svamp-cli 0.2.317 → 0.2.319

package/dist/{run-RA4Vr6lj.mjs → run-09AkgeGM.mjs}

@@ -1,20 +1,21 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os$1, { homedir } from 'os';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import os$1, { homedir, platform, arch } from 'os';
 import fs$1, { mkdir as mkdir$1, readdir as readdir$1, readFile, writeFile as writeFile$1, rename, unlink } from 'fs/promises';
 import * as fs from 'fs';
-import fs__default, { existsSync as existsSync$1, rmSync, readFileSync as readFileSync$1, mkdirSync, writeFileSync, renameSync as renameSync$1, realpathSync as realpathSync$1, copyFileSync, unlinkSync as unlinkSync$1, readdirSync as readdirSync$1, watch, rmdirSync, statSync as statSync$1 } from 'fs';
+import fs__default, { existsSync as existsSync$1, rmSync, readFileSync as readFileSync$1, mkdirSync, writeFileSync, chmodSync, unlinkSync, renameSync as renameSync$1, realpathSync as realpathSync$1, copyFileSync, readdirSync as readdirSync$1, watch, rmdirSync, statSync as statSync$1 } from 'fs';
 import * as path from 'path';
 import path__default, { join, delimiter, resolve as resolve$1, dirname as dirname$1, basename as basename$1 } from 'path';
 import { fileURLToPath } from 'url';
-import { execFile, spawn, execSync, exec as exec$1 } from 'child_process';
+import { execFile, execSync, spawn, exec as exec$1 } from 'child_process';
 import * as crypto from 'crypto';
-import { randomUUID as randomUUID$1, createHash as createHash$1 } from 'crypto';
-import { randomUUID, randomBytes, createHash, timingSafeEqual } from 'node:crypto';
-import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync } from 'node:fs';
+import { randomUUID, createHash } from 'crypto';
+import { randomUUID as randomUUID$1, randomBytes, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
+import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync as unlinkSync$1 } from 'node:fs';
 import { exec, spawn as spawn$1, execSync as execSync$1, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import * as http from 'http';
 import * as net from 'net';
-import os, { homedir as homedir$1, platform } from 'node:os';
+import { createServer } from 'net';
+import os, { homedir as homedir$1, platform as platform$1 } from 'node:os';
 import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:path';
 import { EventEmitter } from 'node:events';
 import { ndJsonStream, ClientSideConnection } from '@agentclientprotocol/sdk';
@@ -1260,6 +1261,1027 @@ async function killDescendant(rootPid, targetPid, signal = "SIGTERM") {
   }
 }
 
+function svampHome() {
+  return process.env.SVAMP_HOME || join(homedir(), ".svamp");
+}
+function cacheFile() {
+  return join(svampHome(), "instance-config.json");
+}
+const CONFIG_FILENAME = "svamp.json";
+let _config = null;
+let _loaded = false;
+let _cacheChecked = false;
+function stripSlash$1(u) {
+  return u.replace(/\/+$/, "");
+}
+function getInstanceUrl() {
+  const raw = (process.env.SVAMP_INSTANCE_URL || "").trim();
+  return raw ? stripSlash$1(raw) : void 0;
+}
+function configUrlsFor(anchor) {
+  const base = stripSlash$1(anchor);
+  return [`${base}/${CONFIG_FILENAME}`, `${base}/.well-known/${CONFIG_FILENAME}`];
+}
+async function fetchConfig(anchor) {
+  for (const url of configUrlsFor(anchor)) {
+    try {
+      const resp = await fetch(url, { signal: AbortSignal.timeout(8e3) });
+      if (!resp.ok) continue;
+      const data = await resp.json();
+      if (data && typeof data === "object" && !Array.isArray(data)) {
+        return data;
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function readCache() {
+  try {
+    if (existsSync$1(cacheFile())) {
+      const data = JSON.parse(readFileSync$1(cacheFile(), "utf-8"));
+      if (data && typeof data === "object" && !Array.isArray(data)) return data;
+    }
+  } catch {
+  }
+  return null;
+}
+function writeCache(cfg) {
+  try {
+    mkdirSync(svampHome(), { recursive: true });
+    writeFileSync(cacheFile(), JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+  } catch {
+  }
