svamp-cli 0.2.235 → 0.2.237

package/dist/{fleet-DYoCJTed.mjs → fleet-CQfui55H.mjs}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { c as connectToHypha } from './run-CVg6eagc.mjs';
-import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-VIupR1NK.mjs';
+import { c as connectToHypha } from './run-D2CpI5au.mjs';
+import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-ivV7xAp3.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{frpc-D3UoKvqr.mjs → frpc-Ba_vkNU8.mjs}

@@ -4,7 +4,7 @@ import { mkdirSync, writeFileSync, unlinkSync, existsSync, chmodSync, readFileSy
 import { join } from 'path';
 import { homedir, platform, arch } from 'os';
 import { randomUUID, createHash } from 'crypto';
-import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-CVg6eagc.mjs';
+import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-D2CpI5au.mjs';
 import 'fs/promises';
 import 'url';
 import 'node:crypto';

package/dist/{headlessCli-BJt2EMMB.mjs → headlessCli-CMUr-41T.mjs}

@@ -1,5 +1,5 @@
-import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run-CVg6eagc.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-Bt0Y2j3D.mjs';
+import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run-D2CpI5au.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-CO3ctHV1.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-CVg6eagc.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-D2CpI5au.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-ChjZJIJr.mjs → package-DyegLVIT.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.235";
+var version = "0.2.237";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";

package/dist/{pinnedClaudeCode-VIupR1NK.mjs → pinnedClaudeCode-ivV7xAp3.mjs}

@@ -3,6 +3,20 @@ import { promisify } from 'node:util';
 
 const PINNED_CLAUDE_CODE_VERSION = "2.1.195";
 const exec = promisify(exec$1);
+let _reconcile = null;
+function beginClaudeVersionReconcile(log) {
+  if (_reconcile) return;
+  _reconcile = ensureClaudeCodeVersion(log).catch((e) => {
+    log(`[claude-version] check failed: ${e?.message || e}`);
+  });
+}
+function awaitClaudeVersionReady(timeoutMs = 6e4) {
+  if (!_reconcile) return Promise.resolve();
+  return Promise.race([
+    _reconcile.then(() => void 0),
+    new Promise((resolve) => setTimeout(resolve, timeoutMs))
+  ]);
+}
 async function readClaudeVersion() {
   try {
     const { stdout } = await exec("claude --version", { timeout: 1e4 });
@@ -55,4 +69,4 @@ async function ensureClaudeCodeVersion(log, pinned = PINNED_CLAUDE_CODE_VERSION,
   return { kind: "installed", from: current, to: after ?? pinned };
 }
 
-export { PINNED_CLAUDE_CODE_VERSION, ensureClaudeCodeVersion };
+export { PINNED_CLAUDE_CODE_VERSION, awaitClaudeVersionReady, beginClaudeVersionReconcile, ensureClaudeCodeVersion };

package/dist/{rpc-DaRTfCjS.mjs → rpc-CTXWi-2N.mjs}

@@ -1,6 +1,6 @@
-import { m as resolveProjectRoot } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot } from './run-D2CpI5au.mjs';
 import { g as getWorkflow, s as setWorkflowEnabled, r as removeWorkflow, a as saveWorkflow, b as rawWorkflow, l as listWorkflows } from './store-BTs0H_y0.mjs';
-import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-DxBjBflT.mjs';
+import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-BDgSvZBQ.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-DPWxDUve.mjs → rpc-hilaJa6_.mjs}

@@ -1,4 +1,4 @@
-import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run-CVg6eagc.mjs';
+import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run-D2CpI5au.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-Dt0YoXZ-.mjs → run-C7Zt6jLc.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run-CVg6eagc.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run-D2CpI5au.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{run-CVg6eagc.mjs → run-D2CpI5au.mjs}

@@ -116,6 +116,12 @@ function resolveRoleLevel(sharing, userEmail) {
   }
   return level;
 }
+function roleAtLeast(role, min) {
+  if (!role) return false;
+  const have = ROLE_HIERARCHY[role];
+  const need = ROLE_HIERARCHY[min];
+  return typeof have === "number" && typeof need === "number" && have >= need;
+}
 function levelToRole(level) {
   const entry = Object.entries(ROLE_HIERARCHY).find(([, v]) => v === level);
   return entry?.[0] ?? null;
@@ -1471,7 +1477,7 @@ class ChannelStore {
     const errs = validateChannel(c);
     if (errs.length) throw new Error("invalid channel: " + errs.join("; "));
     mkdirSync(this.dir, { recursive: true });
-    const tmp = this._path(c.id) + ".tmp";
+    const tmp = `${this._path(c.id)}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
     writeFileSync(tmp, JSON.stringify(c, null, 2));
     renameSync(tmp, this._path(c.id));
     return c;
@@ -1708,11 +1714,13 @@ function renderMessage(channel, { sender = {}, body = {}, query = {}, callId, no
 
