svamp-cli 0.2.315 → 0.2.317

package/dist/{run-vEbmTx6x.mjs → run-RA4Vr6lj.mjs}

@@ -1,15 +1,15 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os$1, { homedir } from 'os';
 import fs$1, { mkdir as mkdir$1, readdir as readdir$1, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
 import * as fs from 'fs';
-import fs__default, { existsSync as existsSync$1, rmSync, readFileSync as readFileSync$1, mkdirSync, writeFileSync, renameSync as renameSync$1, realpathSync as realpathSync$1, copyFileSync, unlinkSync as unlinkSync$1, readdirSync as readdirSync$1, watch, rmdirSync } from 'fs';
+import fs__default, { existsSync as existsSync$1, rmSync, readFileSync as readFileSync$1, mkdirSync, writeFileSync, renameSync as renameSync$1, realpathSync as realpathSync$1, copyFileSync, unlinkSync as unlinkSync$1, readdirSync as readdirSync$1, watch, rmdirSync, statSync as statSync$1 } from 'fs';
 import * as path from 'path';
 import path__default, { join, delimiter, resolve as resolve$1, dirname as dirname$1, basename as basename$1 } from 'path';
 import { fileURLToPath } from 'url';
 import { execFile, spawn, execSync, exec as exec$1 } from 'child_process';
 import * as crypto from 'crypto';
-import { randomUUID as randomUUID$1 } from 'crypto';
+import { randomUUID as randomUUID$1, createHash as createHash$1 } from 'crypto';
 import { randomUUID, randomBytes, createHash, timingSafeEqual } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, unlinkSync } from 'node:fs';
+import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync } from 'node:fs';
 import { exec, spawn as spawn$1, execSync as execSync$1, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import * as http from 'http';
@@ -321,7 +321,26 @@ function buildSecurityContextFromFlags(flags) {
   }
   return ctx;
 }
+function unenforceableRules(method, context) {
+  const unsupported = [];
+  const fs = context.filesystem;
+  if (fs?.denyRead?.length) unsupported.push("filesystem.denyRead");
+  if (fs?.denyWrite?.length) unsupported.push("filesystem.denyWrite");
+  if (context.network?.deniedDomains?.length) unsupported.push("network.deniedDomains");
+  if (method === "docker" || method === "podman") {
+    if (fs?.allowWrite?.length) unsupported.push("filesystem.allowWrite");
+    if (context.network?.allowedDomains?.length) unsupported.push("network.allowedDomains");
+  }
+  return unsupported;
+}
+function describeUnenforceable(method, context) {
+  const unsupported = unenforceableRules(method, context);
+  if (!unsupported.length) return null;
+  return `securityContext: ${unsupported.join(", ")} is NOT ENFORCED by the "${method}" sandbox \u2014 these rules are accepted but have no effect (#0878). ` + (method === "nono" ? `nono is allow-list based and the workspace is granted via --allow-cwd, so a deny rule for a path inside the workspace does nothing. Use allowedDirectories / filesystem.allowWrite, or keep the sensitive path outside the workspace.` : `The container backend maps only allowedDirectories and denyAllNetwork. Use those, or run the machine under the nono sandbox.`);
+}
 function applySecurityContext(baseConfig, context) {
+  const warning = describeUnenforceable(baseConfig.method, context);
+  if (warning) console.warn(`[security] ${warning}`);
   const config = { ...baseConfig };
   if (config.method === "nono") {
     const nonoConfig = { ...config.nonoConfig };
@@ -439,6 +458,7 @@ function buildSkillsPromptSection(skills) {
 }
 
 const READ_ONLY_TOOLS = ["get_context", "ask_session", "summarize_session", "use_skill"];
+const MUTATING_TOOLS = ["run_bash", "send_to_session", "create_loop", "set_checklist", "stop_loop", "create_channel"];
 const str$1 = (v) => v == null ? "" : String(v);
 function buildTools(deps, skills) {
   return [
@@ -1566,6 +1586,8 @@ class TokenCache {
       this.cache.delete(token);
       return null;
     }
+    this.cache.delete(token);
+    this.cache.set(token, info);
     return info;
   }
   set(token, email) {
@@ -2088,6 +2110,7 @@ function getSkillsCollection() {
   return (process.env.HYPHA_SKILLS_COLLECTION || "").trim() || "marketplace";
 }
 
+const SESSION_FILES_MOUNT = "svamp-session-files";
 function generateLinkToken() {
   return crypto.randomBytes(11).toString("hex");
 }
@@ -2267,6 +2290,8 @@ class ServeManager {
   managedPidDir;
   log;
   hyphaServerUrl;
+  /** #126: daemon-provided lookup of sessionId → { cwd, sharing, ownerEmail } for the files gateway. */
+  sessionResolver = null;
   constructor(svampHome, logger, hyphaServerUrl) {
     this.persistFile = path.join(svampHome, "serve-mounts.json");
     this.managedPidDir = path.join(svampHome, "serve-managed");
@@ -2279,6 +2304,60 @@ class ServeManager {
     this.auth = new ServeAuth({ hyphaServerUrl: this.hyphaServerUrl });
   }
   // ── Public API ───────────────────────────────────────────────────────
+  /**
+   * #126: register the daemon's sessionId → { cwd, sharing, ownerEmail } lookup used by the
+   * session-files gateway to resolve + authorize each request. Call once at daemon start.
+   */
+  setSessionResolver(fn) {
+    this.sessionResolver = fn;
+  }
+  /**
+   * #126: bring up the always-on, per-machine session-files gateway. Idempotent. `stableToken`
+   * must be a stable per-machine hex/alnum string (DNS-label-safe) so the gateway's subdomain is
+   * unique across machines AND stable across daemon restarts. The token is NOT a capability —
+   * every request is authorized per-session inside handleSessionFilesRequest. Returns the gateway
+   * base URL (`https://static-svamp-session-files-<token>.svc…/`) or null if the tunnel isn't up.
