svamp-cli 0.2.265 → 0.2.267

package/dist/{run-b-b_szy6.mjs → run-Dn6ZqBs9.mjs}

@@ -6,8 +6,8 @@ import { fileURLToPath } from 'url';
 import { execFile, spawn as spawn$1, execSync as execSync$1, exec as exec$1 } from 'child_process';
 import { randomUUID as randomUUID$1 } from 'crypto';
 import { randomUUID, randomBytes, createHash } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, realpathSync, readdirSync, statSync, renameSync, rmSync, appendFileSync, unlinkSync } from 'node:fs';
-import { exec, execSync, spawn, execFile as execFile$1, execFileSync } from 'node:child_process';
+import { existsSync, readFileSync, mkdirSync, writeFileSync, chmodSync, rmSync, cpSync, realpathSync, readdirSync, statSync, renameSync, appendFileSync, unlinkSync } from 'node:fs';
+import { exec, spawn, execSync, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import os, { homedir, platform } from 'node:os';
 import { join, extname, resolve, sep, basename, dirname } from 'node:path';
@@ -1472,9 +1472,13 @@ var codexProvider = /*#__PURE__*/Object.freeze({
 });
 
 const METHODS_BY_VENDOR = {
-  anthropic: ["anthropic-api-key", "claude-oauth-token", "hypha-proxy", "anthropic-gateway"],
-  openai: ["openai-api-key", "chatgpt-oauth", "openai-gateway"]
+  anthropic: ["anthropic-oauth", "anthropic-api-key", "claude-oauth-token", "hypha-proxy", "anthropic-gateway"],
+  openai: ["chatgpt-oauth", "openai-api-key", "openai-gateway"]
 };
+const OAUTH_METHODS = ["anthropic-oauth", "chatgpt-oauth"];
+function isOAuthMethod(method) {
+  return OAUTH_METHODS.includes(method);
+}
 function accountsFilePath(svampHome) {
   const home = svampHome || process.env.SVAMP_HOME || join(homedir(), ".svamp");
   return join(home, "accounts.json");
@@ -1511,8 +1515,13 @@ function previewSecret(secret) {
   return `${secret.slice(0, 4)}\u2026${secret.slice(-4)}`;
 }
 function redactAccount(a) {
-  const { secret, ...rest } = a;
-  return { ...rest, secretPreview: previewSecret(secret) };
+  const { secret, accessToken, refreshToken, ...rest } = a;
+  const oauthConnected = isOAuthMethod(a.method) ? a.method === "anthropic-oauth" ? !!accessToken : true : void 0;
+  return {
+    ...rest,
+    secretPreview: previewSecret(secret) ?? (accessToken ? previewSecret(accessToken) : void 0),
+    oauthConnected
+  };
 }
 function redactAccounts(accounts) {
   return accounts.map(redactAccount);
@@ -1536,7 +1545,7 @@ function validateAccountInput(input) {
   if (!input.label || !input.label.trim()) {
     throw new Error("Account label is required");
   }
-  const needsSecret = method !== "hypha-proxy";
+  const needsSecret = method !== "hypha-proxy" && !isOAuthMethod(method);
   if (needsSecret && !input.secret && !input.id) {
     throw new Error(`A credential is required for method "${method}"`);
   }
@@ -1557,6 +1566,10 @@ function upsertAccount(input, svampHome) {
     method,
     // Keep the old secret if the update left it blank (edit label/model without re-entry).
     secret: input.secret && input.secret.length > 0 ? input.secret : existing?.secret,
+    // OAuth token bundle (anthropic-oauth) — carried through on refresh/update; kept if unset.
