svamp-cli 0.2.306 → 0.2.308

package/dist/{run-Bd57zohL.mjs → run-VQIHMUdo.mjs}

@@ -3047,7 +3047,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-C1jS23Sn.mjs');
+      const { FrpcTunnel } = await import('./frpc-DV_IIYpM.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,
@@ -4857,8 +4857,43 @@ const SESSION_METHOD_MIN_ROLE = {
   refineLastReply: "admin",
   undoLastEdit: "admin"
 };
+const SESSION_VIEW_METHODS = /* @__PURE__ */ new Set([
+  // read-only (authorizeRequest at view-role)
+  "getMessages",
+  "getLatestMessages",
+  "getMessageCount",
+  "getMetadata",
+  "getSharing",
+  "getInbox",
+  "getEffectiveRole",
+  "getActivityState",
+  "getAgentState",
+  "getChannelSkill",
+  "getMeetingActivity",
+  "listChannels",
+  "outpostList",
+  "registerListener",
+  // self-authenticating (own capability key / token) or liveness — machine role stays view
+  "channelDescribe",
+  "channelExecTool",
+  "channelGetProfile",
+  "channelList",
+  "channelOwns",
+  "channelReceive",
+  "channelSend",
+  "channelUpload",
+  "outpostHello",
+  "outpostPoll",
+  "outpostResult",
+  "disconnect",
+  "reregister",
+  "recordMeetingActivity"
+]);
 function sessionMethodMinRole(method) {
-  return SESSION_METHOD_MIN_ROLE[method] ?? "view";
+  const mapped = SESSION_METHOD_MIN_ROLE[method];
+  if (mapped) return mapped;
+  if (SESSION_VIEW_METHODS.has(method)) return "view";
+  return "admin";
 }
 function getParamNames(fn) {
   const src = fn.toString();
@@ -6088,7 +6123,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-C1jS23Sn.mjs');
+        const { FrpcTunnel } = await import('./frpc-DV_IIYpM.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -6573,7 +6608,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           let owner;
           try {
             role2 = (await rpc.getEffectiveRole(context))?.role ?? null;
-            if (!role2) return { success: false, error: "Not authorized for this session" };
+            if (!roleAtLeast(role2, "interact")) return { success: false, error: "Not authorized: WISE ask requires interact access to this session." };
             const m = await rpc.getMetadata(context);
             cwd = m?.metadata?.path;
             owner = m?.metadata?.sharing?.owner;
@@ -6582,12 +6617,12 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-DM1-IAV7.mjs');
+          const { toolsForRole } = await import('./sideband-CGiNKfNE.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
         const role = getEffectiveRole(context, currentMetadata.sharing);
-        if (!role) return { success: false, error: "Not authorized on this machine" };
+        if (!roleAtLeast(role, "interact")) return { success: false, error: "Not authorized: WISE ask requires interact access to this machine." };
         const machineDeps = buildMachineDeps(
           {
             getSessionIds: handlers.getSessionIds,
@@ -6687,7 +6722,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CvwLQ3MM.mjs');
+    const { queryCore } = await import('./commands-D3Nu5cYE.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -7457,6 +7492,7 @@ class OutpostCoordinator {
   clearTimer;
   execTimeoutMs;
   staleMs;
+  randToken;
   sweeper = null;
   constructor(opts = {}) {
     this.now = opts.now || (() => Date.now());
@@ -7464,6 +7500,7 @@ class OutpostCoordinator {
     this.clearTimer = opts.clearTimer || ((t) => clearTimeout(t));
     this.execTimeoutMs = opts.execTimeoutMs ?? OUTPOST_EXEC_TIMEOUT_MS;
     this.staleMs = opts.staleMs ?? OUTPOST_STALE_MS;
+    this.randToken = opts.randToken || (() => randomBytes(9).toString("base64url"));
   }
   isStale(c, at) {
     return at - c.lastSeen > this.staleMs;
@@ -7575,7 +7612,7 @@ class OutpostCoordinator {
    * machine is not connected.