 const MAX_PER_CHANNEL = 200;
 const TTL_MS = 60 * 60 * 1e3;
+const COMPACT_EVERY = 500;
 class ChannelOutbox {
   file;
   byChannel = /* @__PURE__ */ new Map();
   seqByChannel = /* @__PURE__ */ new Map();
   emitter = new EventEmitter();
+  appendsSinceCompact = 0;
   constructor(projectDir) {
     const dir = join(projectDir, ".svamp", "channels");
     this.file = join(dir, "_outbox.jsonl");
@@ -1726,9 +1734,11 @@ class ChannelOutbox {
   _load() {
     if (!existsSync(this.file)) return;
     const cutoff = Date.now() - TTL_MS;
+    let rawLines = 0;
     try {
       for (const line of readFileSync(this.file, "utf8").split("\n")) {
         if (!line.trim()) continue;
+        rawLines++;
         let rec = null;
         try {
           rec = JSON.parse(line);
@@ -1745,6 +1755,25 @@ class ChannelOutbox {
       for (const [ch, arr] of this.byChannel) if (arr.length > MAX_PER_CHANNEL) this.byChannel.set(ch, arr.slice(-MAX_PER_CHANNEL));
     } catch {
     }
+    let kept = 0;
+    for (const arr of this.byChannel.values()) kept += arr.length;
+    if (rawLines > kept) this._compact();
+  }
+  /** Rewrite _outbox.jsonl to the current in-memory (TTL/MAX-bounded) window. Best-effort. */
+  _compact() {
+    try {
+      const lines = [];
+      for (const [channelId, arr] of this.byChannel) {
+        this._evict(channelId);
+        for (const reply of this.byChannel.get(channelId) || []) lines.push(JSON.stringify({ channelId, ...reply }));
+      }
+      const dir = join(this.file, "..");
+      mkdirSync(dir, { recursive: true });
+      const tmp = `${this.file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+      writeFileSync(tmp, lines.join("\n") + (lines.length ? "\n" : ""));
+      renameSync(tmp, this.file);
+    } catch {
+    }
   }
   _evict(channelId) {
     const cutoff = Date.now() - TTL_MS;
@@ -1772,6 +1801,10 @@ class ChannelOutbox {
       } catch {
       }
     }
+    if (++this.appendsSinceCompact >= COMPACT_EVERY) {
+      this.appendsSinceCompact = 0;
+      this._compact();
+    }
     this.emitter.emit(channelId, reply);
     return reply;
   }
@@ -1855,6 +1888,25 @@ function getParamNames(fn) {
 }
 const terminalSessions = /* @__PURE__ */ new Map();
 let ptyModule = null;
+const TERMINAL_IDLE_MS = 30 * 60 * 1e3;
+let terminalReaper = null;
+function ensureTerminalReaper() {
+  if (terminalReaper) return;
+  terminalReaper = setInterval(() => {
+    const now = Date.now();
+    for (const [id, s] of terminalSessions) {
+      if (s.exited) continue;
+      if (now - s.lastActivity > TERMINAL_IDLE_MS) {
+        try {
+          s.pty.kill();
+        } catch {
+        }
+        terminalSessions.delete(id);
+      }
+    }
+  }, 6e4);
+  terminalReaper.unref?.();
+}
 async function getPtyModule() {
   if (!ptyModule) {
     try {
@@ -2559,9 +2611,11 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           cols,
           rows,
           createdAt: Date.now(),
+          lastActivity: Date.now(),
           cwd
         };
         terminalSessions.set(sessionId, session);
+        ensureTerminalReaper();
         let outputBatch = "";
         let outputTimer = null;
         const flushOutput = () => {
@@ -2584,6 +2638,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         };
         ptyProcess.onData((data) => {
           if (!data) return;
+          session.lastActivity = Date.now();
           outputBatch += data;
           if (!outputTimer) outputTimer = setTimeout(flushOutput, 16);
         });
@@ -2614,6 +2669,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
         const filtered = filterTerminalResponses(params.data);
         if (filtered) session.pty.write(filtered);
+        session.lastActivity = Date.now();
         return { success: true };
       },
       /** Resize a terminal session. */
@@ -2635,6 +2691,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const session = terminalSessions.get(params.sessionId);
         if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
         const output = session.outputBuffer.splice(0).join("");
+        session.lastActivity = Date.now();
         const result = {
           output,
           exited: session.exited
@@ -2934,7 +2991,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+        const { FrpcTunnel } = await import('./frpc-Ba_vkNU8.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3114,8 +3171,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // require a signed-in, non-anonymous user so the daemon isn't an open
       // OpenAI relay. (No context at all = internal call → allowed.)
       wiseCreateEphemeralToken: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use WISE voice." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: WISE voice requires interact access to this machine." };
         }
         const resolved = resolveModel({ provider: "openai" }, process.env);
         const misconfig = describeMisconfiguration(resolved);
@@ -3135,7 +3192,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // the realtime WISE voice loop (connected to this session's WISE agent).
       // sessionId set = attached to that session; omitted = global.
       wiseJoinMeeting: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in to launch a meeting agent." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: launching a meeting agent requires interact access to this machine." };
         const parsed = parseMeetingUrl(params?.meetingUrl || "");
         if (!parsed) return { success: false, error: "Unrecognized meeting link (supports Zoom, Google Meet, Teams)." };
         const base = (process.env.SVAMP_VEXA_API_URL || "").replace(/\/$/, "");
