svamp-cli 0.2.309 → 0.2.311

package/dist/{run-DLG-_xa7.mjs → run-DtVX2pQN.mjs}

@@ -2379,10 +2379,8 @@ class ServeManager {
    */
   listMounts(sessionId) {
     const all = Array.from(this.mounts.values());
-    if (sessionId) {
-      return all.filter((m) => m.sessionId === sessionId);
-    }
-    return all;
+    const filtered = sessionId ? all.filter((m) => m.sessionId === sessionId) : all;
+    return filtered.map((m) => ({ ...m, url: this.getMountUrl(m.name) || void 0 }));
   }
   /** #0649: look up a single mount by name (for ownership checks before remove/replace). */
   getMount(name) {
@@ -2393,10 +2391,8 @@ class ServeManager {
    */
   getInfo() {
     const running = this.proxyServer != null;
-    const firstMount = this.mounts.values().next().value;
-    const firstUrl = firstMount ? this.getMountUrl(firstMount.name) : null;
     return {
-      url: firstUrl,
+      url: null,
       port: running ? this.port : 0,
       authProxyPort: running ? this.port : 0,
       running,
@@ -3151,7 +3147,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-Cv6J2Mex.mjs');
+      const { FrpcTunnel } = await import('./frpc-DvBVvsZC.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,
@@ -4093,7 +4089,8 @@ function inZone(date, tz) {
       o[x.type] = x.value;
       return o;
     }, {});
-    return new Date(+p.year, +p.month - 1, +p.day, +(p.hour === "24" ? 0 : p.hour), +p.minute);
+    const midnight24 = p.hour === "24";
+    return new Date(+p.year, +p.month - 1, +p.day + (midnight24 ? 1 : 0), midnight24 ? 0 : +p.hour, +p.minute);
   } catch {
     return date;
   }
@@ -4926,10 +4923,16 @@ class ChannelOutbox {
       this.emitter.on(channelId, onReply);
     });
   }
-  /** Push subscription for SSE: calls onReply for each new reply addressed to `to`. */
-  subscribe(channelId, to, onReply) {
+  /**
+   * Push subscription for SSE: calls onReply for each new matching reply.
+   * Same key rule as since()/wait(): correlationId-first (knowing the unguessable reply
+   * key proves ownership of that conversation), identity (`to`) only as the fallback.
+   * Without this, several callers sharing a `to` (e.g. caller-supplied/'anonymous'
+   * senders) would receive each other's replies — the cross-caller leak class of #0786.
+   */
+  subscribe(channelId, to, onReply, correlationId) {
     const handler = (r) => {
-      if (r.to === to) onReply(r);
+      if (correlationId ? r.correlationId === correlationId : r.to === to) onReply(r);
     };
     this.emitter.on(channelId, handler);
     return () => this.emitter.off(channelId, handler);
@@ -5020,6 +5023,17 @@ const SESSION_VIEW_METHODS = /* @__PURE__ */ new Set([
   "reregister",
   "recordMeetingActivity"
 ]);
+const MACHINE_MEMBER_READABLE = /* @__PURE__ */ new Set([
+  "getMetadata",
+  "getAgentState",
+  "getActivityState",
+  "getMessages",
+  "getLatestMessages",
+  "getMessageCount",
+  "getSharing",
+  "listChannels",
+  "registerListener"
+]);
 function sessionMethodMinRole(method) {
   const mapped = SESSION_METHOD_MIN_ROLE[method];
   if (mapped) return mapped;
@@ -5362,11 +5376,12 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           const rpc = handlers.getSessionRPCHandlers?.(sid);
           if (!rpc) continue;
           if (!hasMachineAccess && !await hasExplicitSessionAccess(rpc, "view", context)) continue;
+          const readCtx = hasMachineAccess ? void 0 : context;
           try {
             const [metaResult, stateResult, activity] = await Promise.all([
-              rpc.getMetadata(context),
-              rpc.getAgentState(context),
-              rpc.getActivityState(context).catch(() => ({
+              rpc.getMetadata(readCtx),
+              rpc.getAgentState(readCtx),
+              rpc.getActivityState(readCtx).catch(() => ({
                 active: false,
                 thinking: false,
                 time: Date.now()
@@ -5382,7 +5397,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
               thinking: activity.thinking ?? false,
               activeAt: activity.time || Date.now()
             });
-          } catch {
+          } catch (err) {
+            console.debug(
+              `[HYPHA MACHINE] getSessions: skipped session ${sid} (${hasMachineAccess ? "machine-access" : "session-shared"}): ${err?.message ?? err}`
+            );
           }
         }
         return sessions;
@@ -5402,8 +5420,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           throw new Error(`Session ${sessionId} not found on this machine`);
         }
