svamp-cli 0.2.305 → 0.2.307

package/dist/{run-BtVKqoF4.mjs → run-DYVmYsvg.mjs}

@@ -8,8 +8,8 @@ import { fileURLToPath } from 'url';
 import { execFile, spawn, execSync, exec as exec$1 } from 'child_process';
 import * as crypto from 'crypto';
 import { randomUUID as randomUUID$1 } from 'crypto';
-import { randomUUID, randomBytes, createHash } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync, rmSync as rmSync$1, cpSync, realpathSync, readdirSync, statSync, renameSync, appendFileSync, unlinkSync } from 'node:fs';
+import { randomUUID, randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, unlinkSync } from 'node:fs';
 import { exec, spawn as spawn$1, execSync as execSync$1, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import * as http from 'http';
@@ -19,7 +19,7 @@ import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:p
 import { EventEmitter } from 'node:events';
 import { ndJsonStream, ClientSideConnection } from '@agentclientprotocol/sdk';
 import { createInterface } from 'node:readline';
-import { mkdir, rm, chmod, access, mkdtemp, copyFile, writeFile, readdir, stat, readFile as readFile$1 } from 'node:fs/promises';
+import { mkdir, rm, chmod, access, mkdtemp, copyFile, writeFile, readdir, stat, readFile as readFile$1, rename as rename$1 } from 'node:fs/promises';
 import { promisify as promisify$1 } from 'node:util';
 import { parse, stringify } from 'yaml';
 
@@ -1280,6 +1280,14 @@ const MIME = {
 function contentTypeFor(filePath) {
   return MIME[path.extname(filePath).toLowerCase()] || "application/octet-stream";
 }
+function hasBlockedDotSegment(relPath) {
+  const decoded = safeDecode(relPath.replace(/^\/+/, ""));
+  for (const seg of decoded.split("/")) {
+    if (!seg || seg === "." || seg === "..") continue;
+    if (seg.startsWith(".") && seg !== ".well-known") return true;
+  }
+  return false;
+}
 function containedPath(rootDir, relPath) {
   const base = path.resolve(rootDir);
   const decoded = safeDecode(relPath);
@@ -1368,6 +1376,11 @@ function serveStaticMount(req, res, opts) {
     sendFile(req, res, rootDir, rootStat);
     return;
   }
+  if (hasBlockedDotSegment(relPath)) {
+    res.writeHead(404, CORS);
+    res.end("Not Found");
+    return;
+  }
   const lexTarget = containedPath(rootDir, relPath.replace(/^\/+/, ""));
   if (!lexTarget) {
     res.writeHead(403, { ...CORS, "Content-Type": "text/plain" });
@@ -1496,6 +1509,7 @@ var staticFileServer = /*#__PURE__*/Object.freeze({
     containedPath: containedPath,
     contentTypeFor: contentTypeFor,
     directoryListingHtml: directoryListingHtml,
+    hasBlockedDotSegment: hasBlockedDotSegment,
     parseRange: parseRange,
     realContainedPath: realContainedPath,
     serveStaticMount: serveStaticMount
@@ -1504,6 +1518,28 @@ var staticFileServer = /*#__PURE__*/Object.freeze({
 const AUTH0_NAMESPACES = ["https://api.imjoy.io/", "https://amun.ai/"];
 const COOKIE_NAME = "svamp_serve_token";
 const SVAMP_SERVE_TOKEN_PARAM = "__svamp_serve_token";
+function stripServeAuthCookie(cookieHeader) {
+  if (!cookieHeader) return cookieHeader;
+  const kept = cookieHeader.split(";").map((s) => s.trim()).filter((s) => s && !s.toLowerCase().startsWith(COOKIE_NAME + "="));
+  return kept.length ? kept.join("; ") : void 0;
+}
+function stripServeTokenParam(pathWithQuery) {
+  const qIdx = pathWithQuery.indexOf("?");
+  if (qIdx < 0) return pathWithQuery;
+  const base = pathWithQuery.slice(0, qIdx);
+  const params = new URLSearchParams(pathWithQuery.slice(qIdx + 1));
+  params.delete(SVAMP_SERVE_TOKEN_PARAM);
+  const qs = params.toString();
+  return qs ? `${base}?${qs}` : base;
+}
+function sanitizeForwardHeaders(headers) {
+  const out = { ...headers };
+  const cleaned = stripServeAuthCookie(typeof out.cookie === "string" ? out.cookie : void 0);
+  if (cleaned === void 0) delete out.cookie;
+  else out.cookie = cleaned;
+  delete out.authorization;
+  return out;
+}
 const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
 const DEFAULT_CACHE_MAX_SIZE = 1e3;
 function jsStringLiteral(value) {
@@ -2081,9 +2117,10 @@ function assertNonAdminMountDirSafe(directory, homeDir) {
 }
 function sanitizeMountForRole(mount, isAdmin) {
   if (isAdmin) return mount;
-  const { linkToken: _lt, directory: _dir, process: proc, ...rest } = mount;
+  const { linkToken: _lt, directory: _dir, process: proc, url, ...rest } = mount;
   const safeProcess = proc ? { ...proc, env: proc.env ? Object.fromEntries(Object.keys(proc.env).map((k) => [k, "***"])) : proc.env } : proc;
-  return { ...rest, process: safeProcess };
+  const safeUrl = mount.access === "link" ? void 0 : url;
+  return { ...rest, process: safeProcess, ...safeUrl !== void 0 ? { url: safeUrl } : {} };
 }
 const DNS_LABEL_MAX = 63;
 function buildLinkSubdomain(subdomainSafe, linkToken) {
@@ -2286,6 +2323,10 @@ class ServeManager {
     }
     return all;
   }
+  /** #0649: look up a single mount by name (for ownership checks before remove/replace). */
+  getMount(name) {
+    return this.mounts.get(name);
+  }
   /**
    * Get server info — each mount has its own URL (per-mount subdomain).
    */
@@ -2437,9 +2478,9 @@ class ServeManager {
     });
     const warmupPath = cfg.warmupPath ?? "/";
     const warmupTimeoutMs = cfg.warmupTimeoutMs ?? 3e4;
-    const warmupPromise = this.warmupProbe(`http://127.0.0.1:${cfg.port}${warmupPath}`, warmupTimeoutMs).then(() => {
+    const warmupPromise = this.warmupProbe(`http://127.0.0.1:${cfg.port}${warmupPath}`, warmupTimeoutMs, child).then(() => {
       const h = this.managedProcs.get(name);
-      if (h) {
+      if (h && h.child === child) {
         h.warmupPromise = null;
         h.lastRequestAt = Date.now();
       }
@@ -2447,7 +2488,8 @@ class ServeManager {
     }).catch((err) => {
       this.log(`Managed process '${name}' warmup failed: ${err.message}`);
       this.killManagedTree(child, "SIGTERM");
-      this.managedProcs.delete(name);
+      const h = this.managedProcs.get(name);
+      if (h && h.child === child) this.managedProcs.delete(name);
       throw err;
     });
     const newHandle = {
@@ -2482,10 +2524,13 @@ class ServeManager {
     }
   }
   /** Poll a URL until it returns <500 or the deadline passes. */
-  async warmupProbe(url, timeoutMs) {
+  async warmupProbe(url, timeoutMs, child) {
     const deadline = Date.now() + timeoutMs;
     let lastErr;
     while (Date.now() < deadline) {
+      if (child && child.exitCode !== null) {
+        throw new Error(`managed process exited (code=${child.exitCode}) before warmup completed`);
+      }
       try {
         const ctrl = new AbortController();
         const t = setTimeout(() => ctrl.abort(), 2e3);
@@ -2572,8 +2617,12 @@ class ServeManager {
     };
     try {
       const tmp = `${this.persistFile}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
-      fs.writeFileSync(tmp, JSON.stringify(state, null, 2));
+      fs.writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 384 });
       fs.renameSync(tmp, this.persistFile);
+      try {
+        fs.chmodSync(this.persistFile, 384);
+      } catch {
+      }
     } catch (err) {
       this.log(`Error persisting serve state: ${err.message}`);
     }
@@ -2603,218 +2652,234 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
   startAuthProxy() {
     return new Promise((resolve, reject) => {
       const server = http.createServer(async (req, res) => {
-        const url = new URL(req.url || "/", `http://127.0.0.1:${this.port}`);
-        const incomingHost = (req.headers.host || "").split(":")[0].toLowerCase();
-        const hostMount = this.hostToMount.get(incomingHost);
-        let mountName;
-        let mountResolvedByHost = false;
-        let basePath;
-        if (hostMount && this.mounts.has(hostMount)) {
-          mountName = hostMount;
-          mountResolvedByHost = true;
-          basePath = url.pathname;
-        } else {
-          mountName = url.pathname.split("/").filter(Boolean)[0];
-          basePath = mountName ? url.pathname.slice(`/${mountName}`.length) || "/" : url.pathname;
-        }
-        const mount = mountName ? this.mounts.get(mountName) : void 0;
-        if (basePath === "/__svamp_health" || url.pathname === "/__svamp_health") {
-          res.writeHead(200, {
-            "Content-Type": "application/json",
-            "Cache-Control": "no-store"
-          });
-          res.end(JSON.stringify({
-            ok: true,
-            mount: mountName || null,
-            ts: Date.now()
-          }));
-          return;
-        }
-        if (basePath === "/__login__" || url.pathname === "/__login__") {
-          const returnUrl = url.searchParams.get("return") || "/";
-          const isSameOriginPath = returnUrl.startsWith("/") && !returnUrl.startsWith("//") && !returnUrl.startsWith("/__login__");
-          const safeReturn = isSameOriginPath ? returnUrl : "/";
-          const html = this.auth ? this.auth.getLoginPageHtml(safeReturn) : "<h1>Auth not configured</h1>";
-          res.writeHead(200, {
-            "Content-Type": "text/html; charset=utf-8",
-            "Cache-Control": "no-store"
-          });
-          res.end(html);
-          return;
-        }
-        if (mount && mount.access !== "public" && mount.access !== "link") {
-          const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
-          if (mount.access === "owner" && !mount.ownerEmail) {
-            this.log(`Auth DENY '${mountName}': owner-only mount but ownerEmail is empty (misconfigured \u2014 the daemon's token has no email claim). Set access to an explicit email allowlist. requester=${userEmail || "anonymous"}`);
-            const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, misconfigured: true, returnUrl: req.url || "/" }) : "Access denied (misconfigured owner mount).";
-            res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+        try {
+          const url = new URL(req.url || "/", `http://127.0.0.1:${this.port}`);
+          const incomingHost = (req.headers.host || "").split(":")[0].toLowerCase();
+          const hostMount = this.hostToMount.get(incomingHost);
+          let mountName;
+          let mountResolvedByHost = false;
+          let basePath;
+          if (hostMount && this.mounts.has(hostMount)) {
+            mountName = hostMount;
+            mountResolvedByHost = true;
+            basePath = url.pathname;
+          } else {
+            mountName = url.pathname.split("/").filter(Boolean)[0];
+            basePath = mountName ? url.pathname.slice(`/${mountName}`.length) || "/" : url.pathname;
+          }
+          const mount = mountName ? this.mounts.get(mountName) : void 0;
+          if (basePath === "/__svamp_health" || url.pathname === "/__svamp_health") {
+            res.writeHead(200, {
+              "Content-Type": "application/json",
+              "Cache-Control": "no-store"
+            });
+            res.end(JSON.stringify({
+              ok: true,
+              mount: mountName || null,
+              ts: Date.now()
+            }));
+            return;
+          }
+          if (basePath === "/__login__" || url.pathname === "/__login__") {
+            const returnUrl = url.searchParams.get("return") || "/";
+            const isSameOriginPath = returnUrl.startsWith("/") && !returnUrl.startsWith("//") && !returnUrl.startsWith("/__login__");
+            const safeReturn = isSameOriginPath ? returnUrl : "/";
+            const html = this.auth ? this.auth.getLoginPageHtml(safeReturn) : "<h1>Auth not configured</h1>";
+            res.writeHead(200, {
+              "Content-Type": "text/html; charset=utf-8",
+              "Cache-Control": "no-store"
+            });
             res.end(html);
