svamp-cli 0.2.265 → 0.2.266

package/dist/{run-b-b_szy6.mjs → run-CetRvMab.mjs}

@@ -6,8 +6,8 @@ import { fileURLToPath } from 'url';
 import { execFile, spawn as spawn$1, execSync as execSync$1, exec as exec$1 } from 'child_process';
 import { randomUUID as randomUUID$1 } from 'crypto';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, realpathSync, readdirSync, statSync, renameSync, rmSync, appendFileSync, unlinkSync } from 'node:fs';
-import { exec, execSync, spawn, execFile as execFile$1, execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, realpathSync, readdirSync, statSync, renameSync, appendFileSync, unlinkSync } from 'node:fs';
+import { exec, spawn, execSync, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import os, { homedir, platform } from 'node:os';
 import { join, extname, resolve, sep, basename, dirname } from 'node:path';
@@ -1472,9 +1472,13 @@ var codexProvider = /*#__PURE__*/Object.freeze({
 });
 
 const METHODS_BY_VENDOR = {
-  anthropic: ["anthropic-api-key", "claude-oauth-token", "hypha-proxy", "anthropic-gateway"],
-  openai: ["openai-api-key", "chatgpt-oauth", "openai-gateway"]
+  anthropic: ["anthropic-oauth", "anthropic-api-key", "claude-oauth-token", "hypha-proxy", "anthropic-gateway"],
+  openai: ["chatgpt-oauth", "openai-api-key", "openai-gateway"]
 };
+const OAUTH_METHODS = ["anthropic-oauth", "chatgpt-oauth"];
+function isOAuthMethod(method) {
+  return OAUTH_METHODS.includes(method);
+}
 function accountsFilePath(svampHome) {
   const home = svampHome || process.env.SVAMP_HOME || join(homedir(), ".svamp");
   return join(home, "accounts.json");
@@ -1511,8 +1515,13 @@ function previewSecret(secret) {
   return `${secret.slice(0, 4)}\u2026${secret.slice(-4)}`;
 }
 function redactAccount(a) {
-  const { secret, ...rest } = a;
-  return { ...rest, secretPreview: previewSecret(secret) };
+  const { secret, accessToken, refreshToken, ...rest } = a;
+  const oauthConnected = isOAuthMethod(a.method) ? a.method === "anthropic-oauth" ? !!accessToken : true : void 0;
+  return {
+    ...rest,
+    secretPreview: previewSecret(secret) ?? (accessToken ? previewSecret(accessToken) : void 0),
+    oauthConnected
+  };
 }
 function redactAccounts(accounts) {
   return accounts.map(redactAccount);
@@ -1536,7 +1545,7 @@ function validateAccountInput(input) {
   if (!input.label || !input.label.trim()) {
     throw new Error("Account label is required");
   }
-  const needsSecret = method !== "hypha-proxy";
+  const needsSecret = method !== "hypha-proxy" && !isOAuthMethod(method);
   if (needsSecret && !input.secret && !input.id) {
     throw new Error(`A credential is required for method "${method}"`);
   }
@@ -1557,6 +1566,10 @@ function upsertAccount(input, svampHome) {
     method,
     // Keep the old secret if the update left it blank (edit label/model without re-entry).
     secret: input.secret && input.secret.length > 0 ? input.secret : existing?.secret,
+    // OAuth token bundle (anthropic-oauth) — carried through on refresh/update; kept if unset.