+   */
+  async ensureSessionFilesGateway(stableToken) {
+    if (!stableToken || !/^[a-z0-9-]{8,}$/i.test(stableToken)) {
+      throw new Error("ensureSessionFilesGateway: stableToken must be a DNS-label-safe string (\u22658 alnum/hyphen chars)");
+    }
+    const token = stableToken.toLowerCase();
+    const existing = this.mounts.get(SESSION_FILES_MOUNT);
+    if (!existing?.sessionFilesGateway || existing.linkToken !== token) {
+      this.mounts.set(SESSION_FILES_MOUNT, {
+        name: SESSION_FILES_MOUNT,
+        access: "link",
+        linkToken: token,
+        sessionFilesGateway: true,
+        addedAt: Date.now()
+      });
+    }
+    await this.ensureRunning();
+    if (!this.mountTunnels.has(SESSION_FILES_MOUNT)) {
+      await this.startMountTunnel(SESSION_FILES_MOUNT);
+    }
+    const base = this.getSessionFilesBaseUrl();
+    this.log(`Session-files gateway ready: ${base || "(tunnel pending)"}`);
+    return base;
+  }
+  /** #126: base URL of the session-files gateway, or null when the gateway/tunnel isn't up. */
+  getSessionFilesBaseUrl() {
+    const mount = this.mounts.get(SESSION_FILES_MOUNT);
+    if (!mount?.sessionFilesGateway) return null;
+    return this.getMountUrl(SESSION_FILES_MOUNT);
+  }
+  /**
+   * #126: the per-session file endpoint URL — `<base>s/<sessionId>/`. The frontend appends a
+   * relative file path and issues GET (download, Range-streamed) / PUT (upload, streamed) /
+   * DELETE / GET?list=1 (JSON dir listing). Null when the gateway tunnel isn't up (→ RPC fallback).
+   */
+  getSessionFilesEndpoint(sessionId) {
+    const base = this.getSessionFilesBaseUrl();
+    if (!base) return null;
+    const b = base.endsWith("/") ? base : `${base}/`;
+    return `${b}s/${encodeURIComponent(sessionId)}/`;
+  }
   /**
    * Add a static mount (backward-compatible thin wrapper around applyMount).
    * Throws if a mount with the same name already exists, preserving the
@@ -2384,7 +2463,7 @@ class ServeManager {
    * List mounts, optionally filtered by sessionId.
    */
   listMounts(sessionId) {
-    const all = Array.from(this.mounts.values());
+    const all = Array.from(this.mounts.values()).filter((m) => !m.sessionFilesGateway);
     const filtered = sessionId ? all.filter((m) => m.sessionId === sessionId) : all;
     return filtered.map((m) => ({ ...m, url: this.getMountUrl(m.name) || void 0 }));
   }
@@ -2402,8 +2481,9 @@ class ServeManager {
       port: running ? this.port : 0,
       authProxyPort: running ? this.port : 0,
       running,
-      mountCount: this.mounts.size,
-      mounts: Array.from(this.mounts.values()).map((m) => ({
+      // #126: exclude the internal session-files gateway from user-facing counts/listings.
+      mountCount: Array.from(this.mounts.values()).filter((m) => !m.sessionFilesGateway).length,
+      mounts: Array.from(this.mounts.values()).filter((m) => !m.sessionFilesGateway).map((m) => ({
         ...m,
         url: this.getMountUrl(m.name) || void 0
       }))
@@ -2717,7 +2797,9 @@ class ServeManager {
   }
   persist() {
     const state = {
-      mounts: Array.from(this.mounts.values()),
+      // #126: the session-files gateway is recreated fresh at daemon start (directory-less,
+      // token owned by the daemon) — never persist it.
+      mounts: Array.from(this.mounts.values()).filter((m) => !m.sessionFilesGateway),
       ...this.port > 0 ? { port: this.port } : {}
     };
     try {
@@ -2754,6 +2836,195 @@ h1{font-size:1.3rem}ul{list-style:none;padding:0}li{padding:8px 0;border-bottom:
 a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:underline}</style></head>
 <body><h1>Svamp File Server</h1><ul>${items || "<li>No mounts registered.</li>"}</ul></body></html>`;
   }
+  /**
+   * #126: handle a request to the session-files gateway. Routes `/s/<sessionId>/<relPath>`:
+   *   OPTIONS            → CORS preflight (GET/HEAD/PUT/DELETE)
+   *   GET/HEAD           → download (Range/206 streamed via serveStaticMount)
+   *   GET …?list=1       → JSON directory listing [{name,isDir,size,mtime}]
+   *   PUT                → streamed upload to a temp file + atomic rename (large-file safe)
+   *   DELETE             → unlink
+   *
+   * Auth (live boundary): authenticate the requester's email via ServeAuth (parse_token), then
+   * authorize against THAT session's owner/sharing at role 'admin' — mirroring the RPC file ops.
+   * CRITICAL: unlike the RPC path (which relies on Hypha workspace isolation for null sharing),
+   * this is a PUBLIC HTTP ingress, so it FAILS CLOSED: a null/disabled sharing config admits ONLY
+   * the session owner. No token → 401; valid token but not owner/admin → 403.
+   */
+  async handleSessionFilesRequest(req, res, url, basePath) {
+    const CORS = {
+      "Access-Control-Allow-Origin": "*",
+      "Access-Control-Allow-Methods": "GET, HEAD, PUT, DELETE, OPTIONS",
+      "Access-Control-Allow-Headers": "*",
+      "Access-Control-Expose-Headers": "Content-Length, Content-Range, ETag",
+      "Access-Control-Max-Age": "600"
+    };
+    const method = (req.method || "GET").toUpperCase();
+    const deny = (code, msg) => {
+      res.writeHead(code, { ...CORS, "Content-Type": "text/plain", "Cache-Control": "no-store" });
+      res.end(msg);
+    };
+    if (method === "OPTIONS") {
+      res.writeHead(204, CORS);
+      res.end();
+      return;
+    }
+    const m = /^\/s\/([^/]+)(?:\/(.*))?$/.exec(basePath);
+    if (!m) {
+      deny(404, "Not found: expected /s/<sessionId>/<path>");
+      return;
+    }
+    const sessionId = decodeURIComponent(m[1]);
+    const relPath = m[2] ? `/${m[2]}` : "/";
+    const target = this.sessionResolver ? this.sessionResolver(sessionId) : void 0;
+    if (!target || !target.cwd) {
+      deny(404, "Unknown session");
+      return;
+    }
+    const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
+    if (!userEmail) {
+      deny(401, "Authentication required");
+      return;
+    }
+    const ownerEmail = (target.ownerEmail || "").toLowerCase();
+    const isOwner = !!ownerEmail && userEmail.toLowerCase() === ownerEmail;
+    if (!isOwner) {
+      const sharing = target.sharing;
+      if (!sharing || !sharing.enabled) {
+        this.log(`Files-gateway DENY '${sessionId}': ${userEmail} not owner and session not shared`);
+        deny(403, "Access denied");
+        return;
+      }
+      try {
+        authorizeRequest({ user: { email: userEmail } }, sharing, "admin");
+      } catch (err) {
+        this.log(`Files-gateway DENY '${sessionId}': ${userEmail} \u2014 ${err?.message || "not admin"}`);
+        deny(403, "Access denied");
+        return;
+      }
+    }
+    const rootDir = target.cwd;
+    if (method === "GET" || method === "HEAD") {
+      if (url.searchParams.get("list") === "1") {
+        const lex = containedPath(rootDir, relPath.replace(/^\/+/, ""));
+        if (!lex) {
+          deny(403, "Forbidden");
+          return;
+        }
+        let entries;
+        try {
+          const dirents = fs.readdirSync(lex, { withFileTypes: true });
+          entries = dirents.map((d) => {
+            let size = 0, mtime = 0, isDir = d.isDirectory();
+            try {
