svamp-cli 0.2.252 → 0.2.253

package/dist/{agentCommands-BfK_xRcZ.mjs → agentCommands-DYoNzX4K.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from '
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { requireNotSandboxed } from './sandboxDetect-DNTcbgWD.mjs';
-import { k as shortId } from './run-BNxaekWa.mjs';
+import { k as shortId } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -97,7 +97,7 @@ async function sessionSetTitle(title) {
 }
 async function sessionSetProjectDescription(description) {
   const dir = process.cwd();
-  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.al; });
+  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.al; });
   const desc = sanitizeDescription(description, 240);
   if (!desc) {
     console.error("Project description is empty.");
@@ -344,7 +344,7 @@ async function sessionBroadcast(action, args) {
   console.log(`Broadcast sent: ${action}`);
 }
 async function connectToMachineService() {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   return connectAndGetMachine();
 }
 function buildInboxMessage(args) {
@@ -422,7 +422,7 @@ async function inboxSend(targetSessionId, opts) {
     console.error("Message body is required.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndResolveSession } = await import('./commands-YPQSZ4Qx.mjs');
   let server;
   try {
     const { targetId, messageId } = await inboxSendCore(
@@ -476,7 +476,7 @@ async function inboxReply(messageId, body) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndResolveSession } = await import('./commands-YPQSZ4Qx.mjs');
   const { server: localServer, machine: localMachine } = await connectToMachineService();
   let localDisconnected = false;
   const disconnectLocal = async () => {