+    accessToken: input.accessToken ?? existing?.accessToken,
+    refreshToken: input.refreshToken ?? existing?.refreshToken,
+    expiresAt: input.expiresAt ?? existing?.expiresAt,
     baseUrl: input.baseUrl?.trim() || void 0,
     model: input.model?.trim() || void 0,
     isDefault: input.isDefault ?? existing?.isDefault ?? false,
@@ -1656,6 +1669,16 @@ function resolveAccountEnv(account, env = process.env, svampHome) {
         },
         describe: `claude subscription token (${account.label})`
       };
+    case "anthropic-oauth":
+      return {
+        vendor: "anthropic",
+        claudeEnv: {
+          CLAUDE_CODE_OAUTH_TOKEN: account.accessToken,
+          ANTHROPIC_BASE_URL: void 0,
+          ANTHROPIC_API_KEY: void 0
+        },
+        describe: `claude subscription oauth (${account.label})`
+      };
     case "openai-api-key":
       return {
         vendor: "openai",
@@ -1690,13 +1713,6 @@ function resolveAccountEnv(account, env = process.env, svampHome) {
 function ensureCodexHome(account, svampHome) {
   const dir = accountCodexHomeDir(account.id, svampHome);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  const authPath = join(dir, "auth.json");
-  const body = JSON.stringify({ OPENAI_API_KEY: null, tokens: { access_token: account.secret || "" } }, null, 2);
-  writeFileSync(authPath, body + "\n", { encoding: "utf-8", mode: 384 });
-  try {
-    chmodSync(authPath, 384);
-  } catch {
-  }
   return dir;
 }
 async function probeAccount(account, env = process.env) {
@@ -1747,10 +1763,27 @@ async function probeAccount(account, env = process.env) {
         if (res.ok || res.status === 400 || res.status === 429) return { ok: true, detail: `Reachable (HTTP ${res.status})` };
         return { ok: true, detail: `Reachable, unexpected HTTP ${res.status}` };
       }
+      case "anthropic-oauth": {
+        const tok = account.accessToken;
+        if (!tok) return { ok: false, detail: "Not signed in \u2014 start the OAuth flow" };
+        const res = await withTimeout("https://api.anthropic.com/v1/messages", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "authorization": `Bearer ${tok}`,
+            "anthropic-version": "2023-06-01",
+            "anthropic-beta": "oauth-2025-04-20"
+          },
+          body: JSON.stringify({ model: "claude-3-5-haiku-20241022", max_tokens: 1, messages: [{ role: "user", content: "hi" }] })
+        });
+        if (res.status === 401 || res.status === 403) return { ok: false, detail: `Sign-in expired or rejected (HTTP ${res.status}) \u2014 reconnect` };
+        if (res.ok || res.status === 400 || res.status === 429) return { ok: true, detail: `Connected (HTTP ${res.status})` };
+        return { ok: true, detail: `Connected, unexpected HTTP ${res.status}` };
+      }
       case "claude-oauth-token":
         return { ok: !!account.secret, detail: account.secret ? "Token stored \u2014 verified when a session starts (Claude CLI uses CLAUDE_CODE_OAUTH_TOKEN)" : "No token stored" };
       case "chatgpt-oauth":
-        return { ok: !!account.secret, detail: account.secret ? "Token stored \u2014 verified when a Codex session starts (per-account CODEX_HOME)" : "No token stored" };
+        return { ok: !!account.model || true, detail: "ChatGPT signed in via device auth \u2014 verified when a Codex session starts (per-account CODEX_HOME)" };
       default:
         return { ok: false, detail: "Unknown method" };
     }
@@ -1758,6 +1791,242 @@ async function probeAccount(account, env = process.env) {
     return { ok: false, detail: `Unreachable: ${e?.message || e}` };
   }
 }
+async function refreshDueAnthropicAccounts(refresh, log, svampHome, skewMs = 10 * 60 * 1e3) {
+  const due = loadAccounts(svampHome).filter((a) => a.method === "anthropic-oauth" && a.refreshToken && Date.now() >= (a.expiresAt ?? 0) - skewMs);
+  for (const a of due) {
+    try {
+      const t = await refresh(a.refreshToken);
+      upsertAccount({
+        id: a.id,
+        label: a.label,
+        vendor: a.vendor,
+        method: a.method,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken,
+        expiresAt: t.expiresAt
+      }, svampHome);
+      log(`[oauth] refreshed anthropic-oauth account ${a.label}`);
+    } catch (e) {
+      log(`[oauth] refresh failed for account ${a.label}: ${e?.message || e}`);
+    }
+  }
+}
+
+const ANTHROPIC_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const ANTHROPIC_AUTH_ENDPOINT = "https://claude.ai/oauth/authorize";
+const ANTHROPIC_TOKEN_ENDPOINT = "https://platform.claude.com/v1/oauth/token";
+const ANTHROPIC_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+const ANTHROPIC_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+function generatePkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function buildAnthropicAuthUrl(challenge, state) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: ANTHROPIC_CLIENT_ID,
+    redirect_uri: ANTHROPIC_REDIRECT_URI,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state,
+    scope: ANTHROPIC_SCOPES,
+    oauth_beta: "oauth-2025-04-20"