+              const st = fs.statSync(path.join(lex, d.name));
+              size = st.size;
+              mtime = Math.floor(st.mtimeMs);
+              isDir = st.isDirectory();
+            } catch {
+            }
+            return { name: d.name, isDir, size, mtime };
+          });
+        } catch (err) {
+          deny(err?.code === "ENOENT" ? 404 : 500, `Listing failed: ${err?.message || err}`);
+          return;
+        }
+        res.writeHead(200, { ...CORS, "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store" });
+        res.end(method === "HEAD" ? void 0 : JSON.stringify({ path: relPath, entries }));
+        return;
+      }
+      serveStaticMount(req, res, { rootDir, relPath, mountUrlPrefix: "", browse: false});
+      return;
+    }
+    if (method === "PUT" || method === "DELETE") {
+      const filePath = this.resolveContainedPath(rootDir, relPath);
+      if (!filePath) {
+        deny(403, "Forbidden: path escapes session root");
+        return;
+      }
+      if (method === "DELETE") {
+        try {
+          fs.unlinkSync(filePath);
+          res.writeHead(204, CORS);
+          res.end();
+        } catch (err) {
+          deny(err?.code === "ENOENT" ? 404 : 500, err?.message || "delete failed");
+        }
+        return;
+      }
+      let dir;
+      try {
+        dir = path.dirname(filePath);
+        fs.mkdirSync(dir, { recursive: true });
+      } catch (err) {
+        deny(500, `mkdir failed: ${err?.message || err}`);
+        return;
+      }
+      const tmp = path.join(dir, `.svamp-upload-${process.pid}-${crypto.randomBytes(6).toString("hex")}.part`);
+      const ws = fs.createWriteStream(tmp);
+      let settled = false;
+      const cleanupPartial = () => {
+        if (settled) return;
+        settled = true;
+        ws.destroy();
+        fs.unlink(tmp, () => {
+        });
+      };
+      req.on("aborted", cleanupPartial);
+      req.on("close", () => {
+        if (!ws.writableFinished && !req.complete) cleanupPartial();
+      });
+      ws.on("error", (err) => {
+        if (settled) return;
+        settled = true;
+        fs.unlink(tmp, () => {
+        });
+        if (!res.headersSent) deny(500, err.message);
+      });
+      ws.on("finish", () => {
+        if (settled) return;
+        settled = true;
+        try {
+          fs.renameSync(tmp, filePath);
+          res.writeHead(201, CORS);
+          res.end();
+        } catch (err) {
+          fs.unlink(tmp, () => {
+          });
+          if (!res.headersSent) deny(500, `rename failed: ${err?.message || err}`);
+        }
+      });
+      req.pipe(ws);
+      return;
+    }
+    deny(405, "Method not allowed");
+  }
+  /**
+   * #126: resolve a session-relative path against `rootDir` with lexical + symlink containment
+   * (mirrors the static PUT handler's resolveContained). Allows a not-yet-existing target (for
+   * PUT) as long as its deepest existing ancestor stays within the real root. Returns the
+   * contained absolute path, or null on any traversal/symlink escape (fail-closed).
+   */
+  resolveContainedPath(rootDir, relPath) {
+    const base = path.resolve(rootDir);
+    const lex = containedPath(base, relPath.replace(/^\/+/, ""));
+    if (!lex) return null;
+    try {
+      const realRoot = fs.realpathSync(base);
+      let ancestor = lex;
+      while (!fs.existsSync(ancestor) && path.dirname(ancestor) !== ancestor) {
+        ancestor = path.dirname(ancestor);
+      }
+      const realAncestor = fs.realpathSync(ancestor);
+      if (realAncestor !== realRoot && !realAncestor.startsWith(realRoot + path.sep)) return null;
+      if (fs.existsSync(lex) && fs.lstatSync(lex).isSymbolicLink()) {
+        const realTarget = fs.realpathSync(lex);
+        if (realTarget !== realRoot && !realTarget.startsWith(realRoot + path.sep)) return null;
+      }
+    } catch {
+      return null;
+    }
+    return lex;
+  }
   /** Start a lightweight Node.js HTTP proxy with auth + upload support. */
   startAuthProxy() {
     return new Promise((resolve, reject) => {
@@ -2798,6 +3069,10 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             res.end(html);
             return;
           }
+          if (mount?.sessionFilesGateway) {
+            await this.handleSessionFilesRequest(req, res, url, basePath);
+            return;
+          }
           if (mount && mount.access !== "public" && mount.access !== "link") {
             const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
             if (mount.access === "owner" && !mount.ownerEmail) {
@@ -3153,7 +3428,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-pwqsONPX.mjs');
+      const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,
@@ -3249,7 +3524,11 @@ function writeEnvLines(lines) {
   while (lines.length > 0 && lines[lines.length - 1].trim() === "") {
     lines.pop();
   }
-  writeFileSync$1(file, lines.join("\n") + "\n", "utf-8");
+  writeFileSync$1(file, lines.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync(file, 384);
+  } catch {
+  }
 }
 function updateEnvFile(updates) {
   const lines = readEnvLines();
@@ -4323,10 +4602,17 @@ function validateChannel(c) {
   if (c.action?.kind === "loop" && m === "caller-supplied" && !c.identity?.shared_key)
     errs.push("a caller-supplied channel without a shared_key may not use a loop action (unauthenticated task injection)");
   if (c.action?.kind === "agent" && m === "caller-supplied" && !c.identity?.shared_key) {
-    const MUTATING = ["run_bash", "send_to_session"];
     const ag = c.action.agent || {};
-    const grantsMutating = (ag.tools || []).some((t) => MUTATING.includes(t)) || Object.values(ag.per_caller || {}).some((p) => (p?.tools || []).some((t) => MUTATING.includes(t)));
-    if (grantsMutating) errs.push("a caller-supplied agent channel without a shared_key may not grant run_bash/send_to_session");
+    const offending = /* @__PURE__ */ new Set();
+    for (const t of ag.tools || []) if (MUTATING_TOOLS.includes(t)) offending.add(t);
+    for (const p of Object.values(ag.per_caller || {})) {
+      for (const t of p?.tools || []) if (MUTATING_TOOLS.includes(t)) offending.add(t);
+    }
+    if (offending.size) {
+      errs.push(
+        `a caller-supplied agent channel without a shared_key may not grant mutating tools (${[...offending].sort().join(", ")})`
+      );
+    }
   }
   const unsafe = /[<>"'&\r\n]/;
   if (unsafe.test(c.name || "")) errs.push(`name must be single-line and not contain < > " ' &`);
@@ -4503,11 +4789,15 @@ function generateSkillBody(channel, ctx) {
 const res = await get_service("${svc}").send({ channel: "${channel.id}", message: "\u2026", from: "your-name" });
 if (res.status === "completed") return res.reply;          // answered now \u2014 done
 let cursor = 0;                                            // else poll for the async reply
-while (true) {
+// BOUNDED: ~10 min (24 x wait:25). Do not loop forever \u2014 repliability is now the DEFAULT on
+// every ordinary message channel, so you may well be polling a notification channel nobody
+// is watching, and an unbounded loop would spin (and re-read the server-side outbox) forever.