package/dist/{auth-dxadQh0v.mjs → auth-D0nW0Gyj.mjs}

@@ -1,4 +1,4 @@
-import { a1 as resolveModel } from './run-BNxaekWa.mjs';
+import { a1 as resolveModel } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run-BNxaekWa.mjs';
+import { e as clearStopMarker, f as stopMarkerExists, s as startDaemon, b as stopDaemon, d as daemonStatus } from './run-hYUl-Fln.mjs';
 import { ensureSupervisorViaServiceManager, LAUNCHD_LABEL } from './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';
@@ -35,7 +35,7 @@ const subcommand = args[0];
 let daemonSubcommand = args[1];
 async function main() {
   try {
-    const { getLoadedConfig } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ar; });
+    const { getLoadedConfig } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ar; });
     getLoadedConfig();
   } catch {
   }
@@ -54,7 +54,7 @@ async function main() {
       }
       const whenIdle = args.includes("--when-idle");
       const force = args.includes("--force");
-      const mod = await import('./run-BNxaekWa.mjs').then(function (n) { return n.at; });
+      const mod = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.at; });
       if (whenIdle && !force) {
         if (mod.isDaemonAlive()) {
           mod.writePendingRestart({ reason: "svamp daemon restart --when-idle" });
@@ -355,7 +355,7 @@ async function main() {
       console.error("svamp service: Service commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServiceCommand } = await import('./commands-BAtj5B4a.mjs');
+    const { handleServiceCommand } = await import('./commands-EhQiKpwu.mjs');
     await handleServiceCommand();
   } else if (subcommand === "serve") {
     const { isSandboxed: isSandboxedServe } = await import('./sandboxDetect-DNTcbgWD.mjs');
@@ -363,7 +363,7 @@ async function main() {
       console.error("svamp serve: Serve commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { handleServeCommand } = await import('./serveCommands-Bc6fchAf.mjs');
+    const { handleServeCommand } = await import('./serveCommands-BgtRllaY.mjs');
     await handleServeCommand();
     process.exit(0);
   } else if (subcommand === "process" || subcommand === "proc") {
@@ -372,7 +372,7 @@ async function main() {
       console.error("svamp process: Process commands are not available in sandboxed sessions.");
       process.exit(1);
     }
-    const { processCommand } = await import('./commands-B9eaRA8O.mjs');
+    const { processCommand } = await import('./commands-_Tr8pO3_.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -386,18 +386,18 @@ async function main() {
     }), machineId);
     process.exit(0);
   } else if (subcommand === "issue" || subcommand === "issues") {
-    const { issueCommand } = await import('./commands-Blddcoeh.mjs');
+    const { issueCommand } = await import('./commands-C3YGnWyy.mjs');
     await issueCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "workflow" || subcommand === "workflows") {
-    const { workflowCommand } = await import('./commands-eDMV8Q8q.mjs');
+    const { workflowCommand } = await import('./commands-B9wShol7.mjs');
     await workflowCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "wise-agent" || subcommand === "wise") {
     await handleWiseAgentCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "feature" || subcommand === "crew") {
-    const { crewCommand } = await import('./commands-CuSO_rgw.mjs');
+    const { crewCommand } = await import('./commands-CfDWN8Ej.mjs');
     await crewCommand(args.slice(1));
     process.exit(0);
   } else if (subcommand === "--help" || subcommand === "-h") {
@@ -405,7 +405,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-C2CWKEW-.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-BTW_-LFn.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -414,7 +414,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-BPNXOI3F.mjs');
+  const { runInteractive } = await import('./run-BtWV7xhR.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -459,7 +459,7 @@ async function handleAgentCommand() {
     return;
   }
   if (agentArgs[0] === "list") {
-    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ao; });
+    const { KNOWN_ACP_AGENTS, KNOWN_MCP_AGENTS: KNOWN_MCP_AGENTS2 } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ao; });
     console.log("Known agents:");
     for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
       console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
@@ -471,7 +471,7 @@ async function handleAgentCommand() {
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
     return;
   }
-  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ao; });
+  const { resolveAcpAgentConfig, KNOWN_MCP_AGENTS } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ao; });
   let cwd = process.cwd();
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
@@ -495,12 +495,12 @@ async function handleAgentCommand() {
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
   let backend;
   if (KNOWN_MCP_AGENTS[config.agentName]) {
-    const { CodexMcpBackend } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ap; });
+    const { CodexMcpBackend } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ap; });
     backend = new CodexMcpBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.an; });
-    const { GeminiTransport } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.aq; });
-    const { DefaultTransport } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.am; });
+    const { AcpBackend } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.an; });
+    const { GeminiTransport } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.aq; });
+    const { DefaultTransport } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.am; });
     const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : new DefaultTransport(config.agentName);
     backend = new AcpBackend({
       agentName: config.agentName,
@@ -627,7 +627,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
   }
-  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-BkroIJOC.mjs');
+  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-YPQSZ4Qx.mjs');
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -695,7 +695,7 @@ async function handleSessionCommand() {
         allowDomain.push(sessionArgs[++i]);
       }
     }
-    const { parseShareArg } = await import('./commands-BkroIJOC.mjs');
+    const { parseShareArg } = await import('./commands-YPQSZ4Qx.mjs');
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -785,7 +785,7 @@ async function handleSessionCommand() {
       console.error("  Rewinds history: rewrites the message + drops everything after it, then restarts Claude.");
       process.exit(1);
     }
-    const { sessionEditMessage } = await import('./commands-BkroIJOC.mjs');
+    const { sessionEditMessage } = await import('./commands-YPQSZ4Qx.mjs');
     await sessionEditMessage(sessionArgs[1], sessionArgs[2], sessionArgs[3], targetMachineId);
   } else if (sessionSubcommand === "refine") {
     if (!sessionArgs[1] || !sessionArgs[2]) {
@@ -793,7 +793,7 @@ async function handleSessionCommand() {
       console.error("  Asks the agent to revise its latest reply in place (no extra round).");
       process.exit(1);
     }
-    const { sessionRefineLastReply } = await import('./commands-BkroIJOC.mjs');
+    const { sessionRefineLastReply } = await import('./commands-YPQSZ4Qx.mjs');
     await sessionRefineLastReply(sessionArgs[1], sessionArgs[2], targetMachineId);
   } else if (sessionSubcommand === "undo-edit" || sessionSubcommand === "undo") {
     if (!sessionArgs[1]) {
@@ -801,7 +801,7 @@ async function handleSessionCommand() {
       console.error("  Reverts the most recent edit/refine, restoring the pre-edit history.");
       process.exit(1);
     }
-    const { sessionUndoEdit } = await import('./commands-BkroIJOC.mjs');
+    const { sessionUndoEdit } = await import('./commands-YPQSZ4Qx.mjs');
     await sessionUndoEdit(sessionArgs[1], targetMachineId);
   } else if (sessionSubcommand === "query") {
     const dir = sessionArgs[1];
@@ -811,7 +811,7 @@ async function handleSessionCommand() {
       console.error("  Spawns a stateless Claude session in <directory>, sends <prompt>, prints the answer, then deletes the session.");
       process.exit(1);
     }
-    const { sessionQuery } = await import('./commands-BkroIJOC.mjs');
+    const { sessionQuery } = await import('./commands-YPQSZ4Qx.mjs');
     await sessionQuery(dir, prompt, targetMachineId, {
       timeout: parseFlagInt("--timeout"),
       json: hasFlag("--json"),
@@ -844,7 +844,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-BkroIJOC.mjs');
+    const { sessionApprove } = await import('./commands-YPQSZ4Qx.mjs');
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -854,7 +854,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-BkroIJOC.mjs');
+    const { sessionDeny } = await import('./commands-YPQSZ4Qx.mjs');
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -899,7 +899,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-title <title>");
       process.exit(1);
     }
-    const { sessionSetTitle } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { sessionSetTitle } = await import('./agentCommands-DYoNzX4K.mjs');
     await sessionSetTitle(title);
   } else if (sessionSubcommand === "set-project-description" || sessionSubcommand === "set-project") {
     const desc = sessionArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
@@ -907,7 +907,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session set-project-description <text>");
       process.exit(1);
     }
-    const { sessionSetProjectDescription } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { sessionSetProjectDescription } = await import('./agentCommands-DYoNzX4K.mjs');
     await sessionSetProjectDescription(desc);
   } else if (sessionSubcommand === "set-link") {
     const url = sessionArgs[1];
@@ -916,11 +916,11 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
-    const { sessionSetLink } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { sessionSetLink } = await import('./agentCommands-DYoNzX4K.mjs');
     await sessionSetLink(url, label);
   } else if (sessionSubcommand === "link") {
     const op = sessionArgs[1];
-    const lm = await import('./agentCommands-BfK_xRcZ.mjs');
+    const lm = await import('./agentCommands-DYoNzX4K.mjs');
     if (op === "add") {
       const url = sessionArgs[2];
       if (!url || url.startsWith("--")) {
@@ -955,7 +955,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const level = parseFlagStr("--level") || "info";
-    const { sessionNotify } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { sessionNotify } = await import('./agentCommands-DYoNzX4K.mjs');
     await sessionNotify(message, level);
   } else if (sessionSubcommand === "broadcast") {