         const requiredRole = sessionMethodMinRole(method);
+        let machineAuthorized = false;
         try {
           authorizeRequest(context, currentMetadata.sharing, requiredRole);
+          machineAuthorized = true;
         } catch (machineErr) {
           if (!await hasExplicitSessionAccess(rpc, requiredRole, context)) throw machineErr;
         }
@@ -5411,9 +5431,10 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (typeof handler !== "function") {
           throw new Error(`Unknown session method: ${method}`);
         }
+        const dispatchCtx = machineAuthorized && MACHINE_MEMBER_READABLE.has(method) ? void 0 : context;
         const paramNames = getParamNames(handler);
         const callArgs = paramNames.map(
-          (name) => name === "context" ? context : kwargs?.[name] ?? void 0
+          (name) => name === "context" ? dispatchCtx : kwargs?.[name] ?? void 0
         );
         return await handler(...callArgs);
       },
@@ -5427,14 +5448,16 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!rpc) {
           throw new Error(`Session ${sessionId} not found on this machine`);
         }
+        let machineAuthorized = false;
         try {
           authorizeRequest(context, currentMetadata.sharing, "view");
+          machineAuthorized = true;
         } catch (machineErr) {
           if (!await hasExplicitSessionAccess(rpc, "view", context)) {
             throw machineErr;
           }
         }
-        return await rpc.registerListener(callback, context);
+        return await rpc.registerListener(callback, machineAuthorized ? void 0 : context);
       },
       // Spawn a new session
       spawnSession: async (options, context) => {
@@ -5810,9 +5833,11 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const { exec } = await import('child_process');
         const { homedir } = await import('os');
         return new Promise((resolve) => {
-          exec(command, { cwd: cwd || homedir(), timeout: 3e4, maxBuffer: 1024 * 1024 }, (err, stdout, stderr) => {
+          exec(command, { cwd: cwd || homedir(), timeout: 3e4, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
             if (err) {
-              resolve({ success: false, stdout: stdout || "", stderr: stderr || err.message, exitCode: err.code ?? 1 });
+              const enobufs = err.code === "ENOBUFS";
+              const errText = enobufs ? `output exceeded the 16 MB buffer and was truncated (the command may have completed): ${stderr || err.message}` : stderr || err.message;
+              resolve({ success: false, stdout: stdout || "", stderr: errText, exitCode: err.code ?? 1 });
             } else {
               resolve({ success: true, stdout, stderr: stderr || "", exitCode: 0 });
             }
@@ -5823,6 +5848,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
       /** Start a new terminal PTY session. Returns { sessionId, cols, rows }. */
       terminalStart: async (params = {}, context) => {
         authorizeRequest(context, currentMetadata.sharing, "admin");
+        const terminalClient = context?.from;
         const pty = await getPtyModule();
         const { homedir: getHomedir } = await import('os');
         const cols = params.cols || 80;
@@ -5877,7 +5903,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
             server.emit({
               type: "svamp:terminal-output",
               data: { type: "output", content: batch, sessionId },
-              to: "*"
+              to: terminalClient ?? "*"
             });
           } catch {
           }
@@ -5896,7 +5922,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
             server.emit({
               type: "svamp:terminal-output",
               data: { type: "exit", content: "", sessionId, exitCode, signal },
-              to: "*"
+              to: terminalClient ?? "*"
             });
           } catch {
           }
@@ -6254,7 +6280,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-Cv6J2Mex.mjs');
+        const { FrpcTunnel } = await import('./frpc-DvBVvsZC.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -6421,8 +6447,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const info = sm.getInfo();
         const isAdmin = serveCallerTrusted(context);
         const mounts = (info.mounts || []).map((m) => sanitizeMountForRole(m, isAdmin));
-        const topUrl = isAdmin ? info.url : mounts[0]?.url ?? null;
-        return { ...info, url: topUrl, mounts };
+        return { ...info, url: null, mounts };
       },
       /**
        * Aggregate frpc tunnel health for all serve mounts.