+for (let i = 0; i < 24; i++) {
   const r = await get_service("${svc}").receive({ channel: "${channel.id}", key: "${key}", correlationId: res.correlationId, cursor, wait: 25 });
   cursor = r.cursor;
   if (r.replies.length) return r.replies[0].body;          // server matched it by correlationId
 }
+return null;                                               // no reply \u2014 this channel may be fire-and-forget
 \`\`\`
 **HTTP:** \`POST ${recvUrl}\` with \`{"kwargs": {"channel": "${channel.id}", "key": "${key}", "correlationId": "<from send>", "cursor": 0, "wait": 25}}\` (long-poll), or stream \`GET <channel-http>/channel/${channel.id}/events?key=${key}\` (SSE).
 > Tip: always pass the \`correlationId\` from \`send\` to \`receive\` \u2014 it is the reply key, so the reply finds you with no identity matching. Omit it and \`receive\` falls back to matching your \`from\`, which you must then supply identically on every call.
@@ -4987,6 +5277,7 @@ const SESSION_METHOD_MIN_ROLE = {
   readFile: "admin",
   writeFile: "admin",
   writeFileChunk: "admin",
+  filesEndpoint: "admin",
   listDirectory: "admin",
   bash: "admin",
   issue: "admin",
@@ -5911,13 +6202,15 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           if (session.outputBuffer.length > 1e3) {
             session.outputBuffer.splice(0, session.outputBuffer.length - 500);
           }
-          try {
-            server.emit({
-              type: "svamp:terminal-output",
-              data: { type: "output", content: batch, sessionId },
-              to: terminalClient ?? "*"
-            });
-          } catch {
+          if (terminalClient) {
+            try {
+              server.emit({
+                type: "svamp:terminal-output",
+                data: { type: "output", content: batch, sessionId },
+                to: terminalClient
+              });
+            } catch {
+            }
           }
         };
         ptyProcess.onData((data) => {
@@ -5930,13 +6223,15 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           session.exited = true;
           session.exitCode = exitCode;
           session.exitSignal = signal;
-          try {
-            server.emit({
-              type: "svamp:terminal-output",
-              data: { type: "exit", content: "", sessionId, exitCode, signal },
-              to: terminalClient ?? "*"
-            });
-          } catch {
+          if (terminalClient) {
+            try {
+              server.emit({
+                type: "svamp:terminal-output",
+                data: { type: "exit", content: "", sessionId, exitCode, signal },
+                to: terminalClient
+              });
+            } catch {
+            }
           }
           setTimeout(() => {
             if (terminalSessions.has(sessionId)) {
@@ -6292,7 +6587,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-pwqsONPX.mjs');
+        const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -6785,7 +7080,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-DU8QZetT.mjs');
+          const { toolsForRole } = await import('./sideband-gQ7oQEsx.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -6890,7 +7185,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CjBsJQX-.mjs');
+    const { queryCore } = await import('./commands-wQYdc5EK.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -8034,14 +8329,35 @@ function loadMessagesFromDiskReverse(messagesDir, beforeSeq, limit) {
     return { messages: [], hasMore: false };
   }
 }
+const messageCountCache = /* @__PURE__ */ new Map();
 function countMessagesOnDisk(messagesDir, fallbackInMemory) {
   const filePath = join$1(messagesDir, "messages.jsonl");
   if (!existsSync(filePath)) return fallbackInMemory;
   try {
-    const data = readFileSync(filePath, "utf-8");
-    let count = 0;
-    for (let i = 0; i < data.length; i++) if (data.charCodeAt(i) === 10) count++;
-    if (data.length > 0 && data[data.length - 1] !== "\n") count++;
+    const st = statSync(filePath);
+    const cached = messageCountCache.get(filePath);
+    if (cached && cached.size === st.size && cached.mtimeMs === st.mtimeMs) return cached.count;
+    let count;
+    if (cached && st.size > cached.size) {
+      const fd = openSync(filePath, "r");
+      try {
+        const len = st.size - cached.size;
+        const buf = Buffer.allocUnsafe(len);
+        const read = readSync(fd, buf, 0, len, cached.size);
+        let added = 0;
+        for (let i = 0; i < read; i++) if (buf[i] === 10) added++;
+        count = cached.count + added;
+        if (read > 0 && buf[read - 1] !== 10) count++;
+      } finally {
+        closeSync(fd);
+      }
+    } else {
+      const data = readFileSync(filePath, "utf-8");
+      count = 0;
+      for (let i = 0; i < data.length; i++) if (data.charCodeAt(i) === 10) count++;
+      if (data.length > 0 && data[data.length - 1] !== "\n") count++;
+    }
+    messageCountCache.set(filePath, { size: st.size, mtimeMs: st.mtimeMs, count });
     return count;
   } catch {
     return fallbackInMemory;
@@ -9065,6 +9381,9 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     channelReceive: async (params, context) => {
       const c = channelStore.get(params.channel);
       if (!c || c.enabled === false) return { error: "channel not found" };
+      if (!channelAsyncRepliable(c)) {
+        return { error: "this channel has no async replies (agent/loop/stateless channels reply synchronously)" };
+      }
       const u = context?.user;
       const r = resolveSender(c, {
         key: params.key,
@@ -9194,6 +9513,13 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       await callbacks.onWriteFileChunk(path, content, uploadId, chunkIndex, totalChunks, isLast);
       return { success: true };
     },
+    // #126: HTTP files-gateway base URL for this session (large upload/download over the frp
+    // tunnel). Admin-gated like the other file ops. Returns { url: null } when the gateway tunnel
+    // isn't up yet → the frontend falls back to the RPC chunked path.
