svamp-cli 0.2.263 → 0.2.264

package/dist/{commands-f9G9DwC4.mjs → commands-BmpHRl5s.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { T as parseFrontmatter, U as getSkillsServer, V as getSkillsWorkspaceName, W as getSkillsCollectionName, X as fetchWithTimeout, Y as searchSkills, Z as SKILLS_DIR, _ as getSkillInfo, $ as downloadSkillFile, a0 as listSkillFiles } from './run-DAOLRpvC.mjs';
+import { P as parseFrontmatter, Q as getSkillsServer, T as getSkillsWorkspaceName, U as getSkillsCollectionName, V as fetchWithTimeout, W as searchSkills, X as SKILLS_DIR, Y as getSkillInfo, Z as downloadSkillFile, _ as listSkillFiles } from './run-kkeXP2d_.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{commands-aGQUafx6.mjs → commands-CSNOKRVn.mjs}

@@ -1,8 +1,8 @@
 import { existsSync } from 'node:fs';
 import { resolve } from 'node:path';
-import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-Dni5WrqV.mjs';
+import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-DuPRCS2G.mjs';
 import { execSync } from 'node:child_process';
-import { u as updateIssue, t as addComment, v as addIssue, k as shortId } from './run-DAOLRpvC.mjs';
+import { u as updateIssue, o as addComment, q as addIssue, i as shortId } from './run-kkeXP2d_.mjs';
 import 'node:os';
 import 'os';
 import 'fs/promises';

package/dist/{commands-B_N0vONs.mjs → commands-DNyzbWPw.mjs}

@@ -58,7 +58,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./frpc-YKxUZoMA.mjs');
+    const { runFrpcTunnel } = await import('./frpc-DmaWRu0M.mjs');
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -68,7 +68,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -90,7 +90,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-DWshkZ3Z.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-BZPDL-1B.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -138,7 +138,7 @@ async function serviceServe(args) {
       server.once("error", reject);
       server.listen(servePort, "127.0.0.1", () => resolve());
     });
-    const { runFrpcTunnel } = await import('./frpc-YKxUZoMA.mjs');
+    const { runFrpcTunnel } = await import('./frpc-DmaWRu0M.mjs');
     void server;
     await runFrpcTunnel(name, [servePort]);
   } catch (err) {
@@ -148,7 +148,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+    const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -188,7 +188,7 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+    const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });

package/dist/{commands-DfQA4ZX7.mjs → commands-D_YqjDY4.mjs}

@@ -1,7 +1,9 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { n as resolveProjectRoot, x as searchIssues, w as listIssues, p as resumeIssue, q as pauseIssue, t as addComment, u as updateIssue, o as getIssue, y as isVisibleTo, L as summarize, v as addIssue } from './run-DAOLRpvC.mjs';
+import { f as flushAndExit } from './cli-CNorTj26.mjs';
+import { l as resolveProjectRoot, v as searchIssues, t as listIssues, n as resumeIssue, p as pauseIssue, o as addComment, u as updateIssue, m as getIssue, w as isVisibleTo, J as summarize, q as addIssue } from './run-kkeXP2d_.mjs';
+import './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -366,7 +368,7 @@ the user explicitly reserved): re-run with \`--blocked "<the specific blocker>"\
       const pending = listIssues(root).filter(inScope).filter((i) => i.status === "ready" || i.status === "in_progress");
       if (json) console.log(JSON.stringify(pending));
       else out(pending.length ? `${pending.length} pending: ${pending.map((i) => "#" + i.id).join(" ")}` : "No pending issues.");
-      process.exit(pending.length ? 1 : 0);
+      await flushAndExit(pending.length ? 1 : 0);
       break;
     }
     case "search": {

