svamp-cli 0.2.244 → 0.2.246

package/dist/{agentCommands-DvLTS2bk.mjs → agentCommands-wOdV4Do1.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from '
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { requireNotSandboxed } from './sandboxDetect-DNTcbgWD.mjs';
-import { A as shortId } from './run-BgPz-Shl.mjs';
+import { A as shortId } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -96,7 +96,7 @@ async function sessionSetTitle(title) {
 }
 async function sessionSetProjectDescription(description) {
   const dir = process.cwd();
-  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.a9; });
+  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.a9; });
   const desc = sanitizeDescription(description, 240);
   if (!desc) {
     console.error("Project description is empty.");
@@ -327,7 +327,7 @@ async function sessionBroadcast(action, args) {
   console.log(`Broadcast sent: ${action}`);
 }
 async function connectToMachineService() {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   return connectAndGetMachine();
 }
 function buildInboxMessage(args) {
@@ -405,7 +405,7 @@ async function inboxSend(targetSessionId, opts) {
     console.error("Message body is required.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndResolveSession } = await import('./commands-BhLGBhBS.mjs');
   let server;
   try {
     const { targetId, messageId } = await inboxSendCore(
@@ -459,7 +459,7 @@ async function inboxReply(messageId, body) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndResolveSession } = await import('./commands-BhLGBhBS.mjs');
   const { server: localServer, machine: localMachine } = await connectToMachineService();
   let localDisconnected = false;
   const disconnectLocal = async () => {