+    filesEndpoint: async (context) => {
+      authorizeRequest(context, metadata.sharing, "admin");
+      return { url: callbacks.onFilesEndpoint?.() ?? null };
+    },
     listDirectory: async (path, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onListDirectory) throw new Error("listDirectory not supported");
@@ -11650,6 +11976,7 @@ class AcpBackend {
         this.emit({ type: "status", status: "error", detail: err.message });
       });
       this.process.on("exit", (code, signal) => {
+        this.process = null;
         if (this.disposed) return;
         if (code !== 0 && code !== null) {
           signalStartupFailure(new Error(`Exit code: ${code}`));
@@ -12216,6 +12543,25 @@ var acpAgentConfig = /*#__PURE__*/Object.freeze({
     resolveAcpAgentConfig: resolveAcpAgentConfig
 });
 
+function applyPermissionResolution(sessionService, requestId, approved) {
+  const reqs = { ...sessionService._agentState?.requests };
+  if (!(requestId in reqs)) return;
+  const completedReqs = { ...sessionService._agentState?.completedRequests };
+  const existingReq = reqs[requestId];
+  delete reqs[requestId];
+  sessionService.updateAgentState({
+    controlledByUser: false,
+    requests: reqs,
+    completedRequests: {
+      ...completedReqs,
+      [requestId]: {
+        ...existingReq || {},
+        completedAt: Date.now(),
+        status: approved ? "approved" : "denied"
+      }
+    }
+  });
+}
 function bridgeAcpToSession(backend, sessionService, getMetadata, setMetadata, log, onTurnEnd, getModelLabel) {
   let pendingText = "";
   let pendingThinking = "";
@@ -12325,22 +12671,7 @@ function bridgeAcpToSession(backend, sessionService, getMetadata, setMetadata, l
         break;
       }
       case "permission-response": {
-        const reqs = { ...sessionService._agentState?.requests };
-        const completedReqs = { ...sessionService._agentState?.completedRequests };
-        const existingReq = reqs[msg.id];
-        delete reqs[msg.id];
-        sessionService.updateAgentState({
-          controlledByUser: false,
-          requests: reqs,
-          completedRequests: {
-            ...completedReqs,
-            [msg.id]: {
-              ...existingReq || {},
-              completedAt: Date.now(),
-              status: msg.approved ? "approved" : "denied"
-            }
-          }
-        });
+        applyPermissionResolution(sessionService, msg.id, msg.approved);
         break;
       }
       case "event": {
@@ -12372,9 +12703,10 @@ function bridgeAcpToSession(backend, sessionService, getMetadata, setMetadata, l
   };
 }
 class HyphaPermissionHandler {
-  constructor(shouldAutoAllow, log) {
+  constructor(shouldAutoAllow, log, onAutoResolved) {
     this.shouldAutoAllow = shouldAutoAllow;
     this.log = log;
+    this.onAutoResolved = onAutoResolved;
   }
   pendingPermissions = /* @__PURE__ */ new Map();
   // #0445: safety auto-decline so an unanswered ACP/Gemini permission can't wedge the turn
@@ -12396,6 +12728,10 @@ class HyphaPermissionHandler {
           this.pendingPermissions.delete(toolCallId);
           this.log(`[ACP Permission] Auto-declining ${toolName} after ${timeoutMs}ms with no response`);
           p.resolve({ decision: "denied" });
+          try {
+            this.onAutoResolved?.(toolCallId, false);
+          } catch {
+          }
         }
       }, timeoutMs);
       timer.unref?.();
@@ -12422,6 +12758,10 @@ class HyphaPermissionHandler {
     for (const [id, pending] of this.pendingPermissions) {
       if (pending.timer) clearTimeout(pending.timer);
       pending.resolve({ decision: "denied" });
+      try {
+        this.onAutoResolved?.(id, false);
+      } catch {
+      }
     }
     this.pendingPermissions.clear();
   }
@@ -12502,7 +12842,7 @@ function codexCumulativeTokens(payload) {
   return nonCachedInput + output + Math.round(cached * 0.1);
 }
 
-const PINNED_CODEX_VERSION = "0.146.0";
+const PINNED_CODEX_VERSION = "0.147.0";
 const MIN_CODEX_STEER_VERSION = { major: 0, minor: 129, patch: 0 };
 function cmpVer(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
@@ -12605,6 +12945,7 @@ class CodexAppServerClient {
     child.stderr?.on("data", (d) => this.log("[codex-app-server:stderr]", d.toString().trim()));
     child.on("exit", (code) => {
       const wasConnected = this.connected;
+      if (this.process === child) this.process = null;
       this.connected = false;
       this.failAllPending(new Error(`codex app-server exited (code ${code})`));
       this.resolvePendingTurn(true);
@@ -13516,7 +13857,7 @@ function hasKimiProvider(cfg) {
 }
 function buildKimiCatalogAddArgs(cfg) {
   if (!hasKimiProvider(cfg)) return null;
-  const args = ["provider", "catalog", "add", cfg.provider, "--api-key", cfg.apiKey];
+  const args = ["provider", "catalog", "add", cfg.provider];
   if (cfg.apiBase) args.push("--base-url", cfg.apiBase);
   const defaultModel = kimiDefaultModelId(cfg);
   if (defaultModel) args.push("--default-model", defaultModel);
@@ -13532,6 +13873,19 @@ function kimiProviderConfigured(configTomlText, provider) {
   const block = nextTable < 0 ? rest : rest.slice(0, nextTable);
   return /(^|\n)\s*api_key\s*=/.test(block);
 }
+function kimiModelMenu(env = process.env) {
+  return (env.SVAMP_KIMI_MODELS || "").split(",").map((s) => s.trim()).filter(Boolean).filter((m, i, a) => a.indexOf(m) === i);
+}
+function kimiDefaultModel(env = process.env) {
+  const menu = kimiModelMenu(env);
+  return env.SVAMP_KIMI_MODEL || env.LLM_MODEL || menu[0] || void 0;
+}
+function kimiClampModel(requested, env = process.env) {
+  const menu = kimiModelMenu(env);
+  if (!menu.length) return requested;
+  if (requested && menu.includes(requested)) return requested;
+  return kimiDefaultModel(env);
+}
 
 var kimiProvider = /*#__PURE__*/Object.freeze({
     __proto__: null,
@@ -13539,7 +13893,10 @@ var kimiProvider = /*#__PURE__*/Object.freeze({
     DEFAULT_KIMI_PROVIDER: DEFAULT_KIMI_PROVIDER,
     buildKimiCatalogAddArgs: buildKimiCatalogAddArgs,
     hasKimiProvider: hasKimiProvider,
+    kimiClampModel: kimiClampModel,
+    kimiDefaultModel: kimiDefaultModel,
     kimiDefaultModelId: kimiDefaultModelId,
+    kimiModelMenu: kimiModelMenu,
     kimiProviderConfigured: kimiProviderConfigured,
     kimiSpawnEnv: kimiSpawnEnv,
     resolveKimiProvider: resolveKimiProvider
@@ -13553,7 +13910,7 @@ function readKimiConfig() {
     return null;
   }
 }
-function ensureKimiProviderConfigured(env = process.env, command = "kimi", log = () => {
+async function ensureKimiProviderConfigured(env = process.env, command = "kimi", log = () => {
 }) {
   const cfg = resolveKimiProvider(env);
   if (!hasKimiProvider(cfg)) return false;
@@ -13561,10 +13918,18 @@ function ensureKimiProviderConfigured(env = process.env, command = "kimi", log =
   const args = buildKimiCatalogAddArgs(cfg);
   if (!args) return false;
   try {
-    execFileSync(command, args, {
-      stdio: "ignore",
-      timeout: 3e4,
-      env: { ...process.env, KIMI_CLI_NO_AUTO_UPDATE: "1" }
+    await new Promise((resolve, reject) => {
+      execFile$1(
+        command,
+        args,
+        {
+          timeout: 3e4,
+          // #0848: the API key travels in the child ENV, never on argv (argv is world-readable
+          // via ps / /proc/<pid>/cmdline). kimi reads KIMI_REGISTRY_API_KEY when --api-key is omitted.