@@ -3216,7 +3273,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         }
       },
       wiseLeaveMeeting: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: managing a meeting agent requires interact access to this machine." };
         const k = params?.sessionId || (params?.platform && params?.nativeId ? `global:${params.nativeId}` : "");
         const rec = k ? activeMeetingAgents.get(k) : void 0;
         const platform = params?.platform || rec?.platform;
@@ -3233,7 +3290,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         }
       },
       // Drives the title-bar "WISE in a meeting" indicator (poll per session).
-      wiseMeetingStatus: async (params) => {
+      wiseMeetingStatus: async (params, context) => {
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "view")) {
+          return { active: false, error: "Not authorized to view meeting status on this machine." };
+        }
         if (params?.sessionId) {
           const rec = activeMeetingAgents.get(params.sessionId);
           let transcript = [];
@@ -3250,7 +3310,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // (running inside its session) calls `svamp wise announce "<update>"` when work
       // is done so the room hears about it; this POSTs to the bot's Vexa chat endpoint.
       wiseAnnounce: async (params, context) => {
-        if (context && (!context.user || context.user.is_anonymous)) return { success: false, error: "Sign in to announce into a meeting." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) return { success: false, error: "Not authorized: announcing into a meeting requires interact access to this machine." };
         const text = (params?.text || "").trim();
         if (!text) return { success: false, error: "Nothing to announce: provide text." };
         let rec = params?.sessionId ? activeMeetingAgents.get(params.sessionId) : void 0;
@@ -3284,8 +3344,8 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       // which has no key post-Option-A and hits CORS/"Load failed" calling OpenAI direct.
       wiseSummarize: async (params, context) => {
         trackInbound();
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use WISE." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: WISE requires interact access to this machine." };
         }
         const text = (params?.text || "").trim();
         if (!text) return { success: true, answer: "(nothing to summarize)" };
@@ -3336,8 +3396,8 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       // Option A. The browser uses the returned ephemeral secret for its WebRTC leg.
       wiseMintTranscriptionToken: async (params, context) => {
         trackInbound();
-        if (context && (!context.user || context.user.is_anonymous)) {
-          return { success: false, error: "Sign in to use dictation." };
+        if (!roleAtLeast(getEffectiveRole(context, currentMetadata.sharing), "interact")) {
+          return { success: false, error: "Not authorized: dictation requires interact access to this machine." };
         }
         const resolved = resolveModel({ provider: "openai" }, process.env);
         const misconfig = describeMisconfiguration(resolved);
@@ -3382,7 +3442,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-Bt0Y2j3D.mjs');
+          const { toolsForRole } = await import('./sideband-CO3ctHV1.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3481,7 +3541,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-BMCNLXjz.mjs');
+    const { queryCore } = await import('./commands-Cbpf3Qxk.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -3651,6 +3711,7 @@ ${d?.error || "not found"}`;
       });
     },
     getLastInboundRpcAt: () => lastInboundRpcAt,
+    getCurrentMetadata: () => currentMetadata,
     setHandlers: (newHandlers) => {
       handlers = newHandlers;
     },
@@ -4579,10 +4640,15 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       }
     }
     let forwardContent = content;
-    if (!trusted && parsed && parsed.role === "user" && parsed.content && typeof parsed.content === "object") {
-      const txt = parsed.content.text;
-      if (typeof txt === "string" && txt.trimStart().startsWith("<svamp-message")) {
-        parsed = { ...parsed, content: { ...parsed.content, text: neutralizeForgedEnvelope(txt) } };
+    if (!trusted && parsed && parsed.role === "user" && parsed.content != null) {
+      if (typeof parsed.content === "object") {
+        const txt = parsed.content.text;
+        if (typeof txt === "string" && txt.trimStart().startsWith("<svamp-message")) {
+          parsed = { ...parsed, content: { ...parsed.content, text: neutralizeForgedEnvelope(txt) } };
+          forwardContent = JSON.stringify(parsed);
+        }
+      } else if (typeof parsed.content === "string" && parsed.content.trimStart().startsWith("<svamp-message")) {
+        parsed = { ...parsed, content: neutralizeForgedEnvelope(parsed.content) };
         forwardContent = JSON.stringify(parsed);
       }
     }
@@ -4849,7 +4915,10 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       if (meetingActivity.length > 80) meetingActivity.splice(0, meetingActivity.length - 80);
       return { ok: true };
     },
-    getMeetingActivity: async () => ({ activity: meetingActivity.slice(-40) }),
+    getMeetingActivity: async (context) => {
+      authorizeRequest(context, metadata.sharing, "view");
+      return { activity: meetingActivity.slice(-40) };
+    },
     channelDescribe: async (id) => {
       const c = channelStore.get(id);
       if (!c || c.enabled === false || c.system) return { error: "not found" };
@@ -6085,19 +6154,23 @@ var projectInfo = /*#__PURE__*/Object.freeze({
 });
 