package/dist/{auth-JDjru_js.mjs → auth-Bg0Z_bP-.mjs}

@@ -1,4 +1,4 @@
-import { P as resolveModel } from './run-BgPz-Shl.mjs';
+import { P as resolveModel } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run-BgPz-Shl.mjs';
+import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run-BPZ_1RCI.mjs';
 import { ensureSupervisorViaServiceManager, LAUNCHD_LABEL } from './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';
@@ -34,7 +34,7 @@ const subcommand = args[0];
 let daemonSubcommand = args[1];
 async function main() {
   try {
-    const { getLoadedConfig } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.af; });
+    const { getLoadedConfig } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.af; });
     getLoadedConfig();
   } catch {
   }
@@ -51,7 +51,7 @@ async function main() {
         console.error(`svamp daemon restart: ${err.message || err}`);
         process.exit(1);
       }
-      const { restartDaemon } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ah; });
+      const { restartDaemon } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ah; });
       await restartDaemon();
       process.exit(0);
     }
@@ -344,7 +344,7 @@ async function main() {
       console.error("svamp service: Service commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServiceCommand } = await import('./commands-jFRw1VYy.mjs');
+    const { handleServiceCommand } = await import('./commands-CudvGpEz.mjs');
     await handleServiceCommand();
   } else if (subcommand === "serve") {
     const { isSandboxed: isSandboxedServe } = await import('./sandboxDetect-DNTcbgWD.mjs');
@@ -352,7 +352,7 @@ async function main() {
       console.error("svamp serve: Serve commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServeCommand } = await import('./serveCommands-bEavErQo.mjs');
+    const { handleServeCommand } = await import('./serveCommands-Af_7qqzA.mjs');
     await handleServeCommand();
     process.exit(0);
   } else if (subcommand === "process" || subcommand === "proc") {
@@ -361,7 +361,7 @@ async function main() {
       console.error("svamp process: Process commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { processCommand } = await import('./commands-QyDnDry4.mjs');
+    const { processCommand } = await import('./commands-CkduYG4a.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -375,18 +375,18 @@ async function main() {
     }), machineId);
     process.exit(0);
   } else if (subcommand === "issue" || subcommand === "issues") {
-    const { issueCommand } = await import('./commands-CRsGX1t1.mjs');
+    const { issueCommand } = await import('./commands-Bi_LZXPe.mjs');
     await issueCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "workflow" || subcommand === "workflows") {
-    const { workflowCommand } = await import('./commands-Bt8pK8MS.mjs');
+    const { workflowCommand } = await import('./commands-CniwP5Tm.mjs');
     await workflowCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "wise-agent" || subcommand === "wise") {
     await handleWiseAgentCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "feature" || subcommand === "crew") {
-    const { crewCommand } = await import('./commands-CIa6EEAk.mjs');
+    const { crewCommand } = await import('./commands-D9khoYtI.mjs');
     await crewCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "--help" || subcommand === "-h") {
@@ -394,7 +394,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-mhgf18rF.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-CUTX-CB-.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -403,7 +403,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-hCQkcg9-.mjs');
+  const { runInteractive } = await import('./run-DRR6psuh.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -448,7 +448,7 @@ async function handleAgentCommand() {
     return;
   }
   if (agentArgs[0] === "list") {
-    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ac; });
+    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ac; });
     console.log("Known agents:");
     for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
       console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
@@ -460,7 +460,7 @@ async function handleAgentCommand() {
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
     return;
   }
-  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ac; });
+  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ac; });
   let cwd = process.cwd();
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
@@ -484,12 +484,12 @@ async function handleAgentCommand() {
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
   let backend;
   if (KNOWN_MCP_AGENTS[config.agentName]) {
-    const { CodexMcpBackend } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ad; });
+    const { CodexMcpBackend } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ad; });
     backend = new CodexMcpBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ab; });
-    const { GeminiTransport } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ae; });
-    const { DefaultTransport } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.aa; });
+    const { AcpBackend } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ab; });
+    const { GeminiTransport } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ae; });
+    const { DefaultTransport } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.aa; });
     const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : new DefaultTransport(config.agentName);
     backend = new AcpBackend({
       agentName: config.agentName,
@@ -616,7 +616,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
   }
-  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-CnVo5S8W.mjs');
+  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-BhLGBhBS.mjs');
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -684,7 +684,7 @@ async function handleSessionCommand() {
         allowDomain.push(sessionArgs[++i]);
       }
     }
-    const { parseShareArg } = await import('./commands-CnVo5S8W.mjs');
+    const { parseShareArg } = await import('./commands-BhLGBhBS.mjs');
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -772,7 +772,7 @@ async function handleSessionCommand() {
       console.error("  Rewinds history: rewrites the message + drops everything after it, then restarts Claude.");
       process.exit(1);
     }
-    const { sessionEditMessage } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionEditMessage } = await import('./commands-BhLGBhBS.mjs');
     await sessionEditMessage(sessionArgs[1], sessionArgs[2], sessionArgs[3], targetMachineId);
   } else if (sessionSubcommand === "refine") {
     if (!sessionArgs[1] || !sessionArgs[2]) {
@@ -780,7 +780,7 @@ async function handleSessionCommand() {
       console.error("  Asks the agent to revise its latest reply in place (no extra round).");
       process.exit(1);
     }
-    const { sessionRefineLastReply } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionRefineLastReply } = await import('./commands-BhLGBhBS.mjs');
     await sessionRefineLastReply(sessionArgs[1], sessionArgs[2], targetMachineId);
   } else if (sessionSubcommand === "undo-edit" || sessionSubcommand === "undo") {
     if (!sessionArgs[1]) {
@@ -788,7 +788,7 @@ async function handleSessionCommand() {
       console.error("  Reverts the most recent edit/refine, restoring the pre-edit history.");
       process.exit(1);
     }
-    const { sessionUndoEdit } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionUndoEdit } = await import('./commands-BhLGBhBS.mjs');
     await sessionUndoEdit(sessionArgs[1], targetMachineId);
   } else if (sessionSubcommand === "query") {
     const dir = sessionArgs[1];
@@ -798,7 +798,7 @@ async function handleSessionCommand() {
       console.error("  Spawns a stateless Claude session in <directory>, sends <prompt>, prints the answer, then deletes the session.");
       process.exit(1);
     }
-    const { sessionQuery } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionQuery } = await import('./commands-BhLGBhBS.mjs');
     await sessionQuery(dir, prompt, targetMachineId, {
       timeout: parseFlagInt("--timeout"),
       json: hasFlag("--json"),
@@ -831,7 +831,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionApprove } = await import('./commands-BhLGBhBS.mjs');
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -841,7 +841,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-CnVo5S8W.mjs');
+    const { sessionDeny } = await import('./commands-BhLGBhBS.mjs');
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -886,7 +886,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-title <title>");
       process.exit(1);
     }
-    const { sessionSetTitle } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { sessionSetTitle } = await import('./agentCommands-wOdV4Do1.mjs');
     await sessionSetTitle(title);
   } else if (sessionSubcommand === "set-project-description" || sessionSubcommand === "set-project") {
     const desc = sessionArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
@@ -894,7 +894,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-project-description <text>");
       process.exit(1);
     }
-    const { sessionSetProjectDescription } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { sessionSetProjectDescription } = await import('./agentCommands-wOdV4Do1.mjs');
     await sessionSetProjectDescription(desc);
   } else if (sessionSubcommand === "set-link") {
     const url = sessionArgs[1];
@@ -903,11 +903,11 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
-    const { sessionSetLink } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { sessionSetLink } = await import('./agentCommands-wOdV4Do1.mjs');
     await sessionSetLink(url, label);
   } else if (sessionSubcommand === "link") {
     const op = sessionArgs[1];
-    const lm = await import('./agentCommands-DvLTS2bk.mjs');
+    const lm = await import('./agentCommands-wOdV4Do1.mjs');
     if (op === "add") {
       const url = sessionArgs[2];
       if (!url || url.startsWith("--")) {
@@ -942,7 +942,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const level = parseFlagStr("--level") || "info";
-    const { sessionNotify } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { sessionNotify } = await import('./agentCommands-wOdV4Do1.mjs');
     await sessionNotify(message, level);
   } else if (sessionSubcommand === "broadcast") {
     const action = sessionArgs[1];
@@ -950,7 +950,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
       process.exit(1);
     }