package/dist/{commands-BrjfwC7G.mjs → commands-Dg_nTA2I.mjs}

@@ -1,11 +1,11 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-Dni5WrqV.mjs';
+import { connectAndGetMachine } from './commands-DuPRCS2G.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-DAOLRpvC.mjs';
+import './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-Dni5WrqV.mjs → commands-DuPRCS2G.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 import { basename, resolve, join, isAbsolute } from 'node:path';
 import os from 'node:os';
-import { a2 as formatHandle, a3 as normalizeAllowedUser, a4 as loadSecurityContextConfig, a5 as resolveSecurityContext, a6 as buildSecurityContextFromFlags, a7 as mergeSecurityContexts, c as connectToHypha, a8 as buildSessionShareUrl, a9 as computeOutboundHop, k as shortId, aa as registerAwaitingReply, ab as buildMachineShareUrl, ac as parseHandle, ad as handleMatchesMetadata } from './run-DAOLRpvC.mjs';
+import { a2 as formatHandle, a3 as normalizeAllowedUser, a4 as loadSecurityContextConfig, a5 as resolveSecurityContext, a6 as buildSecurityContextFromFlags, a7 as mergeSecurityContexts, c as connectToHypha, a8 as buildSessionShareUrl, a9 as computeOutboundHop, i as shortId, aa as registerAwaitingReply, ab as buildMachineShareUrl, ac as parseHandle, ad as handleMatchesMetadata } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-BsQqZG9I.mjs → commands-Kk7AH5dR.mjs}

@@ -1,5 +1,5 @@
 import { spawnSync } from 'node:child_process';
-import { n as resolveProjectRoot, M as workflowSteps, D as setWorkflowEnabled, I as isWorkflowEnabled, E as removeWorkflow, B as getWorkflow, H as listWorkflows, F as saveWorkflow, G as rawWorkflow } from './run-DAOLRpvC.mjs';
+import { l as resolveProjectRoot, K as workflowSteps, B as setWorkflowEnabled, G as isWorkflowEnabled, C as removeWorkflow, z as getWorkflow, F as listWorkflows, D as saveWorkflow, E as rawWorkflow } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{fleet-Bjg6QRMP.mjs → fleet-DkFOlkxS.mjs}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { c as connectToHypha } from './run-DAOLRpvC.mjs';
+import { c as connectToHypha } from './run-kkeXP2d_.mjs';
 import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-B9O-hKxm.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{frpc-YKxUZoMA.mjs → frpc-DmaWRu0M.mjs}

@@ -4,7 +4,7 @@ import { mkdirSync, chmodSync, writeFileSync, unlinkSync, existsSync, readFileSy
 import { join } from 'path';
 import { homedir, platform, arch } from 'os';
 import { randomUUID, createHash } from 'crypto';
-import { h as getFrpsSubdomainHost, i as getFrpsServerPort, j as getFrpsServerAddr } from './run-DAOLRpvC.mjs';
+import { e as getFrpsSubdomainHost, f as getFrpsServerPort, h as getFrpsServerAddr } from './run-kkeXP2d_.mjs';
 import 'fs/promises';
 import 'url';
 import 'node:crypto';

package/dist/{headlessCli-DfKlYX0C.mjs → headlessCli-DFsJaJ2p.mjs}

@@ -1,5 +1,5 @@
-import { a1 as resolveModel, ae as describeMisconfiguration, af as buildMachineDeps } from './run-DAOLRpvC.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-DPLjT788.mjs';
+import { $ as resolveModel, ae as describeMisconfiguration, af as buildMachineDeps } from './run-kkeXP2d_.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-CIJUNKUA.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-DAOLRpvC.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{package-Cl0NCpCL.mjs → package-Cz5Z0buw.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.263";
+var version = "0.2.264";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -19,7 +19,7 @@ var exports$1 = {
 var scripts = {
 	build: "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
 	typecheck: "tsc --noEmit",
-	test: "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs",
+	test: "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs",
 	"test:hypha": "node --no-warnings test/test-hypha-service.mjs",
 	dev: "tsx src/cli.ts",
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",

package/dist/{rpc-B4zSdme1.mjs → rpc-Db3BR76v.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, z as getRun, A as listRuns, B as getWorkflow, C as runWorkflow, D as setWorkflowEnabled, E as removeWorkflow, F as saveWorkflow, G as rawWorkflow, H as listWorkflows } from './run-DAOLRpvC.mjs';
+import { l as resolveProjectRoot, x as getRun, y as listRuns, z as getWorkflow, A as runWorkflow, B as setWorkflowEnabled, C as removeWorkflow, D as saveWorkflow, E as rawWorkflow, F as listWorkflows } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-DrA4F31T.mjs → rpc-DswYjrCh.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, u as updateIssue, o as getIssue, p as resumeIssue, q as pauseIssue, t as addComment, v as addIssue, w as listIssues, x as searchIssues, y as isVisibleTo } from './run-DAOLRpvC.mjs';
+import { l as resolveProjectRoot, u as updateIssue, m as getIssue, n as resumeIssue, p as pauseIssue, o as addComment, q as addIssue, t as listIssues, v as searchIssues, w as isVisibleTo } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-btCn5o6B.mjs → run-C3qTQEDV.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { ag as applyClaudeProxyEnv, ah as composeSessionId, ai as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, aj as generateHookSettings } from './run-DAOLRpvC.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { ag as applyClaudeProxyEnv, ah as composeSessionId, ai as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, aj as generateHookSettings } from './run-kkeXP2d_.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{run-DAOLRpvC.mjs → run-kkeXP2d_.mjs}