 async function registerDebugService(server, machineId, deps) {
+  const authorize = (context, role) => authorizeRequest(context, deps.getSharing?.(), role);
   const serviceInfo = await server.registerService(
     {
       id: `svamp-debug-${machineId}`,
       name: `Svamp Debug ${machineId.slice(0, 8)}`,
       type: "svamp-debug",
-      config: { visibility: "unlisted" },
+      // require_context: true → Hypha injects the caller context as the last arg of every
+      // method, which the authorize() gate below enforces. 'unlisted' only hides discovery.
+      config: { visibility: "unlisted", require_context: true },
       healthCheck: async () => ({
         ok: true,
         machineId,
         uptime: process.uptime(),
         timestamp: Date.now()
       }),
-      getSessionStates: async () => {
+      getSessionStates: async (context) => {
+        authorize(context, "view");
         const sessions = deps.getTrackedSessions();
         const states = [];
         for (const s of sessions) {
@@ -6120,27 +6193,33 @@ async function registerDebugService(server, machineId, deps) {
         }
         return states;
       },
-      getMachineInfo: async () => ({
-        machineId,
-        hostname: (await import('os')).hostname(),
-        platform: (await import('os')).platform(),
-        uptime: process.uptime(),
-        sessions: deps.getTrackedSessions().length
-      }),
+      getMachineInfo: async (context) => {
+        authorize(context, "view");
+        return {
+          machineId,
+          hostname: (await import('os')).hostname(),
+          platform: (await import('os')).platform(),
+          uptime: process.uptime(),
+          sessions: deps.getTrackedSessions().length
+        };
+      },
       // ── Artifact Sync RPCs ──
-      getArtifactSyncStatus: async () => {
+      getArtifactSyncStatus: async (context) => {
+        authorize(context, "view");
         const sync = deps.getArtifactSync?.();
         if (!sync) return { error: "Artifact sync not available" };
         return sync.getStatus();
       },
-      forceSyncAll: async () => {
+      forceSyncAll: async (context) => {
+        authorize(context, "admin");
         const sync = deps.getArtifactSync?.();
         const sessionsDir = deps.getSessionsDir?.();
         if (!sync || !sessionsDir) return { error: "Artifact sync not available" };
         await sync.syncAll(sessionsDir, machineId);
         return { success: true, status: sync.getStatus() };
       },
-      listRemoteSessions: async () => {
+      listRemoteSessions: async (context) => {
+        authorize(context, "view");
         const sync = deps.getArtifactSync?.();
         if (!sync) return [];
         return await sync.listRemoteSessions();
@@ -10629,8 +10708,22 @@ function addIssue(projectRoot, fields) {
     closed: null,
     body: fields.body
   };
-  atomicWrite(issuePath(projectRoot, issue.id), serializeIssue(issue));
-  return issue;
+  mkdirSync(dirname(issuePath(projectRoot, issue.id)), { recursive: true });
+  let n = Number(issue.id);
+  for (let attempt = 0; attempt < 1e4; attempt++) {
+    issue.id = String(n).padStart(4, "0");
+    try {
+      writeFileSync(issuePath(projectRoot, issue.id), serializeIssue(issue), { flag: "wx" });
+      return issue;
+    } catch (err) {
+      if (err && err.code === "EEXIST") {
+        n++;
+        continue;
+      }
+      throw err;
+    }
+  }
+  throw new Error("addIssue: could not allocate a free issue id");
 }
 function updateIssue(projectRoot, id, patch) {
   const cur = getIssue(projectRoot, id);
@@ -10716,6 +10809,7 @@ function summarize(issues) {
   return { total: issues.length, ready: by("ready"), in_progress: by("in_progress"), archived: by("archived") };
 }
 