    */
   enqueueExec(machine, cmd, cwd) {
-    const id = `x${(++this.seq).toString(36)}_${this.now().toString(36)}`;
+    const id = `x${(++this.seq).toString(36)}_${this.now().toString(36)}_${this.randToken()}`;
     if (!this.isConnected(machine)) {
       return {
         id,
@@ -10470,8 +10507,23 @@ function computeCollectionConfigUpdate(existingConfig, extra) {
 function emailHash(email) {
   return createHash("sha256").update(email.toLowerCase()).digest("hex").slice(0, 12);
 }
+function sessionIdHash(sessionId) {
+  return createHash("sha256").update(sessionId).digest("hex").slice(0, 12);
+}
+function roleLabel(role) {
+  switch (role) {
+    case "admin":
+      return "full access";
+    case "interact":
+      return "can interact";
+    case "view":
+      return "view only";
+    default:
+      return String(role);
+  }
+}
 function shareAlias(sessionId, recipientEmail) {
-  return `share-${sessionId.slice(0, 8)}-${emailHash(recipientEmail)}`;
+  return `share-${sessionIdHash(sessionId)}-${emailHash(recipientEmail)}`;
 }
 function eventAlias(eventId, recipientEmail) {
   return `evt-${emailHash(recipientEmail)}-${eventId.slice(0, 8)}`;
@@ -10479,18 +10531,56 @@ function eventAlias(eventId, recipientEmail) {
 class SharingNotificationSync {
   server;
   artifactManager = null;
+  amResolvedAt = 0;
   shareCollectionId = null;
   eventCollectionId = null;
   initialized = false;
   log;
+  // A resolved `public/artifact-manager` proxy is bound to a SPECIFIC backend client_id. When that
+  // backend pod is replaced (deploy/restart/idle-evict), the new instance registers under the same
+  // public alias but a fresh client_id — the cached proxy dangles and every call TIMES OUT (~30s).
+  // Before this fix that silently broke ALL zero-click share writes fleet-wide (empty
+  // svamp-shared-sessions → recipients never auto-discovered). So we re-resolve on a short TTL and,
+  // on any RPC error, force one fresh re-resolve + retry (a dead pod's proxy always fails first).
+  static AM_TTL_MS = 3e4;
   constructor(server, log) {
     this.server = server;
     this.log = log;
   }
+  /**
+   * Resolve `public/artifact-manager` on the daemon's live connection. hypha-rpc re-queries the
+   * server registry on each getService() call, so a fresh resolve yields the CURRENTLY-registered
+   * live instance (not the dangling cached one). Cached within a short TTL to avoid a lookup per
+   * write; `force` bypasses the cache after a failure.
+   */
+  async getAM(force = false) {
+    const now = Date.now();
+    if (!force && this.artifactManager && now - this.amResolvedAt < SharingNotificationSync.AM_TTL_MS) {
+      return this.artifactManager;
+    }
+    const am = await this.server.getService("public/artifact-manager");
+    this.artifactManager = am;
+    this.amResolvedAt = Date.now();
+    return am;
+  }
+  /**
+   * Run an artifact-manager operation with automatic recovery from a stale/dead proxy: try with the
+   * (possibly cached) instance; on ANY error, force a fresh re-resolve and retry ONCE. This is the
+   * heart of the stale-proxy fix — a replaced backend pod makes the first call time out, the retry
+   * re-binds to the live instance and succeeds. The caller still catches the final error.
+   */
+  async withAM(op) {
+    try {
+      return await op(await this.getAM(false));
+    } catch (err) {
+      this.log(`[SHARING NOTIFY] artifact-manager call failed (${err?.message}); re-resolving + retrying`);
+      return await op(await this.getAM(true));
+    }
+  }
   async init() {
     try {
-      this.artifactManager = await this.server.getService("public/artifact-manager");
-      if (!this.artifactManager) {
+      const am = await this.getAM(true);
+      if (!am) {
         this.log("[SHARING NOTIFY] Artifact manager not available");
         return;
       }
@@ -10519,15 +10609,17 @@ class SharingNotificationSync {
       shareType: params.shareType || "session"
     };
     try {
-      const artifact = await this.artifactManager.create({
-        alias,
-        parent_id: this.shareCollectionId,
-        type: "share-notification",
-        stage: true,
-        manifest,
-        _rkwargs: true
-      });
-      await this.artifactManager.commit({ artifact_id: artifact.id, _rkwargs: true }).catch(() => {
+      await this.withAM(async (am) => {
+        const artifact = await am.create({
+          alias,
+          parent_id: this.shareCollectionId,
+          type: "share-notification",
+          stage: true,
+          manifest,
+          _rkwargs: true
+        });
+        await am.commit({ artifact_id: artifact.id, _rkwargs: true }).catch(() => {
+        });
       });
     } catch (createErr) {
       this.log(`[SHARING NOTIFY] share-notification attach skipped for ${params.recipientEmail}: ${createErr.message}`);
@@ -10545,8 +10637,10 @@ class SharingNotificationSync {
         userEmail: params.ownerEmail
       },
       title: `${typeLabel} shared with you`,
-      // Per-user tiers were retired; explicit users always have full access.