-    const { sessionBroadcast } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { sessionBroadcast } = await import('./agentCommands-wOdV4Do1.mjs');
     await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "inbox") {
     const inboxSubcmd = sessionArgs[1];
@@ -961,7 +961,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId) {
-        const { inboxSend } = await import('./agentCommands-DvLTS2bk.mjs');
+        const { inboxSend } = await import('./agentCommands-wOdV4Do1.mjs');
         await inboxSend(sessionArgs[2], {
           body: sessionArgs[3],
           subject: parseFlagStr("--subject"),
@@ -976,7 +976,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
       if (agentSessionId && !sessionArgs[2]) {
-        const { inboxList } = await import('./agentCommands-DvLTS2bk.mjs');
+        const { inboxList } = await import('./agentCommands-wOdV4Do1.mjs');
         await inboxList({
           unread: hasFlag("--unread"),
           limit: parseFlagInt("--limit"),
@@ -998,7 +998,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId && !sessionArgs[3]) {
-        const { inboxList } = await import('./agentCommands-DvLTS2bk.mjs');
+        const { inboxList } = await import('./agentCommands-wOdV4Do1.mjs');
         await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
       } else if (sessionArgs[3]) {
         await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
@@ -1008,7 +1008,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "reply") {
       if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
-        const { inboxReply } = await import('./agentCommands-DvLTS2bk.mjs');
+        const { inboxReply } = await import('./agentCommands-wOdV4Do1.mjs');
         await inboxReply(sessionArgs[2], sessionArgs[3]);
       } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
         await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
@@ -1046,7 +1046,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-CnVo5S8W.mjs');
+    const { machineShare } = await import('./commands-BhLGBhBS.mjs');
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -1097,14 +1097,14 @@ async function handleMachineCommand() {
       process.exit(1);
     }
     if (all) {
-      const { fleetExec } = await import('./fleet-gkqGOfvU.mjs');
+      const { fleetExec } = await import('./fleet-DCMPBC7b.mjs');
       await fleetExec(command, { cwd });
     } else {
-      const { machineExec } = await import('./commands-CnVo5S8W.mjs');
+      const { machineExec } = await import('./commands-BhLGBhBS.mjs');
       await machineExec(machineId, command, cwd);
     }
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-CnVo5S8W.mjs');
+    const { machineInfo } = await import('./commands-BhLGBhBS.mjs');
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -1124,10 +1124,10 @@ async function handleMachineCommand() {
         level = machineArgs[++i];
       }
     }
-    const { machineNotify } = await import('./agentCommands-DvLTS2bk.mjs');
+    const { machineNotify } = await import('./agentCommands-wOdV4Do1.mjs');
     await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-CnVo5S8W.mjs');
+    const { machineLs } = await import('./commands-BhLGBhBS.mjs');
     let machineId;
     let showHidden = false;
     let path;
@@ -1183,20 +1183,20 @@ Examples:
   };
   const hasFlag = (name) => fleetArgs.includes(`--${name}`);
   if (sub === "status") {
-    const { fleetStatus } = await import('./fleet-gkqGOfvU.mjs');
+    const { fleetStatus } = await import('./fleet-DCMPBC7b.mjs');
     await fleetStatus();
   } else if (sub === "upgrade-claude") {
-    const { fleetUpgradeClaude } = await import('./fleet-gkqGOfvU.mjs');
+    const { fleetUpgradeClaude } = await import('./fleet-DCMPBC7b.mjs');
     await fleetUpgradeClaude({ version: flag("version", "-v") });
   } else if (sub === "upgrade-svamp") {
-    const { fleetUpgradeSvamp } = await import('./fleet-gkqGOfvU.mjs');
+    const { fleetUpgradeSvamp } = await import('./fleet-DCMPBC7b.mjs');
     await fleetUpgradeSvamp({ version: flag("version", "-v"), excludeSelf: hasFlag("exclude-self") });
   } else if (sub === "daemon-restart") {
-    const { fleetDaemonRestart } = await import('./fleet-gkqGOfvU.mjs');
+    const { fleetDaemonRestart } = await import('./fleet-DCMPBC7b.mjs');
     await fleetDaemonRestart({ graceful: !hasFlag("cleanup") });
   } else if (sub === "push-skill") {
     const name = fleetArgs[1];
-    const { fleetPushSkill } = await import('./fleet-gkqGOfvU.mjs');
+    const { fleetPushSkill } = await import('./fleet-DCMPBC7b.mjs');
     await fleetPushSkill(name);
   } else {
     console.error(`Unknown fleet subcommand: ${sub}`);
@@ -1212,7 +1212,7 @@ async function handleSkillsCommand() {
     await printSkillsHelp();
     return;
   }
-  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-DfTq3rS3.mjs');
+  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-Z8Ki8iA9.mjs');
   if (skillsSubcommand === "find" || skillsSubcommand === "search") {
     const query = skillsArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
     if (!query) {
@@ -1259,7 +1259,7 @@ async function loginToHypha() {
     process.exit(1);
   }
   const anchor = anchorArg.replace(/\/+$/, "");
-  const { loadInstanceConfig } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.af; });
+  const { loadInstanceConfig } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.af; });
   let cfg = null;
   try {
     cfg = await loadInstanceConfig({ anchor, force: true });
@@ -1370,7 +1370,7 @@ async function logoutFromHypha() {
   } catch {
   }
   try {
-    const { clearInstanceConfigCache } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.af; });
+    const { clearInstanceConfigCache } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.af; });
     clearInstanceConfigCache();
   } catch {
   }
@@ -1708,7 +1708,7 @@ async function applyClaudeAuthFlags(argv) {
       "--use-hypha-proxy, --use-claude-login, and --anthropic-base-url/--anthropic-api-key are mutually exclusive"
     );
   }
-  const mod = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.a8; });
+  const mod = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.a8; });
   if (hasHypha) {
     let url;
     const hyphaIdx = argv.indexOf("--use-hypha-proxy");
@@ -1762,7 +1762,7 @@ async function applyDaemonShareFlag(argv) {
     }
   }
   if (collected.length === 0) return;
-  const { updateEnvFile } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.a8; });
+  const { updateEnvFile } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.a8; });
   const seen = /* @__PURE__ */ new Set();
   const deduped = collected.filter((e) => {
     const k = e.toLowerCase();
@@ -1795,7 +1795,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const message = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAskCli } = await import('./commands-CnVo5S8W.mjs');
+    const { wiseAskCli } = await import('./commands-BhLGBhBS.mjs');
     await wiseAskCli(machineId, message, sessionId, { json });
     return;
   }
@@ -1807,7 +1807,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { runWiseVoiceCli } = await import('./headlessCli-BIOe8SSK.mjs');
+    const { runWiseVoiceCli } = await import('./headlessCli-d6XjdG6n.mjs');
     await runWiseVoiceCli({ voice: valueOf(["--voice"]), wakeKeywordPath: valueOf(["--wake"]), model: valueOf(["--model"]) });
     return;
   }
@@ -1825,7 +1825,7 @@ async function handleWiseAgentCommand(rest) {
     const mode = valueOf(["--mode"]);
     const mission = valueOf(["--mission"]);
     const url = rest.slice(1).find((a) => /^https?:\/\//.test(a)) || "";
-    const { wiseJoinMeetingCli } = await import('./commands-CnVo5S8W.mjs');
+    const { wiseJoinMeetingCli } = await import('./commands-BhLGBhBS.mjs');
     await wiseJoinMeetingCli(machineId, url, sessionId, { json, mode, mission });
     return;
   }
@@ -1837,7 +1837,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseLeaveMeetingCli } = await import('./commands-CnVo5S8W.mjs');
+    const { wiseLeaveMeetingCli } = await import('./commands-BhLGBhBS.mjs');
     await wiseLeaveMeetingCli(valueOf(["--machine", "-m"]), valueOf(["--session", "-s"]), { json: rest.includes("--json") });
     return;
   }
@@ -1861,7 +1861,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const text = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAnnounceCli } = await import('./commands-CnVo5S8W.mjs');
+    const { wiseAnnounceCli } = await import('./commands-BhLGBhBS.mjs');
     await wiseAnnounceCli(machineId, text, sessionId, { json });
     return;
   }
@@ -1873,7 +1873,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseMeetingsCli } = await import('./commands-CnVo5S8W.mjs');
+    const { wiseMeetingsCli } = await import('./commands-BhLGBhBS.mjs');
     await wiseMeetingsCli(valueOf(["--machine", "-m"]), { json: rest.includes("--json") });
     return;
   }
@@ -1923,7 +1923,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   const authArgs = rest.slice(1);
-  const mod = await import('./auth-JDjru_js.mjs');
+  const mod = await import('./auth-Bg0Z_bP-.mjs');
   let action;
   try {
     action = mod.parseWiseAgentAuthArgs(authArgs);
@@ -1933,7 +1933,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   if (action) {
-    const { updateEnvFile } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.a8; });
+    const { updateEnvFile } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.a8; });
     const updates = mod.buildWiseAgentEnvUpdates(action);
     updateEnvFile(updates);
     for (const [k, v] of Object.entries(updates)) {
@@ -1947,7 +1947,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
 }
 async function handleDaemonAuthCommand(argv) {
   const sub = (argv[0] || "status").toLowerCase();
-  const mod = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.a8; });
+  const mod = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.a8; });
   if (sub === "--help" || sub === "-h" || sub === "help") {
     console.log(`
 svamp daemon auth \u2014 Configure how Claude subprocesses authenticate
@@ -2261,7 +2261,7 @@ Examples:
 async function printSkillsHelp() {
   let browseUrl = "<HYPHA_SERVER_URL>/<workspace>/artifacts/marketplace (set HYPHA_SERVER_URL)";
   try {
-    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run-BgPz-Shl.mjs').then(function (n) { return n.ag; });
+    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run-BPZ_1RCI.mjs').then(function (n) { return n.ag; });
     browseUrl = `${getArtifactBaseUrl()}/${getSkillsCollectionName()}`;
   } catch {
   }