     const action = sessionArgs[1];
@@ -963,7 +963,7 @@ async function handleSessionCommand() {
       console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
       process.exit(1);
     }
-    const { sessionBroadcast } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { sessionBroadcast } = await import('./agentCommands-DYoNzX4K.mjs');
     await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "inbox") {
     const inboxSubcmd = sessionArgs[1];
@@ -974,7 +974,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId) {
-        const { inboxSend } = await import('./agentCommands-BfK_xRcZ.mjs');
+        const { inboxSend } = await import('./agentCommands-DYoNzX4K.mjs');
         await inboxSend(sessionArgs[2], {
           body: sessionArgs[3],
           subject: parseFlagStr("--subject"),
@@ -989,7 +989,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
       if (agentSessionId && !sessionArgs[2]) {
-        const { inboxList } = await import('./agentCommands-BfK_xRcZ.mjs');
+        const { inboxList } = await import('./agentCommands-DYoNzX4K.mjs');
         await inboxList({
           unread: hasFlag("--unread"),
           limit: parseFlagInt("--limit"),
@@ -1011,7 +1011,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId && !sessionArgs[3]) {
-        const { inboxList } = await import('./agentCommands-BfK_xRcZ.mjs');
+        const { inboxList } = await import('./agentCommands-DYoNzX4K.mjs');
         await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
       } else if (sessionArgs[3]) {
         await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
@@ -1021,7 +1021,7 @@ async function handleSessionCommand() {
       }
     } else if (inboxSubcmd === "reply") {
       if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
-        const { inboxReply } = await import('./agentCommands-BfK_xRcZ.mjs');
+        const { inboxReply } = await import('./agentCommands-DYoNzX4K.mjs');
         await inboxReply(sessionArgs[2], sessionArgs[3]);
       } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
         await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
@@ -1059,7 +1059,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-BkroIJOC.mjs');
+    const { machineShare } = await import('./commands-YPQSZ4Qx.mjs');
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -1110,14 +1110,14 @@ async function handleMachineCommand() {
       process.exit(1);
     }
     if (all) {
-      const { fleetExec } = await import('./fleet-CNmpoV_Q.mjs');
+      const { fleetExec } = await import('./fleet-Ndfbo8Ni.mjs');
       await fleetExec(command, { cwd });
     } else {
-      const { machineExec } = await import('./commands-BkroIJOC.mjs');
+      const { machineExec } = await import('./commands-YPQSZ4Qx.mjs');
       await machineExec(machineId, command, cwd);
     }
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-BkroIJOC.mjs');
+    const { machineInfo } = await import('./commands-YPQSZ4Qx.mjs');
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -1137,10 +1137,10 @@ async function handleMachineCommand() {
         level = machineArgs[++i];
       }
     }
-    const { machineNotify } = await import('./agentCommands-BfK_xRcZ.mjs');
+    const { machineNotify } = await import('./agentCommands-DYoNzX4K.mjs');
     await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-BkroIJOC.mjs');
+    const { machineLs } = await import('./commands-YPQSZ4Qx.mjs');
     let machineId;
     let showHidden = false;
     let path;
@@ -1199,20 +1199,20 @@ Examples:
   };
   const hasFlag = (name) => fleetArgs.includes(`--${name}`);
   if (sub === "status") {
-    const { fleetStatus } = await import('./fleet-CNmpoV_Q.mjs');
+    const { fleetStatus } = await import('./fleet-Ndfbo8Ni.mjs');
     await fleetStatus();
   } else if (sub === "upgrade-claude") {
-    const { fleetUpgradeClaude } = await import('./fleet-CNmpoV_Q.mjs');
+    const { fleetUpgradeClaude } = await import('./fleet-Ndfbo8Ni.mjs');
     await fleetUpgradeClaude({ version: flag("version", "-v") });
   } else if (sub === "upgrade-svamp") {
-    const { fleetUpgradeSvamp } = await import('./fleet-CNmpoV_Q.mjs');
+    const { fleetUpgradeSvamp } = await import('./fleet-Ndfbo8Ni.mjs');
     await fleetUpgradeSvamp({ version: flag("version", "-v"), excludeSelf: hasFlag("exclude-self"), force: hasFlag("force") });
   } else if (sub === "daemon-restart") {
-    const { fleetDaemonRestart } = await import('./fleet-CNmpoV_Q.mjs');
+    const { fleetDaemonRestart } = await import('./fleet-Ndfbo8Ni.mjs');
     await fleetDaemonRestart({ graceful: !hasFlag("cleanup") });
   } else if (sub === "push-skill") {
     const name = fleetArgs[1];
-    const { fleetPushSkill } = await import('./fleet-CNmpoV_Q.mjs');
+    const { fleetPushSkill } = await import('./fleet-Ndfbo8Ni.mjs');
     await fleetPushSkill(name);
   } else {
     console.error(`Unknown fleet subcommand: ${sub}`);
@@ -1228,7 +1228,7 @@ async function handleSkillsCommand() {
     await printSkillsHelp();
     return;
   }
-  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-Cg3yUhp1.mjs');
+  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-CvWkQB_c.mjs');
   if (skillsSubcommand === "find" || skillsSubcommand === "search") {
     const query = skillsArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
     if (!query) {
@@ -1275,7 +1275,7 @@ async function loginToHypha() {
     process.exit(1);
   }
   const anchor = anchorArg.replace(/\/+$/, "");
-  const { loadInstanceConfig } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ar; });
+  const { loadInstanceConfig } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ar; });
   let cfg = null;
   try {
     cfg = await loadInstanceConfig({ anchor, force: true });
@@ -1386,7 +1386,7 @@ async function logoutFromHypha() {
   } catch {
   }
   try {
-    const { clearInstanceConfigCache } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ar; });
+    const { clearInstanceConfigCache } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ar; });
     clearInstanceConfigCache();
   } catch {
   }
@@ -1725,7 +1725,7 @@ async function applyClaudeAuthFlags(argv) {
       "--use-hypha-proxy, --use-claude-login, and --anthropic-base-url/--anthropic-api-key are mutually exclusive"
     );
   }
-  const mod = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ak; });
+  const mod = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ak; });
   if (hasHypha) {
     let url;
     const hyphaIdx = argv.indexOf("--use-hypha-proxy");
@@ -1779,7 +1779,7 @@ async function applyDaemonShareFlag(argv) {
     }
   }
   if (collected.length === 0) return;
-  const { updateEnvFile } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ak; });
+  const { updateEnvFile } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ak; });
   const seen = /* @__PURE__ */ new Set();
   const deduped = collected.filter((e) => {
     const k = e.toLowerCase();
@@ -1812,7 +1812,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const message = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAskCli } = await import('./commands-BkroIJOC.mjs');
+    const { wiseAskCli } = await import('./commands-YPQSZ4Qx.mjs');
     await wiseAskCli(machineId, message, sessionId, { json });
     return;
   }
@@ -1824,7 +1824,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { runWiseVoiceCli } = await import('./headlessCli-DGTHnPjT.mjs');
+    const { runWiseVoiceCli } = await import('./headlessCli-CbCWVR81.mjs');
     await runWiseVoiceCli({ voice: valueOf(["--voice"]), wakeKeywordPath: valueOf(["--wake"]), model: valueOf(["--model"]) });
     return;
   }
@@ -1842,7 +1842,7 @@ async function handleWiseAgentCommand(rest) {
     const mode = valueOf(["--mode"]);
     const mission = valueOf(["--mission"]);
     const url = rest.slice(1).find((a) => /^https?:\/\//.test(a)) || "";
-    const { wiseJoinMeetingCli } = await import('./commands-BkroIJOC.mjs');
+    const { wiseJoinMeetingCli } = await import('./commands-YPQSZ4Qx.mjs');
     await wiseJoinMeetingCli(machineId, url, sessionId, { json, mode, mission });
     return;
   }
@@ -1854,7 +1854,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseLeaveMeetingCli } = await import('./commands-BkroIJOC.mjs');
+    const { wiseLeaveMeetingCli } = await import('./commands-YPQSZ4Qx.mjs');
     await wiseLeaveMeetingCli(valueOf(["--machine", "-m"]), valueOf(["--session", "-s"]), { json: rest.includes("--json") });
     return;
   }
@@ -1878,7 +1878,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const text = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAnnounceCli } = await import('./commands-BkroIJOC.mjs');
+    const { wiseAnnounceCli } = await import('./commands-YPQSZ4Qx.mjs');
     await wiseAnnounceCli(machineId, text, sessionId, { json });
     return;
   }
@@ -1890,7 +1890,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseMeetingsCli } = await import('./commands-BkroIJOC.mjs');
+    const { wiseMeetingsCli } = await import('./commands-YPQSZ4Qx.mjs');
     await wiseMeetingsCli(valueOf(["--machine", "-m"]), { json: rest.includes("--json") });
     return;
   }
@@ -1940,7 +1940,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   const authArgs = rest.slice(1);
-  const mod = await import('./auth-dxadQh0v.mjs');
+  const mod = await import('./auth-D0nW0Gyj.mjs');
   let action;
   try {
     action = mod.parseWiseAgentAuthArgs(authArgs);
@@ -1950,7 +1950,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   if (action) {
-    const { updateEnvFile } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ak; });
+    const { updateEnvFile } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ak; });
     const updates = mod.buildWiseAgentEnvUpdates(action);
     updateEnvFile(updates);
     for (const [k, v] of Object.entries(updates)) {
@@ -1964,7 +1964,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
 }
 async function handleDaemonAuthCommand(argv) {
   const sub = (argv[0] || "status").toLowerCase();
-  const mod = await import('./run-BNxaekWa.mjs').then(function (n) { return n.ak; });
+  const mod = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.ak; });
   if (sub === "--help" || sub === "-h" || sub === "help") {
     console.log(`
 svamp daemon auth \u2014 Configure how Claude subprocesses authenticate
@@ -2283,7 +2283,7 @@ Examples:
 async function printSkillsHelp() {
   let browseUrl = "<HYPHA_SERVER_URL>/<workspace>/artifacts/marketplace (set HYPHA_SERVER_URL)";
   try {
-    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run-BNxaekWa.mjs').then(function (n) { return n.as; });
+    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./run-hYUl-Fln.mjs').then(function (n) { return n.as; });
     browseUrl = `${getArtifactBaseUrl()}/${getSkillsCollectionName()}`;
   } catch {
   }