             return;
           }
-          const allowed = this.auth ? this.auth.isAuthorized(userEmail, mount.access, mount.ownerEmail) : false;
-          if (!allowed) {
-            if (!userEmail) {
-              this.log(`Auth: '${mountName}' requires sign-in (no valid token) \u2014 redirecting to /__login__`);
-              const loginUrl = `/__login__?return=${encodeURIComponent(req.url || "/")}`;
-              const headers = { Location: loginUrl };
-              if (hasCookieToken(req)) {
-                headers["Set-Cookie"] = "svamp_serve_token=; Path=/; Max-Age=0; SameSite=Lax";
+          if (mount && mount.access !== "public" && mount.access !== "link") {
+            const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
+            if (mount.access === "owner" && !mount.ownerEmail) {
+              this.log(`Auth DENY '${mountName}': owner-only mount but ownerEmail is empty (misconfigured \u2014 the daemon's token has no email claim). Set access to an explicit email allowlist. requester=${userEmail || "anonymous"}`);
+              const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, misconfigured: true, returnUrl: req.url || "/" }) : "Access denied (misconfigured owner mount).";
+              res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+              res.end(html);
+              return;
+            }
+            const allowed = this.auth ? this.auth.isAuthorized(userEmail, mount.access, mount.ownerEmail) : false;
+            if (!allowed) {
+              if (!userEmail) {
+                this.log(`Auth: '${mountName}' requires sign-in (no valid token) \u2014 redirecting to /__login__`);
+                const loginUrl = `/__login__?return=${encodeURIComponent(req.url || "/")}`;
+                const headers = { Location: loginUrl };
+                if (hasCookieToken(req)) {
+                  headers["Set-Cookie"] = "svamp_serve_token=; Path=/; Max-Age=0; SameSite=Lax";
+                }
+                res.writeHead(302, headers);
+                res.end();
+                return;
               }
-              res.writeHead(302, headers);
-              res.end();
+              const need = mount.access === "owner" ? `owner (${mount.ownerEmail || "unset"})` : `one of [${mount.access.join(", ")}]`;
+              this.log(`Auth DENY '${mountName}': '${userEmail}' is not authorized (requires ${need})`);
+              const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, returnUrl: req.url || "/" }) : `Access denied for ${userEmail}.`;
+              res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+              res.end(html);
               return;
             }
-            const need = mount.access === "owner" ? `owner (${mount.ownerEmail || "unset"})` : `one of [${mount.access.join(", ")}]`;
-            this.log(`Auth DENY '${mountName}': '${userEmail}' is not authorized (requires ${need})`);
-            const html = this.auth ? this.auth.getAccessDeniedHtml({ email: userEmail, access: mount.access, ownerEmail: mount.ownerEmail, returnUrl: req.url || "/" }) : `Access denied for ${userEmail}.`;
-            res.writeHead(403, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-            res.end(html);
-            return;
+            this.log(`Auth OK '${mountName}': ${userEmail}`);
           }
-          this.log(`Auth OK '${mountName}': ${userEmail}`);
-        }
-        const resolveContained = () => {
-          const base = path.resolve(mount.directory);
-          const fp = path.resolve(path.join(base, basePath));
-          if (fp !== base && !fp.startsWith(base + path.sep)) return null;
-          try {
-            const realRoot = fs.realpathSync(base);
-            let ancestor = fp;
-            while (!fs.existsSync(ancestor) && path.dirname(ancestor) !== ancestor) {
-              ancestor = path.dirname(ancestor);
+          const resolveContained = () => {
+            const base = path.resolve(mount.directory);
+            const fp = path.resolve(path.join(base, basePath));
+            if (fp !== base && !fp.startsWith(base + path.sep)) return null;
+            try {
+              const realRoot = fs.realpathSync(base);
+              let ancestor = fp;
+              while (!fs.existsSync(ancestor) && path.dirname(ancestor) !== ancestor) {
+                ancestor = path.dirname(ancestor);
+              }
+              const realAncestor = fs.realpathSync(ancestor);
+              if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + path.sep)) return null;
+              if (fs.existsSync(fp) && fs.lstatSync(fp).isSymbolicLink()) {
+                const realTarget = fs.realpathSync(fp);
+                if (realTarget !== realRoot && !realTarget.startsWith(realRoot + path.sep)) return null;
+              }
+            } catch {
+              return null;
             }
-            const realAncestor = fs.realpathSync(ancestor);
-            if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + path.sep)) return null;
-            if (fs.existsSync(fp) && fs.lstatSync(fp).isSymbolicLink()) {
-              const realTarget = fs.realpathSync(fp);
-              if (realTarget !== realRoot && !realTarget.startsWith(realRoot + path.sep)) return null;
+            return fp;
+          };
+          if ((req.method === "PUT" || req.method === "DELETE") && mount && mount.directory) {
+            if (mount.access === "public") {
+              this.log(`Write DENY '${mountName}': ${req.method} not allowed on a public (unauthenticated) mount`);
+              res.writeHead(403, { "Content-Type": "text/plain" });
+              res.end("Write access denied: public mounts are read-only.");
+              return;
+            }
+            const filePath = resolveContained();
+            if (!filePath) {
+              this.log(`Write DENY '${mountName}': path escapes mount root (${basePath})`);
+              res.writeHead(403, { "Content-Type": "text/plain" });
+              res.end("Forbidden: path escapes mount root.");
+              return;
+            }
+            if (req.method === "PUT") {
+              fs.mkdirSync(path.dirname(filePath), { recursive: true });
+              const ws = fs.createWriteStream(filePath);
+              let done = false;
+              const cleanupPartial = () => {
+                if (done) return;
+                done = true;
+                ws.destroy();
+                fs.unlink(filePath, () => {
+                });
+              };
+              req.on("aborted", cleanupPartial);
+              req.on("close", () => {
+                if (!ws.writableFinished && !req.complete) cleanupPartial();
+              });
+              req.pipe(ws);
+              ws.on("finish", () => {
+                done = true;
+                res.writeHead(201);
+                res.end();
+              });
+              ws.on("error", (err) => {
+                if (done) return;
+                done = true;
+                res.writeHead(500);
+                res.end(err.message);
+              });
+              return;
+            }
+            try {
+              fs.unlinkSync(filePath);
+              res.writeHead(204);
+              res.end();
+            } catch (err) {
+              res.writeHead(err.code === "ENOENT" ? 404 : 500);
+              res.end(err.message);
             }
-          } catch {
-            return null;
-          }
-          return fp;
-        };
-        if ((req.method === "PUT" || req.method === "DELETE") && mount && mount.directory) {
-          if (mount.access === "public") {
-            this.log(`Write DENY '${mountName}': ${req.method} not allowed on a public (unauthenticated) mount`);
-            res.writeHead(403, { "Content-Type": "text/plain" });
-            res.end("Write access denied: public mounts are read-only.");
-            return;
-          }
-          const filePath = resolveContained();
-          if (!filePath) {
-            this.log(`Write DENY '${mountName}': path escapes mount root (${basePath})`);
-            res.writeHead(403, { "Content-Type": "text/plain" });
-            res.end("Forbidden: path escapes mount root.");
             return;
           }
-          if (req.method === "PUT") {
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
-            const ws = fs.createWriteStream(filePath);
-            let done = false;
-            const cleanupPartial = () => {
-              if (done) return;
-              done = true;
-              ws.destroy();
-              fs.unlink(filePath, () => {
-              });
-            };
-            req.on("aborted", cleanupPartial);
-            req.on("close", () => {
-              if (!ws.writableFinished) cleanupPartial();
+          if (mount && mount.process) {
+            const cfg = mount.process;
+            if (cfg.wakeOnRequest || !this.managedProcs.has(mount.name)) {
+              try {
+                await this.ensureManagedRunning(mount.name);
+              } catch (err) {
+                res.writeHead(503, { "Content-Type": "text/plain" });
+                res.end(`Backend not ready: ${err?.message || err}`);
+                return;
+              }
+            }
+            const handle = this.managedProcs.get(mount.name);
+            if (handle) {
+              handle.lastRequestAt = Date.now();
+              handle.activeConns++;
+              let released = false;
+              const release = () => {
+                if (released) return;
+                released = true;
+                handle.activeConns = Math.max(0, handle.activeConns - 1);
+                handle.lastRequestAt = Date.now();
+              };
+              res.on("close", release);
+            }
+            const targetPath = stripServeTokenParam(mountResolvedByHost ? req.url || "/" : (basePath || "/") + (url.search || ""));
+            const proxyReq = http.request({
+              hostname: "127.0.0.1",
+              port: cfg.port,
+              path: targetPath,
+              method: req.method,
+              headers: sanitizeForwardHeaders(req.headers)
+            }, (proxyRes) => {
+              res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
+              proxyRes.pipe(res);
             });
-            req.pipe(ws);
-            ws.on("finish", () => {
-              done = true;
-              res.writeHead(201);
-              res.end();
+            proxyReq.on("error", (err) => {
+              if (!res.headersSent) {
+                res.writeHead(502);
+                res.end(`Backend error: ${err.message}`);
+              }
             });
-            ws.on("error", (err) => {
-              if (done) return;
-              done = true;
-              res.writeHead(500);
-              res.end(err.message);
+            const abortUpstream = () => {
+              if (!proxyReq.destroyed) proxyReq.destroy();
+            };
+            req.on("aborted", abortUpstream);
+            res.on("close", () => {
+              if (!res.writableFinished) abortUpstream();
             });
+            proxyReq.setTimeout(12e4, abortUpstream);
+            req.pipe(proxyReq);
             return;
           }
-          try {
-            fs.unlinkSync(filePath);
-            res.writeHead(204);
-            res.end();
-          } catch (err) {
-            res.writeHead(err.code === "ENOENT" ? 404 : 500);
-            res.end(err.message);
+          if (mount && mount.directory) {
+            serveStaticMount(req, res, {
+              rootDir: mount.directory,
+              relPath: basePath || "/",
+              // Path-based access is prefixed with /<mountName>; host-based has no prefix.