-      body: `${params.ownerEmail} shared "${params.label || "Untitled"}" with you (full access)`,
+      // #0689: render the recipient's ACTUAL role (view/interact/admin) — authorize.ts genuinely
+      // enforces per-user roles, so the old hardcoded "(full access)" misstated a view/interact
+      // invitee's access.
+      body: `${params.ownerEmail} shared "${params.label || "Untitled"}" with you (${roleLabel(params.role)})`,
       level: "info",
       action: shareType === "session" ? {
         type: "add-session-bookmark",
@@ -10569,14 +10663,16 @@ class SharingNotificationSync {
     if (!this.initialized || !this.shareCollectionId) return;
     const alias = shareAlias(sessionId, recipientEmail);
     try {
-      const existing = await this.artifactManager.read({
-        artifact_id: alias,
-        parent_id: this.shareCollectionId,
-        _rkwargs: true
-      });
-      await this.artifactManager.delete({
-        artifact_id: existing.id,
-        _rkwargs: true
+      await this.withAM(async (am) => {
+        const existing = await am.read({
+          artifact_id: alias,
+          parent_id: this.shareCollectionId,
+          _rkwargs: true
+        });
+        await am.delete({
+          artifact_id: existing.id,
+          _rkwargs: true
+        });
       });
       this.log(`[SHARING NOTIFY] Removed share notification for ${recipientEmail} on ${sessionId.slice(0, 8)}`);
     } catch {
@@ -10607,17 +10703,19 @@ class SharingNotificationSync {
     if (!this.initialized || !this.eventCollectionId) return;
     const alias = eventAlias(event.id, event.recipientEmail);
     try {
-      const artifact = await this.artifactManager.create({
-        alias,
-        parent_id: this.eventCollectionId,
-        type: "user-event",
-        stage: true,
-        manifest: event,
-        _rkwargs: true
-      });
-      await this.artifactManager.commit({
-        artifact_id: artifact.id,
-        _rkwargs: true
+      await this.withAM(async (am) => {
+        const artifact = await am.create({
+          alias,
+          parent_id: this.eventCollectionId,
+          type: "user-event",
+          stage: true,
+          manifest: event,
+          _rkwargs: true
+        });
+        await am.commit({
+          artifact_id: artifact.id,
+          _rkwargs: true
+        });
       });
       this.log(`[USER EVENT] Published ${event.type} to ${event.recipientEmail}`);
       try {
@@ -10644,7 +10742,7 @@ class SharingNotificationSync {
     const all = [];
     const seen = /* @__PURE__ */ new Set();
     for (let offset = 0; ; offset += PAGE) {
-      const page = await this.artifactManager.list({ parent_id: parentId, offset, limit: PAGE, _rkwargs: true });
+      const page = await this.withAM((am) => am.list({ parent_id: parentId, offset, limit: PAGE, _rkwargs: true }));
       if (!Array.isArray(page) || page.length === 0) break;
       let fresh = 0;
       for (const c of page) {
@@ -10685,7 +10783,7 @@ class SharingNotificationSync {
         live.push(m);
       }
       for (const id of expiredOwnedIds) {
-        this.artifactManager.delete({ artifact_id: id, _rkwargs: true }).catch(() => {
+        this.withAM((am) => am.delete({ artifact_id: id, _rkwargs: true })).catch(() => {
         });
       }
       return live.sort((a, b) => (b.createdAt || 0) - (a.createdAt || 0));
@@ -10711,7 +10809,7 @@ class SharingNotificationSync {
         return m && typeof m.id === "string" && (m.id === eventId || m.id.slice(0, 8) === short) && typeof m.recipientEmail === "string" && m.recipientEmail.toLowerCase() === normalized;
       });
       if (!match) return false;
-      await this.artifactManager.delete({ artifact_id: match.id, _rkwargs: true });
+      await this.withAM((am) => am.delete({ artifact_id: match.id, _rkwargs: true }));
       this.log(`[USER EVENT] Acked ${eventId.slice(0, 8)} for ${recipientEmail}`);
       return true;
     } catch (err) {
@@ -10722,13 +10820,15 @@ class SharingNotificationSync {