@@ -253,6 +253,34 @@ function mergeSecurityContexts(base, override) {
   merged.allowedDirectories = mergeArrays(base.allowedDirectories, override.allowedDirectories);
   return merged;
 }
+function clampSecurityContextToCeiling(ceiling, requested) {
+  if (!ceiling) return void 0;
+  if (!requested) return ceiling;
+  const merged = {};
+  merged.role = ceiling.role;
+  merged.denyAllNetwork = (ceiling.denyAllNetwork ?? false) || (requested.denyAllNetwork ?? false);
+  const cf = ceiling.filesystem;
+  const rf = requested.filesystem;
+  if (cf || rf) {
+    merged.filesystem = {
+      // Grants: ceiling only (caller cannot widen writable paths).
+      allowWrite: cf?.allowWrite ? dedup(cf.allowWrite) : void 0,
+      // Denials: union (caller may add more).
+      denyRead: mergeArrays(cf?.denyRead, rf?.denyRead),
+      denyWrite: mergeArrays(cf?.denyWrite, rf?.denyWrite)
+    };
+  }
+  const cn = ceiling.network;
+  const rn = requested.network;
+  if (cn || rn) {
+    merged.network = {
+      allowedDomains: cn?.allowedDomains ? dedup(cn.allowedDomains) : void 0,
+      deniedDomains: mergeArrays(cn?.deniedDomains, rn?.deniedDomains)
+    };
+  }
+  merged.allowedDirectories = ceiling.allowedDirectories ? dedup(ceiling.allowedDirectories) : void 0;
+  return merged;
+}
 function resolveSecurityContext(config, userEmail) {
   if (!config) return void 0;
   const defaultCtx = config.default;
@@ -2356,7 +2384,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           if (machineCtx) {
             options = {
               ...options,
-              securityContext: mergeSecurityContexts(machineCtx, options.securityContext)
+              securityContext: isSharedUser ? clampSecurityContextToCeiling(machineCtx, options.securityContext) : mergeSecurityContexts(machineCtx, options.securityContext)
             };
           }
         }
@@ -3013,7 +3041,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-YKxUZoMA.mjs');
+        const { FrpcTunnel } = await import('./frpc-DmaWRu0M.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -3480,7 +3508,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-DPLjT788.mjs');
+          const { toolsForRole } = await import('./sideband-CIJUNKUA.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -3579,7 +3607,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-Dni5WrqV.mjs');
+    const { queryCore } = await import('./commands-DuPRCS2G.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -8692,6 +8720,23 @@ function mapDecisionToWire(d) {
   }
 }
 