package/dist/{commands-eDMV8Q8q.mjs → commands-B9wShol7.mjs}

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { n as resolveProjectRoot, M as workflowSteps, D as setWorkflowEnabled, I as isWorkflowEnabled, E as removeWorkflow, B as getWorkflow, H as listWorkflows, F as saveWorkflow, G as rawWorkflow } from './run-BNxaekWa.mjs';
+import { n as resolveProjectRoot, M as workflowSteps, D as setWorkflowEnabled, I as isWorkflowEnabled, E as removeWorkflow, B as getWorkflow, H as listWorkflows, F as saveWorkflow, G as rawWorkflow } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-Blddcoeh.mjs → commands-C3YGnWyy.mjs}

@@ -1,7 +1,7 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { n as resolveProjectRoot, x as searchIssues, w as listIssues, p as resumeIssue, q as pauseIssue, t as addComment, u as updateIssue, o as getIssue, y as isVisibleTo, L as summarize, v as addIssue } from './run-BNxaekWa.mjs';
+import { n as resolveProjectRoot, x as searchIssues, w as listIssues, p as resumeIssue, q as pauseIssue, t as addComment, u as updateIssue, o as getIssue, y as isVisibleTo, L as summarize, v as addIssue } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-CuSO_rgw.mjs → commands-CfDWN8Ej.mjs}