   // ── Sharing config diff + sync ───────────────────────────────────
   async syncSharing(sessionId, oldSharing, newSharing, context) {
     if (!this.initialized) return;
-    const oldEmails = new Set(
-      (oldSharing?.allowedUsers || []).map((u) => u.email.toLowerCase())
+    const oldRoleByEmail = new Map(
+      (oldSharing?.allowedUsers || []).map((u) => [u.email.toLowerCase(), u.role])
     );
+    const oldEmails = new Set(oldRoleByEmail.keys());
     const newUsers = newSharing.allowedUsers || [];
     const newEmails = new Set(newUsers.map((u) => u.email.toLowerCase()));
     for (const user of newUsers) {
-      if (!oldEmails.has(user.email.toLowerCase())) {
+      const prevRole = oldRoleByEmail.get(user.email.toLowerCase());
+      if (prevRole === void 0 || prevRole !== user.role) {
         this.notifyShare({
           recipientEmail: user.email,
           sessionId,
@@ -12165,6 +12265,16 @@ function codexCumulativeTokens(payload) {
   return nonCachedInput + output + Math.round(cached * 0.1);
 }
 
+const PINNED_CODEX_VERSION = "0.146.0";
+const MIN_CODEX_STEER_VERSION = { major: 0, minor: 129, patch: 0 };
+function cmpVer(a, b) {
+  return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+function codexSupportsSteer(v) {
+  if (!v) return false;
+  return cmpVer(v, MIN_CODEX_STEER_VERSION) >= 0;
+}
+
 function parseCodexVersion(v) {
   const m = v.match(/codex-cli\s+(\d+)\.(\d+)\.(\d+)/);
   if (!m) return null;
@@ -12181,6 +12291,16 @@ function codexAppServerAvailable() {
     return null;
   }
 }
+let _steerSupport = null;
+function codexSupportsSteerInstalled() {
+  if (_steerSupport !== null) return _steerSupport;
+  try {
+    _steerSupport = codexSupportsSteer(parseCodexVersion(execSync$1("codex --version", { encoding: "utf8" }).trim()));
+  } catch {
+    _steerSupport = false;
+  }
+  return _steerSupport;
+}
 class CodexAppServerClient {
   constructor(opts) {
     this.opts = opts;
@@ -12337,19 +12457,36 @@ class CodexAppServerClient {
   /**
    * Inject additional input into the CURRENTLY RUNNING turn (Claude-Code-style mid-turn steering).
    *
-   * codex app-server FOLDS a second `turn/start` sent mid-turn into the active turn: the new input's
-   * items are emitted under the RUNNING turn's id and NO separate `turn/completed` fires for the
-   * injected turn (verified empirically — probe-codex-midturn). So we send it WITHOUT arming a new
-   * `pendingTurn` slot and WITHOUT overwriting `_turnId` (which must keep pointing at the turn to
-   * interrupt). The single in-flight completion still resolves the original `sendTurnAndWait`.
+   * Uses codex app-server's NATIVE `turn/steer` — the correct primitive for "append this message to
+   * the in-flight turn without interrupting it." The steered input is applied at the next model step
+   * (it does NOT abort a running tool call), the assistant finishes the current work and drains the
+   * steered message as user input before its next LLM call, and NO separate `turn/started` /
+   * `turn/completed` fires — the original single in-flight completion still resolves `sendTurnAndWait`.
+   * So we send it WITHOUT arming a new `pendingTurn` slot and WITHOUT overwriting `_turnId`.
+   *
+   * (The earlier #86 implementation fired a second `turn/start` mid-turn; on codex 0.144 that
+   * ABORTS/REPLACES the running turn instead of folding — the "cuts off the previous task" bug.)
    *
-   * Returns false when there is NO active turn to fold into (the caller then falls back to a normal
-   * turn via sendPrompt). `pendingTurn` is the in-flight signal.
+   * Returns false when there is no active turn to steer, or when the server REJECTS the steer
+   * (no active turn / expectedTurnId mismatch / non-steerable turn kind such as review or manual
+   * compact). The caller then falls back to client-side queueing (post-turn drain via sendPrompt),
+   * so a rejected steer degrades gracefully rather than losing the message.