+function codexPermissionSettings(mode) {
+  switch (mode) {
+    case "yolo":
+    case "bypassPermissions":
+    case "danger-full-access":
+      return { approvalPolicy: "never", sandbox: "danger-full-access" };
+    case "safe-yolo":
+    case "acceptEdits":
+      return { approvalPolicy: "on-failure", sandbox: "workspace-write" };
+    case "read-only":
+    case "plan":
+      return { approvalPolicy: "on-request", sandbox: "read-only" };
+    case "default":
+    default:
+      return { approvalPolicy: "on-request", sandbox: "workspace-write" };
+  }
+}
 const CODEX_PROVIDER_KEY_ENV = "SVAMP_CODEX_API_KEY";
 const PROVIDER_NAME = "svamp";
 function resolveCodexProvider(env = process.env) {
@@ -8728,6 +8773,7 @@ var codexProvider = /*#__PURE__*/Object.freeze({
     __proto__: null,
     CODEX_PROVIDER_KEY_ENV: CODEX_PROVIDER_KEY_ENV,
     buildCodexProviderArgs: buildCodexProviderArgs,
+    codexPermissionSettings: codexPermissionSettings,
     hasCustomProvider: hasCustomProvider,
     resolveCodexProvider: resolveCodexProvider
 });
@@ -8740,6 +8786,8 @@ class CodexAppServerBackend {
     const provider = opts.provider ?? resolveCodexProvider();
     const { configArgs, env: providerEnv, model: providerModel } = buildCodexProviderArgs(provider);
     this.model = opts.model ?? providerModel;
+    this.approvalPolicy = opts.approvalPolicy;
+    this.sandbox = opts.sandbox;
     this.client = new CodexAppServerClient({
       cwd: opts.cwd,
       env: { ...opts.env ?? {}, ...providerEnv },
@@ -8756,6 +8804,11 @@ class CodexAppServerBackend {
   sessionId = randomUUID();
   log;
   model;
+  // #0438: codex's own approval policy + sandbox, derived from the svamp permission mode. Mutable
+  // so a mid-session switchMode takes effect on the next turn. yolo → 'never' + 'danger-full-access'
+  // so codex NEVER prompts for writes (and never times out waiting on a prompt).
+  approvalPolicy;
+  sandbox;
   started = false;
   // Approval promises keyed by callId, resolved by respondToPermission().
   pendingApprovals = /* @__PURE__ */ new Map();
@@ -8779,9 +8832,9 @@ class CodexAppServerBackend {
     if (avail === false) throw new Error("Installed Codex is too old for app-server \u2014 upgrade to >= 0.100 (`npm i -g @openai/codex@latest`).");
     await this.client.start();
     if (this.opts.resumeThreadId) {
-      await this.client.resumeThread({ threadId: this.opts.resumeThreadId, model: this.model, approvalPolicy: this.opts.approvalPolicy, sandbox: this.opts.sandbox });
+      await this.client.resumeThread({ threadId: this.opts.resumeThreadId, model: this.model, approvalPolicy: this.approvalPolicy, sandbox: this.sandbox });
     } else {
-      const r = await this.client.startThread({ model: this.model, approvalPolicy: this.opts.approvalPolicy, sandbox: this.opts.sandbox });
+      const r = await this.client.startThread({ model: this.model, approvalPolicy: this.approvalPolicy, sandbox: this.sandbox });
       this.model = this.model ?? r.model;
     }
     this.started = true;
@@ -8798,7 +8851,7 @@ class CodexAppServerBackend {
       resolveTurn = res;
     });
     try {
-      await this.client.sendTurnAndWait(prompt, { model: this.model, approvalPolicy: this.opts.approvalPolicy, sandbox: this.opts.sandbox });
+      await this.client.sendTurnAndWait(prompt, { model: this.model, approvalPolicy: this.approvalPolicy, sandbox: this.sandbox });
     } catch (err) {
       this.emit({ type: "status", status: "error", detail: err instanceof Error ? err.message : String(err) });
     } finally {
@@ -8849,6 +8902,12 @@ class CodexAppServerBackend {
   setModel(model) {
     this.model = model;
   }
+  /** #0438: update codex's approval policy + sandbox (from a svamp permission-mode switch). Takes
+   *  effect on the next turn (and next thread start). yolo → 'never' + 'danger-full-access'. */
+  setPermission(approvalPolicy, sandbox) {
+    this.approvalPolicy = approvalPolicy;
+    this.sandbox = sandbox;
+  }
   /** The model label for assistant-message parity with Claude (frontend schema requires a non-empty `model`). */
   getModel() {
     return this.model || "codex";
@@ -11985,17 +12044,31 @@ function resolveEvaluatorModel(envValue) {
 function parseEvaluatorVerdict(text) {
   if (!text) return null;
   const candidates = [];
-  let depth = 0, start = -1;
+  let depth = 0, start = -1, inStr = false, esc = false;
   for (let i = 0; i < text.length; i++) {
     const c = text[i];
-    if (c === "{") {
+    if (inStr) {
+      if (esc) {
+        esc = false;
+      } else if (c === "\\") {
+        esc = true;
+      } else if (c === '"') {
+        inStr = false;
+      }
+      continue;
+    }
+    if (c === '"') {
+      inStr = true;
+    } else if (c === "{") {
       if (depth === 0) start = i;
       depth++;
     } else if (c === "}") {
-      depth--;
-      if (depth === 0 && start >= 0) {
-        candidates.push(text.slice(start, i + 1));
-        start = -1;
+      if (depth > 0) {
+        depth--;
+        if (depth === 0 && start >= 0) {
+          candidates.push(text.slice(start, i + 1));
+          start = -1;
+        }
       }
     }
   }
@@ -13867,7 +13940,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-DWshkZ3Z.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BZPDL-1B.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -13885,7 +13958,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-YKxUZoMA.mjs');
+    const { FrpcTunnel } = await import('./frpc-DmaWRu0M.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -13906,7 +13979,7 @@ async function startDaemon(options) {
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
   const tunnelRecreateInFlight = /* @__PURE__ */ new Set();
-  const { ServeManager } = await import('./serveManager-DVDWrx2q.mjs');
+  const { ServeManager } = await import('./serveManager-a_dIQuK4.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
@@ -16028,11 +16101,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DrA4F31T.mjs');
+              const { issueRpc } = await import('./rpc-DswYjrCh.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-B4zSdme1.mjs');
+              const { workflowRpc } = await import('./rpc-Db3BR76v.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -16426,6 +16499,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               if (currentPermissionMode === mode) return;