@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-BkroIJOC.mjs';
+import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-YPQSZ4Qx.mjs';
 import { execSync } from 'node:child_process';
-import { u as updateIssue, t as addComment, v as addIssue, k as shortId } from './run-BNxaekWa.mjs';
+import { u as updateIssue, t as addComment, v as addIssue, k as shortId } from './run-hYUl-Fln.mjs';
 import 'node:os';
 import 'os';
 import 'fs/promises';

package/dist/{commands-Cg3yUhp1.mjs → commands-CvWkQB_c.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { T as parseFrontmatter, U as getSkillsServer, V as getSkillsWorkspaceName, W as getSkillsCollectionName, X as fetchWithTimeout, Y as searchSkills, Z as SKILLS_DIR, _ as getSkillInfo, $ as downloadSkillFile, a0 as listSkillFiles } from './run-BNxaekWa.mjs';
+import { T as parseFrontmatter, U as getSkillsServer, V as getSkillsWorkspaceName, W as getSkillsCollectionName, X as fetchWithTimeout, Y as searchSkills, Z as SKILLS_DIR, _ as getSkillInfo, $ as downloadSkillFile, a0 as listSkillFiles } from './run-hYUl-Fln.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{commands-BAtj5B4a.mjs → commands-EhQiKpwu.mjs}

@@ -58,7 +58,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./frpc-DoUUUoZn.mjs');
+    const { runFrpcTunnel } = await import('./frpc-CLQB-GM1.mjs');
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -68,7 +68,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -90,7 +90,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-BfK_xRcZ.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-DYoNzX4K.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -136,7 +136,7 @@ async function serviceServe(args) {
     };
     process.on("SIGINT", cleanup);
     process.on("SIGTERM", cleanup);
-    const { runFrpcTunnel } = await import('./frpc-DoUUUoZn.mjs');
+    const { runFrpcTunnel } = await import('./frpc-CLQB-GM1.mjs');
     await runFrpcTunnel(name, [caddyPort]);
   } catch (err) {
     console.error(`Error serving directory: ${err.message}`);
@@ -145,7 +145,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+    const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -185,7 +185,7 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+    const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });

package/dist/{commands-BkroIJOC.mjs → commands-YPQSZ4Qx.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { basename, resolve, join, isAbsolute } from 'node:path';
 import os from 'node:os';
-import { a2 as formatHandle, a3 as normalizeAllowedUser, a4 as loadSecurityContextConfig, a5 as resolveSecurityContext, a6 as buildSecurityContextFromFlags, a7 as mergeSecurityContexts, c as connectToHypha, a8 as buildSessionShareUrl, a9 as computeOutboundHop, k as shortId, aa as registerAwaitingReply, ab as buildMachineShareUrl, ac as parseHandle, ad as handleMatchesMetadata } from './run-BNxaekWa.mjs';
+import { a2 as formatHandle, a3 as normalizeAllowedUser, a4 as loadSecurityContextConfig, a5 as resolveSecurityContext, a6 as buildSecurityContextFromFlags, a7 as mergeSecurityContexts, c as connectToHypha, a8 as buildSessionShareUrl, a9 as computeOutboundHop, k as shortId, aa as registerAwaitingReply, ab as buildMachineShareUrl, ac as parseHandle, ad as handleMatchesMetadata } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-B9eaRA8O.mjs → commands-_Tr8pO3_.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-BkroIJOC.mjs';
+import { connectAndGetMachine } from './commands-YPQSZ4Qx.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-BNxaekWa.mjs';
+import './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{fleet-CNmpoV_Q.mjs → fleet-Ndfbo8Ni.mjs}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { c as connectToHypha } from './run-BNxaekWa.mjs';
-import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-ivV7xAp3.mjs';
+import { c as connectToHypha } from './run-hYUl-Fln.mjs';
+import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-DuLXaoGP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{frpc-DoUUUoZn.mjs → frpc-CLQB-GM1.mjs}

@@ -4,7 +4,7 @@ import { mkdirSync, writeFileSync, unlinkSync, existsSync, chmodSync, readFileSy
 import { join } from 'path';
 import { homedir, platform, arch } from 'os';
 import { randomUUID, createHash } from 'crypto';
-import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-BNxaekWa.mjs';
+import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-hYUl-Fln.mjs';
 import 'fs/promises';
 import 'url';
 import 'node:crypto';

package/dist/{headlessCli-DGTHnPjT.mjs → headlessCli-CbCWVR81.mjs}

@@ -1,5 +1,5 @@
-import { a1 as resolveModel, ae as describeMisconfiguration, af as buildMachineDeps } from './run-BNxaekWa.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-D6vgqNiq.mjs';
+import { a1 as resolveModel, ae as describeMisconfiguration, af as buildMachineDeps } from './run-hYUl-Fln.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-C0qzprWp.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-BNxaekWa.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-C2CWKEW-.mjs → package-BTW_-LFn.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.252";
+var version = "0.2.253";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";

package/dist/{pinnedClaudeCode-ivV7xAp3.mjs → pinnedClaudeCode-DuLXaoGP.mjs}

@@ -1,7 +1,7 @@
 import { spawn, exec as exec$1 } from 'node:child_process';
 import { promisify } from 'node:util';
 