    */
-  async injectInput(prompt, o) {
-    if (!this._threadId || !this.pendingTurn) return false;
-    await this.request("turn/start", this.buildTurnParams(prompt, o));
-    return true;
+  async injectInput(prompt, _o) {
+    if (!this._threadId || !this.pendingTurn || !this._turnId) return false;
+    if (!codexSupportsSteerInstalled()) return false;
+    const params = {
+      threadId: this._threadId,
+      expectedTurnId: this._turnId,
+      input: [{ type: "text", text: prompt }]
+    };
+    try {
+      await this.request("turn/steer", params);
+      return true;
+    } catch (e) {
+      this.log("[codex-app-server] turn/steer rejected \u2014 falling back to post-turn queue", e);
+      return false;
+    }
   }
   /** Interrupt the in-flight turn (real server-side abort — the old MCP path couldn't do this). */
   async interrupt() {
@@ -17475,7 +17612,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CUcyA_KE.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-DEJpgdgc.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -17493,7 +17630,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-C1jS23Sn.mjs');
+    const { FrpcTunnel } = await import('./frpc-DV_IIYpM.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -19711,11 +19848,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-iNafaHoh.mjs');
+              const { issueRpc } = await import('./rpc-wL-45Raf.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BxmbyDga.mjs');
+              const { workflowRpc } = await import('./rpc-BjKmyKdA.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -20347,11 +20484,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-iNafaHoh.mjs');
+              const { issueRpc } = await import('./rpc-wL-45Raf.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BxmbyDga.mjs');
+              const { workflowRpc } = await import('./rpc-BjKmyKdA.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -21502,7 +21639,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-CZYOanXt.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-Dia9Akaw.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -22135,4 +22272,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { downloadSkillFile as $, removeWorkflow as A, validateWorkflowName as B, saveWorkflow as C, rawWorkflow as D, listWorkflows as E, isWorkflowEnabled as F, workflowCrons as G, cronMatches as H, summarize as I, workflowSteps as J, parseJwtEmail as K, computeCollectionConfigUpdate as L, SYSTEM_COLLECTION_CONFIG as M, loadMachineContext as N, buildMachineInstructions as O, machineToolsForRole as P, buildMachineTools as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, parseFrontmatter as T, getSkillsServer as U, getSkillsWorkspaceName as V, getSkillsCollectionName as W, fetchWithTimeout as X, searchSkills as Y, SKILLS_DIR as Z, getSkillInfo as _, createSessionStore as a, listSkillFiles as a0, resolveModel as a1, clearStopMarker as a2, stopMarkerExists as a3, formatHandle as a4, normalizeAllowedUser as a5, loadSecurityContextConfig as a6, resolveSecurityContext as a7, buildSecurityContextFromFlags as a8, mergeSecurityContexts as a9, buildSessionShareUrl as aa, computeOutboundHop as ab, registerAwaitingReply as ac, buildMachineShareUrl as ad, parseHandle as ae, handleMatchesMetadata as af, describeMisconfiguration as ag, buildMachineDeps as ah, applyClaudeProxyEnv as ai, composeSessionId as aj, generateFriendlyName as ak, generateHookSettings as al, staticFileServer as am, instanceConfig as an, claudeAuth as ao, codexProvider as ap, projectInfo as aq, DefaultTransport$1 as ar, acpBackend as as, acpAgentConfig as at, codexAppServerBackend as au, GeminiTransport$1 as av, api as aw, run as ax, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, searchIssues as q, registerMachineService as r, startDaemon as s, isVisibleTo as t, updateIssue as u, getRun as v, listRuns as w, getWorkflow as x, runWorkflow as y, setWorkflowEnabled as z };
+export { getSkillInfo as $, removeWorkflow as A, validateWorkflowName as B, saveWorkflow as C, rawWorkflow as D, listWorkflows as E, isWorkflowEnabled as F, workflowCrons as G, cronMatches as H, summarize as I, workflowSteps as J, parseJwtEmail as K, computeCollectionConfigUpdate as L, SYSTEM_COLLECTION_CONFIG as M, loadMachineContext as N, buildMachineInstructions as O, machineToolsForRole as P, buildMachineTools as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, PINNED_CODEX_VERSION as T, parseFrontmatter as U, getSkillsServer as V, getSkillsWorkspaceName as W, getSkillsCollectionName as X, fetchWithTimeout as Y, searchSkills as Z, SKILLS_DIR as _, createSessionStore as a, downloadSkillFile as a0, listSkillFiles as a1, resolveModel as a2, clearStopMarker as a3, stopMarkerExists as a4, formatHandle as a5, normalizeAllowedUser as a6, loadSecurityContextConfig as a7, resolveSecurityContext as a8, buildSecurityContextFromFlags as a9, mergeSecurityContexts as aa, buildSessionShareUrl as ab, computeOutboundHop as ac, registerAwaitingReply as ad, buildMachineShareUrl as ae, parseHandle as af, handleMatchesMetadata as ag, describeMisconfiguration as ah, buildMachineDeps as ai, applyClaudeProxyEnv as aj, composeSessionId as ak, generateFriendlyName as al, generateHookSettings as am, staticFileServer as an, instanceConfig as ao, claudeAuth as ap, codexProvider as aq, projectInfo as ar, DefaultTransport$1 as as, acpBackend as at, acpAgentConfig as au, codexAppServerBackend as av, GeminiTransport$1 as aw, api as ax, run as ay, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, searchIssues as q, registerMachineService as r, startDaemon as s, isVisibleTo as t, updateIssue as u, getRun as v, listRuns as w, getWorkflow as x, runWorkflow as y, setWorkflowEnabled as z };