+          env: { ...process.env, KIMI_CLI_NO_AUTO_UPDATE: "1", KIMI_REGISTRY_API_KEY: cfg.apiKey }
+        },
+        (err) => err ? reject(err) : resolve()
+      );
     });
     log(`[kimi] configured provider '${cfg.provider}' in ${KIMI_CONFIG_PATH}`);
     return kimiProviderConfigured(readKimiConfig(), cfg.provider);
@@ -15154,6 +15519,9 @@ function listIssues(projectRoot, opts = {}) {
   if (opts.scope) items = items.filter((i) => i.scope === opts.scope);
   return items.sort((a, b) => Number(a.id) - Number(b.id));
 }
+function isPendingIssue(issue) {
+  return issue.status !== "archived" && issue.status !== "paused";
+}
 function isVisibleTo(issue, session) {
   if (issue.scope === "session") return issue.session === session || issue.owner === session;
   if (issue.owner === session) return true;
@@ -15323,6 +15691,47 @@ function summarize(issues) {
   return { total: issues.length, ready: by("ready"), in_progress: by("in_progress"), paused: by("paused"), archived: by("archived") };
 }
 
+const DEFAULT_LOG_PRUNE_POLICY = {
+  keepFiles: 10,
+  maxAgeDays: 14,
+  maxBytes: 64 * 1024 * 1024
+  // 64 MiB
+};
+const APPEND_ONLY_LOGS = ["daemon-supervised.log", "daemon-boot.log"];
+function isPerStartLog(name) {
+  if (!name.startsWith("daemon-") || !name.endsWith(".log")) return false;
+  return !APPEND_ONLY_LOGS.includes(name);
+}
+function planLogPrune(files, policy = DEFAULT_LOG_PRUNE_POLICY, nowMs = Date.now(), exclude = []) {
+  const excluded = new Set(exclude);
+  const keepFiles = Math.max(0, policy.keepFiles);
+  const maxAgeMs = Math.max(0, policy.maxAgeDays) * 24 * 60 * 60 * 1e3;
+  const perStart = files.filter((f) => isPerStartLog(f.name) && !excluded.has(f.name)).sort((a, b) => b.mtimeMs - a.mtimeMs);
+  const overCount = keepFiles > 0 ? perStart.slice(keepFiles) : perStart;
+  const tooOld = maxAgeMs > 0 ? perStart.filter((f) => nowMs - f.mtimeMs > maxAgeMs) : [];
+  const deleteFiles = [...new Set([...overCount, ...tooOld].map((f) => f.name))];
+  const truncateFiles = files.filter((f) => APPEND_ONLY_LOGS.includes(f.name) && !excluded.has(f.name)).filter((f) => policy.maxBytes > 0 && f.size > policy.maxBytes).map((f) => ({ name: f.name, size: f.size }));
+  return { deleteFiles, truncateFiles };
+}
+function resolveLogPrunePolicy(env = process.env) {
+  const num = (raw, fallback) => {
+    if (raw === void 0 || raw === "") return fallback;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : fallback;
+  };
+  return {
+    keepFiles: num(env.SVAMP_LOG_KEEP_FILES, DEFAULT_LOG_PRUNE_POLICY.keepFiles),
+    maxAgeDays: num(env.SVAMP_LOG_MAX_AGE_DAYS, DEFAULT_LOG_PRUNE_POLICY.maxAgeDays),
+    maxBytes: num(env.SVAMP_LOG_MAX_BYTES, DEFAULT_LOG_PRUNE_POLICY.maxBytes)
+  };
+}
+function tailSlice(buf, tailBytes) {
+  if (buf.length <= tailBytes) return buf;
+  const cut = buf.subarray(buf.length - tailBytes);
+  const nl = cut.indexOf(10);
+  return nl >= 0 && nl + 1 < cut.length ? cut.subarray(nl + 1) : cut;
+}
+
 function isWorkflowEnabled(wf) {
   return wf.enabled !== false;
 }
@@ -15878,12 +16287,19 @@ function loopCancelledDuringVerify(current) {
 }
 function backlogOraclePending(projectRoot, sessionId) {
   const inScope = (i) => !sessionId || isVisibleTo(i, sessionId);
-  return listIssues(projectRoot).filter(inScope).filter((i) => i.status !== "archived" && i.status !== "paused").map((i) => ({ id: i.id }));
+  return listIssues(projectRoot).filter(inScope).filter(isPendingIssue).map((i) => ({ id: i.id }));
 }
 function isBacklogDrainerOracle(oracle) {
   if (!oracle || typeof oracle !== "string") return false;
   return /(^|\s)svamp\s+issue\s+pending(\s|$)/.test(oracle.trim());
 }
+function oracleScopeSessionId(oracle, selfSessionId) {
+  if (!oracle || typeof oracle !== "string") return void 0;
+  const explicit = /(^|\s)--session[=\s]+(\S+)/.exec(oracle);
+  if (explicit) return explicit[2];
+  if (/(^|\s)--mine(\s|$)/.test(oracle)) return selfSessionId;
+  return void 0;
+}
 function resolveLoopDurable(cfg) {
   if (typeof cfg.durable === "boolean") return cfg.durable;
   return isBacklogDrainerOracle(cfg.oracle);
@@ -16790,16 +17206,24 @@ async function installSkillFromMarketplace(name) {
   const files = await collectFiles();
   if (files.length === 0) throw new Error(`Skill ${name} has no files in marketplace`);
   const targetDir = join(CLAUDE_SKILLS_DIR, name);
-  mkdirSync(targetDir, { recursive: true });
-  for (const filePath of files) {
-    const url = `${BASE}/files/${filePath}`;
-    const resp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
-    if (!resp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${resp.status}`);
-    const content = await resp.text();
-    const localPath = join(targetDir, filePath);
-    if (!localPath.startsWith(targetDir + "/")) continue;
-    mkdirSync(dirname$1(localPath), { recursive: true });
-    writeFileSync(localPath, content, "utf-8");
+  const stagingDir = `${targetDir}.tmp-${process.pid}-${Date.now().toString(36)}`;
+  try {
+    mkdirSync(stagingDir, { recursive: true });
+    for (const filePath of files) {
+      const url = `${BASE}/files/${filePath}`;
+      const resp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+      if (!resp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${resp.status}`);
+      const content = await resp.text();
+      const localPath = join(stagingDir, filePath);
+      if (!localPath.startsWith(stagingDir + "/")) continue;
+      mkdirSync(dirname$1(localPath), { recursive: true });
+      writeFileSync(localPath, content, "utf-8");
+    }
+    rmSync(targetDir, { recursive: true, force: true });
+    renameSync$1(stagingDir, targetDir);
+  } catch (err) {
+    rmSync(stagingDir, { recursive: true, force: true });
+    throw err;
   }
 }
 function getBundledSkillsDir() {
@@ -17934,8 +18358,38 @@ function ensureHomeDir() {
     mkdirSync(LOGS_DIR, { recursive: true });
   }
 }
+function pruneDaemonLogs() {
+  try {
+    const policy = resolveLogPrunePolicy(process.env);
+    const entries = readdirSync$1(LOGS_DIR).map((name) => {
+      try {
+        const st = statSync$1(join(LOGS_DIR, name));
+        return { name, size: st.size, mtimeMs: st.mtimeMs };
+      } catch {
+        return null;
+      }
+    }).filter((e) => e !== null);
+    const plan = planLogPrune(entries, policy);
+    for (const name of plan.deleteFiles) {