-const PINNED_CLAUDE_CODE_VERSION = "2.1.195";
+const PINNED_CLAUDE_CODE_VERSION = "2.1.206";
 const exec = promisify(exec$1);
 let _reconcile = null;
 function beginClaudeVersionReconcile(log) {

package/dist/{rpc-_rwZwiHD.mjs → rpc-0HSLhpCb.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, u as updateIssue, o as getIssue, p as resumeIssue, q as pauseIssue, t as addComment, v as addIssue, w as listIssues, x as searchIssues, y as isVisibleTo } from './run-BNxaekWa.mjs';
+import { n as resolveProjectRoot, u as updateIssue, o as getIssue, p as resumeIssue, q as pauseIssue, t as addComment, v as addIssue, w as listIssues, x as searchIssues, y as isVisibleTo } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-665-sPRQ.mjs → rpc-BB-AxQa_.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, z as getRun, A as listRuns, B as getWorkflow, C as runWorkflow, D as setWorkflowEnabled, E as removeWorkflow, F as saveWorkflow, G as rawWorkflow, H as listWorkflows } from './run-BNxaekWa.mjs';
+import { n as resolveProjectRoot, z as getRun, A as listRuns, B as getWorkflow, C as runWorkflow, D as setWorkflowEnabled, E as removeWorkflow, F as saveWorkflow, G as rawWorkflow, H as listWorkflows } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-BPNXOI3F.mjs → run-BtWV7xhR.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { ag as applyClaudeProxyEnv, ah as composeSessionId, ai as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, aj as generateHookSettings } from './run-BNxaekWa.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { ag as applyClaudeProxyEnv, ah as composeSessionId, ai as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, aj as generateHookSettings } from './run-hYUl-Fln.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{run-BNxaekWa.mjs → run-hYUl-Fln.mjs}

@@ -2985,7 +2985,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-DoUUUoZn.mjs');
+        const { FrpcTunnel } = await import('./frpc-CLQB-GM1.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3452,7 +3452,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-D6vgqNiq.mjs');
+          const { toolsForRole } = await import('./sideband-C0qzprWp.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3551,7 +3551,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-BkroIJOC.mjs');
+    const { queryCore } = await import('./commands-YPQSZ4Qx.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -3813,14 +3813,19 @@ function registerAwaitingReply(sessionId, threadId, now = Date.now()) {
   }
   writeAwaiting(sessionId, map);
 }
-function takeAwaitingReply(sessionId, threadId, now = Date.now()) {
+function peekAwaitingReply(sessionId, threadId, now = Date.now()) {
   if (!sessionId || !threadId) return false;
   const map = readAwaiting(sessionId);
   const at = map[threadId];
   if (typeof at !== "number") return false;
+  return now - at <= AWAIT_TTL_MS;
+}
+function consumeAwaitingReply(sessionId, threadId) {
+  if (!sessionId || !threadId) return;
+  const map = readAwaiting(sessionId);
+  if (!(threadId in map)) return;
   delete map[threadId];
   writeAwaiting(sessionId, map);
-  return now - at <= AWAIT_TTL_MS;
 }
 function computeOutboundHop(sessionId) {
   if (!sessionId) return { hopCount: 0, fromInboxTurn: false };
@@ -4177,6 +4182,26 @@ function isStructuredMessage(msg) {
 function escapeXml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
+function sanitizeInboundInboxMessage(message, opts) {
+  if (opts.trusted) return message;
+  const email = opts.callerEmail;
+  return {
+    ...message,
+    // Attribute to the SERVER-KNOWN identity, never the caller's self-asserted `from`.
+    // An authenticated collaborator is an honest verified human (`user:<email>` → may
+    // wake, attributed to THEM not the owner); an anonymous caller cannot claim human.
+    from: email ? `user:${email}` : "agent:anonymous",
+    verified: !!email,
+    // Strip self-asserted channel provenance + async-reply routing a direct caller
+    // has no business setting (legit channel ingress goes via the trusted channel path).
+    channel: void 0,
+    channelId: void 0,
+    correlationId: void 0,
+    // Escape the body so a nested </svamp-message> can't break out and forge a second
+    // attributed envelope in the agent's transcript.
+    body: xmlEscape(String(message.body ?? "").slice(0, 16 * 1024))
+  };
+}
 function formatInboxMessageXml(msg) {
   if (!isStructuredMessage(msg)) return msg.body;
   const attrs = [`message-id="${escapeXml(msg.messageId)}"`];
@@ -5305,12 +5330,14 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // ── Inbox ──
     sendInboxMessage: async (message, context) => {
       authorizeRequest(context, metadata.sharing, "interact");
-      inbox.push(message);
+      const trusted = getEffectiveRole(context, metadata.sharing) === "admin";
+      const msg = sanitizeInboundInboxMessage(message, { trusted, callerEmail: context?.user?.email });
+      inbox.push(msg);
       while (inbox.length > INBOX_MAX) inbox.shift();
       syncInboxToMetadata();
-      callbacks.onInboxMessage?.(message);
-      notifyListeners({ type: "inbox-update", sessionId, message });
-      return { success: true, messageId: message.messageId };
+      callbacks.onInboxMessage?.(msg);
+      notifyListeners({ type: "inbox-update", sessionId, message: msg });
+      return { success: true, messageId: msg.messageId };
     },
     getInbox: async (opts, context) => {
       authorizeRequest(context, metadata.sharing, "view");
@@ -6279,12 +6306,10 @@ async function registerDebugService(server, machineId, deps) {
       // require_context: true → Hypha injects the caller context as the last arg of every
       // method, which the authorize() gate below enforces. 'unlisted' only hides discovery.
       config: { visibility: "unlisted", require_context: true },
-      healthCheck: async () => ({
-        ok: true,
-        machineId,
-        uptime: process.uptime(),
-        timestamp: Date.now()
-      }),
+      healthCheck: async (context) => {
+        authorize(context, "view");
+        return { ok: true, machineId, uptime: process.uptime(), timestamp: Date.now() };
+      },
       getSessionStates: async (context) => {
         authorize(context, "view");
         const sessions = deps.getTrackedSessions();
@@ -10127,6 +10152,18 @@ var api = /*#__PURE__*/Object.freeze({
     searchSkills: searchSkills
 });
 