package/dist/{run-D351s_uv.mjs → run-ofbo9uzA.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { ai as applyClaudeProxyEnv, aj as composeSessionId, ak as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, al as generateHookSettings } from './run-Bd57zohL.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { aj as applyClaudeProxyEnv, ak as composeSessionId, al as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, am as generateHookSettings } from './run-VQIHMUdo.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{scheduler-CZYOanXt.mjs → scheduler-Dia9Akaw.mjs}

@@ -1,4 +1,4 @@
-import { j as resolveProjectRoot, E as listWorkflows, F as isWorkflowEnabled, G as workflowCrons, y as runWorkflow, H as cronMatches } from './run-Bd57zohL.mjs';
+import { j as resolveProjectRoot, E as listWorkflows, F as isWorkflowEnabled, G as workflowCrons, y as runWorkflow, H as cronMatches } from './run-VQIHMUdo.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-DotLju8m.mjs → serveCommands-DehmO1cO.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CvwLQ3MM.mjs');
+  const { connectAndGetMachine } = await import('./commands-D3Nu5cYE.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CvwLQ3MM.mjs');
+  const { connectAndGetMachine } = await import('./commands-D3Nu5cYE.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CvwLQ3MM.mjs');
+  const { connectAndGetMachine } = await import('./commands-D3Nu5cYE.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CvwLQ3MM.mjs');
+  const { connectAndGetMachine } = await import('./commands-D3Nu5cYE.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -235,7 +235,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-CvwLQ3MM.mjs');
+  const { connectAndGetMachine } = await import('./commands-D3Nu5cYE.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{sideband-DM1-IAV7.mjs → sideband-CGiNKfNE.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-Bd57zohL.mjs';
+import { R as READ_ONLY_TOOLS, N as loadMachineContext, O as buildMachineInstructions, P as machineToolsForRole, Q as buildMachineTools } from './run-VQIHMUdo.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.306",
+  "version": "0.2.308",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-codex-force-model.mjs && npx tsx test/test-backend-oauth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-user-events.mjs && npx tsx test/test-migrate-children.mjs && npx tsx test/test-outpost-install.mjs && npx tsx test/test-outpost-setup.mjs && npx tsx test/test-outpost-pairing.mjs && npx tsx test/test-outpost-coordinator.mjs && npx tsx test/e2e-outpost-transport.mjs && npx tsx test/test-inbox-reconcile.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-isolation-disable.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-session-access-fallback.mjs && npx tsx test/test-session-rpc-role-map.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-listener-backoff.mjs && npx tsx test/test-session-identity-env.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-compact-detect.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-store-lock.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-restore-decision.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-runs-lock.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-workflow-reconcile.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-store-lock.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-stateless-dispatch-limiter.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-artifact-sync-pagination.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs && npx tsx test/test-codex-skills.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-sharing-notify-resolve.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-codex-force-model.mjs && npx tsx test/test-backend-oauth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-user-events.mjs && npx tsx test/test-migrate-children.mjs && npx tsx test/test-outpost-install.mjs && npx tsx test/test-outpost-setup.mjs && npx tsx test/test-outpost-pairing.mjs && npx tsx test/test-outpost-coordinator.mjs && npx tsx test/e2e-outpost-transport.mjs && npx tsx test/test-inbox-reconcile.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-isolation-disable.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-session-access-fallback.mjs && npx tsx test/test-session-rpc-role-map.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-pinned-codex.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/e2e-codex-midturn-steer.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-listener-backoff.mjs && npx tsx test/test-session-identity-env.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-compact-detect.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-store-lock.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-restore-decision.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-runs-lock.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-workflow-reconcile.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-store-lock.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-stateless-dispatch-limiter.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-artifact-sync-pagination.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs && npx tsx test/test-codex-skills.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",