+        authorize(context, "view");
         const sessions = deps.getTrackedSessions();
         const states = [];
         for (const s of sessions) {
@@ -6120,27 +6137,33 @@ async function registerDebugService(server, machineId, deps) {
         }
         return states;
       },
-      getMachineInfo: async () => ({
-        machineId,
-        hostname: (await import('os')).hostname(),
-        platform: (await import('os')).platform(),
-        uptime: process.uptime(),
-        sessions: deps.getTrackedSessions().length
-      }),
+      getMachineInfo: async (context) => {
+        authorize(context, "view");
+        return {
+          machineId,
+          hostname: (await import('os')).hostname(),
+          platform: (await import('os')).platform(),
+          uptime: process.uptime(),
+          sessions: deps.getTrackedSessions().length
+        };
+      },
       // ── Artifact Sync RPCs ──
-      getArtifactSyncStatus: async () => {
+      getArtifactSyncStatus: async (context) => {
+        authorize(context, "view");
         const sync = deps.getArtifactSync?.();
         if (!sync) return { error: "Artifact sync not available" };
         return sync.getStatus();
       },
-      forceSyncAll: async () => {
+      forceSyncAll: async (context) => {
+        authorize(context, "admin");
         const sync = deps.getArtifactSync?.();
         const sessionsDir = deps.getSessionsDir?.();
         if (!sync || !sessionsDir) return { error: "Artifact sync not available" };
         await sync.syncAll(sessionsDir, machineId);
         return { success: true, status: sync.getStatus() };
       },
-      listRemoteSessions: async () => {
+      listRemoteSessions: async (context) => {
+        authorize(context, "view");
         const sync = deps.getArtifactSync?.();
         if (!sync) return [];
         return await sync.listRemoteSessions();
@@ -10716,6 +10739,7 @@ function summarize(issues) {
   return { total: issues.length, ready: by("ready"), in_progress: by("in_progress"), archived: by("archived") };
 }
 
+const UNBOUNDED_LOOP_ITERATIONS = 1e6;
 function backlogOraclePending(projectRoot, sessionId) {
   const inScope = (i) => !sessionId || isVisibleTo(i, sessionId);
   return listIssues(projectRoot).filter(inScope).filter((i) => i.status === "ready" || i.status === "in_progress").map((i) => ({ id: i.id }));
@@ -10809,7 +10833,7 @@ function checkLoopBudget(ledger, limits, now, startedAt) {
   const L = limits || {};
   const led = ledger || { turns: 0, tokens: 0, window: [] };
   const pos = (v) => typeof v === "number" && Number.isFinite(v) && v > 0;
-  if (pos(L.max_iterations) && led.turns >= L.max_iterations) {
+  if (pos(L.max_iterations) && L.max_iterations < UNBOUNDED_LOOP_ITERATIONS && led.turns >= L.max_iterations) {
     return { exceeded: true, reason: `iteration budget reached (${led.turns}/${L.max_iterations} turns)` };
   }
   if (pos(L.max_runtime_sec) && pos(startedAt)) {
@@ -11721,7 +11745,8 @@ function writeSvampConfig(configPath, config) {
   renameSync$1(tmpPath, configPath);
   return content;
 }
-const DEFAULT_LOOP_MAX_ITERATIONS = 1e3;
+const DEFAULT_LOOP_MAX_ITERATIONS = UNBOUNDED_LOOP_ITERATIONS;
+const LOOP_CHECKPOINT_CADENCE = 25;
 function getLoopDir(directory, sessionId) {
   if (sessionId) {
     const scoped = join$1(directory, ".svamp", sessionId, "loop");
@@ -12100,6 +12125,19 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
           sessionService.pushMessage({ type: "message", message: 'No loop to modify \u2014 start one with: svamp session loop <id> "<task>" --until "<criteria>" --max N', level: "warning" }, "event");
         } else {
           const newMax = typeof cfg.max_iterations === "number" ? cfg.max_iterations : typeof cfg.max_rounds === "number" ? cfg.max_rounds : void 0;
+          const recomposedTask = (() => {
+            try {
+              const gt = existing.goal_task;
+              const un = existing.until;
+              const or = existing.oracle;
+              const effMax = newMax != null ? newMax : existing.max_iterations;
+              if (typeof effMax === "number" && effMax > 0 && (gt || un)) {
+                return buildGoalCondition({ task: gt, until: un, oracle: or, maxIterations: Math.min(effMax, LOOP_CHECKPOINT_CADENCE) });
+              }
+            } catch {
+            }
+            return void 0;
+          })();
           try {
             const lcPath = join$1(getLoopDir(directory, sessionId), "loop.config.json");
             const lc = readLoopJson(directory, sessionId, "loop.config.json") || {};
@@ -12120,6 +12158,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
                 phase: "continue",
                 iteration: 0,
                 ...newMax != null ? { max_iterations: newMax } : {},
+                ...recomposedTask ? { task: recomposedTask } : {},
                 ...bumpedBudget ? { budget: { ...existing.budget || {}, ...bumpedBudget } } : {},
                 completed_at: void 0,
                 gave_up_reason: void 0,
@@ -12138,6 +12177,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
               if (cur) writeGoalLoopState(directory, sessionId, {
                 ...cur,
                 ...newMax != null ? { max_iterations: newMax } : {},
+                ...recomposedTask ? { task: recomposedTask } : {},
                 ...bumpedBudget ? { budget: { ...cur.budget || {}, ...bumpedBudget } } : {}
               });
             } catch {
@@ -12151,7 +12191,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
         const explicitMax = typeof cfg.max_iterations === "number" ? cfg.max_iterations : typeof cfg.max_rounds === "number" ? cfg.max_rounds : void 0;
         const hasExplicitMax = typeof explicitMax === "number" && explicitMax > 0;
         const hardMax = hasExplicitMax ? explicitMax : DEFAULT_LOOP_MAX_ITERATIONS;
-        const softTurnCap = hasExplicitMax ? explicitMax : 20;
+        const softTurnCap = Math.min(hardMax, LOOP_CHECKPOINT_CADENCE);
         const condition = buildGoalCondition({ task, until, oracle, maxIterations: softTurnCap });
         const budget = parseLoopBudget(cfg.budget);
         try {
@@ -12607,7 +12647,7 @@ async function startDaemon(options) {
     saveExposedTunnels(list);
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+    const { FrpcTunnel } = await import('./frpc-CoFt3YiO.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -12627,15 +12667,15 @@ async function startDaemon(options) {
     return tunnel;
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
-  const { ServeManager } = await import('./serveManager-TUKxMan6.mjs');
+  const { ServeManager } = await import('./serveManager-DBqhEdOE.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { ensureClaudeCodeVersion } = await import('./pinnedClaudeCode-VIupR1NK.mjs');
-      await ensureClaudeCodeVersion((msg) => logger.log(msg));
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+      beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
     }
@@ -14636,11 +14676,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DPWxDUve.mjs');
+              const { issueRpc } = await import('./rpc-BPCA-q42.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DaRTfCjS.mjs');
+              const { workflowRpc } = await import('./rpc-Def2Apuq.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15173,11 +15213,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DPWxDUve.mjs');
+              const { issueRpc } = await import('./rpc-BPCA-q42.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DaRTfCjS.mjs');
+              const { workflowRpc } = await import('./rpc-Def2Apuq.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15854,8 +15894,10 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         return null;
       },
       getArtifactSync: () => artifactSync,
-      getSessionsDir: () => SVAMP_HOME
+      getSessionsDir: () => SVAMP_HOME,
       // Legacy; debug service uses session index now
+      // SECURITY #0207: authorize debug RPCs against the machine's live sharing config.
+      getSharing: () => machineService.getCurrentMetadata().sharing
     });
     logger.log(`Debug service registered: svamp-debug-${machineId}`);
     const supervised = process.env.SVAMP_SUPERVISED === "1";
@@ -15909,6 +15951,11 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       }
     }
     if (persistedSessions.length > 0) {
+      try {
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+        await awaitClaudeVersionReady();
+      } catch {
+      }
       logger.log(`Restoring ${persistedSessions.length} persisted session(s)...`);
       const restoreConcurrency = Math.max(1, parseInt(process.env.SVAMP_RESTORE_CONCURRENCY || "8", 10) || 8);
       const restoreOne = async (persisted) => {
@@ -16047,7 +16094,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-CPX7QBP-.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-Dfr3y3FI.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();

