svamp-cli 0.2.258 → 0.2.259

package/dist/{scheduler-7wve0Fy3.mjs → scheduler-CN8jChyQ.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, H as listWorkflows, I as isWorkflowEnabled, J as workflowCrons, C as runWorkflow, K as cronMatches } from './run-C1Unk4Zx.mjs';
+import { n as resolveProjectRoot, H as listWorkflows, I as isWorkflowEnabled, J as workflowCrons, C as runWorkflow, K as cronMatches } from './run-CT8Leg3-.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -14,10 +14,7 @@ import 'node:path';
 import 'node:events';
 import 'node:os';
 import '@agentclientprotocol/sdk';
-import '@modelcontextprotocol/sdk/client/index.js';
-import '@modelcontextprotocol/sdk/client/stdio.js';
-import '@modelcontextprotocol/sdk/types.js';
-import 'zod';
+import 'node:readline';
 import 'node:fs/promises';
 import 'node:util';
 import 'yaml';

package/dist/{serveCommands-iQJJLsMJ.mjs → serveCommands-sWtLnJRW.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-D8l74hsL.mjs');
+  const { connectAndGetMachine } = await import('./commands-BtXxn3tI.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-D8l74hsL.mjs');
+  const { connectAndGetMachine } = await import('./commands-BtXxn3tI.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-D8l74hsL.mjs');
+  const { connectAndGetMachine } = await import('./commands-BtXxn3tI.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-D8l74hsL.mjs');
+  const { connectAndGetMachine } = await import('./commands-BtXxn3tI.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-D8l74hsL.mjs');
+  const { connectAndGetMachine } = await import('./commands-BtXxn3tI.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-BszV0oIl.mjs → serveManager-BuXk1_SH.mjs}

@@ -4,8 +4,8 @@ import * as fs from 'fs';
 import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
-import { serveStaticMount } from './staticFileServer-FCEOLIYH.mjs';
-import { l as getHyphaServerUrl, S as ServeAuth, m as hasCookieToken } from './run-C1Unk4Zx.mjs';
+import { serveStaticMount } from './staticFileServer-CbYnj2bH.mjs';
+import { l as getHyphaServerUrl, S as ServeAuth, m as hasCookieToken } from './run-CT8Leg3-.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -17,10 +17,7 @@ import 'node:path';
 import 'node:events';
 import 'node:os';
 import '@agentclientprotocol/sdk';
-import '@modelcontextprotocol/sdk/client/index.js';
-import '@modelcontextprotocol/sdk/client/stdio.js';
-import '@modelcontextprotocol/sdk/types.js';
-import 'zod';
+import 'node:readline';
 import 'node:fs/promises';
 import 'node:util';
 import 'yaml';
@@ -597,6 +594,21 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
           const base = path.resolve(mount.directory);
           const fp = path.resolve(path.join(base, basePath));
           if (fp !== base && !fp.startsWith(base + path.sep)) return null;
+          try {
+            const realRoot = fs.realpathSync(base);
+            let ancestor = fp;
+            while (!fs.existsSync(ancestor) && path.dirname(ancestor) !== ancestor) {
+              ancestor = path.dirname(ancestor);
+            }
+            const realAncestor = fs.realpathSync(ancestor);
+            if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + path.sep)) return null;
+            if (fs.existsSync(fp) && fs.lstatSync(fp).isSymbolicLink()) {
+              const realTarget = fs.realpathSync(fp);
+              if (realTarget !== realRoot && !realTarget.startsWith(realRoot + path.sep)) return null;
+            }
+          } catch {
+            return null;
+          }
           return fp;
         };
         if ((req.method === "PUT" || req.method === "DELETE") && mount && mount.directory) {
@@ -667,6 +679,14 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
               res.end(`Backend error: ${err.message}`);
             }
           });
+          const abortUpstream = () => {
+            if (!proxyReq.destroyed) proxyReq.destroy();
+          };
+          req.on("aborted", abortUpstream);
+          res.on("close", () => {
+            if (!res.writableFinished) abortUpstream();
+          });
+          proxyReq.setTimeout(12e4, abortUpstream);
           req.pipe(proxyReq);
           return;
         }
@@ -688,6 +708,101 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
           res.end("Not found");
         }
       });
+      server.on("upgrade", (req, clientSocket, head) => {
+        const deny = (code, reason) => {
+          try {
+            clientSocket.write(`HTTP/1.1 ${code} ${reason}\r
+Connection: close\r
+\r
+`);
+          } catch {
+          }
+          try {
+            clientSocket.destroy();
+          } catch {
+          }
+        };
+        void (async () => {
+          try {
+            const url = new URL(req.url || "/", `http://127.0.0.1:${this.port}`);
+            const incomingHost = (req.headers.host || "").split(":")[0].toLowerCase();
+            const hostMount = this.hostToMount.get(incomingHost);
+            let mountName;
+            let mountResolvedByHost = false;
+            if (hostMount && this.mounts.has(hostMount)) {
+              mountName = hostMount;
+              mountResolvedByHost = true;
+            } else {
+              mountName = url.pathname.split("/").filter(Boolean)[0];
+            }
+            const mount = mountName ? this.mounts.get(mountName) : void 0;
+            if (!mount || !mount.process) {
+              deny(404, "Not Found");
+              return;
+            }
+            if (mount.access !== "public" && mount.access !== "link") {
+              if (mount.access === "owner" && !mount.ownerEmail) {
+                deny(403, "Forbidden");
+                return;
+              }
+              const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
+              const allowed = userEmail && this.auth ? this.auth.isAuthorized(userEmail, mount.access, mount.ownerEmail) : false;
+              if (!allowed) {
+                deny(userEmail ? 403 : 401, userEmail ? "Forbidden" : "Unauthorized");
+                return;
+              }
+            }
+            const cfg = mount.process;
+            if (cfg.wakeOnRequest || !this.managedProcs.has(mount.name)) {
+              try {
+                await this.ensureManagedRunning(mount.name);
+              } catch {
+                deny(503, "Backend Not Ready");
+                return;
+              }
+            }
+            const handle = this.managedProcs.get(mount.name);
+            if (handle) handle.lastRequestAt = Date.now();
+            const targetPath = mountResolvedByHost ? req.url || "/" : (url.pathname.slice(`/${mountName}`.length) || "/") + (url.search || "");
+            const upstream = net.connect(cfg.port, "127.0.0.1", () => {
+              const lines = [`${req.method} ${targetPath} HTTP/1.1`];
+              for (let i = 0; i < req.rawHeaders.length; i += 2) {
+                lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+              }
+              upstream.write(lines.join("\r\n") + "\r\n\r\n");
+              if (head && head.length) upstream.write(head);
+              upstream.pipe(clientSocket);
+              clientSocket.pipe(upstream);
+            });
+            const teardown = () => {
+              try {
+                upstream.destroy();
+              } catch {
+              }
+              try {
+                clientSocket.destroy();
+              } catch {
+              }
+            };
+            upstream.on("error", teardown);
+            clientSocket.on("error", teardown);
+            upstream.on("close", () => {
+              try {
+                clientSocket.destroy();
+              } catch {
+              }
+            });
+            clientSocket.on("close", () => {
+              try {
+                upstream.destroy();
+              } catch {
+              }
+            });
+          } catch {
+            deny(500, "Internal Server Error");
+          }
+        })();
+      });
       this.proxyServer = server;
       server.listen(this.port, "127.0.0.1", () => resolve());
       server.on("error", reject);
@@ -739,7 +854,7 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-IXxyfgPn.mjs');
+      const { FrpcTunnel } = await import('./frpc-BCOnJSAM.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-DMPZ-ZoR.mjs → sideband-ByYvGtj3.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-C1Unk4Zx.mjs';
+import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-CT8Leg3-.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';
@@ -14,10 +14,7 @@ import 'node:path';
 import 'node:events';
 import 'node:os';
 import '@agentclientprotocol/sdk';
-import '@modelcontextprotocol/sdk/client/index.js';
-import '@modelcontextprotocol/sdk/client/stdio.js';
-import '@modelcontextprotocol/sdk/types.js';
-import 'zod';
+import 'node:readline';
 import 'node:fs/promises';
 import 'node:util';
 import 'yaml';