+}
+function applyConfig(cfg) {
+  _config = cfg;
+  if (cfg.hyphaServerUrl && typeof cfg.hyphaServerUrl === "string") {
+    process.env.HYPHA_SERVER_URL = stripSlash$1(cfg.hyphaServerUrl.trim());
+  }
+}
+async function loadInstanceConfig(opts = {}) {
+  if (_loaded && !opts.force) return _config;
+  const anchor = opts.anchor ? stripSlash$1(opts.anchor) : getInstanceUrl();
+  if (anchor) {
+    const fetched = await fetchConfig(anchor);
+    if (fetched) {
+      applyConfig(fetched);
+      writeCache(fetched);
+      _loaded = true;
+      _cacheChecked = true;
+      return _config;
+    }
+  }
+  const cached = readCache();
+  if (cached) applyConfig(cached);
+  _loaded = true;
+  _cacheChecked = true;
+  return _config;
+}
+function getLoadedConfig() {
+  if (!_loaded && !_cacheChecked) {
+    const cached = readCache();
+    if (cached) applyConfig(cached);
+    _cacheChecked = true;
+  }
+  return _config;
+}
+function clearInstanceConfigCache() {
+  _config = null;
+  _loaded = false;
+  _cacheChecked = false;
+  try {
+    if (existsSync$1(cacheFile())) rmSync(cacheFile());
+  } catch {
+  }
+}
+function __setConfigForTest(cfg) {
+  _config = cfg;
+  _loaded = true;
+  _cacheChecked = true;
+  if (cfg) applyConfig(cfg);
+}
+function __resetForTest() {
+  _config = null;
+  _loaded = false;
+  _cacheChecked = false;
+}
+
+var instanceConfig = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    CONFIG_FILENAME: CONFIG_FILENAME,
+    __resetForTest: __resetForTest,
+    __setConfigForTest: __setConfigForTest,
+    clearInstanceConfigCache: clearInstanceConfigCache,
+    configUrlsFor: configUrlsFor,
+    getInstanceUrl: getInstanceUrl,
+    getLoadedConfig: getLoadedConfig,
+    loadInstanceConfig: loadInstanceConfig
+});
+
+function stripSlash(u) {
+  return u.replace(/\/+$/, "");
+}
+function getHyphaServerUrl() {
+  const fromCfg = getLoadedConfig()?.hyphaServerUrl;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
+  const env = (process.env.HYPHA_SERVER_URL || "").trim();
+  return env ? stripSlash(env) : void 0;
+}
+function getFrpsSubdomainHost() {
+  const fromCfg = getLoadedConfig()?.frps?.subdomainHost;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
+  const env = (process.env.FRPS_SUBDOMAIN_HOST || "").trim();
+  if (env) return env;
+  throw new Error(
+    'frps subdomain host is not configured. Serve a svamp.json with "frps.subdomainHost" at your frontend URL (svamp login <frontend-url>), or set FRPS_SUBDOMAIN_HOST (legacy). It is deployment-specific and never guessed.'
+  );
+}
+function getFrpsServerAddr() {
+  const fromCfg = getLoadedConfig()?.frps?.serverAddr;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
+  const env = (process.env.FRPS_SERVER_ADDR || "").trim();
+  if (env) return env;
+  return `frps-ctrl.${getFrpsSubdomainHost()}`;
+}
+function getFrpsServerPort() {
+  const fromCfg = getLoadedConfig()?.frps?.serverPort;
+  if (typeof fromCfg === "number" && Number.isFinite(fromCfg)) return fromCfg;
+  const env = parseInt(process.env.FRPS_SERVER_PORT || "", 10);
+  return Number.isFinite(env) ? env : void 0;
+}
+function getSvampWebBaseUrl() {
+  const fromCfg = getLoadedConfig()?.web?.baseUrl;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
+  const env = (process.env.SVAMP_WEB_URL || "").trim();
+  if (env) return stripSlash(env);
+  const instance = getInstanceUrl();
+  if (instance) return instance;
+  throw new Error(
+    'Svamp web base URL is not configured. Serve a svamp.json with "web.baseUrl", log in with your frontend URL (svamp login <frontend-url>), or set SVAMP_WEB_URL (legacy).'
+  );
+}
+function getSkillsServerUrl() {
+  const fromCfg = getLoadedConfig()?.skills?.server;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
+  const env = (process.env.HYPHA_SKILLS_SERVER || "").trim();
+  if (env) return stripSlash(env);
+  const server = getHyphaServerUrl();
+  if (server) return server;
+  throw new Error(
+    "Cannot determine skills marketplace server. Serve a svamp.json or set HYPHA_SERVER_URL."