package/dist/{commands-CnVo5S8W.mjs → commands-BhLGBhBS.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { basename, resolve, join, isAbsolute } from 'node:path';
 import os from 'node:os';
-import { Q as formatHandle, T as normalizeAllowedUser, U as loadSecurityContextConfig, V as resolveSecurityContext, W as buildSecurityContextFromFlags, X as mergeSecurityContexts, c as connectToHypha, Y as buildSessionShareUrl, Z as computeOutboundHop, A as shortId, _ as registerAwaitingReply, $ as buildMachineShareUrl, a0 as parseHandle, a1 as handleMatchesMetadata } from './run-BgPz-Shl.mjs';
+import { Q as formatHandle, T as normalizeAllowedUser, U as loadSecurityContextConfig, V as resolveSecurityContext, W as buildSecurityContextFromFlags, X as mergeSecurityContexts, c as connectToHypha, Y as buildSessionShareUrl, Z as computeOutboundHop, A as shortId, _ as registerAwaitingReply, $ as buildMachineShareUrl, a0 as parseHandle, a1 as handleMatchesMetadata } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-CRsGX1t1.mjs → commands-Bi_LZXPe.mjs}

@@ -1,7 +1,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { m as resolveProjectRoot, w as searchIssues, v as listIssues, o as resumeIssue, p as pauseIssue, q as addComment, u as updateIssue, n as getIssue, x as isVisibleTo, z as summarize, t as addIssue } from './run-BgPz-Shl.mjs';
+import { m as resolveProjectRoot, w as searchIssues, v as listIssues, o as resumeIssue, p as pauseIssue, q as addComment, u as updateIssue, n as getIssue, x as isVisibleTo, z as summarize, t as addIssue } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-QyDnDry4.mjs → commands-CkduYG4a.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-CnVo5S8W.mjs';
+import { connectAndGetMachine } from './commands-BhLGBhBS.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-BgPz-Shl.mjs';
+import './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-Bt8pK8MS.mjs → commands-CniwP5Tm.mjs}