+    accessToken: input.accessToken ?? existing?.accessToken,
+    refreshToken: input.refreshToken ?? existing?.refreshToken,
+    expiresAt: input.expiresAt ?? existing?.expiresAt,
     baseUrl: input.baseUrl?.trim() || void 0,
     model: input.model?.trim() || void 0,
     isDefault: input.isDefault ?? existing?.isDefault ?? false,
@@ -1656,6 +1669,16 @@ function resolveAccountEnv(account, env = process.env, svampHome) {
         },
         describe: `claude subscription token (${account.label})`
       };
+    case "anthropic-oauth":
+      return {
+        vendor: "anthropic",
+        claudeEnv: {
+          CLAUDE_CODE_OAUTH_TOKEN: account.accessToken,
+          ANTHROPIC_BASE_URL: void 0,
+          ANTHROPIC_API_KEY: void 0
+        },
+        describe: `claude subscription oauth (${account.label})`
+      };
     case "openai-api-key":
       return {
         vendor: "openai",
@@ -1690,13 +1713,6 @@ function resolveAccountEnv(account, env = process.env, svampHome) {
 function ensureCodexHome(account, svampHome) {
   const dir = accountCodexHomeDir(account.id, svampHome);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-  const authPath = join(dir, "auth.json");
-  const body = JSON.stringify({ OPENAI_API_KEY: null, tokens: { access_token: account.secret || "" } }, null, 2);
-  writeFileSync(authPath, body + "\n", { encoding: "utf-8", mode: 384 });
-  try {
-    chmodSync(authPath, 384);
-  } catch {
-  }
   return dir;
 }
 async function probeAccount(account, env = process.env) {
@@ -1747,10 +1763,27 @@ async function probeAccount(account, env = process.env) {
         if (res.ok || res.status === 400 || res.status === 429) return { ok: true, detail: `Reachable (HTTP ${res.status})` };
         return { ok: true, detail: `Reachable, unexpected HTTP ${res.status}` };
       }
+      case "anthropic-oauth": {
+        const tok = account.accessToken;
+        if (!tok) return { ok: false, detail: "Not signed in \u2014 start the OAuth flow" };
+        const res = await withTimeout("https://api.anthropic.com/v1/messages", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            "authorization": `Bearer ${tok}`,
+            "anthropic-version": "2023-06-01",
+            "anthropic-beta": "oauth-2025-04-20"
+          },
+          body: JSON.stringify({ model: "claude-3-5-haiku-20241022", max_tokens: 1, messages: [{ role: "user", content: "hi" }] })
+        });
+        if (res.status === 401 || res.status === 403) return { ok: false, detail: `Sign-in expired or rejected (HTTP ${res.status}) \u2014 reconnect` };
+        if (res.ok || res.status === 400 || res.status === 429) return { ok: true, detail: `Connected (HTTP ${res.status})` };
+        return { ok: true, detail: `Connected, unexpected HTTP ${res.status}` };
+      }
       case "claude-oauth-token":
         return { ok: !!account.secret, detail: account.secret ? "Token stored \u2014 verified when a session starts (Claude CLI uses CLAUDE_CODE_OAUTH_TOKEN)" : "No token stored" };
       case "chatgpt-oauth":
-        return { ok: !!account.secret, detail: account.secret ? "Token stored \u2014 verified when a Codex session starts (per-account CODEX_HOME)" : "No token stored" };
+        return { ok: !!account.model || true, detail: "ChatGPT signed in via device auth \u2014 verified when a Codex session starts (per-account CODEX_HOME)" };
       default:
         return { ok: false, detail: "Unknown method" };
     }
@@ -1758,6 +1791,242 @@ async function probeAccount(account, env = process.env) {
     return { ok: false, detail: `Unreachable: ${e?.message || e}` };
   }
 }
+async function refreshDueAnthropicAccounts(refresh, log, svampHome, skewMs = 10 * 60 * 1e3) {
+  const due = loadAccounts(svampHome).filter((a) => a.method === "anthropic-oauth" && a.refreshToken && Date.now() >= (a.expiresAt ?? 0) - skewMs);
+  for (const a of due) {
+    try {
+      const t = await refresh(a.refreshToken);
+      upsertAccount({
+        id: a.id,
+        label: a.label,
+        vendor: a.vendor,
+        method: a.method,
+        accessToken: t.accessToken,
+        refreshToken: t.refreshToken,
+        expiresAt: t.expiresAt