+              mountUrlPrefix: mountResolvedByHost ? "" : `/${mountName}`,
+              browse: true,
+              log: (m) => this.log(m)
+            });
+            return;
           }
-          return;
-        }
-        if (mount && mount.process) {
-          const cfg = mount.process;
-          if (cfg.wakeOnRequest || !this.managedProcs.has(mount.name)) {
+          const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": "*" };
+          if (url.pathname === "/" || basePath === "/") {
+            res.writeHead(200, { ...cors, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
+            res.end(this.mountListHtml());
+          } else {
+            res.writeHead(404, { ...cors, "Content-Type": "text/plain" });
+            res.end("Not found");
+          }
+        } catch (err) {
+          this.log(`Auth-proxy request error: ${err?.message || err}`);
+          if (!res.headersSent) {
             try {
-              await this.ensureManagedRunning(mount.name);
-            } catch (err) {
-              res.writeHead(503, { "Content-Type": "text/plain" });
-              res.end(`Backend not ready: ${err?.message || err}`);
-              return;
+              res.writeHead(500, { "Content-Type": "text/plain" });
+            } catch {
             }
           }
-          const handle = this.managedProcs.get(mount.name);
-          if (handle) {
-            handle.lastRequestAt = Date.now();
-            handle.activeConns++;
-            let released = false;
-            const release = () => {
-              if (released) return;
-              released = true;
-              handle.activeConns = Math.max(0, handle.activeConns - 1);
-              handle.lastRequestAt = Date.now();
-            };
-            res.on("close", release);
+          try {
+            res.end("Internal Server Error");
+          } catch {
           }
-          const targetPath = mountResolvedByHost ? req.url || "/" : (basePath || "/") + (url.search || "");
-          const proxyReq = http.request({
-            hostname: "127.0.0.1",
-            port: cfg.port,
-            path: targetPath,
-            method: req.method,
-            headers: req.headers
-          }, (proxyRes) => {
-            res.writeHead(proxyRes.statusCode || 200, proxyRes.headers);
-            proxyRes.pipe(res);
-          });
-          proxyReq.on("error", (err) => {
-            if (!res.headersSent) {
-              res.writeHead(502);
-              res.end(`Backend error: ${err.message}`);
-            }
-          });
-          const abortUpstream = () => {
-            if (!proxyReq.destroyed) proxyReq.destroy();
-          };
-          req.on("aborted", abortUpstream);
-          res.on("close", () => {
-            if (!res.writableFinished) abortUpstream();
-          });
-          proxyReq.setTimeout(12e4, abortUpstream);
-          req.pipe(proxyReq);
-          return;
-        }
-        if (mount && mount.directory) {
-          serveStaticMount(req, res, {
-            rootDir: mount.directory,
-            relPath: basePath || "/",
-            // Path-based access is prefixed with /<mountName>; host-based has no prefix.
-            mountUrlPrefix: mountResolvedByHost ? "" : `/${mountName}`,
-            browse: true});
-          return;
-        }
-        const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": "*" };
-        if (url.pathname === "/" || basePath === "/") {
-          res.writeHead(200, { ...cors, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-          res.end(this.mountListHtml());
-        } else {
-          res.writeHead(404, { ...cors, "Content-Type": "text/plain" });
-          res.end("Not found");
         }
       });
       server.on("upgrade", (req, clientSocket, head) => {
@@ -2882,11 +2947,20 @@ Connection: close\r
                 handle.lastRequestAt = Date.now();
               });
             }
-            const targetPath = mountResolvedByHost ? req.url || "/" : (url.pathname.slice(`/${mountName}`.length) || "/") + (url.search || "");
+            const targetPath = stripServeTokenParam(mountResolvedByHost ? req.url || "/" : (url.pathname.slice(`/${mountName}`.length) || "/") + (url.search || ""));
             const upstream = net.connect(cfg.port, "127.0.0.1", () => {
               const lines = [`${req.method} ${targetPath} HTTP/1.1`];
               for (let i = 0; i < req.rawHeaders.length; i += 2) {
-                lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+                const name = req.rawHeaders[i];
+                const lname = name.toLowerCase();
+                let value = req.rawHeaders[i + 1];
+                if (lname === "authorization") continue;
+                if (lname === "cookie") {
+                  const cleaned = stripServeAuthCookie(value);
+                  if (cleaned === void 0) continue;
+                  value = cleaned;
+                }
+                lines.push(`${name}: ${value}`);
               }
               upstream.write(lines.join("\r\n") + "\r\n\r\n");
               if (head && head.length) upstream.write(head);
@@ -2973,7 +3047,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Dsada5ox.mjs');
+      const { FrpcTunnel } = await import('./frpc-NDcBtpwa.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,
@@ -3910,6 +3984,46 @@ function renderTemplate(template, ctx) {
   });
 }
 
+const _sleepSab$1 = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync$1(ms) {
+  try {
+    Atomics.wait(_sleepSab$1, 0, 0, ms);
+  } catch {
+  }
+}
+function withFileLock(lockPath, fn, opts) {
+  const deadlineMs = 50;
+  const staleMs = 5e3;
+  const deadline = Date.now() + deadlineMs;
+  let held = false;
+  while (Date.now() < deadline) {
+    try {
+      mkdirSync$1(lockPath);
+      held = true;
+      break;
+    } catch {
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > staleMs) {
+          rmSync$1(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+      }
+      sleepSync$1(5);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) {
+      try {
+        rmSync$1(lockPath, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
+
 const HARD_MAX_BYTES = 25 * 1024 * 1024;
 const DEFAULT_MAX_BYTES = 5 * 1024 * 1024;
 const DEFAULT_MAX_COUNT = 100;
@@ -4125,6 +4239,22 @@ class ChannelStore {
   _path(id) {
     return join$1(this.dir, `${id}.json`);
   }
+  _lock(id) {
+    return join$1(this.dir, `${id}.json.lock`);
+  }
+  // #0679: the actual validate + atomic write, WITHOUT the lock, so a locked RMW mutator can
+  // reuse it inside its own lock section (no re-entrant re-lock / deadlock).
+  _writeChannel(channel) {
+    const c = { enabled: true, bind: "dynamic", template: DEFAULT_TEMPLATE, last_calls: [], ...channel };
+    if (!c.id) c.id = genId();
+    const errs = validateChannel(c);
+    if (errs.length) throw new Error("invalid channel: " + errs.join("; "));
+    mkdirSync$1(this.dir, { recursive: true });
+    const tmp = `${this._path(c.id)}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+    writeFileSync$1(tmp, JSON.stringify(c, null, 2));
+    renameSync(tmp, this._path(c.id));
+    return c;
+  }
   list() {
     if (!existsSync(this.dir)) return [];
     return readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
@@ -4143,15 +4273,8 @@ class ChannelStore {
     }
   }
   save(channel) {
-    const c = { enabled: true, bind: "dynamic", template: DEFAULT_TEMPLATE, last_calls: [], ...channel };
-    if (!c.id) c.id = genId();
-    const errs = validateChannel(c);
-    if (errs.length) throw new Error("invalid channel: " + errs.join("; "));
-    mkdirSync$1(this.dir, { recursive: true });
-    const tmp = `${this._path(c.id)}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-    writeFileSync$1(tmp, JSON.stringify(c, null, 2));
-    renameSync(tmp, this._path(c.id));
-    return c;
+    if (channel.id) return withFileLock(this._lock(channel.id), () => this._writeChannel(channel));
+    return this._writeChannel(channel);
   }
   remove(id) {
     const p = this._path(id);
@@ -4161,28 +4284,40 @@ class ChannelStore {
     }
     return false;
   }
+  // #0679: setEnabled/recordCall/addCaller are read-modify-write mutators — multiple ChannelStore
+  // instances (one per session) point at the same .svamp/channels/<id>.json, so without
+  // serialization two concurrent RMWs both read the same base and the second save() clobbers the
+  // first (addCaller silently DROPS a freshly-generated caller key). Hold the bounded fail-open
+  // per-channel lock across the whole read→mutate→write so the read sees the other's committed
+  // change (mirrors inboxGuard's #0625 withAwaitLock). _writeChannel is the un-locked write.
   setEnabled(id, enabled) {
-    const c = this.get(id);
-    if (!c) return null;
-    c.enabled = enabled;
-    return this.save(c);
+    return withFileLock(this._lock(id), () => {
+      const c = this.get(id);
+      if (!c) return null;
+      c.enabled = enabled;
+      return this._writeChannel(c);
+    });
   }
   recordCall(id, entry) {
-    const c = this.get(id);
-    if (!c) return;
-    c.last_calls = c.last_calls || [];
-    c.last_calls.unshift({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
-    c.last_calls = c.last_calls.slice(0, 20);
-    this.save(c);
+    withFileLock(this._lock(id), () => {
+      const c = this.get(id);
+      if (!c) return;
+      c.last_calls = c.last_calls || [];
+      c.last_calls.unshift({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
+      c.last_calls = c.last_calls.slice(0, 20);
+      this._writeChannel(c);
+    });
   }
   addCaller(id, name, kind = "agent") {
-    const c = this.get(id);
-    if (!c) return null;
-    c.identity.callers = c.identity.callers || [];
-    const caller = { name, kind, key: genKey() };
-    c.identity.callers.push(caller);
-    this.save(c);
-    return caller;
+    return withFileLock(this._lock(id), () => {
+      const c = this.get(id);
+      if (!c) return null;
+      c.identity.callers = c.identity.callers || [];
+      const caller = { name, kind, key: genKey() };
+      c.identity.callers.push(caller);
+      this._writeChannel(c);
+      return caller;
+    });
   }
 }
 function routingSession(channel, ctx) {
@@ -4326,6 +4461,13 @@ curl -X POST "${sendUrl}" \\
 Always-current copy of this skill (all ids filled in): ${skillUrl}${uploadSection}${queueSection}`;
 }
 
+function keysMatch(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  const ba = Buffer.from(a);
+  const bb = Buffer.from(b);
+  if (ba.length !== bb.length) return false;
+  return timingSafeEqual(ba, bb);
+}
 function resolveSender(channel, input = {}) {
   const { key, from, hyphaUser, hyphaWorkspace, hyphaAnonymous } = input;
   const id = channel.identity || {};
@@ -4342,7 +4484,7 @@ function resolveSender(channel, input = {}) {
     return { sender: { name: id.fixed.name, kind: id.fixed.kind, verified: true } };
   }
   if (id.mode === "per-key") {
-    const caller = (id.callers || []).find((c) => c.key && c.key === key);
+    const caller = (id.callers || []).find((c) => c.key && keysMatch(c.key, key));
     if (!caller) {
       const acceptsHypha = Array.isArray(id.hypha_allow) && id.hypha_allow.length > 0;
       return { error: acceptsHypha ? "invalid or missing key \u2014 supply a caller key issued by the channel owner, or call with an authenticated Hypha identity (this channel accepts hypha_allow callers; anonymous/keyless requests are rejected)" : "invalid or missing key \u2014 this channel requires a caller key issued by the channel owner" };
@@ -4350,7 +4492,7 @@ function resolveSender(channel, input = {}) {
     return { sender: { name: caller.name, kind: caller.kind, verified: true } };
   }
   if (id.mode === "caller-supplied") {
-    if (id.shared_key && key !== id.shared_key) return { error: "invalid key" };
+    if (id.shared_key && !keysMatch(key, id.shared_key)) return { error: "invalid key" };
     return { sender: { name: from || "anonymous", kind: "user", verified: false } };
   }
   return { error: "unsupported identity mode" };
@@ -4592,6 +4734,11 @@ class ChannelOutbox {
       this.reload();
       this._compact();
     }
+    {
+      const sig = this._stat();
+      this._lastMtimeMs = sig.mtimeMs;
+      this._lastSize = sig.size;
+    }
     this.emitter.emit(channelId, reply);
     return reply;
   }
@@ -4618,6 +4765,7 @@ class ChannelOutbox {
    * the next append (filtered to this channel + `to`) or `timeoutMs`, then return.