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { m as resolveProjectRoot } from './run-BgPz-Shl.mjs';
+import { m as resolveProjectRoot } from './run-BPZ_1RCI.mjs';
 import { c as workflowSteps, s as setWorkflowEnabled, i as isWorkflowEnabled, r as removeWorkflow, g as getWorkflow, l as listWorkflows, a as saveWorkflow, b as rawWorkflow } from './store-BTs0H_y0.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{commands-jFRw1VYy.mjs → commands-CudvGpEz.mjs}

@@ -58,7 +58,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./frpc-Dp9dDwDE.mjs');
+    const { runFrpcTunnel } = await import('./frpc-nvGz8fWs.mjs');
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -68,7 +68,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -90,7 +90,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-DvLTS2bk.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-wOdV4Do1.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -136,7 +136,7 @@ async function serviceServe(args) {
     };
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    const { runFrpcTunnel } = await import('./frpc-Dp9dDwDE.mjs');
+    const { runFrpcTunnel } = await import('./frpc-nvGz8fWs.mjs');
     await runFrpcTunnel(name, [caddyPort]);
   } catch (err) {
     console.error(`Error serving directory: ${err.message}`);
@@ -145,7 +145,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+    const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -185,7 +185,7 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+    const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });

package/dist/{commands-CIa6EEAk.mjs → commands-D9khoYtI.mjs}

@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-CnVo5S8W.mjs';
+import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-BhLGBhBS.mjs';
 import { execSync } from 'node:child_process';
-import { u as updateIssue, q as addComment, t as addIssue, A as shortId } from './run-BgPz-Shl.mjs';
+import { u as updateIssue, q as addComment, t as addIssue, A as shortId } from './run-BPZ_1RCI.mjs';
 import 'node:os';
 import 'os';
 import 'fs/promises';

package/dist/{commands-DfTq3rS3.mjs → commands-Z8Ki8iA9.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { F as parseFrontmatter, G as getSkillsServer, H as getSkillsWorkspaceName, I as getSkillsCollectionName, J as fetchWithTimeout, K as searchSkills, L as SKILLS_DIR, M as getSkillInfo, N as downloadSkillFile, O as listSkillFiles } from './run-BgPz-Shl.mjs';
+import { F as parseFrontmatter, G as getSkillsServer, H as getSkillsWorkspaceName, I as getSkillsCollectionName, J as fetchWithTimeout, K as searchSkills, L as SKILLS_DIR, M as getSkillInfo, N as downloadSkillFile, O as listSkillFiles } from './run-BPZ_1RCI.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{fleet-gkqGOfvU.mjs → fleet-DCMPBC7b.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { c as connectToHypha } from './run-BgPz-Shl.mjs';
+import { c as connectToHypha } from './run-BPZ_1RCI.mjs';
 import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-ivV7xAp3.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{frpc-Dp9dDwDE.mjs → frpc-nvGz8fWs.mjs}

@@ -4,7 +4,7 @@ import { mkdirSync, writeFileSync, unlinkSync, existsSync, chmodSync, readFileSy
 import { join } from 'path';
 import { homedir, platform, arch } from 'os';
 import { randomUUID, createHash } from 'crypto';
-import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-BgPz-Shl.mjs';
+import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-BPZ_1RCI.mjs';
 import 'fs/promises';
 import 'url';
 import 'node:crypto';
@@ -339,7 +339,6 @@ class FrpcTunnel {
           if (!this._connected) {
             this._connected = true;
             this._lastConnectedAt = Date.now();
-            this._restartAttempts = 0;
             this._consecutiveErrors = 0;
             this._firstErrorAt = 0;
             this.options.onConnect?.();
@@ -375,6 +374,10 @@ class FrpcTunnel {
           reject(new Error(`frpc exited with code ${code}`));
         }
         if (!this._destroyed && code !== 0) {
+          const STABILITY_WINDOW_MS = 3e4;
+          if (this._lastConnectedAt > 0 && Date.now() - this._lastConnectedAt >= STABILITY_WINDOW_MS) {
+            this._restartAttempts = 0;
+          }
           this._restartAttempts++;
           const delay = Math.min(3e3 * Math.pow(2, this._restartAttempts - 1), 6e4);
           this.log(`frpc exited with code ${code}, restarting in ${Math.round(delay / 1e3)}s (attempt ${this._restartAttempts})...`);

package/dist/{headlessCli-BIOe8SSK.mjs → headlessCli-d6XjdG6n.mjs}

@@ -1,5 +1,5 @@
-import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run-BgPz-Shl.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-l39JbmHM.mjs';
+import { P as resolveModel, a2 as describeMisconfiguration, a3 as buildMachineDeps } from './run-BPZ_1RCI.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-C-0cCNeL.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/{httpServer-B1KVQJfm.mjs → httpServer-CSMZTpoh.mjs}

@@ -86,7 +86,8 @@ function createChannelHttpServer(deps) {
       }
       m = u.pathname.match(/^\/channel\/([\w.-]+)\/events$/);
       if (m) {
-        const rpc2 = await findOwner(deps, m[1]);
+        const cid = m[1];
+        let rpc2 = await findOwner(deps, cid);
         if (!rpc2?.channelReceive) {
           res.writeHead(404).end("not found");
           return;
@@ -100,8 +101,25 @@ function createChannelHttpServer(deps) {
         req.on("close", () => {
           closed = true;
         });
+        const MIN_LOOP_MS = 1e3;
         while (!closed) {
-          const out = await rpc2.channelReceive({ channel: m[1], key, from, cursor, wait: 25 });
+          const started = Date.now();
+          let out;
+          try {
+            out = await rpc2.channelReceive({ channel: cid, key, from, cursor, wait: 25 });
+          } catch (e) {
+            const re = await findOwner(deps, cid).catch(() => null);
+            if (re?.channelReceive && !closed) {
+              rpc2 = re;
+              await new Promise((r) => setTimeout(r, MIN_LOOP_MS));
+              continue;
+            }
+            res.write(`event: error
+data: ${JSON.stringify({ error: e?.message || String(e) })}
+
+`);
+            break;
+          }
           if (out?.error) {
             res.write(`event: error
 data: ${JSON.stringify({ error: out.error })}
@@ -113,7 +131,11 @@ data: ${JSON.stringify({ error: out.error })}
 