+function signalProcessTree(child, signal) {
+  const pid = child.pid;
+  if (pid === void 0) return;
+  try {
+    process.kill(-pid, signal);
+  } catch {
+    try {
+      child.kill(signal);
+    } catch {
+    }
+  }
+}
 const DEFAULT_PROBE_INTERVAL_S = 10;
 const DEFAULT_PROBE_TIMEOUT_S = 5;
 const DEFAULT_PROBE_FAILURE_THRESHOLD = 3;
@@ -10458,7 +10495,13 @@ class ProcessSupervisor {
       const child = spawn$1(spec.command, spec.args, {
         cwd: spec.workdir,
         env,
-        stdio: ["ignore", "pipe", "pipe"]
+        stdio: ["ignore", "pipe", "pipe"],
+        // #0316: run each supervised process in its OWN process group (setsid) so a
+        // shell-wrapping spec (`bash -c …`, `npm start`) can be torn down with the whole
+        // tree — otherwise stop/restart/TTL only kills the direct PID and leaks
+        // grandchildren. Kills below signal the group (negative PID). POSIX only; on
+        // Windows `detached` just decouples the console and the group-kill falls back.
+        detached: process.platform !== "win32"
       });
       entry.child = child;
       state.status = "running";
@@ -10620,10 +10663,7 @@ class ProcessSupervisor {
     console.warn(`[SUPERVISOR] Probe failed for '${entry.spec.name}' \u2014 killing to trigger restart`);
     entry.state.consecutiveProbeFailures = 0;
     if (entry.child) {
-      try {
-        entry.child.kill("SIGTERM");
-      } catch {
-      }
+      signalProcessTree(entry.child, "SIGTERM");
     }
   }
   // ── TTL ───────────────────────────────────────────────────────────────────
@@ -10668,15 +10708,9 @@ class ProcessSupervisor {
       };
       child.once("exit", done);
       child.once("close", done);
-      try {
-        child.kill("SIGTERM");
-      } catch {
-      }
+      signalProcessTree(child, "SIGTERM");
       forceKillTimer = setTimeout(() => {
-        try {
-          child.kill("SIGKILL");
-        } catch {
-        }
+        signalProcessTree(child, "SIGKILL");
         hardDeadlineTimer = setTimeout(() => {
           if (!resolved) {
             resolved = true;
@@ -11379,6 +11413,9 @@ function fireIdleWorkflows(root, sessionId, deps = {}) {
 }
 