+      }, svampHome);
+      log(`[oauth] refreshed anthropic-oauth account ${a.label}`);
+    } catch (e) {
+      log(`[oauth] refresh failed for account ${a.label}: ${e?.message || e}`);
+    }
+  }
+}
+
+const ANTHROPIC_CLIENT_ID = "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+const ANTHROPIC_AUTH_ENDPOINT = "https://claude.ai/oauth/authorize";
+const ANTHROPIC_TOKEN_ENDPOINT = "https://platform.claude.com/v1/oauth/token";
+const ANTHROPIC_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callback";
+const ANTHROPIC_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
+function generatePkce() {
+  const verifier = randomBytes(32).toString("base64url");
+  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  return { verifier, challenge };
+}
+function buildAnthropicAuthUrl(challenge, state) {
+  const params = new URLSearchParams({
+    response_type: "code",
+    client_id: ANTHROPIC_CLIENT_ID,
+    redirect_uri: ANTHROPIC_REDIRECT_URI,
+    code_challenge: challenge,
+    code_challenge_method: "S256",
+    state,
+    scope: ANTHROPIC_SCOPES,
+    oauth_beta: "oauth-2025-04-20"
+  });
+  return `${ANTHROPIC_AUTH_ENDPOINT}?${params.toString()}`;
+}
+function extractAuthCode(raw) {
+  let s = (raw || "").trim();
+  if (s.startsWith("http")) {
+    try {
+      const u = new URL(s);
+      const c = u.searchParams.get("code");
+      if (c) return c;
+    } catch {
+    }
+  }
+  if (s.includes("#")) s = s.split("#")[0];
+  return s.trim();
+}
+function tokensFromResponse(j) {
+  const expiresInSec = typeof j.expires_in === "number" ? j.expires_in : 3600;
+  return {
+    accessToken: j.access_token || "",
+    refreshToken: j.refresh_token || "",
+    expiresAt: Date.now() + expiresInSec * 1e3
+  };
+}
+async function exchangeAnthropicCode(code, verifier, state) {
+  const res = await fetch(ANTHROPIC_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: extractAuthCode(code),
+      redirect_uri: ANTHROPIC_REDIRECT_URI,
+      client_id: ANTHROPIC_CLIENT_ID,
+      code_verifier: verifier,
+      state
+      // Anthropic requires state echoed in the body
+    })
+  });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    throw new Error(`Token exchange failed (${res.status}): ${t.slice(0, 300)}`);
+  }
+  return tokensFromResponse(await res.json());
+}
+async function refreshAnthropicToken(refreshToken) {
+  const res = await fetch(ANTHROPIC_TOKEN_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: ANTHROPIC_CLIENT_ID
+    })
+  });
+  if (!res.ok) {
+    const t = await res.text().catch(() => "");
+    throw new Error(`Token refresh failed (${res.status}): ${t.slice(0, 300)}`);
+  }
+  const tokens = tokensFromResponse(await res.json());
+  if (!tokens.refreshToken) tokens.refreshToken = refreshToken;
+  return tokens;
+}
+function parseDeviceAuthOutput(text) {
+  const out = {};
+  const urlMatch = text.match(/https?:\/\/[^\s"'<>)]+/i);
+  if (urlMatch) out.verificationUrl = urlMatch[0].replace(/[.,]$/, "");
+  const codeMatch = text.match(/\b([A-Z0-9]{3,5}(?:-[A-Z0-9]{3,5})+)\b/);
+  if (codeMatch) out.userCode = codeMatch[1];
+  return out;
+}
+const flows = /* @__PURE__ */ new Map();
+const FLOW_TTL_MS = 15 * 60 * 1e3;
+function oauthFlowDir(flowId, svampHome) {
+  const home = svampHome || process.env.SVAMP_HOME || join(homedir(), ".svamp");
+  return join(home, "oauth-flows", flowId);
+}
+function pruneFlows() {
+  const now = Date.now();
+  for (const [id, f] of flows) {
+    if (now - f.createdAt > FLOW_TTL_MS) {
+      try {
+        f.proc?.kill();
+      } catch {
+      }
+      try {
+        if (f.codexHome) rmSync(join(f.codexHome, ".."), { recursive: true, force: true });
+      } catch {
+      }
+      flows.delete(id);
+    }
+  }
+}
+function startAnthropicFlow(label) {
+  pruneFlows();
+  const { verifier, challenge } = generatePkce();
+  const state = randomBytes(32).toString("base64url");
+  const flowId = randomUUID();
+  const authorizeUrl = buildAnthropicAuthUrl(challenge, state);
+  flows.set(flowId, { id: flowId, vendor: "anthropic", label, createdAt: Date.now(), status: "pending", state, verifier });
+  return { flowId, authorizeUrl };