               logger.log(`[${agentName} Session ${sessionId}] Switch mode: ${mode}`);
               currentPermissionMode = mode;
+              const cp = codexPermissionSettings(mode);
+              agentBackend.setPermission?.(cp.approvalPolicy, cp.sandbox);
             },
             onRestartClaude: async () => {
               logger.log(`[${agentName} Session ${sessionId}] Restart agent requested`);
@@ -16588,11 +16663,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DrA4F31T.mjs');
+              const { issueRpc } = await import('./rpc-DswYjrCh.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-B4zSdme1.mjs');
+              const { workflowRpc } = await import('./rpc-Db3BR76v.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -16745,7 +16820,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           if (avail === false) throw new Error("Installed Codex is too old for app-server \u2014 upgrade to >= 0.100 (`npm i -g @openai/codex@latest`).");
           const provider = resolveCodexProvider();
           const codexModel = options2.model || agentConfig?.default_model || provider.model || void 0;
-          logger.log(`[Agent Session ${sessionId}] Codex backend: app-server (model=${codexModel ?? "default"}${provider.apiBase ? `, provider=${provider.apiBase}` : ""})`);
+          const codexPerm = codexPermissionSettings(currentPermissionMode);
+          logger.log(`[Agent Session ${sessionId}] Codex backend: app-server (model=${codexModel ?? "default"}${provider.apiBase ? `, provider=${provider.apiBase}` : ""}, mode=${currentPermissionMode} \u2192 approval=${codexPerm.approvalPolicy}/sandbox=${codexPerm.sandbox})`);
           if (acpResumeThreadId) logger.log(`[Agent Session ${sessionId}] Resuming Codex thread ${acpResumeThreadId} (restart recovery)`);
           agentBackend = new CodexAppServerBackend({
             cwd: directory,
@@ -16754,6 +16830,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             env: options2.environmentVariables,
             log: logger.log,
             isolationConfig: agentIsoConfig,
+            approvalPolicy: codexPerm.approvalPolicy,
+            sandbox: codexPerm.sandbox,
             // #0412 P2: resume the persisted thread across a daemon restart (context intact).
             resumeThreadId: acpResumeThreadId
           });
@@ -17600,7 +17678,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DfbBMHWm.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-DhKDP3hC.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();
@@ -18211,4 +18289,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { downloadSkillFile as $, listRuns as A, getWorkflow as B, runWorkflow as C, setWorkflowEnabled as D, removeWorkflow as E, saveWorkflow as F, rawWorkflow as G, listWorkflows as H, isWorkflowEnabled as I, workflowCrons as J, cronMatches as K, summarize as L, workflowSteps as M, loadMachineContext as N, buildMachineInstructions as O, machineToolsForRole as P, buildMachineTools as Q, READ_ONLY_TOOLS as R, ServeAuth as S, parseFrontmatter as T, getSkillsServer as U, getSkillsWorkspaceName as V, getSkillsCollectionName as W, fetchWithTimeout as X, searchSkills as Y, SKILLS_DIR as Z, getSkillInfo as _, createSessionStore as a, listSkillFiles as a0, resolveModel as a1, formatHandle as a2, normalizeAllowedUser as a3, loadSecurityContextConfig as a4, resolveSecurityContext as a5, buildSecurityContextFromFlags as a6, mergeSecurityContexts as a7, buildSessionShareUrl as a8, computeOutboundHop as a9, registerAwaitingReply as aa, buildMachineShareUrl as ab, parseHandle as ac, handleMatchesMetadata as ad, describeMisconfiguration as ae, buildMachineDeps as af, applyClaudeProxyEnv as ag, composeSessionId as ah, generateFriendlyName as ai, generateHookSettings as aj, claudeAuth as ak, projectInfo as al, DefaultTransport$1 as am, acpBackend as an, acpAgentConfig as ao, codexProvider as ap, codexAppServerBackend as aq, GeminiTransport$1 as ar, instanceConfig as as, api as at, run as au, stopDaemon as b, connectToHypha as c, daemonStatus as d, clearStopMarker as e, stopMarkerExists as f, getHyphaServerUrl$1 as g, getFrpsSubdomainHost as h, getFrpsServerPort as i, getFrpsServerAddr as j, shortId as k, getHyphaServerUrl as l, hasCookieToken as m, resolveProjectRoot as n, getIssue as o, resumeIssue as p, pauseIssue as q, registerMachineService as r, startDaemon as s, addComment as t, updateIssue as u, addIssue as v, listIssues as w, searchIssues as x, isVisibleTo as y, getRun as z };
+export { resolveModel as $, runWorkflow as A, setWorkflowEnabled as B, removeWorkflow as C, saveWorkflow as D, rawWorkflow as E, listWorkflows as F, isWorkflowEnabled as G, workflowCrons as H, cronMatches as I, summarize as J, workflowSteps as K, loadMachineContext as L, buildMachineInstructions as M, machineToolsForRole as N, buildMachineTools as O, parseFrontmatter as P, getSkillsServer as Q, READ_ONLY_TOOLS as R, ServeAuth as S, getSkillsWorkspaceName as T, getSkillsCollectionName as U, fetchWithTimeout as V, searchSkills as W, SKILLS_DIR as X, getSkillInfo as Y, downloadSkillFile as Z, listSkillFiles as _, createSessionStore as a, clearStopMarker as a0, stopMarkerExists as a1, formatHandle as a2, normalizeAllowedUser as a3, loadSecurityContextConfig as a4, resolveSecurityContext as a5, buildSecurityContextFromFlags as a6, mergeSecurityContexts as a7, buildSessionShareUrl as a8, computeOutboundHop as a9, registerAwaitingReply as aa, buildMachineShareUrl as ab, parseHandle as ac, handleMatchesMetadata as ad, describeMisconfiguration as ae, buildMachineDeps as af, applyClaudeProxyEnv as ag, composeSessionId as ah, generateFriendlyName as ai, generateHookSettings as aj, claudeAuth as ak, projectInfo as al, DefaultTransport$1 as am, acpBackend as an, acpAgentConfig as ao, codexProvider as ap, codexAppServerBackend as aq, GeminiTransport$1 as ar, instanceConfig as as, api as at, run as au, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, getHyphaServerUrl as j, hasCookieToken as k, resolveProjectRoot as l, getIssue as m, resumeIssue as n, addComment as o, pauseIssue as p, addIssue as q, registerMachineService as r, startDaemon as s, listIssues as t, updateIssue as u, searchIssues as v, isVisibleTo as w, getRun as x, listRuns as y, getWorkflow as z };