+  });
+  return `${ANTHROPIC_AUTH_ENDPOINT}?${params.toString()}`;
+}
+function extractAuthCode(raw) {
+  let s = (raw || "").trim();
+  if (s.startsWith("http")) {
+    try {
+      const u = new URL(s);
+      const c = u.searchParams.get("code");
+      if (c) return c;
+    } catch {
+    }
+  }
+  if (s.includes("#")) s = s.split("#")[0];
+  return s.trim();
+}
+function tokensFromResponse(j) {
+  const expiresInSec = typeof j.expires_in === "number" ? j.expires_in : 3600;
+  return {
+    accessToken: j.access_token || "",
+    refreshToken: j.refresh_token || "",
+    expiresAt: Date.now() + expiresInSec * 1e3
+  };
+}
+async function exchangeAnthropicCode(code, verifier, state) {
+  const res = await fetch(ANTHROPIC_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: extractAuthCode(code),
+      redirect_uri: ANTHROPIC_REDIRECT_URI,
+      client_id: ANTHROPIC_CLIENT_ID,
+      code_verifier: verifier,
+      state
+      // Anthropic requires state echoed in the body
+    })
+  });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    throw new Error(`Token exchange failed (${res.status}): ${t.slice(0, 300)}`);
+  }
+  return tokensFromResponse(await res.json());
+}
+async function refreshAnthropicToken(refreshToken) {
+  const res = await fetch(ANTHROPIC_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: ANTHROPIC_CLIENT_ID
+    })
+  });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    throw new Error(`Token refresh failed (${res.status}): ${t.slice(0, 300)}`);
+  }
+  const tokens = tokensFromResponse(await res.json());
+  if (!tokens.refreshToken) tokens.refreshToken = refreshToken;
+  return tokens;
+}
+function parseDeviceAuthOutput(text) {
+  const out = {};
+  const urlMatch = text.match(/https?:\/\/[^\s"'<>)]+/i);
+  if (urlMatch) out.verificationUrl = urlMatch[0].replace(/[.,]$/, "");
+  const codeMatch = text.match(/\b([A-Z0-9]{3,5}(?:-[A-Z0-9]{3,5})+)\b/);
+  if (codeMatch) out.userCode = codeMatch[1];
+  return out;
+}
+const flows = /* @__PURE__ */ new Map();
+const FLOW_TTL_MS = 15 * 60 * 1e3;
+function oauthFlowDir(flowId, svampHome) {
+  const home = svampHome || process.env.SVAMP_HOME || join(homedir(), ".svamp");
+  return join(home, "oauth-flows", flowId);
+}
+function pruneFlows() {
+  const now = Date.now();
+  for (const [id, f] of flows) {
+    if (now - f.createdAt > FLOW_TTL_MS) {
+      try {
+        f.proc?.kill();
+      } catch {
+      }
+      try {
+        if (f.codexHome) rmSync(join(f.codexHome, ".."), { recursive: true, force: true });
+      } catch {
+      }
+      flows.delete(id);
+    }
+  }
+}
+function startAnthropicFlow(label) {
+  pruneFlows();
+  const { verifier, challenge } = generatePkce();
+  const state = randomBytes(32).toString("base64url");
+  const flowId = randomUUID();
+  const authorizeUrl = buildAnthropicAuthUrl(challenge, state);
+  flows.set(flowId, { id: flowId, vendor: "anthropic", label, createdAt: Date.now(), status: "pending", state, verifier });
+  return { flowId, authorizeUrl };
+}
+function startOpenAiDeviceFlow(label, log, svampHome) {
+  pruneFlows();
+  const flowId = randomUUID();
+  const codexHome = join(oauthFlowDir(flowId, svampHome), "codex");
+  mkdirSync(codexHome, { recursive: true });
+  const flow = { id: flowId, vendor: "openai", label, createdAt: Date.now(), status: "pending", codexHome, outputBuffer: "" };
+  flows.set(flowId, flow);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const proc = spawn("codex", ["login", "--device-auth"], {
+      env: { ...process.env, CODEX_HOME: codexHome },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    flow.proc = proc;
+    const onData = (buf) => {
+      const text = buf.toString();
+      flow.outputBuffer = (flow.outputBuffer || "") + text;
+      const parsed = parseDeviceAuthOutput(flow.outputBuffer);
+      if (parsed.verificationUrl) flow.verificationUrl = parsed.verificationUrl;
+      if (parsed.userCode) flow.userCode = parsed.userCode;
+      if (!settled && flow.verificationUrl && flow.userCode) {
+        settled = true;
+        resolve({ flowId, verificationUrl: flow.verificationUrl, userCode: flow.userCode });
+      }
+    };
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    proc.on("exit", (code) => {
+      if (code === 0 && flow.codexHome && existsSync(join(flow.codexHome, "auth.json"))) {
+        flow.status = "authorized";
+      } else {
+        flow.status = "error";
+        flow.error = flow.error || `codex login exited ${code}` + (/(device code|workspace admin|not.*enabled)/i.test(flow.outputBuffer || "") ? " \u2014 device-code login may be disabled for this ChatGPT workspace (ask an admin to enable it)." : "");
+        if (!settled) {
+          settled = true;
+          reject(new Error(flow.error));
+        }
+      }
+    });
+    proc.on("error", (err) => {
+      flow.status = "error";
+      flow.error = `Failed to run codex login: ${err.message}. Is the Codex CLI installed on this machine?`;
+      if (!settled) {
+        settled = true;