+}
+function startOpenAiDeviceFlow(label, log, svampHome) {
+  pruneFlows();
+  const flowId = randomUUID();
+  const codexHome = join(oauthFlowDir(flowId, svampHome), "codex");
+  mkdirSync(codexHome, { recursive: true });
+  const flow = { id: flowId, vendor: "openai", label, createdAt: Date.now(), status: "pending", codexHome, outputBuffer: "" };
+  flows.set(flowId, flow);
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const proc = spawn("codex", ["login", "--device-auth"], {
+      env: { ...process.env, CODEX_HOME: codexHome },
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    flow.proc = proc;
+    const onData = (buf) => {
+      const text = buf.toString();
+      flow.outputBuffer = (flow.outputBuffer || "") + text;
+      const parsed = parseDeviceAuthOutput(flow.outputBuffer);
+      if (parsed.verificationUrl) flow.verificationUrl = parsed.verificationUrl;
+      if (parsed.userCode) flow.userCode = parsed.userCode;
+      if (!settled && flow.verificationUrl && flow.userCode) {
+        settled = true;
+        resolve({ flowId, verificationUrl: flow.verificationUrl, userCode: flow.userCode });
+      }
+    };
+    proc.stdout?.on("data", onData);
+    proc.stderr?.on("data", onData);
+    proc.on("exit", (code) => {
+      if (code === 0 && flow.codexHome && existsSync(join(flow.codexHome, "auth.json"))) {
+        flow.status = "authorized";
+      } else {
+        flow.status = "error";
+        flow.error = flow.error || `codex login exited ${code}` + (/(device code|workspace admin|not.*enabled)/i.test(flow.outputBuffer || "") ? " \u2014 device-code login may be disabled for this ChatGPT workspace (ask an admin to enable it)." : "");
+        if (!settled) {
+          settled = true;
+          reject(new Error(flow.error));
+        }
+      }
+    });
+    proc.on("error", (err) => {
+      flow.status = "error";
+      flow.error = `Failed to run codex login: ${err.message}. Is the Codex CLI installed on this machine?`;
+      if (!settled) {
+        settled = true;
+        reject(new Error(flow.error));
+      }
+    });
+    setTimeout(() => {
+      if (!settled) {
+        settled = true;
+        reject(new Error("Timed out waiting for the device code from codex login."));
+      }
+    }, 3e4);
+    log(`[oauth] started codex device-auth flow ${flowId}`);
+  });
+}
+function getFlow(flowId) {
+  return flows.get(flowId);
+}
+async function completeAnthropicFlow(flowId, code) {
+  const flow = flows.get(flowId);
+  if (!flow || flow.vendor !== "anthropic" || !flow.verifier || !flow.state) {
+    throw new Error("Invalid or expired OAuth flow");
+  }
+  const tokens = await exchangeAnthropicCode(code, flow.verifier, flow.state);
+  flows.delete(flowId);
+  return tokens;
+}
+function finalizeOpenAiFlow(flowId, accountCodexHome) {
+  const flow = flows.get(flowId);
+  if (!flow || flow.vendor !== "openai") throw new Error("Invalid or expired OAuth flow");
+  if (flow.status !== "authorized" || !flow.codexHome) throw new Error("Device authorization not complete yet");
+  mkdirSync(accountCodexHome, { recursive: true });
+  cpSync(flow.codexHome, accountCodexHome, { recursive: true });
+  try {
+    rmSync(join(flow.codexHome, ".."), { recursive: true, force: true });
+  } catch {
+  }
+  flows.delete(flowId);
+}
+function cancelFlow(flowId) {
+  const flow = flows.get(flowId);
+  if (!flow) return;
+  flow.status = "cancelled";
+  try {
+    flow.proc?.kill();
+  } catch {
+  }
+  try {
+    if (flow.codexHome) rmSync(join(flow.codexHome, ".."), { recursive: true, force: true });
+  } catch {
+  }
+  flows.delete(flowId);
+}
 
 const FIELD_RANGES = [[0, 59], [0, 23], [1, 31], [1, 12], [0, 6]];
 function parseField(token, [min, max]) {
@@ -3178,6 +3447,73 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!acct) return { ok: false, detail: "Account not found" };
         return await probeAccount(acct);
       },
+      // ── Guided OAuth login (both vendors; admin-gated) ──
+      // Anthropic: PKCE authorize URL → user pastes the shown code back.
+      // OpenAI: device-auth → we show a verification URL + user code, then poll to completion.