package/dist/{scheduler-DfbBMHWm.mjs → scheduler-DhKDP3hC.mjs}

@@ -1,4 +1,4 @@
-import { n as resolveProjectRoot, H as listWorkflows, I as isWorkflowEnabled, J as workflowCrons, C as runWorkflow, K as cronMatches } from './run-DAOLRpvC.mjs';
+import { l as resolveProjectRoot, F as listWorkflows, G as isWorkflowEnabled, H as workflowCrons, A as runWorkflow, I as cronMatches } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-YmniTKX9.mjs → serveCommands-BVJR3K9P.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-Dni5WrqV.mjs');
+  const { connectAndGetMachine } = await import('./commands-DuPRCS2G.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-DVDWrx2q.mjs → serveManager-a_dIQuK4.mjs}

@@ -5,7 +5,7 @@ import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
 import { serveStaticMount } from './staticFileServer-CbYnj2bH.mjs';
-import { l as getHyphaServerUrl, S as ServeAuth, m as hasCookieToken } from './run-DAOLRpvC.mjs';
+import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-kkeXP2d_.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -854,7 +854,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-YKxUZoMA.mjs');
+      const { FrpcTunnel } = await import('./frpc-DmaWRu0M.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-DPLjT788.mjs → sideband-CIJUNKUA.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-DAOLRpvC.mjs';
+import { R as READ_ONLY_TOOLS, L as loadMachineContext, M as buildMachineInstructions, N as machineToolsForRole, O as buildMachineTools } from './run-kkeXP2d_.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';