    */
   wait(channelId, cursor, to, timeoutMs, correlationId) {
+    this.reload();
     const ready = this.since(channelId, cursor, to, correlationId);
     if (ready.length) return Promise.resolve({ replies: ready, cursor: this.cursor(channelId) });
     return new Promise((resolve) => {
@@ -4626,12 +4774,23 @@ class ChannelOutbox {
         cleanup();
         resolve({ replies: this.since(channelId, cursor, to, correlationId), cursor: this.cursor(channelId) });
       };
+      const diskPoll = setInterval(() => {
+        if (this.reload()) {
+          const more = this.since(channelId, cursor, to, correlationId);
+          if (more.length) {
+            cleanup();
+            resolve({ replies: more, cursor: this.cursor(channelId) });
+          }
+        }
+      }, 1e3);
+      diskPoll.unref?.();
       const timer = setTimeout(() => {
         cleanup();
         resolve({ replies: [], cursor: this.cursor(channelId) });
       }, Math.max(0, timeoutMs));
       const cleanup = () => {
         clearTimeout(timer);
+        clearInterval(diskPoll);
         this.emitter.off(channelId, onReply);
       };
       this.emitter.on(channelId, onReply);
@@ -4650,11 +4809,57 @@ class ChannelOutbox {
     if (existsSync(this.file)) this.reload();
     this.byChannel.delete(channelId);
     this.seqByChannel.delete(channelId);
+    if (this.highWater.delete(channelId)) this._persistHighWater();
     if (!existsSync(this.file)) return;
     this._compact();
   }
 }
 
+const SESSION_METHOD_MIN_ROLE = {
+  // interact
+  sendMessage: "interact",
+  abort: "interact",
+  permissionResponse: "interact",
+  regenerateSummary: "interact",
+  keepAlive: "interact",
+  sessionEnd: "interact",
+  markInboxRead: "interact",
+  sendInboxMessage: "interact",
+  // admin
+  updateMetadata: "admin",
+  updateConfig: "admin",
+  saveChannel: "admin",
+  removeChannel: "admin",
+  setChannelEnabled: "admin",
+  addChannelCaller: "admin",
+  outpostConnectInfo: "admin",
+  outpostExec: "admin",
+  channelReply: "admin",
+  updateAgentState: "admin",
+  switchMode: "admin",
+  restartClaude: "admin",
+  archiveSession: "admin",
+  readFile: "admin",
+  writeFile: "admin",
+  listDirectory: "admin",
+  bash: "admin",
+  issue: "admin",
+  workflow: "admin",
+  ripgrep: "admin",
+  getDirectoryTree: "admin",
+  updateSharing: "admin",
+  updateSecurityContext: "admin",
+  setClaudeChrome: "admin",
+  applySystemPrompt: "admin",
+  clearInbox: "admin",
+  btw: "admin",
+  editMessage: "admin",
+  refineLastReply: "admin",
+  undoLastEdit: "admin"
+};
+function sessionMethodMinRole(method) {
+  return SESSION_METHOD_MIN_ROLE[method] ?? "view";
+}
 function getParamNames(fn) {
   const src = fn.toString();
   const match = src.match(/^(?:async\s+)?(?:function\s*\w*)?\s*\(([^)]*)\)/);
@@ -4909,9 +5114,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         } catch {
         }
         if (hasMachineAccess) {
+          const { securityContextConfig: _sc2, ...safeMetadata2 } = currentMetadata;
           return {
             machineId,
-            metadata: currentMetadata,
+            metadata: safeMetadata2,
             metadataVersion,
             daemonState: currentDaemonState,
             daemonStateVersion
@@ -4922,11 +5128,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         for (const sid of sessionIds) {
           const rpc = handlers.getSessionRPCHandlers?.(sid);
           if (!rpc) continue;
-          try {
-            await rpc.getMetadata(context);
+          if (await hasExplicitSessionAccess(rpc, "view", context)) {
             hasSessionAccess = true;
             break;
-          } catch {
           }
         }
         if (!hasSessionAccess) {
@@ -5031,10 +5235,11 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!rpc) {
           throw new Error(`Session ${sessionId} not found on this machine`);
         }
+        const requiredRole = sessionMethodMinRole(method);
         try {
-          authorizeRequest(context, currentMetadata.sharing, "view");
+          authorizeRequest(context, currentMetadata.sharing, requiredRole);
         } catch (machineErr) {
-          if (!await hasExplicitSessionAccess(rpc, "view", context)) throw machineErr;
+          if (!await hasExplicitSessionAccess(rpc, requiredRole, context)) throw machineErr;
         }
         const handler = rpc[method];
         if (typeof handler !== "function") {
@@ -5883,7 +6088,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-Dsada5ox.mjs');
+        const { FrpcTunnel } = await import('./frpc-NDcBtpwa.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -5998,6 +6203,14 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           const { homedir } = await import('os');
           assertNonAdminMountDirSafe(params.directory, homedir());
         }
+        const existingMount = sm.getMount(params.name);
+        if (existingMount && !serveCallerTrusted(context)) {
+          const callerEmail = (context?.user?.email || "").toLowerCase();
+          const mountOwner = (existingMount.ownerEmail || "").toLowerCase();
+          if (!callerEmail || !mountOwner || callerEmail !== mountOwner) {
+            throw new Error(`Not authorized to replace mount '${params.name}' (owned by another user)`);
+          }
+        }
         const ownerEmail2 = params.ownerEmail || context?.user?.email || currentMetadata.sharing?.owner || process.env.SVAMP_OWNER_EMAIL || void 0;
         const access = params.access ?? "owner";
         return sm.applyMount({
@@ -6014,6 +6227,14 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         authorizeRequest(context, currentMetadata.sharing, "interact");
         const sm = handlers.serveManager;
         if (!sm) throw new Error("Serve manager not available");
+        const target = sm.getMount(params.name);
+        if (target && !serveCallerTrusted(context)) {
+          const callerEmail = (context?.user?.email || "").toLowerCase();
+          const mountOwner = (target.ownerEmail || "").toLowerCase();
+          if (!callerEmail || !mountOwner || callerEmail !== mountOwner) {
+            throw new Error(`Not authorized to remove mount '${params.name}' (owned by another user)`);
+          }
+        }
         await sm.removeMount(params.name);
         return { removed: true };
       },
@@ -6033,7 +6254,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!sm) throw new Error("Serve manager not available");
         const info = sm.getInfo();
         const isAdmin = serveCallerTrusted(context);
-        return { ...info, mounts: (info.mounts || []).map((m) => sanitizeMountForRole(m, isAdmin)) };
+        const mounts = (info.mounts || []).map((m) => sanitizeMountForRole(m, isAdmin));
+        const topUrl = isAdmin ? info.url : mounts[0]?.url ?? null;
+        return { ...info, url: topUrl, mounts };
       },
       /**
        * Aggregate frpc tunnel health for all serve mounts.