+        reject(new Error(flow.error));
+      }
+    });
+    setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        reject(new Error("Timed out waiting for the device code from codex login."));
+      }
+    }, 3e4);
+    log(`[oauth] started codex device-auth flow ${flowId}`);
+  });
+}
+function getFlow(flowId) {
+  return flows.get(flowId);
+}
+async function completeAnthropicFlow(flowId, code) {
+  const flow = flows.get(flowId);
+  if (!flow || flow.vendor !== "anthropic" || !flow.verifier || !flow.state) {
+    throw new Error("Invalid or expired OAuth flow");
+  }
+  const tokens = await exchangeAnthropicCode(code, flow.verifier, flow.state);
+  flows.delete(flowId);
+  return tokens;
+}
+function finalizeOpenAiFlow(flowId, accountCodexHome) {
+  const flow = flows.get(flowId);
+  if (!flow || flow.vendor !== "openai") throw new Error("Invalid or expired OAuth flow");
+  if (flow.status !== "authorized" || !flow.codexHome) throw new Error("Device authorization not complete yet");
+  mkdirSync(accountCodexHome, { recursive: true });
+  cpSync(flow.codexHome, accountCodexHome, { recursive: true });
+  try {
+    rmSync(join(flow.codexHome, ".."), { recursive: true, force: true });
+  } catch {
+  }
+  flows.delete(flowId);
+}
+function cancelFlow(flowId) {
+  const flow = flows.get(flowId);
+  if (!flow) return;
+  flow.status = "cancelled";
+  try {
+    flow.proc?.kill();
+  } catch {
+  }
+  try {
+    if (flow.codexHome) rmSync(join(flow.codexHome, ".."), { recursive: true, force: true });
+  } catch {
+  }
+  flows.delete(flowId);
+}
 
 const FIELD_RANGES = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 6]];
 function parseField(token, [min, max]) {
@@ -3178,6 +3447,73 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!acct) return { ok: false, detail: "Account not found" };
         return await probeAccount(acct);
       },
+      // ── Guided OAuth login (both vendors; admin-gated) ──
+      // Anthropic: PKCE authorize URL → user pastes the shown code back.
+      // OpenAI: device-auth → we show a verification URL + user code, then poll to completion.
+      startBackendOAuth: async (vendor, label, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const lbl = (label || "").trim() || (vendor === "anthropic" ? "Claude subscription" : "ChatGPT subscription");
+        if (vendor === "anthropic") {
+          const { flowId, authorizeUrl } = startAnthropicFlow(lbl);
+          return { vendor, flowId, mode: "paste-code", authorizeUrl };
+        }
+        if (vendor === "openai") {
+          const { flowId, verificationUrl, userCode } = await startOpenAiDeviceFlow(
+            lbl,
+            (m) => console.log(m),
+            metadata.svampHomeDir
+          );
+          return { vendor, flowId, mode: "device-code", verificationUrl, userCode };
+        }
+        throw new Error(`Unsupported OAuth vendor: ${String(vendor)}`);
+      },
+      completeBackendOAuth: async (flowId, code, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const flow = getFlow(flowId);
+        if (!flow) throw new Error("OAuth flow expired \u2014 start again");
+        const createdBy = context?.user?.email;
+        if (flow.vendor === "anthropic") {
+          if (!code || !code.trim()) throw new Error("Paste the authorization code");
+          const tokens = await completeAnthropicFlow(flowId, code);
+          const account = upsertAccount({
+            label: flow.label,
+            vendor: "anthropic",
+            method: "anthropic-oauth",
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt: tokens.expiresAt,
+            createdBy
+          }, metadata.svampHomeDir);
+          notifyListeners({ type: "update-machine", machineId, backendAccountsChanged: true });
+          return { done: true, account: redactAccount(account) };
+        }
+        if (flow.status === "pending") {
+          return { done: false, status: "pending", verificationUrl: flow.verificationUrl, userCode: flow.userCode };
+        }
+        if (flow.status === "error") throw new Error(flow.error || "Device authorization failed");
+        if (flow.status === "authorized") {
+          const account = upsertAccount({
+            label: flow.label,
+            vendor: "openai",
+            method: "chatgpt-oauth",
+            createdBy
+          }, metadata.svampHomeDir);
+          try {
+            finalizeOpenAiFlow(flowId, accountCodexHomeDir(account.id, metadata.svampHomeDir));
+          } catch (e) {
+            deleteAccount(account.id, metadata.svampHomeDir);
+            throw e;
+          }
+          notifyListeners({ type: "update-machine", machineId, backendAccountsChanged: true });
+          return { done: true, account: redactAccount(account) };
+        }
+        throw new Error("Device authorization was cancelled");
+      },
+      cancelBackendOAuth: async (flowId, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        cancelFlow(flowId);
+        return { success: true };
+      },
       // Register a listener for real-time updates (app calls this with _rintf callback)