@@ -6748,7 +6773,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-C_3PVGh-.mjs');
+          const { toolsForRole } = await import('./sideband-DjjXlVhw.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -6853,7 +6878,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-BTN9XxVx.mjs');
+    const { queryCore } = await import('./commands-BoGUxb2o.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -8891,7 +8916,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       const ownerCtx = ownerEmail ? { user: { email: ownerEmail, id: ownerEmail } } : void 0;
       try {
         if (c.system && c.action?.kind !== "agent") {
-          const role = ownerEmail && r.sender.name.toLowerCase() === ownerEmail.toLowerCase() ? "owner" : "collaborator";
+          const role = r.sender.verified && ownerEmail && r.sender.name.toLowerCase() === ownerEmail.toLowerCase() ? "owner" : "collaborator";
           const envelope = renderMessage(c, {
             sender: r.sender,
             body: { message: params.message },
@@ -15219,6 +15244,7 @@ function runsFile(projectRoot, workflow) {
   const safe = workflow.replace(/[^\w.-]+/g, "_");
   return join$1(runsDir(projectRoot), `${safe}.jsonl`);
 }
+let _runSeq = 0;
 function shortRunId(seed) {
   let h = 2166136261;
   for (let i = 0; i < seed.length; i++) {
@@ -15444,7 +15470,7 @@ async function runWorkflowInner(projectRoot, wf, opts) {
   });
   const exec = opts.execStep || defaultExecStep;
   const start = now();
-  const id = shortRunId(`${wf.name}:${start.iso}:${start.ms}`);
+  const id = shortRunId(`${wf.name}:${start.iso}:${start.ms}:${_runSeq++}`);
   const env = wf.session ? { ...process.env, SVAMP_SESSION_ID: wf.session } : process.env;
   const run = {
     id,
@@ -16332,6 +16358,28 @@ async function writeSessionFileChunk(directory, sessionMetadata, path, content,
   }
 }
 
+function isStdinWritable(proc) {
+  if (!proc || proc.exitCode !== null) return false;
+  const stdin = proc.stdin;
+  if (!stdin) return false;
+  if (stdin.destroyed === true) return false;
+  if (stdin.writable === false) return false;
+  return true;
+}
+function serializeUserFrame(text) {
+  return JSON.stringify({ type: "user", message: { role: "user", content: text } }) + "\n";
+}
+function writeUserFrame(proc, text, onError) {
+  if (!isStdinWritable(proc)) return false;
+  try {
+    proc.stdin.write(serializeUserFrame(text));
+    return true;
+  } catch (err) {
+    onError?.(err);
+    return false;
+  }
+}
+
 const __filename$1 = fileURLToPath(import.meta.url);
 const __dirname$1 = dirname$1(__filename$1);
 const CLAUDE_SKILLS_DIR = join(os$1.homedir(), ".claude", "skills");
@@ -17206,7 +17254,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
       const gaveUpCfg = readLoopJson(directory, sessionId, "loop.config.json") || {};
       const curMax = typeof gaveUpCfg.max_iterations === "number" ? gaveUpCfg.max_iterations : iter;
       const nextMax = Math.max(curMax * 2, iter + 10);
-      const msg = s.phase === "done" ? `\u{1F501} Loop complete \u2705 \u2014 finished after ${iter} iteration${plural}.` : `\u{1F501} Loop paused \u{1F6D1} \u2014 did NOT finish after ${iter} iteration${plural}${s.gave_up_reason ? ` (${s.gave_up_reason})` : ""}. Resume & extend with:  svamp session loop-resume ${sessionId} --max ${nextMax}`;
+      const msg = s.phase === "done" ? `\u{1F501} Loop complete \u2705 \u2014 finished after ${iter} iteration${plural}.` : `\u{1F501} Loop paused \u{1F6D1} \u2014 did NOT finish after ${iter} iteration${plural}${s.gave_up_reason ? ` (${s.gave_up_reason})` : ""}. Resume & extend with:  svamp session loop-extend ${sessionId} --reason "<why more turns are needed>" --turns ${Math.max(10, nextMax - iter)}`;
       sessionService.pushMessage(
         s.phase === "gave_up" ? { type: "message", message: msg, level: "warning" } : { type: "message", message: msg },
         "event"
@@ -17275,7 +17323,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
             maxExtensions
           });
           if (!grant.granted) {
-            sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Extension refused \u2014 this loop already used all ${grant.max} allowed extension${grant.max === 1 ? "" : "s"} (${grant.used}/${grant.max}). A hard cap is a hard cap; do the remaining work or raise the limit manually: svamp session loop-resume ${sessionId} --max <N>`, level: "warning" }, "event");