@@ -6359,7 +6582,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-CSwHDjzp.mjs');
+          const { toolsForRole } = await import('./sideband-CdJ0O6L6.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -6464,7 +6687,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands--WPYI2sm.mjs');
+    const { queryCore } = await import('./commands-CJVqMnNf.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -6742,6 +6965,48 @@ const AWAIT_MAX = num("SVAMP_INBOX_AWAIT_MAX", 200);
 function awaitPath(sessionId) {
   return join$1(SVAMP_HOME$2, "awaiting", `${sessionId}.json`);
 }
+const _sleepSab = new Int32Array(new SharedArrayBuffer(4));
+function sleepSync(ms) {
+  try {
+    Atomics.wait(_sleepSab, 0, 0, ms);
+  } catch {
+  }
+}
+function withAwaitLock(sessionId, fn) {
+  const lock = awaitPath(sessionId) + ".lock";
+  try {
+    mkdirSync$1(join$1(SVAMP_HOME$2, "awaiting"), { recursive: true });
+  } catch {
+  }
+  const deadline = Date.now() + 50;
+  let held = false;
+  while (Date.now() < deadline) {
+    try {
+      mkdirSync$1(lock);
+      held = true;
+      break;
+    } catch {
+      try {
+        if (Date.now() - statSync(lock).mtimeMs > 5e3) {
+          rmSync$1(lock, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+      }
+      sleepSync(5);
+    }
+  }
+  try {
+    return fn();
+  } finally {
+    if (held) {
+      try {
+        rmSync$1(lock, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  }
+}
 function readAwaiting(sessionId) {
   try {
     const p = awaitPath(sessionId);
@@ -6764,14 +7029,16 @@ function writeAwaiting(sessionId, map) {
 }
 function registerAwaitingReply(sessionId, threadId, now = Date.now()) {
   if (!sessionId || !threadId) return;
-  const map = readAwaiting(sessionId);
-  for (const k of Object.keys(map)) if (now - map[k] > AWAIT_TTL_MS) delete map[k];
-  map[threadId] = now;
-  const keys = Object.keys(map);
-  if (keys.length > AWAIT_MAX) {
-    keys.sort((a, b) => map[a] - map[b]).slice(0, keys.length - AWAIT_MAX).forEach((k) => delete map[k]);
-  }
-  writeAwaiting(sessionId, map);
+  withAwaitLock(sessionId, () => {
+    const map = readAwaiting(sessionId);
+    for (const k of Object.keys(map)) if (now - map[k] > AWAIT_TTL_MS) delete map[k];
+    map[threadId] = now;
+    const keys = Object.keys(map);
+    if (keys.length > AWAIT_MAX) {
+      keys.sort((a, b) => map[a] - map[b]).slice(0, keys.length - AWAIT_MAX).forEach((k) => delete map[k]);
+    }
+    writeAwaiting(sessionId, map);
+  });
 }
 function peekAwaitingReply(sessionId, threadId, now = Date.now()) {
   if (!sessionId || !threadId) return false;
@@ -6782,10 +7049,12 @@ function peekAwaitingReply(sessionId, threadId, now = Date.now()) {
 }
 function consumeAwaitingReply(sessionId, threadId) {
   if (!sessionId || !threadId) return;
-  const map = readAwaiting(sessionId);
-  if (!(threadId in map)) return;
-  delete map[threadId];
-  writeAwaiting(sessionId, map);
+  withAwaitLock(sessionId, () => {
+    const map = readAwaiting(sessionId);
+    if (!(threadId in map)) return;
+    delete map[threadId];
+    writeAwaiting(sessionId, map);
+  });
 }
 function computeOutboundHop(sessionId) {
   if (!sessionId) return { hopCount: 0, fromInboxTurn: false };
@@ -6908,7 +7177,7 @@ function saveInbox(projectDir, sessionId, inbox) {
   try {
     const p = inboxFilePath(projectDir, sessionId);
     mkdirSync$1(dirname(p), { recursive: true });
-    const tmp = `${p}.tmp-${process.pid}`;
+    const tmp = `${p}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
     writeFileSync$1(tmp, JSON.stringify(inbox));
     renameSync(tmp, p);
   } catch {
@@ -7188,6 +7457,7 @@ class OutpostCoordinator {
   clearTimer;
   execTimeoutMs;
   staleMs;
+  sweeper = null;
   constructor(opts = {}) {
     this.now = opts.now || (() => Date.now());
     this.setTimer = opts.setTimer || ((fn, ms) => setTimeout(fn, ms));
@@ -7208,6 +7478,35 @@ class OutpostCoordinator {
       }
     }
   }
+  /** Public sweep — prune stale connections and fail their in-flight execs. Safe to call anytime. */
+  sweepStale() {
+    this.prune();
+  }
+  /**
+   * Start a periodic background sweep so an in-flight exec to a machine that STOPS polling is
+   * failed FAST (#0612) — the header's "rejected immediately with a clear disconnected error"
+   * promise. Without this driver, prune() only ran on-demand (register/list/isConnected), so an
+   * already-enqueued exec waited the full OUTPOST_EXEC_TIMEOUT_MS backstop. Opt-in (the daemon
+   * enables it; the pure unit tests drive time via injected timers and never call this). Unref'd
+   * so it never keeps the process alive; idempotent.
+   */
+  startSweeper(intervalMs = Math.max(5e3, Math.floor(this.staleMs / 3))) {
+    if (this.sweeper) return;
+    this.sweeper = setInterval(() => {
+      try {
+        this.prune();
+      } catch {
+      }
+    }, intervalMs);
+    this.sweeper.unref?.();
+  }
+  /** Stop the background sweep (e.g. on session teardown). Idempotent. */
+  dispose() {
+    if (this.sweeper) {
+      clearInterval(this.sweeper);
+      this.sweeper = null;
+    }
+  }
   /** Reject every pending exec on a machine with a synthetic disconnect result (exitCode -1). */
   failMachine(machine, reason) {
     for (const [id, p] of [...this.pending]) {
@@ -7309,6 +7608,7 @@ class OutpostCoordinator {
   resolveResult(result) {
     const p = this.pending.get(result.id);
     if (!p) return false;
+    if (result.machine && result.machine !== p.machine) return false;
     this.clearTimer(p.timer);
     this.pending.delete(result.id);
     this.touch(p.machine);
@@ -7734,6 +8034,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
   const meetingActivity = [];
   const channelOutbox = new ChannelOutbox(initialMetadata.path);
   const outpostCoordinator = new OutpostCoordinator();
+  outpostCoordinator.startSweeper();
   const outpostProjectDir = () => metadata.path || process.cwd();
   const announceOutpost = (conn) => {
     const who = conn.label || conn.machine;
@@ -7804,7 +8105,10 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
   const ensureParticipantsChannel = (sharing) => {
     try {
       if (sharing?.enabled) channelStore.save(buildParticipantsChannel(sharing));
-      else channelStore.remove(PARTICIPANTS_CHANNEL_ID);
+      else {
+        channelStore.remove(PARTICIPANTS_CHANNEL_ID);
+        channelOutbox.purge(PARTICIPANTS_CHANNEL_ID);
+      }
     } catch {
     }
   };
@@ -8228,7 +8532,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       const rec = loadOutpostToken(outpostProjectDir(), sessionId);
       if (!outpostTokenMatches(rec, params?.token)) return { error: "unauthorized" };
       if (!params?.id) return { error: "missing result id" };
-      const ok = outpostCoordinator.resolveResult({ id: params.id, stdout: params.stdout, stderr: params.stderr, exitCode: params.exitCode });
+      const ok = outpostCoordinator.resolveResult({ id: params.id, stdout: params.stdout, stderr: params.stderr, exitCode: params.exitCode, machine: params.machine });
       return { ok };
     },
     outpostExec: async (params, context) => {
@@ -8743,7 +9047,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // ── Inbox ──
     sendInboxMessage: async (message, context) => {
       authorizeRequest(context, metadata.sharing, "interact");
-      const trusted = getEffectiveRole(context, metadata.sharing) === "admin";
+      const trusted = !context?.user || isSameOwnerWorkspace(context) || !!metadata.sharing && getEffectiveRole(context, metadata.sharing) === "admin";
       const msg = sanitizeInboundInboxMessage(message, { trusted, callerEmail: context?.user?.email });
       inbox.push(msg);
       while (inbox.length > INBOX_MAX) inbox.shift();
@@ -10175,18 +10479,56 @@ function eventAlias(eventId, recipientEmail) {
 class SharingNotificationSync {
   server;
   artifactManager = null;
+  amResolvedAt = 0;
   shareCollectionId = null;
   eventCollectionId = null;
   initialized = false;
   log;
+  // A resolved `public/artifact-manager` proxy is bound to a SPECIFIC backend client_id. When that
+  // backend pod is replaced (deploy/restart/idle-evict), the new instance registers under the same
+  // public alias but a fresh client_id — the cached proxy dangles and every call TIMES OUT (~30s).
+  // Before this fix that silently broke ALL zero-click share writes fleet-wide (empty
+  // svamp-shared-sessions → recipients never auto-discovered). So we re-resolve on a short TTL and,
+  // on any RPC error, force one fresh re-resolve + retry (a dead pod's proxy always fails first).
+  static AM_TTL_MS = 3e4;
   constructor(server, log) {
     this.server = server;
     this.log = log;
   }
+  /**
+   * Resolve `public/artifact-manager` on the daemon's live connection. hypha-rpc re-queries the
+   * server registry on each getService() call, so a fresh resolve yields the CURRENTLY-registered
+   * live instance (not the dangling cached one). Cached within a short TTL to avoid a lookup per
+   * write; `force` bypasses the cache after a failure.
+   */
+  async getAM(force = false) {
+    const now = Date.now();
+    if (!force && this.artifactManager && now - this.amResolvedAt < SharingNotificationSync.AM_TTL_MS) {
+      return this.artifactManager;
+    }
+    const am = await this.server.getService("public/artifact-manager");
+    this.artifactManager = am;
+    this.amResolvedAt = Date.now();
+    return am;
+  }
+  /**
+   * Run an artifact-manager operation with automatic recovery from a stale/dead proxy: try with the
+   * (possibly cached) instance; on ANY error, force a fresh re-resolve and retry ONCE. This is the
+   * heart of the stale-proxy fix — a replaced backend pod makes the first call time out, the retry
+   * re-binds to the live instance and succeeds. The caller still catches the final error.