       registerListener: async (callback, context) => {
         trackInbound();
@@ -3619,7 +3955,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+        const { FrpcTunnel } = await import('./frpc-CxqX4sQ7.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -4086,7 +4422,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-DywLL2xs.mjs');
+          const { toolsForRole } = await import('./sideband-CWu6yjFl.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -4185,7 +4521,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-C_74tXoO.mjs');
+    const { queryCore } = await import('./commands-BX6_mFbE.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -14265,7 +14601,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CKd1jXfX.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-aCeb0xu5.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -14283,7 +14619,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+    const { FrpcTunnel } = await import('./frpc-CxqX4sQ7.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -14304,7 +14640,7 @@ async function startDaemon(options) {
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
   const tunnelRecreateInFlight = /* @__PURE__ */ new Set();
-  const { ServeManager } = await import('./serveManager-Dy1ZZNaY.mjs');
+  const { ServeManager } = await import('./serveManager-Bk6Fkoha.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
@@ -16451,11 +16787,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-BnHMvDxQ.mjs');
+              const { issueRpc } = await import('./rpc-BB9tE2dR.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DwlZTOtK.mjs');
+              const { workflowRpc } = await import('./rpc-BXmmzMmw.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -17015,11 +17351,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-BnHMvDxQ.mjs');
+              const { issueRpc } = await import('./rpc-BB9tE2dR.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DwlZTOtK.mjs');
+              const { workflowRpc } = await import('./rpc-BXmmzMmw.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -18055,7 +18391,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-BxijQDI8.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-Xhs6PCCU.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();
@@ -18073,6 +18409,18 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         logger.log(`[workflow] scheduler tick error: ${e?.message || e}`);
       }
     }, 2e4);
+    const runOAuthAccountRefresh = () => {
+      refreshDueAnthropicAccounts(
+        async (rt) => {
+          const t = await refreshAnthropicToken(rt);
+          return t;
+        },
+        (m) => logger.log(m),
+        SVAMP_HOME
+      ).catch((e) => logger.log(`[oauth] account refresh error: ${e?.message || e}`));
+    };
+    runOAuthAccountRefresh();
+    const backendAccountRefreshInterval = setInterval(runOAuthAccountRefresh, 5 * 6e4);
     let heartbeatRunning = false;
     let lastReconnectAt = 0;
     let heartbeatCycle = 0;

package/dist/{scheduler-BxijQDI8.mjs → scheduler-Xhs6PCCU.mjs}

@@ -1,4 +1,4 @@
-import { l as resolveProjectRoot, F as listWorkflows, G as isWorkflowEnabled, H as workflowCrons, A as runWorkflow, I as cronMatches } from './run-b-b_szy6.mjs';
+import { l as resolveProjectRoot, F as listWorkflows, G as isWorkflowEnabled, H as workflowCrons, A as runWorkflow, I as cronMatches } from './run-CetRvMab.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-CL6B6kEf.mjs → serveCommands-DGOH5VP9.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BX6_mFbE.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BX6_mFbE.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BX6_mFbE.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BX6_mFbE.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BX6_mFbE.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-Dy1ZZNaY.mjs → serveManager-Bk6Fkoha.mjs}

@@ -5,7 +5,7 @@ import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
 import { serveStaticMount } from './staticFileServer-CbYnj2bH.mjs';
-import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-b-b_szy6.mjs';
+import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-CetRvMab.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -854,7 +854,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+      const { FrpcTunnel } = await import('./frpc-CxqX4sQ7.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-DywLL2xs.mjs → sideband-CWu6yjFl.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, L as loadMachineContext, M as buildMachineInstructions, N as machineToolsForRole, O as buildMachineTools } from './run-b-b_szy6.mjs';
+import { R as READ_ONLY_TOOLS, L as loadMachineContext, M as buildMachineInstructions, N as machineToolsForRole, O as buildMachineTools } from './run-CetRvMab.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.265",
+  "version": "0.2.266",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-backend-oauth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",