 `);
           cursor = out.cursor ?? cursor;
-          if (!(out.replies || []).length) res.write(": keepalive\n\n");
+          if (!(out.replies || []).length) {
+            res.write(": keepalive\n\n");
+            const elapsed = Date.now() - started;
+            if (elapsed < MIN_LOOP_MS) await new Promise((r) => setTimeout(r, MIN_LOOP_MS - elapsed));
+          }
         }
         try {
           res.end();

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-BgPz-Shl.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-mhgf18rF.mjs → package-CUTX-CB-.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.243";
+var version = "0.2.246";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -19,12 +19,13 @@ var exports$1 = {
 var scripts = {
 	build: "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
 	typecheck: "tsc --noEmit",
-	test: "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs",
+	test: "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs",
 	"test:hypha": "node --no-warnings test/test-hypha-service.mjs",
 	dev: "tsx src/cli.ts",
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",
 	"test:e2e": "node --no-warnings test/e2e-session-tests.mjs",
-	"test:frpc": "npx tsx test/test-frpc-e2e.mjs"
+	"test:frpc": "npx tsx test/test-frpc-e2e.mjs",
+	prepublishOnly: "yarn build"
 };
 var dependencies = {
 	"@agentclientprotocol/sdk": "^0.14.1",

package/dist/{rpc-Wp_ufnPT.mjs → rpc-CDI7i151.mjs}

@@ -1,6 +1,6 @@
-import { m as resolveProjectRoot } from './run-BgPz-Shl.mjs';
+import { m as resolveProjectRoot } from './run-BPZ_1RCI.mjs';
 import { g as getWorkflow, s as setWorkflowEnabled, r as removeWorkflow, a as saveWorkflow, b as rawWorkflow, l as listWorkflows } from './store-BTs0H_y0.mjs';
-import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-BKgHQGNO.mjs';
+import { g as getRun, l as listRuns, r as runWorkflow } from './runStore-DKC_bMSi.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-CdbgL61q.mjs → rpc-s_Hibfpl.mjs}

@@ -1,4 +1,4 @@
-import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run-BgPz-Shl.mjs';
+import { m as resolveProjectRoot, u as updateIssue, n as getIssue, o as resumeIssue, p as pauseIssue, q as addComment, t as addIssue, v as listIssues, w as searchIssues, x as isVisibleTo } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-BgPz-Shl.mjs → run-BPZ_1RCI.mjs}

@@ -1201,10 +1201,15 @@ function parseField(token, [min, max]) {
       for (let i = min; i <= max; i++) set.add(i);
     } else if (m = part.match(/^\*\/(\d+)$/)) {
       const s = +m[1];
+      if (s <= 0) throw new Error(`invalid cron step (must be >= 1): "${token}"`);
       for (let i = min; i <= max; i += s) set.add(i);
     } else if (m = part.match(/^(\d+)-(\d+)\/(\d+)$/)) {
-      for (let i = +m[1]; i <= +m[2]; i += +m[3]) set.add(i);
+      const s = +m[3];
+      if (s <= 0) throw new Error(`invalid cron step (must be >= 1): "${token}"`);
+      if (+m[1] > +m[2]) throw new Error(`invalid cron range (start > end): "${token}"`);
+      for (let i = +m[1]; i <= +m[2]; i += s) set.add(i);
     } else if (m = part.match(/^(\d+)-(\d+)$/)) {
+      if (+m[1] > +m[2]) throw new Error(`invalid cron range (start > end): "${token}"`);
       for (let i = +m[1]; i <= +m[2]; i++) set.add(i);
     } else if (m = part.match(/^(\d+)$/)) {
       set.add(+m[1]);
@@ -2991,7 +2996,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-Dp9dDwDE.mjs');
+        const { FrpcTunnel } = await import('./frpc-nvGz8fWs.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3442,7 +3447,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-l39JbmHM.mjs');
+          const { toolsForRole } = await import('./sideband-C-0cCNeL.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3541,7 +3546,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CnVo5S8W.mjs');
+    const { queryCore } = await import('./commands-BhLGBhBS.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -3748,15 +3753,7 @@ function writeInboundContext(sessionId, ctx) {
     mkdirSync(join(SVAMP_HOME$2, "inbound"), { recursive: true });
     const tmp = p + ".tmp";
     writeFileSync(tmp, JSON.stringify({ ...ctx, deliveredAt: Date.now() }));
-    try {
-      rmSync(p, { force: true });
-    } catch {
-    }
-    writeFileSync(p, readFileSync(tmp));
-    try {
-      rmSync(tmp, { force: true });
-    } catch {
-    }
+    renameSync(tmp, p);
   } catch {
   }
 }
@@ -5402,7 +5399,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     },
     // ── BTW (By The Way) — ephemeral side-channel ──
     btw: async (question, context) => {
-      authorizeRequest(context, metadata.sharing, "view");
+      authorizeRequest(context, metadata.sharing, "admin");
       if (!question || typeof question !== "string") {
         return { success: false, error: "Question is required" };
       }
@@ -11000,7 +10997,7 @@ const HOUR_MS = 36e5;
 function sumUsageTokens(usage) {
   if (!usage || typeof usage !== "object") return 0;
   const n = (v) => typeof v === "number" && Number.isFinite(v) && v > 0 ? v : 0;
-  return n(usage.input_tokens) + n(usage.output_tokens) + n(usage.cache_creation_input_tokens);
+  return n(usage.input_tokens) + n(usage.output_tokens) + n(usage.cache_creation_input_tokens) + Math.round(n(usage.cache_read_input_tokens) * 0.1);
 }
 function accumulateLedger(prev, sample) {
   const base = prev && typeof prev === "object" ? { turns: prev.turns || 0, tokens: prev.tokens || 0, window: Array.isArray(prev.window) ? prev.window : [] } : { turns: 0, tokens: 0, window: [] };
@@ -12831,7 +12828,7 @@ async function startDaemon(options) {
     saveExposedTunnels(list);
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-Dp9dDwDE.mjs');
+    const { FrpcTunnel } = await import('./frpc-nvGz8fWs.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -12851,7 +12848,7 @@ async function startDaemon(options) {
     return tunnel;
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
-  const { ServeManager } = await import('./serveManager-3zR_v1Xj.mjs');
+  const { ServeManager } = await import('./serveManager-DGRpRAFM.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
@@ -14876,11 +14873,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CdbgL61q.mjs');
+              const { issueRpc } = await import('./rpc-s_Hibfpl.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-Wp_ufnPT.mjs');
+              const { workflowRpc } = await import('./rpc-CDI7i151.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15413,11 +15410,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CdbgL61q.mjs');
+              const { issueRpc } = await import('./rpc-s_Hibfpl.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-Wp_ufnPT.mjs');
+              const { workflowRpc } = await import('./rpc-CDI7i151.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -16034,7 +16031,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const channelHttpPort = Number(process.env.SVAMP_CHANNEL_HTTP_PORT) || 0;
     if (channelHttpPort > 0) {
       try {
-        const { createChannelHttpServer } = await import('./httpServer-B1KVQJfm.mjs');
+        const { createChannelHttpServer } = await import('./httpServer-CSMZTpoh.mjs');
         const channelHttpServer = createChannelHttpServer({
           getSessionIds: () => {
             const ids = [];
@@ -16294,7 +16291,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-BUo_8paQ.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-E1Bw4HUY.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();