+const UNBOUNDED_LOOP_ITERATIONS = 1e6;
 function backlogOraclePending(projectRoot, sessionId) {
   const inScope = (i) => !sessionId || isVisibleTo(i, sessionId);
   return listIssues(projectRoot).filter(inScope).filter((i) => i.status === "ready" || i.status === "in_progress").map((i) => ({ id: i.id }));
@@ -10809,7 +10903,7 @@ function checkLoopBudget(ledger, limits, now, startedAt) {
   const L = limits || {};
   const led = ledger || { turns: 0, tokens: 0, window: [] };
   const pos = (v) => typeof v === "number" && Number.isFinite(v) && v > 0;
-  if (pos(L.max_iterations) && led.turns >= L.max_iterations) {
+  if (pos(L.max_iterations) && L.max_iterations < UNBOUNDED_LOOP_ITERATIONS && led.turns >= L.max_iterations) {
     return { exceeded: true, reason: `iteration budget reached (${led.turns}/${L.max_iterations} turns)` };
   }
   if (pos(L.max_runtime_sec) && pos(startedAt)) {
@@ -11721,7 +11815,8 @@ function writeSvampConfig(configPath, config) {
   renameSync$1(tmpPath, configPath);
   return content;
 }
-const DEFAULT_LOOP_MAX_ITERATIONS = 1e3;
+const DEFAULT_LOOP_MAX_ITERATIONS = UNBOUNDED_LOOP_ITERATIONS;
+const LOOP_CHECKPOINT_CADENCE = 25;
 function getLoopDir(directory, sessionId) {
   if (sessionId) {
     const scoped = join$1(directory, ".svamp", sessionId, "loop");
@@ -12100,6 +12195,19 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
           sessionService.pushMessage({ type: "message", message: 'No loop to modify \u2014 start one with: svamp session loop <id> "<task>" --until "<criteria>" --max N', level: "warning" }, "event");
         } else {
           const newMax = typeof cfg.max_iterations === "number" ? cfg.max_iterations : typeof cfg.max_rounds === "number" ? cfg.max_rounds : void 0;
+          const recomposedTask = (() => {
+            try {
+              const gt = existing.goal_task;
+              const un = existing.until;
+              const or = existing.oracle;
+              const effMax = newMax != null ? newMax : existing.max_iterations;
+              if (typeof effMax === "number" && effMax > 0 && (gt || un)) {
+                return buildGoalCondition({ task: gt, until: un, oracle: or, maxIterations: Math.min(effMax, LOOP_CHECKPOINT_CADENCE) });
+              }
+            } catch {
+            }
+            return void 0;
+          })();
           try {
             const lcPath = join$1(getLoopDir(directory, sessionId), "loop.config.json");
             const lc = readLoopJson(directory, sessionId, "loop.config.json") || {};
@@ -12120,6 +12228,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
                 phase: "continue",
                 iteration: 0,
                 ...newMax != null ? { max_iterations: newMax } : {},
+                ...recomposedTask ? { task: recomposedTask } : {},
                 ...bumpedBudget ? { budget: { ...existing.budget || {}, ...bumpedBudget } } : {},
                 completed_at: void 0,
                 gave_up_reason: void 0,
@@ -12138,6 +12247,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
               if (cur) writeGoalLoopState(directory, sessionId, {
                 ...cur,
                 ...newMax != null ? { max_iterations: newMax } : {},
+                ...recomposedTask ? { task: recomposedTask } : {},
                 ...bumpedBudget ? { budget: { ...cur.budget || {}, ...bumpedBudget } } : {}
               });
             } catch {
@@ -12151,7 +12261,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
         const explicitMax = typeof cfg.max_iterations === "number" ? cfg.max_iterations : typeof cfg.max_rounds === "number" ? cfg.max_rounds : void 0;
         const hasExplicitMax = typeof explicitMax === "number" && explicitMax > 0;
         const hardMax = hasExplicitMax ? explicitMax : DEFAULT_LOOP_MAX_ITERATIONS;
-        const softTurnCap = hasExplicitMax ? explicitMax : 20;