+   */
+  async withAM(op) {
+    try {
+      return await op(await this.getAM(false));
+    } catch (err) {
+      this.log(`[SHARING NOTIFY] artifact-manager call failed (${err?.message}); re-resolving + retrying`);
+      return await op(await this.getAM(true));
+    }
+  }
   async init() {
     try {
-      this.artifactManager = await this.server.getService("public/artifact-manager");
-      if (!this.artifactManager) {
+      const am = await this.getAM(true);
+      if (!am) {
         this.log("[SHARING NOTIFY] Artifact manager not available");
         return;
       }
@@ -10215,15 +10557,17 @@ class SharingNotificationSync {
       shareType: params.shareType || "session"
     };
     try {
-      const artifact = await this.artifactManager.create({
-        alias,
-        parent_id: this.shareCollectionId,
-        type: "share-notification",
-        stage: true,
-        manifest,
-        _rkwargs: true
-      });
-      await this.artifactManager.commit({ artifact_id: artifact.id, _rkwargs: true }).catch(() => {
+      await this.withAM(async (am) => {
+        const artifact = await am.create({
+          alias,
+          parent_id: this.shareCollectionId,
+          type: "share-notification",
+          stage: true,
+          manifest,
+          _rkwargs: true
+        });
+        await am.commit({ artifact_id: artifact.id, _rkwargs: true }).catch(() => {
+        });
       });
     } catch (createErr) {
       this.log(`[SHARING NOTIFY] share-notification attach skipped for ${params.recipientEmail}: ${createErr.message}`);
@@ -10265,14 +10609,16 @@ class SharingNotificationSync {
     if (!this.initialized || !this.shareCollectionId) return;
     const alias = shareAlias(sessionId, recipientEmail);
     try {
-      const existing = await this.artifactManager.read({
-        artifact_id: alias,
-        parent_id: this.shareCollectionId,
-        _rkwargs: true
-      });
-      await this.artifactManager.delete({
-        artifact_id: existing.id,
-        _rkwargs: true
+      await this.withAM(async (am) => {
+        const existing = await am.read({
+          artifact_id: alias,
+          parent_id: this.shareCollectionId,
+          _rkwargs: true
+        });
+        await am.delete({
+          artifact_id: existing.id,
+          _rkwargs: true
+        });
       });
       this.log(`[SHARING NOTIFY] Removed share notification for ${recipientEmail} on ${sessionId.slice(0, 8)}`);
     } catch {
@@ -10303,17 +10649,19 @@ class SharingNotificationSync {
     if (!this.initialized || !this.eventCollectionId) return;
     const alias = eventAlias(event.id, event.recipientEmail);
     try {
-      const artifact = await this.artifactManager.create({
-        alias,
-        parent_id: this.eventCollectionId,
-        type: "user-event",
-        stage: true,
-        manifest: event,
-        _rkwargs: true
-      });
-      await this.artifactManager.commit({
-        artifact_id: artifact.id,
-        _rkwargs: true
+      await this.withAM(async (am) => {
+        const artifact = await am.create({
+          alias,
+          parent_id: this.eventCollectionId,
+          type: "user-event",
+          stage: true,
+          manifest: event,
+          _rkwargs: true
+        });
+        await am.commit({
+          artifact_id: artifact.id,
+          _rkwargs: true
+        });
       });
       this.log(`[USER EVENT] Published ${event.type} to ${event.recipientEmail}`);
       try {
@@ -10340,7 +10688,7 @@ class SharingNotificationSync {
     const all = [];
     const seen = /* @__PURE__ */ new Set();
     for (let offset = 0; ; offset += PAGE) {
-      const page = await this.artifactManager.list({ parent_id: parentId, offset, limit: PAGE, _rkwargs: true });
+      const page = await this.withAM((am) => am.list({ parent_id: parentId, offset, limit: PAGE, _rkwargs: true }));
       if (!Array.isArray(page) || page.length === 0) break;
       let fresh = 0;
       for (const c of page) {
@@ -10381,7 +10729,7 @@ class SharingNotificationSync {
         live.push(m);
       }
       for (const id of expiredOwnedIds) {
-        this.artifactManager.delete({ artifact_id: id, _rkwargs: true }).catch(() => {
+        this.withAM((am) => am.delete({ artifact_id: id, _rkwargs: true })).catch(() => {
         });
       }
       return live.sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
@@ -10407,7 +10755,7 @@ class SharingNotificationSync {
         return m && typeof m.id === "string" && (m.id === eventId || m.id.slice(0, 8) === short) && typeof m.recipientEmail === "string" && m.recipientEmail.toLowerCase() === normalized;
       });
       if (!match) return false;
-      await this.artifactManager.delete({ artifact_id: match.id, _rkwargs: true });
+      await this.withAM((am) => am.delete({ artifact_id: match.id, _rkwargs: true }));
       this.log(`[USER EVENT] Acked ${eventId.slice(0, 8)} for ${recipientEmail}`);
       return true;
     } catch (err) {
@@ -13517,7 +13865,13 @@ const MAX_RESTART_DELAY_S = 300;
 const BACKOFF_RESET_WINDOW_MS = 6e4;
 const MAX_LOG_LINES = 300;
 const CRASH_LOOP_FAILURE_THRESHOLD = 10;
-const CRASH_LOOP_WINDOW_MS = 3e5;
+function accumulateCrashLoopFailure(prev, healthy, now) {
+  if (healthy) return { consecutiveFailures: 0, failureWindowStart: void 0 };
+  return {
+    consecutiveFailures: prev.consecutiveFailures + 1,
+    failureWindowStart: prev.failureWindowStart ?? now
+  };
+}
 class ProcessSupervisor {
   entries = /* @__PURE__ */ new Map();
   persistDir;
@@ -13924,17 +14278,13 @@ class ProcessSupervisor {
     if (!spec.keepAlive) return;
     const uptime = state.startedAt ? Date.now() - state.startedAt : 0;
     const now = Date.now();
-    if (uptime > BACKOFF_RESET_WINDOW_MS) {
-      state.consecutiveFailures = 0;
-      entry.failureWindowStart = void 0;
-    } else {
-      if (!entry.failureWindowStart || now - entry.failureWindowStart > CRASH_LOOP_WINDOW_MS) {
-        entry.failureWindowStart = now;
-        state.consecutiveFailures = 1;
-      } else {
-        state.consecutiveFailures++;
-      }
-    }
+    const acct = accumulateCrashLoopFailure(
+      { consecutiveFailures: state.consecutiveFailures, failureWindowStart: entry.failureWindowStart },
+      uptime > BACKOFF_RESET_WINDOW_MS,
+      now
+    );
+    state.consecutiveFailures = acct.consecutiveFailures;
+    entry.failureWindowStart = acct.failureWindowStart;
     if (state.consecutiveFailures >= CRASH_LOOP_FAILURE_THRESHOLD) {
       const windowS = Math.round((now - (entry.failureWindowStart ?? now)) / 1e3);
       state.status = "crash-loop-backoff";
@@ -14193,22 +14543,29 @@ function parseIssue(content) {
     body: (m[2] || "").trim() || void 0
   };
 }
-function readDir(dir) {
+function readDirWithMtime(dir) {
   if (!existsSync(dir)) return [];
   const out = [];
   for (const name of readdirSync(dir)) {
     if (!name.endsWith(".md")) continue;
     try {
-      const issue = parseIssue(readFileSync(join$1(dir, name), "utf-8"));
-      if (issue) out.push(issue);
+      const p = join$1(dir, name);
+      const issue = parseIssue(readFileSync(p, "utf-8"));
+      if (issue) out.push({ issue, mtimeMs: statSync(p).mtimeMs });
     } catch {
     }
   }
   return out;
 }
 function listIssues(projectRoot, opts = {}) {
-  let items = readDir(issuesDir(projectRoot));
-  if (opts.includeArchived) items = items.concat(readDir(archiveDir(projectRoot)));
+  const entries = readDirWithMtime(issuesDir(projectRoot));
+  if (opts.includeArchived) entries.push(...readDirWithMtime(archiveDir(projectRoot)));
+  const byId = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const prev = byId.get(e.issue.id);
+    if (!prev || e.mtimeMs >= prev.mtimeMs) byId.set(e.issue.id, e);
+  }
+  let items = Array.from(byId.values()).map((e) => e.issue);
   if (opts.status) items = items.filter((i) => i.status === opts.status);
   if (opts.label) items = items.filter((i) => i.labels.includes(opts.label));
   if (opts.scope) items = items.filter((i) => i.scope === opts.scope);
@@ -14223,20 +14580,22 @@ function isVisibleTo(issue, session) {
 }
 function getIssue(projectRoot, id) {
   const padded = /^\d+$/.test(id) ? id.padStart(4, "0") : id;
+  let best = null;
   for (const p of [issuePath(projectRoot, padded), issuePath(projectRoot, padded, true)]) {
-    if (existsSync(p)) {
-      try {
-        return parseIssue(readFileSync(p, "utf-8"));
-      } catch {
-        return null;
-      }
+    if (!existsSync(p)) continue;
+    try {
+      const issue = parseIssue(readFileSync(p, "utf-8"));
+      if (!issue) continue;
+      const mtimeMs = statSync(p).mtimeMs;
+      if (!best || mtimeMs >= best.mtimeMs) best = { issue, mtimeMs };
+    } catch {
     }
   }
-  return null;
+  return best ? best.issue : null;
 }
 function atomicWrite(path, content) {
   mkdirSync$1(dirname(path), { recursive: true });
-  const tmp = `${path}.tmp-${process.pid}`;
+  const tmp = `${path}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
   writeFileSync$1(tmp, content);
   renameSync(tmp, path);
 }
@@ -14280,7 +14639,18 @@ function addIssue(projectRoot, fields) {
   }
   throw new Error("addIssue: could not allocate a free issue id");
 }
-function updateIssue(projectRoot, id, patch) {
+function issueLockPath(projectRoot, id) {
+  const padded = /^\d+$/.test(id) ? id.padStart(4, "0") : id;
+  return join$1(issuesDir(projectRoot), `${padded}.lock`);
+}
+function withIssueLock(projectRoot, id, fn) {
+  try {
+    mkdirSync$1(issuesDir(projectRoot), { recursive: true });
+  } catch {
+  }
+  return withFileLock(issueLockPath(projectRoot, id), fn);
+}
+function _updateIssueUnlocked(projectRoot, id, patch) {
   const cur = getIssue(projectRoot, id);
   if (!cur) return null;
   const wasArchived = cur.status === "archived";
@@ -14299,17 +14669,23 @@ function updateIssue(projectRoot, id, patch) {
   }
   return next;
 }
+function updateIssue(projectRoot, id, patch) {
+  return withIssueLock(projectRoot, id, () => _updateIssueUnlocked(projectRoot, id, patch));
+}
 function addComment(projectRoot, id, text) {
-  const cur = getIssue(projectRoot, id);
-  if (!cur || !text.trim()) return cur;
-  const entry = `
+  if (!text.trim()) return getIssue(projectRoot, id);
+  return withIssueLock(projectRoot, id, () => {
+    const cur = getIssue(projectRoot, id);
+    if (!cur) return null;
+    const entry = `
 
 ---
 **Follow-up \xB7 ${(/* @__PURE__ */ new Date()).toISOString()}**
 
 ${text.trim()}`;
-  const body = (cur.body ? cur.body.replace(/\s+$/, "") : "") + entry;
-  return updateIssue(projectRoot, id, { body });
+    const body = (cur.body ? cur.body.replace(/\s+$/, "") : "") + entry;
+    return _updateIssueUnlocked(projectRoot, id, { body });
+  });
 }
 function pauseIssue(projectRoot, id, question) {
   const cur = getIssue(projectRoot, id);
@@ -14376,8 +14752,14 @@ function workflowCrons(wf) {
 function workflowsDir(projectRoot) {
   return join$1(projectRoot, ".svamp", "workflows");
 }
+function validateWorkflowName(name) {