package/dist/{run-hCQkcg9-.mjs → run-DRR6psuh.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run-BgPz-Shl.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { a4 as applyClaudeProxyEnv, a5 as composeSessionId, a6 as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, a7 as generateHookSettings } from './run-BPZ_1RCI.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{runStore-BKgHQGNO.mjs → runStore-DKC_bMSi.mjs}

@@ -3,7 +3,7 @@ import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from '
 import { randomBytes } from 'node:crypto';
 import { join } from 'node:path';
 import { c as workflowSteps, d as workflowsDir } from './store-BTs0H_y0.mjs';
-import { v as listIssues, t as addIssue } from './run-BgPz-Shl.mjs';
+import { v as listIssues, t as addIssue } from './run-BPZ_1RCI.mjs';
 
 const MAX_RUNS_PER_WORKFLOW = 50;
 function maxRunsPerWorkflow() {

package/dist/{scheduler-BUo_8paQ.mjs → scheduler-E1Bw4HUY.mjs}

@@ -1,6 +1,6 @@
-import { m as resolveProjectRoot, y as cronMatches } from './run-BgPz-Shl.mjs';
+import { m as resolveProjectRoot, y as cronMatches } from './run-BPZ_1RCI.mjs';
 import { l as listWorkflows, i as isWorkflowEnabled, w as workflowCrons } from './store-BTs0H_y0.mjs';
-import { r as runWorkflow } from './runStore-BKgHQGNO.mjs';
+import { r as runWorkflow } from './runStore-DKC_bMSi.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -38,8 +38,18 @@ class WorkflowScheduler {
   // Wall-clock minute we last processed, so multiple sub-minute ticks fire a workflow at most once
   // per minute (cron granularity is one minute).
   lastMinuteKey = null;
+  // Epoch ms of the last tick we processed — used to detect and catch up wall-clock minutes that were
+  // SKIPPED between two ticks (host sleep / suspend / a >60s event-loop stall), since setInterval does
+  // not fire while the process is suspended (#0243).
+  lastTickMs = null;
   // In-flight runs (fire-and-forget). `idle()` awaits them — used by tests; harmless in prod.
   pending = /* @__PURE__ */ new Set();
+  // Default cap on how many skipped minutes we look back over on a single tick. Deliberately small: it
+  // rescues genuine short gaps (a >60s event-loop stall, a brief suspend) without resurrecting daily
+  // crons hours late after a long sleep — multi-hour catch-up needs persisted last-fire state, out of
+  // scope here. Per-workflow dedup means even an every-minute cron fires at most once per sweep (no
+  // stampede). Override via SVAMP_SCHEDULER_MAX_CATCHUP_MIN (0 disables catch-up entirely).
+  static DEFAULT_MAX_CATCHUP_MINUTES = 5;
   /** Await all in-flight scheduled runs (test helper; the daemon never needs to block on these). */
   async idle() {
     await Promise.all([...this.pending]);
@@ -47,11 +57,27 @@ class WorkflowScheduler {
   static minuteKey(d) {
     return `${d.getFullYear()}-${d.getMonth()}-${d.getDate()}-${d.getHours()}-${d.getMinutes()}`;
   }
-  /** Fire all scheduled workflows whose cron matches `now`. Returns the names fired (for tests/logs). */
+  static maxCatchupMinutes() {
+    const raw = Number(process.env.SVAMP_SCHEDULER_MAX_CATCHUP_MIN);
+    if (Number.isFinite(raw) && raw >= 0) return Math.min(Math.floor(raw), 1440);
+    return WorkflowScheduler.DEFAULT_MAX_CATCHUP_MINUTES;
+  }
+  /** Fire all scheduled workflows whose cron matches `now` (or any skipped minute since the last tick).
+   *  Returns the names fired (for tests/logs). */
   tick(now) {
     const key = WorkflowScheduler.minuteKey(now);
     if (key === this.lastMinuteKey) return [];
+    const nowMs = now.getTime();
+    const curBoundary = Math.floor(nowMs / 6e4) * 6e4;
+    const minutes = [];
+    if (this.lastTickMs != null) {
+      const earliest = nowMs - WorkflowScheduler.maxCatchupMinutes() * 6e4;
+      let t = Math.floor(Math.max(this.lastTickMs + 6e4, earliest) / 6e4) * 6e4;
+      for (; t < curBoundary; t += 6e4) minutes.push(new Date(t));
+    }
+    minutes.push(now);
     this.lastMinuteKey = key;
+    this.lastTickMs = nowMs;
     const fired = [];
     const seen = /* @__PURE__ */ new Set();
     for (const dir of this.deps.projectRoots()) {
@@ -73,7 +99,7 @@ class WorkflowScheduler {
         if (!isWorkflowEnabled(wf)) continue;
         const crons = workflowCrons(wf);
         if (!crons.length) continue;
-        if (crons.some((c) => cronMatchesSafe(c, now))) {
+        if (minutes.some((m) => crons.some((c) => cronMatchesSafe(c, m)))) {
           this.fire(root, wf);
           fired.push(wf.name);
         }