+      try {
+        unlinkSync$1(join(LOGS_DIR, name));
+      } catch {
+      }
+    }
+    for (const { name } of plan.truncateFiles) {
+      try {
+        const p = join(LOGS_DIR, name);
+        const kept = tailSlice(readFileSync$1(p), Math.floor(policy.maxBytes / 8));
+        writeFileSync(p, kept);
+      } catch {
+      }
+    }
+  } catch {
+  }
+}
 function createLogger() {
   ensureHomeDir();
+  pruneDaemonLogs();
   const logFile = join(LOGS_DIR, `daemon-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.log`);
   return {
     logFilePath: logFile,
@@ -18215,7 +18669,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-RhxyIA_z.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-DdOSpUEW.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -18233,7 +18687,7 @@ async function startDaemon(options) {
     }
   }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-pwqsONPX.mjs');
+    const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -18261,7 +18715,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-mM9Q6Q2G.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-CnCpensV.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -20578,11 +21032,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DAcODVs3.mjs');
+              const { issueRpc } = await import('./rpc-Cx6KsBYC.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BFIy8FTe.mjs');
+              const { workflowRpc } = await import('./rpc-CclCeDcu.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -20617,6 +21071,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             onWriteFileChunk: async (path, content, uploadId, chunkIndex, totalChunks, isLast) => {
               await writeSessionFileChunk(directory, sessionMetadata, path, content, uploadId, chunkIndex, isLast);
             },
+            onFilesEndpoint: () => serveManager$1.getSessionFilesEndpoint(sessionId),
             onListDirectory: async (path) => {
               const resolvedDir = resolve$1(directory, path || ".");
               if (sessionMetadata.securityContext && resolvedDir !== resolve$1(directory) && !resolvedDir.startsWith(resolve$1(directory) + "/")) {
@@ -20876,7 +21331,9 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           if (!s || s.phase !== "dormant") return;
           let pending = [];
           try {
-            pending = backlogOraclePending(directory, sessionId);
+            const root = resolveProjectRoot(directory);
+            const scope = oracleScopeSessionId(typeof s.oracle === "string" ? s.oracle : void 0, sessionId);
+            pending = backlogOraclePending(root, scope);
           } catch {
             return;
           }
@@ -21002,7 +21459,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               {
                 const forcedModel = agentName === "codex" ? codexForcedModel() : void 0;
                 const composerModel = typeof msgMeta?.model === "string" && msgMeta.model ? msgMeta.model : void 0;
-                const rawModel = forcedModel || (agentName === "codex" && codexModelMenu().length ? codexClampModel(composerModel) : composerModel);
+                const rawModel = forcedModel || (agentName === "codex" && codexModelMenu().length ? codexClampModel(composerModel) : void 0) || (agentName === "kimi" && kimiModelMenu().length ? kimiClampModel(composerModel) : void 0) || composerModel;
                 const desiredModel = rawModel || agentConfig?.default_model || void 0;
                 if (desiredModel !== appliedAgentModel) {
                   agentBackend?.setModel?.(desiredModel);
@@ -21286,11 +21743,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DAcODVs3.mjs');
+              const { issueRpc } = await import('./rpc-Cx6KsBYC.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-BFIy8FTe.mjs');
+              const { workflowRpc } = await import('./rpc-CclCeDcu.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -21325,6 +21782,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
             onWriteFileChunk: async (path, content, uploadId, chunkIndex, totalChunks, isLast) => {
               await writeSessionFileChunk(directory, sessionMetadata, path, content, uploadId, chunkIndex, isLast);
             },
+            onFilesEndpoint: () => serveManager$1.getSessionFilesEndpoint(sessionId),
             onListDirectory: async (path) => {
               const resolvedDir = resolve$1(directory, path || ".");
               if (sessionMetadata.securityContext && resolvedDir !== resolve$1(directory) && !resolvedDir.startsWith(resolve$1(directory) + "/")) {
@@ -21424,7 +21882,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
         );
         const checkSvampConfig = svampConfigChecker.check;
         const writeSvampConfigPatchAcp = svampConfigChecker.writeConfig;
-        const permissionHandler = new HyphaPermissionHandler(shouldAutoAllow2, logger.log);
+        const permissionHandler = new HyphaPermissionHandler(
+          shouldAutoAllow2,
+          logger.log,
+          (requestId, approved) => applyPermissionResolution(sessionService, requestId, approved)
+        );
         let agentIsoConfig;
         const agentShouldIsolate = Boolean(options2.forceIsolation) || Boolean(options2.securityContext);
         if (agentShouldIsolate && isolationCapabilities.preferred) {
@@ -21527,10 +21989,24 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           let kimiEnv = {};
           if (agentName === "kimi") {
             try {
-              ensureKimiProviderConfigured(process.env, acpConfig.command, logger.log);
+              await ensureKimiProviderConfigured(process.env, acpConfig.command, logger.log);
             } catch {
             }
             kimiEnv = kimiSpawnEnv(process.env);
+            const kimiMenu = kimiModelMenu();
+            if (kimiMenu.length) {
+              const kimiModel = kimiClampModel(options2.model ?? void 0) || kimiDefaultModel();
+              sessionMetadata.models = kimiMenu.map((m) => ({
+                code: m,
+                value: m,
+                description: m === kimiModel ? "Default on this machine" : "Available on this machine"
+              }));
+              try {
+                sessionService.updateMetadata(sessionMetadata);
+              } catch {
+              }