+            sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Extension refused \u2014 this loop already used all ${grant.max} allowed extension${grant.max === 1 ? "" : "s"} (${grant.used}/${grant.max}). A hard cap is a hard cap; do the remaining work or raise the limit manually: svamp session loop-extend ${sessionId} --reason "<why>" --turns <N>`, level: "warning" }, "event");
             logger.log(`[svampConfig] loop-extend refused (bounded ${grant.used}/${grant.max})`);
           } else {
             const wasStopped = existing.active === false || existing.phase === "done" || existing.phase === "gave_up" || existing.phase === "cancelled";
@@ -17829,7 +17877,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-DdNUACV8.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BefFTl6g.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -17847,7 +17895,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-Cv6J2Mex.mjs');
+    const { FrpcTunnel } = await import('./frpc-DvBVvsZC.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -17875,7 +17923,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-C6MSkqS9.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-zDzkOTi2.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -19194,7 +19242,7 @@ ${parts.join("\n")}`);
                             auto_resumes: prog.auto_resumes
                           });
                           const extNote = summarizeExtensions(ls.extensions, maxExt);
-                          const resumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
+                          const resumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>" [--turns <N>]` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
                           const detail = `${budgetCheck.reason} (hard ${iterStop ? "iteration ceiling" : "cost ceiling"} \u2014 will not auto-resume)${extNote ? ` [${extNote}]` : ""}. ${resumeHint}`;
                           sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Loop stopped \u2014 ${detail}`, level: "warning" }, "event");
                           checkSvampConfig?.();
@@ -19446,6 +19494,9 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           }
           return child;
         };
+        const writeUserFrameToClaude = (text) => writeUserFrame(claudeProcess, text, (err) => {
+          logger.log(`[Session ${sessionId}] Claude stdin write failed: ${err?.message || err}`);
+        });
         const restartClaudeHandler = async (opts) => {
           logger.log(`[Session ${sessionId}] Restart Claude requested`);
           if (isRestartingClaude || isSwitchingMode) {
@@ -19484,6 +19535,9 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               spawnClaude(void 0, { permissionMode: currentPermissionMode });
               sessionService.updateMetadata(sessionMetadata);
               logger.log(`[Session ${sessionId}] Claude respawned with --resume ${claudeResumeId}`);
+              if ((sessionMetadata.messageQueue?.length ?? 0) > 0 && !trackedSession?.stopped) {
+                setTimeout(() => processMessageQueueRef?.(), 300);
+              }
               if (beforeRespawnError) {
                 return { success: false, message: `Edit failed (session restored): ${beforeRespawnError}` };
               }
@@ -19708,15 +19762,26 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               pendingCompactTurn = isCompactCommand(text);
               if (!claudeProcess || claudeProcess.exitCode !== null) {
                 spawnClaude(text, msgMeta);
+                signalProcessing(true);
+                sessionWasProcessing = true;
+              } else if (writeUserFrameToClaude(text)) {
+                signalProcessing(true);
+                sessionWasProcessing = true;
               } else {
-                const stdinMsg = JSON.stringify({
-                  type: "user",
-                  message: { role: "user", content: text }
-                });
-                claudeProcess.stdin?.write(stdinMsg + "\n");
+                logger.log(`[Session ${sessionId}] Claude stdin unwritable \u2014 requeueing message for respawn delivery`);
+                const existingQueue = sessionMetadata.messageQueue || [];
+                sessionMetadata = {
+                  ...sessionMetadata,
+                  messageQueue: [...existingQueue, { id: randomUUID$1(), text, createdAt: Date.now(), alreadyStored: true }]
+                };
+                sessionService.updateMetadata(sessionMetadata);
+                signalProcessing(true);
+                sessionWasProcessing = true;
+                try {
+                  claudeProcess.kill("SIGTERM");
+                } catch {