package/dist/{staticFileServer-FCEOLIYH.mjs → staticFileServer-CbYnj2bH.mjs}

@@ -54,6 +54,16 @@ function containedPath(rootDir, relPath) {
   if (fp !== base && !fp.startsWith(base + path.sep)) return null;
   return fp;
 }
+function realContainedPath(rootDir, candidate) {
+  try {
+    const realRoot = fs.realpathSync(path.resolve(rootDir));
+    const real = fs.realpathSync(candidate);
+    if (real === realRoot || real.startsWith(realRoot + path.sep)) return real;
+    return null;
+  } catch {
+    return null;
+  }
+}
 function safeDecode(p) {
   try {
     return decodeURIComponent(p);
@@ -125,12 +135,18 @@ function serveStaticMount(req, res, opts) {
     sendFile(req, res, rootDir, rootStat);
     return;
   }
-  const target = containedPath(rootDir, relPath.replace(/^\/+/, ""));
-  if (!target) {
+  const lexTarget = containedPath(rootDir, relPath.replace(/^\/+/, ""));
+  if (!lexTarget) {
     res.writeHead(403, { ...CORS, "Content-Type": "text/plain" });
     res.end("Forbidden");
     return;
   }
+  const target = realContainedPath(rootDir, lexTarget);
+  if (!target) {
+    res.writeHead(404, { ...CORS, "Content-Type": "text/plain" });
+    res.end("Not Found");
+    return;
+  }
   let st;
   try {
     st = fs.statSync(target);
@@ -146,8 +162,8 @@ function serveStaticMount(req, res, opts) {
       res.end();
       return;
     }
-    const indexPath = path.join(target, "index.html");
-    if (fs.existsSync(indexPath) && fs.statSync(indexPath).isFile()) {
+    const indexPath = realContainedPath(rootDir, path.join(target, "index.html"));
+    if (indexPath && fs.statSync(indexPath).isFile()) {
       sendFile(req, res, indexPath, fs.statSync(indexPath));
       return;
     }
@@ -236,4 +252,4 @@ function pipeStream(stream, res) {
   stream.pipe(res);
 }
 
-export { containedPath, contentTypeFor, directoryListingHtml, parseRange, serveStaticMount };
+export { containedPath, contentTypeFor, directoryListingHtml, parseRange, realContainedPath, serveStaticMount };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.258",
+  "version": "0.2.259",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-backend.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",