+              logger.log(`[Agent Session ${sessionId}] Kimi model menu advertised (SVAMP_KIMI_MODELS): [${kimiMenu.join(", ")}] default=${kimiModel}`);
+            }
           }
           agentBackend = new AcpBackend({
             agentName,
@@ -21875,6 +22351,8 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
             "event"
           );
           sessionService.sendSessionEnd();
+          agentBackend.dispose().catch(() => {
+          });
           if (!acpPersisted) {
             deleteSession(sessionId);
           } else {
@@ -22253,6 +22731,27 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     writeDaemonStateFile(localState);
     logger.log("Daemon state file written \u2014 daemon is up; restoring mounts/sessions in background");
     serveManager$1.restore().catch((err) => logger.error(`[serve] mount restore failed: ${err?.message || err}`));
+    const daemonOwnerEmail = parseJwtEmail(process.env.HYPHA_TOKEN || "") || null;
+    serveManager$1.setSessionResolver((sessionId) => {
+      for (const [, session] of pidToTrackedSession) {
+        if (session.svampSessionId === sessionId && !session.stopped && session.directory) {
+          let sharing = null;
+          try {
+            sharing = session.hyphaService?.getMetadata?.()?.sharing ?? null;
+          } catch {
+            sharing = null;
+          }
+          return {
+            cwd: session.directory,
+            sharing,
+            ownerEmail: sharing?.owner || daemonOwnerEmail
+          };
+        }
+      }
+      return null;
+    });
+    const sessionFilesToken = createHash$1("sha256").update(`session-files:${machineId}`).digest("hex").slice(0, 20);
+    serveManager$1.ensureSessionFilesGateway(sessionFilesToken).then((base) => logger.log(`[serve] session-files gateway: ${base || "(tunnel pending)"}`)).catch((err) => logger.error(`[serve] session-files gateway failed: ${err?.message || err}`));
     const persistedSessions = loadPersistedSessions();
     try {
       const knownIds = new Set(persistedSessions.map((s) => s.sessionId).concat(Object.keys(loadSessionIndex())));
@@ -22291,7 +22790,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-mM9Q6Q2G.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-CnCpensV.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -22536,7 +23035,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DlDYY_wS.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-Wzzed1CU.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -23170,4 +23669,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { getSkillInfo as $, removeWorkflow as A, validateWorkflowName as B, saveWorkflow as C, rawWorkflow as D, listWorkflows as E, isWorkflowEnabled as F, workflowSchedules as G, inZone as H, cronMatches as I, summarize as J, workflowSteps as K, parseJwtEmail as L, computeCollectionConfigUpdate as M, SYSTEM_COLLECTION_CONFIG as N, loadMachineContext as O, buildMachineInstructions as P, machineToolsForRole as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, buildMachineTools as T, parseFrontmatter as U, getSkillsServer as V, getSkillsWorkspaceName as W, getSkillsCollectionName as X, fetchWithTimeout as Y, searchSkills as Z, SKILLS_DIR as _, createSessionStore as a, downloadSkillFile as a0, listSkillFiles as a1, resolveModel as a2, clearStopMarker as a3, stopMarkerExists as a4, formatHandle as a5, normalizeAllowedUser as a6, loadSecurityContextConfig as a7, resolveSecurityContext as a8, buildSecurityContextFromFlags as a9, kimiProvider as aA, kimiSetup as aB, api as aC, run as aD, mergeSecurityContexts as aa, buildSessionShareUrl as ab, computeOutboundHop as ac, registerAwaitingReply as ad, buildMachineShareUrl as ae, parseHandle as af, handleMatchesMetadata as ag, PINNED_CODEX_VERSION as ah, withFileLock as ai, describeMisconfiguration as aj, buildMachineDeps as ak, applyClaudeProxyEnv as al, composeSessionId as am, generateFriendlyName as an, generateHookSettings as ao, staticFileServer as ap, instanceConfig as aq, claudeAuth as ar, codexProvider as as, projectInfo as at, DefaultTransport$1 as au, acpBackend as av, acpAgentConfig as aw, codexAppServerBackend as ax, GeminiTransport$1 as ay, KimiTransport$1 as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, searchIssues as q, registerMachineService as r, startDaemon as s, isVisibleTo as t, updateIssue as u, getRun as v, listRuns as w, getWorkflow as x, runWorkflow as y, setWorkflowEnabled as z };
+export { SKILLS_DIR as $, setWorkflowEnabled as A, removeWorkflow as B, validateWorkflowName as C, saveWorkflow as D, rawWorkflow as E, listWorkflows as F, isWorkflowEnabled as G, workflowSchedules as H, inZone as I, cronMatches as J, summarize as K, workflowSteps as L, parseJwtEmail as M, computeCollectionConfigUpdate as N, SYSTEM_COLLECTION_CONFIG as O, loadMachineContext as P, buildMachineInstructions as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, machineToolsForRole as T, buildMachineTools as U, parseFrontmatter as V, getSkillsServer as W, getSkillsWorkspaceName as X, getSkillsCollectionName as Y, fetchWithTimeout as Z, searchSkills as _, createSessionStore as a, getSkillInfo as a0, downloadSkillFile as a1, listSkillFiles as a2, resolveModel as a3, clearStopMarker as a4, stopMarkerExists as a5, formatHandle as a6, normalizeAllowedUser as a7, loadSecurityContextConfig as a8, resolveSecurityContext as a9, KimiTransport$1 as aA, kimiProvider as aB, kimiSetup as aC, api as aD, run as aE, buildSecurityContextFromFlags as aa, mergeSecurityContexts as ab, buildSessionShareUrl as ac, computeOutboundHop as ad, registerAwaitingReply as ae, buildMachineShareUrl as af, parseHandle as ag, handleMatchesMetadata as ah, PINNED_CODEX_VERSION as ai, withFileLock as aj, describeMisconfiguration as ak, buildMachineDeps as al, applyClaudeProxyEnv as am, composeSessionId as an, generateFriendlyName as ao, generateHookSettings as ap, staticFileServer as aq, instanceConfig as ar, claudeAuth as as, codexProvider as at, projectInfo as au, DefaultTransport$1 as av, acpBackend as aw, acpAgentConfig as ax, codexAppServerBackend as ay, GeminiTransport$1 as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, isPendingIssue as q, registerMachineService as r, startDaemon as s, searchIssues as t, updateIssue as u, isVisibleTo as v, getRun as w, listRuns as x, getWorkflow as y, runWorkflow as z };