package/dist/{run-Dt0YoXZ-.mjs → run-MOBlMV11.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run-CVg6eagc.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run--5q3ieqY.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{runStore-DxBjBflT.mjs → runStore-Bfr7UIzR.mjs}

@@ -2,7 +2,7 @@ import { spawn } from 'node:child_process';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
 import { join } from 'node:path';
 import { c as workflowSteps, d as workflowsDir } from './store-BTs0H_y0.mjs';
-import { v as listIssues, t as addIssue } from './run-CVg6eagc.mjs';
+import { v as listIssues, t as addIssue } from './run--5q3ieqY.mjs';
 
 const MAX_RUNS_PER_WORKFLOW = 50;
 const MAX_STREAM_CHARS = 8e3;

package/dist/{scheduler-CPX7QBP-.mjs → scheduler-Dfr3y3FI.mjs}

@@ -1,6 +1,6 @@
-import { m as resolveProjectRoot, y as cronMatches } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot, y as cronMatches } from './run--5q3ieqY.mjs';
 import { l as listWorkflows, i as isWorkflowEnabled, w as workflowCrons } from './store-BTs0H_y0.mjs';
-import { r as runWorkflow } from './runStore-DxBjBflT.mjs';
+import { r as runWorkflow } from './runStore-Bfr7UIzR.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-dQo7QYhs.mjs → serveCommands-CNXAhbi8.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-BMCNLXjz.mjs');
+  const { connectAndGetMachine } = await import('./commands-C07RBbtJ.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-TUKxMan6.mjs → serveManager-DBqhEdOE.mjs}

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-CVg6eagc.mjs';
+import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run--5q3ieqY.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -733,7 +733,7 @@ class ServeManager {
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+      const { FrpcTunnel } = await import('./frpc-CoFt3YiO.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-Bt0Y2j3D.mjs → sideband-C3srx9Jx.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, B as loadMachineContext, C as buildMachineInstructions, D as machineToolsForRole, E as buildMachineTools } from './run-CVg6eagc.mjs';
+import { R as READ_ONLY_TOOLS, B as loadMachineContext, C as buildMachineInstructions, D as machineToolsForRole, E as buildMachineTools } from './run--5q3ieqY.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.235",
+  "version": "0.2.236",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",