 const UNBOUNDED_LOOP_ITERATIONS = 1e6;
+function loopCancelledDuringVerify(current) {
+  return !!current && (current.phase === "cancelled" || current.active === false);
+}
 function backlogOraclePending(projectRoot, sessionId) {
   const inScope = (i) => !sessionId || isVisibleTo(i, sessionId);
   return listIssues(projectRoot).filter(inScope).filter((i) => i.status === "ready" || i.status === "in_progress").map((i) => ({ id: i.id }));
@@ -11506,7 +11543,7 @@ function computeSoftTurnCap(hardMax, cadence) {
   return Math.ceil(hardMax / chunks);
 }
 const DEFAULT_LOOP_STUCK_CHECKPOINTS = 3;
-const DEFAULT_LOOP_MAX_AUTORESUMES = 3;
+const DEFAULT_LOOP_MAX_AUTORESUMES = Number.POSITIVE_INFINITY;
 const PROGRESS_HISTORY_CAP = 12;
 function resolveStuckLimit(envValue) {
   const n = Number(envValue);
@@ -11551,7 +11588,8 @@ function decideLoopContinuation(input) {
     return { action: "continue", kind: "progress", consumeAutoResume: false, reason: `still making progress (${stuckCheckpoints}/${stuckLimit} stuck checkpoints)` };
   }
   if (autoResumes < maxAutoResumes) {
-    return { action: "continue", kind: "autoresume", consumeAutoResume: true, reason: `no progress across ${stuckCheckpoints} checkpoints \u2014 auto-resume ${autoResumes + 1}/${maxAutoResumes}` };
+    const label = Number.isFinite(maxAutoResumes) ? `auto-resume ${autoResumes + 1}/${maxAutoResumes}` : `auto-resume ${autoResumes + 1} (unbounded \u2014 bounded only by the cost/iteration ceiling)`;
+    return { action: "continue", kind: "autoresume", consumeAutoResume: true, reason: `no progress across ${stuckCheckpoints} checkpoints \u2014 ${label}` };
   }
   const tail = `no progress across ${stuckCheckpoints} checkpoints; ${maxAutoResumes} auto-resume(s) exhausted`;
   return { action: "stop", kind: "stuck", reason: input.stuckReason ? `${input.stuckReason} \u2014 ${tail}` : tail };
@@ -12523,9 +12561,17 @@ function classifyOptsForMessage(sessionId, message, ownerEmail) {
   const fromVal = message.from || "";
   const senderEmail = message.verified && fromVal.includes("@") ? fromVal.replace(/^user:/, "").toLowerCase() : void 0;
   const self = !!(ownerEmail && senderEmail && senderEmail === String(ownerEmail).toLowerCase());
-  const openThreadReply = takeAwaitingReply(sessionId, message.threadId);
+  const openThreadReply = peekAwaitingReply(sessionId, message.threadId);
   return { self, openThreadReply };
 }
+function classifyInboundForSession(sessionId, message, ownerEmail) {
+  const opts = classifyOptsForMessage(sessionId, message, ownerEmail);
+  const decision = classifyInbound(message, Date.now(), opts);
+  if (opts.openThreadReply && decision.action === "wake") {
+    consumeAwaitingReply(sessionId, message.threadId);
+  }
+  return decision;
+}
 function writeGoalLoopState(directory, sessionId, state) {
   try {
     const dir = getLoopDir(directory, sessionId);
@@ -13403,7 +13449,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-BfK_xRcZ.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-DYoNzX4K.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -13421,7 +13467,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-DoUUUoZn.mjs');
+    const { FrpcTunnel } = await import('./frpc-CLQB-GM1.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -13441,14 +13487,14 @@ async function startDaemon(options) {
     return tunnel;
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
-  const { ServeManager } = await import('./serveManager-DAuIjPuV.mjs');
+  const { ServeManager } = await import('./serveManager-BK5OjhXU.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-DuLXaoGP.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -14119,6 +14165,10 @@ ${parts.join("\n")}`);
                 log: (m) => logger.log(`[Session ${sessionId}] ${m}`)
               }
             );
+            if (loopCancelledDuringVerify(readLoopState(directory, sessionId))) {
+              logger.log(`[Session ${sessionId}] loop was cancelled during verification \u2014 not re-kicking (#0308)`);
+              return;
+            }
             const ledger = ls.ledger;
             const budget = ls.budget;
             const progress_history = ls.progress_history;
@@ -14167,7 +14217,9 @@ ${parts.join("\n")}`);
                   max_iterations: ls.max_iterations,
                   budget,
                   started_at: startedAt,
-                  holds,
+                  // #0319: a PROGRESSING loop resets its hold counter so the evaluator-guided re-kick
+                  // mechanism re-engages fresh (it's making headway, not stuck); an auto-resume keeps it.
+                  holds: decision.kind === "progress" ? 0 : holds,
                   ledger,
                   progress_history,
                   auto_resumes: nextAuto
@@ -15433,7 +15485,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             },
             onInboxMessage: (message) => {
               if (trackedSession?.stopped) return;
-              const decision = classifyInbound(message, Date.now(), classifyOptsForMessage(sessionId, message, sessionMetadata?.sharing?.owner));
+              const decision = classifyInboundForSession(sessionId, message, sessionMetadata?.sharing?.owner);
               logger.log(`[Session ${sessionId}] Inbox message (urgency: ${message.urgency || "normal"}, hop: ${message.hopCount ?? 0}, from: ${message.from || "unknown"}) \u2192 ${decision.action} (${decision.reason})`);
               if (decision.breakerTripped) {
                 logger.error(`[Session ${sessionId}] Inbox circuit breaker TRIPPED \u2014 cross-agent wake rate too high; auto-waking paused.`);
@@ -15529,11 +15581,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-_rwZwiHD.mjs');
+              const { issueRpc } = await import('./rpc-0HSLhpCb.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-665-sPRQ.mjs');
+              const { workflowRpc } = await import('./rpc-BB-AxQa_.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -15942,7 +15994,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             },
             onInboxMessage: (message) => {
               if (acpStopped) return;
-              const decision = classifyInbound(message, Date.now(), classifyOptsForMessage(sessionId, message, sessionMetadata?.sharing?.owner));
+              const decision = classifyInboundForSession(sessionId, message, sessionMetadata?.sharing?.owner);
               logger.log(`[${agentName} Session ${sessionId}] Inbox message (urgency: ${message.urgency || "normal"}, hop: ${message.hopCount ?? 0}, from: ${message.from || "unknown"}) \u2192 ${decision.action} (${decision.reason})`);
               if (decision.breakerTripped) {
                 logger.error(`[${agentName} Session ${sessionId}] Inbox circuit breaker TRIPPED \u2014 auto-waking paused.`);
@@ -16069,11 +16121,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-_rwZwiHD.mjs');
+              const { issueRpc } = await import('./rpc-0HSLhpCb.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-665-sPRQ.mjs');
+              const { workflowRpc } = await import('./rpc-BB-AxQa_.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -16835,7 +16887,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-ivV7xAp3.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-DuLXaoGP.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -17032,7 +17084,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DjMTCoWS.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-DaFydJPf.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();

package/dist/{scheduler-DjMTCoWS.mjs → scheduler-DaFydJPf.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, H as listWorkflows, I as isWorkflowEnabled, J as workflowCrons, C as runWorkflow, K as cronMatches } from './run-BNxaekWa.mjs';
+import { n as resolveProjectRoot, H as listWorkflows, I as isWorkflowEnabled, J as workflowCrons, C as runWorkflow, K as cronMatches } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-Bc6fchAf.mjs → serveCommands-BgtRllaY.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-BkroIJOC.mjs');
+  const { connectAndGetMachine } = await import('./commands-YPQSZ4Qx.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-DAuIjPuV.mjs → serveManager-BK5OjhXU.mjs}

@@ -4,7 +4,7 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { l as getHyphaServerUrl, S as ServeAuth, m as hasCookieToken } from './run-BNxaekWa.mjs';
+import { l as getHyphaServerUrl, S as ServeAuth, m as hasCookieToken } from './run-hYUl-Fln.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -751,7 +751,7 @@ class ServeManager {
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-DoUUUoZn.mjs');
+      const { FrpcTunnel } = await import('./frpc-CLQB-GM1.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-D6vgqNiq.mjs → sideband-C0qzprWp.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-BNxaekWa.mjs';
+import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-hYUl-Fln.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.252",
+  "version": "0.2.253",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",