+        const softTurnCap = Math.min(hardMax, LOOP_CHECKPOINT_CADENCE);
         const condition = buildGoalCondition({ task, until, oracle, maxIterations: softTurnCap });
         const budget = parseLoopBudget(cfg.budget);
         try {
@@ -12607,7 +12717,7 @@ async function startDaemon(options) {
     saveExposedTunnels(list);
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-D3UoKvqr.mjs');
+    const { FrpcTunnel } = await import('./frpc-Ba_vkNU8.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -12627,15 +12737,15 @@ async function startDaemon(options) {
     return tunnel;
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
-  const { ServeManager } = await import('./serveManager-TUKxMan6.mjs');
+  const { ServeManager } = await import('./serveManager-BzWW7OuZ.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { ensureClaudeCodeVersion } = await import('./pinnedClaudeCode-VIupR1NK.mjs');
-      await ensureClaudeCodeVersion((msg) => logger.log(msg));
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+      beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
     }
@@ -14636,11 +14746,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DPWxDUve.mjs');
+              const { issueRpc } = await import('./rpc-hilaJa6_.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DaRTfCjS.mjs');
+              const { workflowRpc } = await import('./rpc-CTXWi-2N.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15173,11 +15283,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DPWxDUve.mjs');
+              const { issueRpc } = await import('./rpc-hilaJa6_.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DaRTfCjS.mjs');
+              const { workflowRpc } = await import('./rpc-CTXWi-2N.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15854,8 +15964,10 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         return null;
       },
       getArtifactSync: () => artifactSync,
-      getSessionsDir: () => SVAMP_HOME
+      getSessionsDir: () => SVAMP_HOME,
       // Legacy; debug service uses session index now
+      // SECURITY #0207: authorize debug RPCs against the machine's live sharing config.
+      getSharing: () => machineService.getCurrentMetadata().sharing
     });
     logger.log(`Debug service registered: svamp-debug-${machineId}`);
     const supervised = process.env.SVAMP_SUPERVISED === "1";
@@ -15909,6 +16021,11 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       }
     }
     if (persistedSessions.length > 0) {
+      try {
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+        await awaitClaudeVersionReady();
+      } catch {
+      }
       logger.log(`Restoring ${persistedSessions.length} persisted session(s)...`);
       const restoreConcurrency = Math.max(1, parseInt(process.env.SVAMP_RESTORE_CONCURRENCY || "8", 10) || 8);
       const restoreOne = async (persisted) => {
@@ -16047,7 +16164,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-CPX7QBP-.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-C_p2K8SX.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();

package/dist/{runStore-DxBjBflT.mjs → runStore-BDgSvZBQ.mjs}

@@ -1,8 +1,9 @@
 import { spawn } from 'node:child_process';
 import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { c as workflowSteps, d as workflowsDir } from './store-BTs0H_y0.mjs';
-import { v as listIssues, t as addIssue } from './run-CVg6eagc.mjs';
+import { v as listIssues, t as addIssue } from './run-D2CpI5au.mjs';
 
 const MAX_RUNS_PER_WORKFLOW = 50;
 const MAX_STREAM_CHARS = 8e3;
@@ -41,7 +42,7 @@ function recordRun(projectRoot, run) {
     if (idx >= 0) existing[idx] = run;
     else existing.push(run);
     const kept = existing.slice(-MAX_RUNS_PER_WORKFLOW);
-    const tmp = `${file}.tmp`;
+    const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
     writeFileSync(tmp, kept.map((r) => JSON.stringify(r)).join("\n") + "\n");
     renameSync(tmp, file);
   } catch {