+      startBackendOAuth: async (vendor, label, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const lbl = (label || "").trim() || (vendor === "anthropic" ? "Claude subscription" : "ChatGPT subscription");
+        if (vendor === "anthropic") {
+          const { flowId, authorizeUrl } = startAnthropicFlow(lbl);
+          return { vendor, flowId, mode: "paste-code", authorizeUrl };
+        }
+        if (vendor === "openai") {
+          const { flowId, verificationUrl, userCode } = await startOpenAiDeviceFlow(
+            lbl,
+            (m) => console.log(m),
+            metadata.svampHomeDir
+          );
+          return { vendor, flowId, mode: "device-code", verificationUrl, userCode };
+        }
+        throw new Error(`Unsupported OAuth vendor: ${String(vendor)}`);
+      },
+      completeBackendOAuth: async (flowId, code, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        const flow = getFlow(flowId);
+        if (!flow) throw new Error("OAuth flow expired \u2014 start again");
+        const createdBy = context?.user?.email;
+        if (flow.vendor === "anthropic") {
+          if (!code || !code.trim()) throw new Error("Paste the authorization code");
+          const tokens = await completeAnthropicFlow(flowId, code);
+          const account = upsertAccount({
+            label: flow.label,
+            vendor: "anthropic",
+            method: "anthropic-oauth",
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            expiresAt: tokens.expiresAt,
+            createdBy
+          }, metadata.svampHomeDir);
+          notifyListeners({ type: "update-machine", machineId, backendAccountsChanged: true });
+          return { done: true, account: redactAccount(account) };
+        }
+        if (flow.status === "pending") {
+          return { done: false, status: "pending", verificationUrl: flow.verificationUrl, userCode: flow.userCode };
+        }
+        if (flow.status === "error") throw new Error(flow.error || "Device authorization failed");
+        if (flow.status === "authorized") {
+          const account = upsertAccount({
+            label: flow.label,
+            vendor: "openai",
+            method: "chatgpt-oauth",
+            createdBy
+          }, metadata.svampHomeDir);
+          try {
+            finalizeOpenAiFlow(flowId, accountCodexHomeDir(account.id, metadata.svampHomeDir));
+          } catch (e) {
+            deleteAccount(account.id, metadata.svampHomeDir);
+            throw e;
+          }
+          notifyListeners({ type: "update-machine", machineId, backendAccountsChanged: true });
+          return { done: true, account: redactAccount(account) };
+        }
+        throw new Error("Device authorization was cancelled");
+      },
+      cancelBackendOAuth: async (flowId, context) => {
+        authorizeRequest(context, currentMetadata.sharing, "admin");
+        cancelFlow(flowId);
+        return { success: true };
+      },
       // Register a listener for real-time updates (app calls this with _rintf callback)
       registerListener: async (callback, context) => {
         trackInbound();
@@ -3619,7 +3955,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+        const { FrpcTunnel } = await import('./frpc-Dch3Eq_f.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -4086,7 +4422,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-DywLL2xs.mjs');
+          const { toolsForRole } = await import('./sideband-DAbvCvgz.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -4185,7 +4521,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
     const callId = "call_" + Math.random().toString(16).slice(2, 12);
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-C_74tXoO.mjs');
+    const { queryCore } = await import('./commands-BpoCTRmH.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -14265,7 +14601,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CKd1jXfX.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-C-GPVVEh.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -14283,7 +14619,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+    const { FrpcTunnel } = await import('./frpc-Dch3Eq_f.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -14304,7 +14640,7 @@ async function startDaemon(options) {
   }
   const tunnelRecreateState = /* @__PURE__ */ new Map();
   const tunnelRecreateInFlight = /* @__PURE__ */ new Set();
-  const { ServeManager } = await import('./serveManager-Dy1ZZNaY.mjs');
+  const { ServeManager } = await import('./serveManager-DFt3WQpJ.mjs');
   const serveManager = new ServeManager(SVAMP_HOME, (msg) => logger.log(`[SERVE] ${msg}`), hyphaServerUrl);
   ensureAutoInstalledSkills(logger).catch(() => {
   });
@@ -16451,11 +16787,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-BnHMvDxQ.mjs');
+              const { issueRpc } = await import('./rpc-BctBAWZg.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DwlZTOtK.mjs');
+              const { workflowRpc } = await import('./rpc-iRm5bxwr.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -16755,6 +17091,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