+  if (typeof name !== "string" || !/^[A-Za-z0-9._-]+$/.test(name) || name === "." || name === "..") {
+    throw new Error(`Invalid workflow name "${name}" \u2014 allowed: letters, digits, dot, dash, underscore (no path separators).`);
+  }
+  return name;
+}
 function workflowPath(projectRoot, name) {
-  return join$1(workflowsDir(projectRoot), `${name}.yaml`);
+  return join$1(workflowsDir(projectRoot), `${validateWorkflowName(name)}.yaml`);
 }
 function normalizeOn(on) {
   if (!on || typeof on !== "object") {
@@ -14469,7 +14851,12 @@ function listWorkflows(projectRoot) {
   return out.sort((a, b) => a.name.localeCompare(b.name));
 }
 function getWorkflow(projectRoot, name) {
-  const p = workflowPath(projectRoot, name);
+  let p;
+  try {
+    p = workflowPath(projectRoot, name);
+  } catch {
+    return null;
+  }
   if (!existsSync(p)) return null;
   try {
     return parseWorkflow(readFileSync(p, "utf-8"));
@@ -14478,14 +14865,19 @@ function getWorkflow(projectRoot, name) {
   }
 }
 function rawWorkflow(projectRoot, name) {
-  const p = workflowPath(projectRoot, name);
+  let p;
+  try {
+    p = workflowPath(projectRoot, name);
+  } catch {
+    return null;
+  }
   return existsSync(p) ? readFileSync(p, "utf-8") : null;
 }
 function saveWorkflow(projectRoot, wf) {
   const dir = workflowsDir(projectRoot);
   mkdirSync$1(dir, { recursive: true });
   const path = workflowPath(projectRoot, wf.name);
-  const tmp = `${path}.tmp-${process.pid}`;
+  const tmp = `${path}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
   writeFileSync$1(tmp, serializeWorkflow(wf));
   renameSync(tmp, path);
 }
@@ -14517,6 +14909,10 @@ function maxRunsPerWorkflow() {
 }
 const MAX_STREAM_CHARS = 8e3;
 const STEP_TIMEOUT_MS = 12e4;
+function stepTimeoutMs() {
+  const v = Number(process.env.SVAMP_WORKFLOW_STEP_TIMEOUT_MS);
+  return Number.isFinite(v) && v > 0 ? v : STEP_TIMEOUT_MS;
+}
 function capStream(s, max = MAX_STREAM_CHARS) {
   if (s.length <= max) return s;
   const head = Math.floor(max * 0.6);
@@ -14546,14 +14942,16 @@ function recordRun(projectRoot, run) {
     const dir = runsDir(projectRoot);
     if (!existsSync(dir)) mkdirSync$1(dir, { recursive: true });
     const file = runsFile(projectRoot, run.workflow);
-    const existing = loadRuns(projectRoot, run.workflow);
-    const idx = existing.findIndex((r) => r.id === run.id);
-    if (idx >= 0) existing[idx] = run;
-    else existing.push(run);
-    const kept = existing.slice(-maxRunsPerWorkflow());
-    const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-    writeFileSync$1(tmp, kept.map((r) => JSON.stringify(r)).join("\n") + "\n");
-    renameSync(tmp, file);
+    withFileLock(`${file}.lock`, () => {
+      const existing = loadRuns(projectRoot, run.workflow);
+      const idx = existing.findIndex((r) => r.id === run.id);
+      if (idx >= 0) existing[idx] = run;
+      else existing.push(run);
+      const kept = existing.slice(-maxRunsPerWorkflow());
+      const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+      writeFileSync$1(tmp, kept.map((r) => JSON.stringify(r)).join("\n") + "\n");
+      renameSync(tmp, file);
+    });
   } catch {
   }
 }
@@ -14589,6 +14987,48 @@ function listRuns(projectRoot, workflow, opts = {}) {
 function getRun(projectRoot, workflow, runId) {
   return loadRuns(projectRoot, workflow).find((r) => r.id === runId) || null;
 }
+function reconcileInterruptedRuns(projectRoot) {
+  let fixed = 0;
+  try {
+    const dir = runsDir(projectRoot);
+    if (!existsSync(dir)) return 0;
+    for (const entry of readdirSync(dir)) {
+      if (!entry.endsWith(".jsonl")) continue;
+      const file = join$1(dir, entry);
+      let runs;
+      try {
+        runs = readFileSync(file, "utf-8").split("\n").filter(Boolean).map((l) => {
+          try {
+            return JSON.parse(l);
+          } catch {
+            return null;
+          }
+        }).filter((r) => !!r);
+      } catch {
+        continue;
+      }
+      let changed = false;
+      for (const r of runs) {
+        if (r.status !== "running") continue;
+        if (isWorkflowInFlight(projectRoot, r.workflow)) continue;
+        r.status = "failed";
+        r.error = r.error || "interrupted by daemon restart";
+        r.finishedAt = r.finishedAt || r.startedAt;
+        changed = true;
+        fixed++;
+      }
+      if (!changed) continue;
+      try {
+        const tmp = `${file}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
+        writeFileSync$1(tmp, runs.map((r) => JSON.stringify(r)).join("\n") + "\n");
+        renameSync(tmp, file);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return fixed;
+}
 function defaultExecStep(root, cmd, env) {
   return new Promise((resolve) => {
     let stdout = "", stderr = "", timedOut = false, settled = false;
@@ -14598,14 +15038,18 @@ function defaultExecStep(root, cmd, env) {
       resolve({ exitCode, stdout, stderr, timedOut });
     };
     try {
-      const child = spawn$1("sh", ["-c", cmd], { cwd: root, env, stdio: ["ignore", "pipe", "pipe"] });
+      const child = spawn$1("sh", ["-c", cmd], { cwd: root, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
       const timer = setTimeout(() => {
         timedOut = true;
         try {
-          child.kill("SIGKILL");
+          if (child.pid) process.kill(-child.pid, "SIGKILL");
         } catch {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
         }
-      }, STEP_TIMEOUT_MS);
+      }, stepTimeoutMs());
       child.stdout?.on("data", (d) => {
         stdout += d.toString();
         if (stdout.length > MAX_STREAM_CHARS * 4) stdout = capStream(stdout);
@@ -14684,6 +15128,9 @@ const inFlightRuns = /* @__PURE__ */ new Map();
 function workflowLockKey(projectRoot, name) {
   return `${projectRoot}\0${name}`;
 }
+function isWorkflowInFlight(projectRoot, name) {
+  return inFlightRuns.has(workflowLockKey(projectRoot, name));
+}
 function runWorkflow(projectRoot, wf, opts) {
   if (opts.allowConcurrent) return runWorkflowInner(projectRoot, wf, opts);
   const key = workflowLockKey(projectRoot, wf.name);
@@ -14760,6 +15207,25 @@ async function runWorkflowInner(projectRoot, wf, opts) {
   return run;
 }
 
+var runStore = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    MAX_RUNS_PER_WORKFLOW: MAX_RUNS_PER_WORKFLOW,
+    MAX_STREAM_CHARS: MAX_STREAM_CHARS,
+    STEP_TIMEOUT_MS: STEP_TIMEOUT_MS,
+    capStream: capStream,
+    escalateWorkflowFailure: escalateWorkflowFailure,
+    getRun: getRun,
+    isWorkflowInFlight: isWorkflowInFlight,
+    listRuns: listRuns,
+    loadRuns: loadRuns,
+    maxRunsPerWorkflow: maxRunsPerWorkflow,
+    reconcileInterruptedRuns: reconcileInterruptedRuns,
+    recordRun: recordRun,
+    runWorkflow: runWorkflow,
+    runsDir: runsDir,
+    stepTimeoutMs: stepTimeoutMs
+});
+
 const DEFAULT_IDLE_COOLDOWN_MS = 15e3;
 function idleCooldownMs() {
   const raw = Number(process.env.SVAMP_WORKFLOW_IDLE_COOLDOWN_MS);
@@ -15162,7 +15628,9 @@ async function readCredentials() {
 }
 async function writeCredentials(creds) {
   const path = getCredentialsPath();
-  await writeFile(path, JSON.stringify(creds), { mode: 384 });
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  await writeFile(tmp, JSON.stringify(creds), { mode: 384 });
+  await rename$1(tmp, path);
 }
 async function checkAndRefreshOAuthToken(force = false, logger) {
   const log = logger?.log ?? (() => {
@@ -17051,7 +17519,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-B3FTfsg-.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-D68wBf-y.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -17069,7 +17537,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-Dsada5ox.mjs');
+    const { FrpcTunnel } = await import('./frpc-NDcBtpwa.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -17138,10 +17606,14 @@ async function startDaemon(options) {
     const routeSupervisionVerdict = (parentId, v) => {
       try {
         if (!parentId) return;
-        const parent = Array.from(pidToTrackedSession.values()).find((t) => t.svampSessionId === parentId);
-        const send = parent?.sessionRPCHandlers?.sendInboxMessage;
-        if (!send) return;
-        Promise.resolve(send({
+        const tracked = Array.from(pidToTrackedSession.values());
+        const parent = tracked.find((t) => t.svampSessionId === parentId);
+        const liveParent = tracked.find((t) => t.svampSessionId === parentId && !t.stopped);
+        const send = liveParent?.sessionRPCHandlers?.sendInboxMessage;
+        if (!send) {
+          logger.log(`[supervision] parent ${parentId.slice(0, 8)} not live \u2014 recording verdict on the backlog issue only (no in-memory wake)`);
+        }
+        if (send) Promise.resolve(send({
           messageId: randomUUID$1(),
           from: `agent:${v.sessionId}`,
           fromSession: v.sessionId,
@@ -17680,24 +18152,22 @@ ${parts.join("\n")}`);
         const STUCK_CHECK_INTERVAL_MS = 2 * 60 * 1e3;
         let lastOutputTime = Date.now();
         let stuckWatchdogTimer = null;
-        const hasActiveChildren = (pid) => {
-          try {
-            const result = execSync(`pgrep -P ${pid}`, { encoding: "utf8", timeout: 5e3 });
-            return result.trim().length > 0;
-          } catch {
-            return false;
-          }
-        };
+        const hasActiveChildren = (pid) => new Promise((resolve2) => {
+          execFile("pgrep", ["-P", String(pid)], { encoding: "utf8", timeout: 5e3 }, (err, stdout) => {
+            resolve2(!err && String(stdout).trim().length > 0);
+          });
+        });
         const startStuckWatchdog = () => {
           if (stuckWatchdogTimer) return;
-          stuckWatchdogTimer = setInterval(() => {
+          stuckWatchdogTimer = setInterval(async () => {
             if (!claudeProcess || claudeProcess.exitCode !== null) return;
             if (!sessionWasProcessing) return;
             if (!isLoopActive(directory, sessionId)) return;
-            if (claudeProcess.pid && hasActiveChildren(claudeProcess.pid)) {
+            if (claudeProcess.pid && await hasActiveChildren(claudeProcess.pid)) {
               lastOutputTime = Date.now();
               return;
             }
+            if (!claudeProcess || claudeProcess.exitCode !== null) return;
             const elapsed = Date.now() - lastOutputTime;
             if (elapsed > STUCK_PROCESS_TIMEOUT_MS) {
               logger.log(`[Session ${sessionId}] Loop stuck: mid-turn, no output for ${Math.round(elapsed / 1e3)}s, no child processes \u2014 killing to resume the loop`);
@@ -18398,7 +18868,7 @@ ${parts.join("\n")}`);
                             auto_resumes: prog.auto_resumes
                           });
                           const extNote = summarizeExtensions(ls.extensions, maxExt);
-                          const resumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Resume & extend with:  svamp session loop-resume ${sessionId} --max <N>`;
+                          const resumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