package/dist/{serveCommands-bEavErQo.mjs → serveCommands-Af_7qqzA.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-CnVo5S8W.mjs');
+  const { connectAndGetMachine } = await import('./commands-BhLGBhBS.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-3zR_v1Xj.mjs → serveManager-DGRpRAFM.mjs}

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-BgPz-Shl.mjs';
+import { k as getHyphaServerUrl, S as ServeAuth, l as hasCookieToken } from './run-BPZ_1RCI.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -599,23 +599,40 @@ class ServeManager {
           }
           this.log(`Auth OK '${mountName}': ${userEmail}`);
         }
-        if (req.method === "PUT" && mount && mount.directory) {
-          const filePath = path.join(mount.directory, basePath);
-          fs.mkdirSync(path.dirname(filePath), { recursive: true });
-          const ws = fs.createWriteStream(filePath);
-          req.pipe(ws);
-          ws.on("finish", () => {
-            res.writeHead(201);
-            res.end();
-          });
-          ws.on("error", (err) => {
-            res.writeHead(500);
-            res.end(err.message);
-          });
-          return;
-        }
-        if (req.method === "DELETE" && mount && mount.directory) {
-          const filePath = path.join(mount.directory, basePath);
+        const resolveContained = () => {
+          const base = path.resolve(mount.directory);
+          const fp = path.resolve(path.join(base, basePath));
+          if (fp !== base && !fp.startsWith(base + path.sep)) return null;
+          return fp;
+        };
+        if ((req.method === "PUT" || req.method === "DELETE") && mount && mount.directory) {
+          if (mount.access === "public") {
+            this.log(`Write DENY '${mountName}': ${req.method} not allowed on a public (unauthenticated) mount`);
+            res.writeHead(403, { "Content-Type": "text/plain" });
+            res.end("Write access denied: public mounts are read-only.");
+            return;
+          }
+          const filePath = resolveContained();
+          if (!filePath) {
+            this.log(`Write DENY '${mountName}': path escapes mount root (${basePath})`);
+            res.writeHead(403, { "Content-Type": "text/plain" });
+            res.end("Forbidden: path escapes mount root.");
+            return;
+          }
+          if (req.method === "PUT") {
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            const ws = fs.createWriteStream(filePath);
+            req.pipe(ws);
+            ws.on("finish", () => {
+              res.writeHead(201);
+              res.end();
+            });
+            ws.on("error", (err) => {
+              res.writeHead(500);
+              res.end(err.message);
+            });
+            return;
+          }
           try {
             fs.unlinkSync(filePath);
             res.writeHead(204);
@@ -733,7 +750,7 @@ class ServeManager {
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Dp9dDwDE.mjs');
+      const { FrpcTunnel } = await import('./frpc-nvGz8fWs.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-l39JbmHM.mjs → sideband-C-0cCNeL.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, B as loadMachineContext, C as buildMachineInstructions, D as machineToolsForRole, E as buildMachineTools } from './run-BgPz-Shl.mjs';
+import { R as READ_ONLY_TOOLS, B as loadMachineContext, C as buildMachineInstructions, D as machineToolsForRole, E as buildMachineTools } from './run-BPZ_1RCI.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.244",
+  "version": "0.2.246",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,12 +20,13 @@
   "scripts": {
     "build": "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",
     "test:e2e": "node --no-warnings test/e2e-session-tests.mjs",
-    "test:frpc": "npx tsx test/test-frpc-e2e.mjs"
+    "test:frpc": "npx tsx test/test-frpc-e2e.mjs",
+    "prepublishOnly": "yarn build"
   },
   "dependencies": {
     "@agentclientprotocol/sdk": "^0.14.1",