         const allowedBashLiterals = /* @__PURE__ */ new Set();
         const allowedBashPrefixes = /* @__PURE__ */ new Set();
         const EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "MultiEdit", "Write", "NotebookEdit"]);
+        let appliedAgentModel;
         const { store: sessionService, rpcHandlers: sessionRPCHandlersAcp } = createSessionStore(
           server,
           sessionId,
@@ -16783,6 +17120,15 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               if (msgMeta?.permissionMode && msgMeta.permissionMode !== currentPermissionMode) {
                 logger.log(`[${agentName} Session ${sessionId}] Ignoring meta.permissionMode='${msgMeta.permissionMode}' from sendMessage (current: ${currentPermissionMode}; use switchMode to change)`);
               }
+              {
+                const rawModel = typeof msgMeta?.model === "string" && msgMeta.model ? msgMeta.model : void 0;
+                const desiredModel = rawModel || agentConfig?.default_model || void 0;
+                if (desiredModel !== appliedAgentModel) {
+                  agentBackend?.setModel?.(desiredModel);
+                  appliedAgentModel = desiredModel;
+                  logger.log(`[${agentName} Session ${sessionId}] Model \u2192 ${desiredModel ?? "backend default"}`);
+                }
+              }
               if (!acpBackendReady) {
                 logger.log(`[${agentName} Session ${sessionId}] Backend not ready \u2014 queuing message`);
                 const existingQueue = sessionMetadata.messageQueue || [];
@@ -17015,11 +17361,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-BnHMvDxQ.mjs');
+              const { issueRpc } = await import('./rpc-BctBAWZg.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DwlZTOtK.mjs');
+              const { workflowRpc } = await import('./rpc-iRm5bxwr.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -18055,7 +18401,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-BxijQDI8.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-D4CmcA1u.mjs');
     const workflowScheduler = new WorkflowScheduler({
       projectRoots: () => {
         const dirs = /* @__PURE__ */ new Set();
@@ -18073,6 +18419,18 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         logger.log(`[workflow] scheduler tick error: ${e?.message || e}`);
       }
     }, 2e4);
+    const runOAuthAccountRefresh = () => {
+      refreshDueAnthropicAccounts(
+        async (rt) => {
+          const t = await refreshAnthropicToken(rt);
+          return t;
+        },
+        (m) => logger.log(m),
+        SVAMP_HOME
+      ).catch((e) => logger.log(`[oauth] account refresh error: ${e?.message || e}`));
+    };
+    runOAuthAccountRefresh();
+    const backendAccountRefreshInterval = setInterval(runOAuthAccountRefresh, 5 * 6e4);
     let heartbeatRunning = false;
     let lastReconnectAt = 0;
     let heartbeatCycle = 0;

package/dist/{scheduler-BxijQDI8.mjs → scheduler-D4CmcA1u.mjs}

@@ -1,4 +1,4 @@
-import { l as resolveProjectRoot, F as listWorkflows, G as isWorkflowEnabled, H as workflowCrons, A as runWorkflow, I as cronMatches } from './run-b-b_szy6.mjs';
+import { l as resolveProjectRoot, F as listWorkflows, G as isWorkflowEnabled, H as workflowCrons, A as runWorkflow, I as cronMatches } from './run-Dn6ZqBs9.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-CL6B6kEf.mjs → serveCommands-D6NMXj6M.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BpoCTRmH.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BpoCTRmH.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BpoCTRmH.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BpoCTRmH.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-C_74tXoO.mjs');
+  const { connectAndGetMachine } = await import('./commands-BpoCTRmH.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{serveManager-Dy1ZZNaY.mjs → serveManager-DFt3WQpJ.mjs}

@@ -5,7 +5,7 @@ import * as http from 'http';
 import * as net from 'net';
 import * as path from 'path';
 import { serveStaticMount } from './staticFileServer-CbYnj2bH.mjs';
-import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-b-b_szy6.mjs';
+import { j as getHyphaServerUrl, S as ServeAuth, k as hasCookieToken } from './run-Dn6ZqBs9.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';
@@ -854,7 +854,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Cwn_s0Fs.mjs');
+      const { FrpcTunnel } = await import('./frpc-Dch3Eq_f.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,

package/dist/{sideband-DywLL2xs.mjs → sideband-DAbvCvgz.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, L as loadMachineContext, M as buildMachineInstructions, N as machineToolsForRole, O as buildMachineTools } from './run-b-b_szy6.mjs';
+import { R as READ_ONLY_TOOLS, L as loadMachineContext, M as buildMachineInstructions, N as machineToolsForRole, O as buildMachineTools } from './run-Dn6ZqBs9.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';