+                }
               }
-              signalProcessing(true);
-              sessionWasProcessing = true;
             },
             onAbort: () => {
               logger.log(`[Session ${sessionId}] Abort requested`);
@@ -19818,6 +19883,9 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                   isKillingClaude = false;
                   if (trackedSession?.stopped) return;
                   spawnClaude(void 0, { permissionMode: normalizedMode });
+                  if ((sessionMetadata.messageQueue?.length ?? 0) > 0 && !trackedSession?.stopped) {
+                    setTimeout(() => processMessageQueueRef?.(), 300);
+                  }
                 } finally {
                   isKillingClaude = false;
                   isSwitchingMode = false;
@@ -20081,11 +20149,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CkcBAtcs.mjs');
+              const { issueRpc } = await import('./rpc-BLWr4p8g.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BwxwusfB.mjs');
+              const { workflowRpc } = await import('./rpc-BXpuORiQ.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -20231,12 +20299,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             try {
               if (!claudeProcess || claudeProcess.exitCode !== null) {
                 spawnClaude(next.text);
-              } else {
-                const stdinMsg = JSON.stringify({
-                  type: "user",
-                  message: { role: "user", content: next.text }
-                });
-                claudeProcess.stdin?.write(stdinMsg + "\n");
+              } else if (writeUserFrameToClaude(next.text)) {
                 if (claudeResumeId && !trackedSession?.stopped) {
                   saveSession({
                     sessionId,
@@ -20250,6 +20313,15 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                     wasProcessing: true
                   });
                 }
+              } else {
+                logger.log(`[Session ${sessionId}] Claude stdin unwritable during queue drain \u2014 restoring head + respawning`);
+                sessionMetadata = { ...sessionMetadata, messageQueue: [next, ...remaining] };
+                sessionService.updateMetadata(sessionMetadata);
+                sessionWasProcessing = false;
+                try {
+                  claudeProcess.kill("SIGTERM");
+                } catch {
+                }
               }
             } catch (err) {
               logger.log(`[Session ${sessionId}] Error in processMessageQueue spawn: ${err.message}`);
@@ -20755,11 +20827,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CkcBAtcs.mjs');
+              const { issueRpc } = await import('./rpc-BLWr4p8g.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BwxwusfB.mjs');
+              const { workflowRpc } = await import('./rpc-BXpuORiQ.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -21089,7 +21161,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               const iterStop = !isCostCeiling(budgetCheck.kind);
               writeGoalLoopState(directory, sessionId, { ...ls, active: false, phase: "gave_up", completed_at: now, gave_up_reason: `resource budget exhausted \u2014 ${budgetCheck.reason}`, ledger });
               const acpExtNote = summarizeExtensions(ls.extensions, acpMaxExt);
-              const acpResumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>"  \xB7 or set a new cap:  svamp session loop-resume ${sessionId} --max <N>` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
+              const acpResumeHint = iterStop ? `Extend with a reason:  svamp session loop-extend ${sessionId} --reason "<why>" [--turns <N>]` : `Raise the cost cap to resume (--max won't \u2014 it only raises the iteration cap):  svamp session loop ${sessionId} --max-runtime-sec <N>  and/or  --max-tokens-per-hour <N>`;
               sessionService.pushMessage({ type: "message", message: `\u{1F6D1} Loop stopped \u2014 ${budgetCheck.reason} (hard ${iterStop ? "iteration ceiling" : "cost ceiling"} \u2014 will not auto-resume)${acpExtNote ? ` [${acpExtNote}]` : ""}. ${acpResumeHint}`, level: "warning" }, "event");
               checkSvampConfig?.();
               return;
@@ -21717,7 +21789,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-C6MSkqS9.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-zDzkOTi2.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -21922,7 +21994,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-CurN4UtP.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-7aLvf5mn.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {

package/dist/{scheduler-CurN4UtP.mjs → scheduler-7aLvf5mn.mjs}

@@ -1,4 +1,4 @@
-import { j as resolveProjectRoot, E as listWorkflows, F as isWorkflowEnabled, G as workflowSchedules, H as inZone, y as runWorkflow, I as cronMatches } from './run-DLG-_xa7.mjs';
+import { j as resolveProjectRoot, E as listWorkflows, F as isWorkflowEnabled, G as workflowSchedules, H as inZone, y as runWorkflow, I as cronMatches } from './run-DtVX2pQN.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-CtVZhR-V.mjs → serveCommands-D7BieIJ5.mjs}

@@ -54,7 +54,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BTN9XxVx.mjs');
+  const { connectAndGetMachine } = await import('./commands-BoGUxb2o.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -93,7 +93,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BTN9XxVx.mjs');
+  const { connectAndGetMachine } = await import('./commands-BoGUxb2o.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -182,7 +182,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BTN9XxVx.mjs');
+  const { connectAndGetMachine } = await import('./commands-BoGUxb2o.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -202,7 +202,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-BTN9XxVx.mjs');
+  const { connectAndGetMachine } = await import('./commands-BoGUxb2o.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -221,6 +221,7 @@ async function serveList(args, machineId) {
         const session = m.sessionId ? m.sessionId.slice(0, 8) : "-";
         console.log(`  ${m.name}`);
         console.log(`    Directory: ${m.directory}`);
+        console.log(`    URL:       ${m.url || "-"}`);
         console.log(`    Session:   ${session}`);
         console.log(`    Added:     ${new Date(m.addedAt).toISOString().slice(0, 16).replace("T", " ")}`);
         console.log("");
@@ -235,15 +236,15 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-BTN9XxVx.mjs');
+  const { connectAndGetMachine } = await import('./commands-BoGUxb2o.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();
     console.log(`Static file server:`);
     console.log(`  Status:  ${info.running ? "running" : "stopped"}`);
     console.log(`  Port:    ${info.port || "-"}`);
-    console.log(`  URL:     ${info.url || "(not exposed)"}`);
     console.log(`  Mounts:  ${info.mountCount}`);
+    console.log(`  URLs:    per-mount \u2014 run 'svamp serve list' to see each mount's own URL`);
   } catch (err) {
     console.error(`Error: ${err.message || err}`);
     process.exit(1);
@@ -254,20 +255,26 @@ async function serveInfo(machineId) {
 }
 function printServeHelp() {
   console.log(`
-svamp serve \u2014 Shared static file server
+svamp serve \u2014 Static file server (per-mount subdomains)
 
-Serve local directories via a single daemon-managed HTTP server with one public URL.
-Multiple sessions can register different mount points without port conflicts.
+Serve local directories via a daemon-managed HTTP server. Each mount gets its OWN
+public URL on its own subdomain (static-<name>-<token>.svc\u2026) \u2014 there is NO single
+server URL. Multiple sessions register different mounts without port conflicts.
+
+IMPORTANT: use each mount's own URL exactly as printed. NEVER build a URL by
+appending a path (e.g. /<name>/) to another mount's URL or to 'serve info' \u2014 that
+lands on a DIFFERENT project's subdomain and serves the wrong files. To get a
+mount's URL, read it from 'svamp serve <name>' (on create) or 'svamp serve list'.
 
 Usage:
-  svamp serve <name> [directory]       Add a mount and print its URL (dir defaults to .)
+  svamp serve <name> [directory]       Add a mount and print ITS OWN url (dir defaults to .)
   svamp serve add <name> [directory]   Same as above
   svamp serve apply <yaml>             Apply a declarative mount config (idempotent).
                                        Supports static and managed-process mounts
                                        with wake-on-request and idle timeout.
   svamp serve remove <name>            Remove a mount
-  svamp serve list [--all] [--json]    List mounts (default: current session only)
-  svamp serve info                     Show server status and URL
+  svamp serve list [--all] [--json]    List mounts + each mount's own URL (default: this session)
+  svamp serve info                     Show server status (per-mount URLs via 'serve list')
 
 Access tiers (default: link):
   (no flag)                 Capability URL \u2014 anyone with the URL can view.