                           const detail = `${budgetCheck.reason} (hard ${iterStop ? "iteration ceiling" : "cost ceiling"} \u2014 will not auto-resume)${extNote ? ` [${extNote}]` : ""}. ${resumeHint}`;
                           sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Loop stopped \u2014 ${detail}`, level: "warning" }, "event");
                           checkSvampConfig?.();
@@ -19285,19 +19755,19 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc--eK356Xz.mjs');
+              const { issueRpc } = await import('./rpc-K5xzddMF.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DOVHyr_6.mjs');
+              const { workflowRpc } = await import('./rpc-DSyBSuTF.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
-              const { execFile } = await import('child_process');
+              const { execFile: execFile2 } = await import('child_process');
               const rgCwd = cwd || directory;
               const argv = Array.isArray(args) ? args : String(args).split(/\s+/).filter(Boolean);
               return new Promise((resolve2, reject) => {
-                execFile("rg", argv, { cwd: rgCwd, timeout: 3e4, maxBuffer: 5 * 1024 * 1024 }, (err, stdout) => {
+                execFile2("rg", argv, { cwd: rgCwd, timeout: 3e4, maxBuffer: 5 * 1024 * 1024 }, (err, stdout) => {
                   if (err && !stdout) {
                     reject(new Error(err.message));
                   } else {
@@ -19921,19 +20391,19 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc--eK356Xz.mjs');
+              const { issueRpc } = await import('./rpc-K5xzddMF.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-DOVHyr_6.mjs');
+              const { workflowRpc } = await import('./rpc-DSyBSuTF.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
-              const { execFile } = await import('child_process');
+              const { execFile: execFile2 } = await import('child_process');
               const rgCwd = cwd || directory;
               const argv = Array.isArray(args) ? args : String(args).split(/\s+/).filter(Boolean);
               return new Promise((resolve2, reject) => {
-                execFile("rg", argv, { cwd: rgCwd, timeout: 3e4, maxBuffer: 5 * 1024 * 1024 }, (err, stdout) => {
+                execFile2("rg", argv, { cwd: rgCwd, timeout: 3e4, maxBuffer: 5 * 1024 * 1024 }, (err, stdout) => {
                   if (err && !stdout) {
                     reject(new Error(err.message));
                   } else {
@@ -20208,7 +20678,8 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           const startedAt = typeof ls.started_at === "number" ? ls.started_at : typeof ls.resumed_at === "number" ? ls.resumed_at : void 0;
           const oracleCmd = typeof ls.oracle === "string" && ls.oracle.trim() ? ls.oracle.trim() : void 0;
           const acpCumTokens = agentBackend.getCumulativeTokens?.() ?? 0;
-          const acpPrevCum = typeof ls.acp_last_cum_tokens === "number" ? ls.acp_last_cum_tokens : 0;
+          let acpPrevCum = typeof ls.acp_last_cum_tokens === "number" ? ls.acp_last_cum_tokens : 0;
+          if (acpCumTokens < acpPrevCum) acpPrevCum = 0;
           const acpDeltaTokens = Math.max(0, acpCumTokens - acpPrevCum);
           ls.acp_last_cum_tokens = acpCumTokens;
           const ledger = accumulateLedger(ls.ledger, { turns: 1, tokens: acpDeltaTokens, ts: now });
@@ -20242,7 +20713,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               const iterStop = !isCostCeiling(budgetCheck.kind);
               writeGoalLoopState(directory, sessionId, { ...ls, active: false, phase: "gave_up", completed_at: now, gave_up_reason: `resource budget exhausted \u2014 ${budgetCheck.reason}`, ledger });
               const acpExtNote = summarizeExtensions(ls.extensions, acpMaxExt);
-              const acpResumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Resume & extend with:  svamp session loop-resume ${sessionId} --max <N>`;
+              const acpResumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
               sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Loop stopped \u2014 ${budgetCheck.reason} (hard ${iterStop ? "iteration ceiling" : "cost ceiling"} \u2014 will not auto-resume)${acpExtNote ? ` [${acpExtNote}]` : ""}. ${acpResumeHint}`, level: "warning" }, "event");
               checkSvampConfig?.();
               return;
@@ -20750,7 +21221,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const channelHttpPort = Number(process.env.SVAMP_CHANNEL_HTTP_PORT) || 0;
     if (channelHttpPort > 0) {
       try {
-        const { createChannelHttpServer } = await import('./httpServer-CSMZTpoh.mjs');
+        const { createChannelHttpServer } = await import('./httpServer-1XjB2h3K.mjs');
         const channelHttpServer = createChannelHttpServer({
           getSessionIds: () => {
             const ids = [];
@@ -20991,7 +21462,10 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (sessionsToAutoContinue.length > 0 && !options?.noAutoContinue) {
       logger.log(`Auto-continuing ${sessionsToAutoContinue.length} interrupted session(s)...`);
-      for (const sessionId of sessionsToAutoContinue) {
+      const AUTO_CONTINUE_STEP_MS = Number(process.env.SVAMP_AUTO_CONTINUE_STEP_MS) || 300;
+      const AUTO_CONTINUE_MAX_SPREAD_MS = Number(process.env.SVAMP_AUTO_CONTINUE_MAX_SPREAD_MS) || 6e4;
+      sessionsToAutoContinue.forEach((sessionId, i) => {
+        const delay = 2e3 + Math.min(i * AUTO_CONTINUE_STEP_MS, AUTO_CONTINUE_MAX_SPREAD_MS) + Math.floor(Math.random() * AUTO_CONTINUE_STEP_MS);
         setTimeout(async () => {
           try {
             const tracked = Array.from(pidToTrackedSession.values()).find((s) => s.svampSessionId === sessionId);
@@ -21008,8 +21482,8 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
           } catch (err) {
             logger.log(`Failed to auto-continue session ${sessionId}: ${err.message}`);
           }
-        }, 2e3);
-      }
+        }, delay);
+      });
     } else if (sessionsToAutoContinue.length > 0) {
       logger.log(`Skipping auto-continue for ${sessionsToAutoContinue.length} interrupted session(s) (--no-auto-continue)`);
     }
@@ -21072,15 +21546,24 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DAkzJVgr.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-CtKlSyIq.mjs');
+    const workflowProjectRoots = () => {
+      const dirs = /* @__PURE__ */ new Set();
+      for (const s of pidToTrackedSession.values()) {
+        if (!s.stopped && s.directory) dirs.add(s.directory);
+      }
+      return [...dirs];
+    };
+    try {
+      const { reconcileInterruptedRuns } = await Promise.resolve().then(function () { return runStore; });
+      let reconciled = 0;
+      for (const root of workflowProjectRoots()) reconciled += reconcileInterruptedRuns(root);
+      if (reconciled > 0) logger.log(`[workflow] reconciled ${reconciled} interrupted run(s) (running \u2192 failed) after restart`);
+    } catch (e) {
+      logger.log(`[workflow] interrupted-run reconcile skipped: ${e?.message || e}`);
+    }
     const workflowScheduler = new WorkflowScheduler({
-      projectRoots: () => {
-        const dirs = /* @__PURE__ */ new Set();
-        for (const s of pidToTrackedSession.values()) {
-          if (!s.stopped && s.directory) dirs.add(s.directory);
-        }
-        return [...dirs];
-      },
+      projectRoots: workflowProjectRoots,
       log: (m) => logger.log(m)
     });
     const workflowSchedulerInterval = setInterval(() => {
@@ -21696,4 +22179,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { listSkillFiles as $, removeWorkflow as A, saveWorkflow as B, rawWorkflow as C, listWorkflows as D, isWorkflowEnabled as E, workflowCrons as F, cronMatches as G, summarize as H, workflowSteps as I, parseJwtEmail as J, computeCollectionConfigUpdate as K, SYSTEM_COLLECTION_CONFIG as L, loadMachineContext as M, buildMachineInstructions as N, machineToolsForRole as O, buildMachineTools as P, parseFrontmatter as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, getSkillsServer as T, getSkillsWorkspaceName as U, getSkillsCollectionName as V, fetchWithTimeout as W, searchSkills as X, SKILLS_DIR as Y, getSkillInfo as Z, downloadSkillFile as _, createSessionStore as a, resolveModel as a0, clearStopMarker as a1, stopMarkerExists as a2, formatHandle as a3, normalizeAllowedUser as a4, loadSecurityContextConfig as a5, resolveSecurityContext as a6, buildSecurityContextFromFlags as a7, mergeSecurityContexts as a8, buildSessionShareUrl as a9, computeOutboundHop as aa, registerAwaitingReply as ab, buildMachineShareUrl as ac, parseHandle as ad, handleMatchesMetadata as ae, describeMisconfiguration as af, buildMachineDeps as ag, applyClaudeProxyEnv as ah, composeSessionId as ai, generateFriendlyName as aj, generateHookSettings as ak, staticFileServer as al, instanceConfig as am, claudeAuth as an, codexProvider as ao, projectInfo as ap, DefaultTransport$1 as aq, acpBackend as ar, acpAgentConfig as as, codexAppServerBackend as at, GeminiTransport$1 as au, api as av, run as aw, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, searchIssues as q, registerMachineService as r, startDaemon as s, isVisibleTo as t, updateIssue as u, getRun as v, listRuns as w, getWorkflow as x, runWorkflow as y, setWorkflowEnabled as z };
+export { downloadSkillFile as $, removeWorkflow as A, validateWorkflowName as B, saveWorkflow as C, rawWorkflow as D, listWorkflows as E, isWorkflowEnabled as F, workflowCrons as G, cronMatches as H, summarize as I, workflowSteps as J, parseJwtEmail as K, computeCollectionConfigUpdate as L, SYSTEM_COLLECTION_CONFIG as M, loadMachineContext as N, buildMachineInstructions as O, machineToolsForRole as P, buildMachineTools as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, parseFrontmatter as T, getSkillsServer as U, getSkillsWorkspaceName as V, getSkillsCollectionName as W, fetchWithTimeout as X, searchSkills as Y, SKILLS_DIR as Z, getSkillInfo as _, createSessionStore as a, listSkillFiles as a0, resolveModel as a1, clearStopMarker as a2, stopMarkerExists as a3, formatHandle as a4, normalizeAllowedUser as a5, loadSecurityContextConfig as a6, resolveSecurityContext as a7, buildSecurityContextFromFlags as a8, mergeSecurityContexts as a9, buildSessionShareUrl as aa, computeOutboundHop as ab, registerAwaitingReply as ac, buildMachineShareUrl as ad, parseHandle as ae, handleMatchesMetadata as af, describeMisconfiguration as ag, buildMachineDeps as ah, applyClaudeProxyEnv as ai, composeSessionId as aj, generateFriendlyName as ak, generateHookSettings as al, staticFileServer as am, instanceConfig as an, claudeAuth as ao, codexProvider as ap, projectInfo as aq, DefaultTransport$1 as ar, acpBackend as as, acpAgentConfig as at, codexAppServerBackend as au, GeminiTransport$1 as av, api as aw, run as ax, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, searchIssues as q, registerMachineService as r, startDaemon as s, isVisibleTo as t, updateIssue as u, getRun as v, listRuns as w, getWorkflow as x, runWorkflow as y, setWorkflowEnabled as z };