package/dist/{sideband-C_3PVGh-.mjs → sideband-DjjXlVhw.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, O as loadMachineContext, P as buildMachineInstructions, Q as machineToolsForRole, T as buildMachineTools } from './run-DLG-_xa7.mjs';
+import { R as READ_ONLY_TOOLS, O as loadMachineContext, P as buildMachineInstructions, Q as machineToolsForRole, T as buildMachineTools } from './run-DtVX2pQN.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svamp-cli",
-  "version": "0.2.309",
+  "version": "0.2.311",
   "description": "Svamp CLI — AI workspace daemon on Hypha Cloud",
   "author": "Amun AI AB",
   "license": "SEE LICENSE IN LICENSE",
@@ -20,7 +20,7 @@
   "scripts": {
     "build": "rm -rf dist bin/skills bin/commands && mkdir -p bin/skills && cp -r ../../skills/artifact bin/skills/artifact && cp -r ../../skills/crew bin/skills/crew && cp -r ../../commands bin/commands && tsc --noEmit && pkgroll",
     "typecheck": "tsc --noEmit",
-    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-sharing-notify-resolve.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-codex-force-model.mjs && npx tsx test/test-backend-oauth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-user-events.mjs && npx tsx test/test-migrate-children.mjs && npx tsx test/test-outpost-install.mjs && npx tsx test/test-outpost-setup.mjs && npx tsx test/test-outpost-pairing.mjs && npx tsx test/test-outpost-coordinator.mjs && npx tsx test/e2e-outpost-transport.mjs && npx tsx test/test-inbox-reconcile.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-isolation-disable.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-session-access-fallback.mjs && npx tsx test/test-session-rpc-role-map.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-pinned-codex.mjs && npx tsx test/test-codex-request-timeout.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/e2e-codex-midturn-steer.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-listener-backoff.mjs && npx tsx test/test-session-identity-env.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-compact-detect.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-store-lock.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-restore-decision.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-runs-lock.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-workflow-reconcile.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-store-lock.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-stateless-dispatch-limiter.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-artifact-sync-pagination.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs && npx tsx test/test-codex-skills.mjs",
+    "test": "npx tsx test/test-context-window.mjs && npx tsx test/test-ratelimit-retry.mjs && npx tsx test/test-instance-config.mjs && npx tsx test/test-authorize.mjs && npx tsx test/test-normalize-allowed-user.mjs && npx tsx test/test-share-url.mjs && npx tsx test/test-update-sharing-normalization.mjs && npx tsx test/test-sharing-notify-sync.mjs && npx tsx test/test-sharing-notify-resolve.mjs && npx tsx test/test-staged-homes-sweep.mjs && npx tsx test/test-session-helpers.mjs && npx tsx test/test-cli-routing.mjs && npx tsx test/test-security-context.mjs && npx tsx test/test-isolation-decision.mjs && npx tsx test/test-message-helpers.mjs && npx tsx test/test-stdin-delivery.mjs && npx tsx test/test-agent-config.mjs && npx tsx test/test-wrap-command.mjs && npx tsx test/test-credential-staging.mjs && npx tsx test/test-claude-auth.mjs && npx tsx test/test-backend-accounts.mjs && npx tsx test/test-codex-force-model.mjs && npx tsx test/test-backend-oauth.mjs && npx tsx test/test-btw-proxy-env.mjs && npx tsx test/test-output-formatters.mjs && npx tsx test/test-inbox-guard.mjs && npx tsx test/test-user-events.mjs && npx tsx test/test-migrate-children.mjs && npx tsx test/test-outpost-install.mjs && npx tsx test/test-outpost-setup.mjs && npx tsx test/test-outpost-pairing.mjs && npx tsx test/test-outpost-coordinator.mjs && npx tsx test/e2e-outpost-transport.mjs && npx tsx test/test-inbox-reconcile.mjs && npx tsx test/test-auto-topic.mjs && npx tsx test/test-project-info.mjs && npx tsx test/test-agent-types.mjs && npx tsx test/test-transport.mjs && npx tsx test/test-session-update-handlers.mjs && npx tsx test/test-session-scanner.mjs && npx tsx test/test-hypha-client.mjs && npx tsx test/test-hook-settings.mjs && npx tsx test/test-session-service-logic.mjs && npx tsx test/test-daemon-persistence.mjs && npx tsx test/test-detect-isolation.mjs && npx tsx test/test-isolation-disable.mjs && npx tsx test/test-machine-service-logic.mjs && npx tsx test/test-machine-session-visibility.mjs && npx tsx test/test-session-access-fallback.mjs && npx tsx test/test-session-rpc-role-map.mjs && npx tsx test/test-interactive-helpers.mjs && npx tsx test/test-pinned-codex.mjs && npx tsx test/test-codex-request-timeout.mjs && npx tsx test/test-codex-app-server.mjs && npx tsx test/e2e-codex-midturn-steer.mjs && npx tsx test/test-acp-backend.mjs && npx tsx test/test-acp-bridge.mjs && npx tsx test/test-listener-backoff.mjs && npx tsx test/test-session-identity-env.mjs && npx tsx test/test-hook-server.mjs && npx tsx test/test-session-commands.mjs && npx tsx test/test-interactive-console.mjs && npx tsx test/test-session-messages.mjs && npx tsx test/test-session-send-query.mjs && npx tsx test/test-skills.mjs && npx tsx test/test-agent-grouping.mjs && npx tsx test/test-machine-list-directory.mjs && npx tsx test/test-service-commands.mjs && npx tsx test/test-supervisor.mjs && npx tsx test/test-supervisor-lock.mjs && node test/test-supervisor-restart.mjs && npx tsx test/test-clear-detection.mjs && npx tsx test/test-compact-detect.mjs && npx tsx test/test-session-consolidation.mjs && npx tsx test/test-inbox-store.mjs && npx tsx test/test-inbox.mjs && npx tsx test/test-inbox-cross-machine.mjs && npx tsx test/test-issue-store.mjs && npx tsx test/test-issue-store-lock.mjs && npx tsx test/test-issue-close-gate.mjs && npx tsx test/test-loop-verify.mjs && npx tsx test/test-restore-decision.mjs && npx tsx test/test-issue-rpc.mjs && npx tsx test/test-issue-pause.mjs && npx tsx test/test-workflow-store.mjs && npx tsx test/test-workflow-rpc.mjs && npx tsx test/test-workflow-scheduler.mjs && npx tsx test/test-cron.mjs && npx tsx test/test-workflow-runs.mjs && npx tsx test/test-workflow-runs-lock.mjs && npx tsx test/test-workflow-idle.mjs && npx tsx test/test-workflow-reconcile.mjs && npx tsx test/test-serve-link-subdomain.mjs && npx tsx test/test-short-id.mjs && npx tsx test/test-transcript-edit.mjs && npx tsx test/test-edit-history.mjs && npx tsx test/test-friendly-name.mjs && npx tsx test/test-session-rpc-dispatch.mjs && npx tsx test/test-sandbox-cli.mjs && npx tsx test/test-serve-manager.mjs && npx tsx test/test-serve-ws-upgrade.mjs && npx tsx test/test-serve-auth.mjs && npx tsx test/test-static-file-server.mjs && npx tsx test/test-serve-stability.mjs && npx tsx test/test-frpc-e2e.mjs --unit-only && npx tsx test/test-frpc-status.mjs && node test/pinnedClaudeCode.test.mjs && node test/fleet.test.mjs && npx tsx test/test-session-file.mjs && npx tsx test/test-channel-rpc.mjs && npx tsx test/test-wise-agent.mjs && npx tsx test/test-channel-agent.mjs && npx tsx test/test-channels-service.mjs && npx tsx test/test-hotreload-seam.mjs && npx tsx test/test-hot-reload.mjs && npx tsx test/test-hot-reload-live.mjs && npx tsx test/test-session-core.mjs && npx tsx test/test-channel-async-reply.mjs && npx tsx test/test-outbox-reload.mjs && npx tsx test/test-channel-binding.mjs && npx tsx test/test-channel-store-lock.mjs && npx tsx test/test-channel-identity.mjs && npx tsx test/test-stateless-dispatch-limiter.mjs && npx tsx test/test-shared-session-identity.mjs && npx tsx test/test-wise-agent-auth.mjs && npx tsx test/test-channel-http.mjs && npx tsx test/test-channel-upload.mjs && npx tsx test/test-wise-voice.mjs && npx tsx test/test-wise-headless.mjs && npx tsx test/test-wise-machine.mjs && npx tsx test/test-crew-merge.mjs && npx tsx test/test-crew-verdict-routing.mjs && npx tsx test/test-crew-standalone.mjs && npx tsx test/test-session-links.mjs && npx tsx test/test-issue-loop-pause-guard.mjs && npx tsx test/test-artifact-guard.mjs && npx tsx test/test-artifact-sync-pagination.mjs && npx tsx test/test-graceful-restart.mjs && npx tsx test/test-flush-exit.mjs && npx tsx test/test-codex-skills.mjs",
     "test:hypha": "node --no-warnings test/test-hypha-service.mjs",
     "dev": "tsx src/cli.ts",
     "dev:daemon": "tsx src/cli.ts daemon start-sync",