+  );
+}
+function getSkillsWorkspace() {
+  const fromCfg = getLoadedConfig()?.skills?.workspace;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
+  return (process.env.HYPHA_SKILLS_WORKSPACE || "").trim() || "hypha-cloud";
+}
+function getSkillsCollection() {
+  const fromCfg = getLoadedConfig()?.skills?.collection;
+  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
+  return (process.env.HYPHA_SKILLS_COLLECTION || "").trim() || "marketplace";
+}
+
+function getMachineFingerprint() {
+  const idFile = join(homedir(), ".svamp", "machine-id");
+  try {
+    const existing = readFileSync$1(idFile, "utf-8").trim();
+    if (existing) return existing;
+  } catch {
+  }
+  const id = randomUUID();
+  try {
+    mkdirSync(join(homedir(), ".svamp"), { recursive: true });
+    writeFileSync(idFile, id + "\n");
+  } catch {
+  }
+  return id;
+}
+const FRP_VERSION = "0.68.0";
+const BIN_DIR = join(homedir(), ".svamp", "bin");
+const FRPC_BIN = join(BIN_DIR, platform() === "win32" ? "frpc.exe" : "frpc");
+const _livingFrpcPids = /* @__PURE__ */ new Set();
+function isFrpcSubdomainConflict(errorLine) {
+  return /router config conflict|already exists/i.test(errorLine);
+}
+function shouldGiveUpOnConflict(args) {
+  if (args.everStartedProxy) return false;
+  return args.conflictCount >= args.minAttempts && args.elapsedMs >= args.minElapsedMs;
+}
+function selectOrphanedFrpcPids(psOutput, selfPid, livingPids) {
+  const pids = [];
+  for (const line of psOutput.split("\n")) {
+    const m = /^\s*(\d+)\s+(.*)$/.exec(line);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    const cmd = m[2];
+    if (!cmd.includes(".svamp/bin/frpc")) continue;
+    if (pid === selfPid || livingPids.has(pid)) continue;
+    pids.push(pid);
+  }
+  return pids;
+}
+function killOrphanedFrpc(log) {
+  if (process.platform === "win32") return;
+  try {
+    const out = execSync("ps -axo pid=,command=", { encoding: "utf-8" });
+    const pids = selectOrphanedFrpcPids(out, process.pid, _livingFrpcPids);
+    for (const pid of pids) {
+      try {
+        process.kill(pid, "SIGKILL");
+      } catch {
+      }
+    }
+    if (pids.length) {
+      log(`Reaped ${pids.length} orphaned frpc process(es) from a prior daemon generation \u2014 they were retrying stale subdomains and causing frps router-config-conflict churn.`);
+    }
+  } catch {
+  }
+}
+function isInCluster() {
+  return !!(process.env.KUBERNETES_SERVICE_HOST || process.env.SANDBOX_ID);
+}
+const FRPS_CLUSTER_ADDR = "frps.hypha.svc.cluster.local";
+const DEFAULT_FRPS_PORT = isInCluster() ? 7e3 : 443;
+const FRPS_PUBLIC_TOKEN = "hypha-frps-public";
+function getFrpcDownloadUrl() {
+  const os = platform();
+  const a = arch();
+  let osStr;
+  let archStr;
+  switch (os) {
+    case "darwin":
+      osStr = "darwin";
+      break;
+    case "linux":
+      osStr = "linux";
+      break;
+    case "win32":
+      osStr = "windows";
+      break;
+    default:
+      throw new Error(`Unsupported platform: ${os}`);
+  }
+  switch (a) {
+    case "x64":
+      archStr = "amd64";
+      break;
+    case "arm64":
+      archStr = "arm64";
+      break;
+    case "arm":
+      archStr = "arm";
+      break;
+    default:
+      throw new Error(`Unsupported architecture: ${a}`);
+  }
+  const ext = os === "win32" ? "zip" : "tar.gz";
+  const filename = `frp_${FRP_VERSION}_${osStr}_${archStr}`;
+  return `https://github.com/fatedier/frp/releases/download/v${FRP_VERSION}/${filename}.${ext}`;
+}
+let _frpcDownloadInFlight = null;
+async function ensureFrpc(log) {
+  if (existsSync$1(FRPC_BIN)) {
+    try {
+      const out = execSync(`"${FRPC_BIN}" --version`, { stdio: "pipe", timeout: 5e3 }).toString().trim();
+      if (out === FRP_VERSION) return FRPC_BIN;
+      (log || console.log)(`frpc version mismatch: ${out} \u2260 ${FRP_VERSION}, re-downloading...`);
+    } catch {
+      (log || console.log)("frpc binary broken or invalid signature, re-downloading...");
+    }
+  }
+  if (_frpcDownloadInFlight) return _frpcDownloadInFlight;
+  _frpcDownloadInFlight = downloadFrpc(log).finally(() => {
+    _frpcDownloadInFlight = null;
+  });
+  return _frpcDownloadInFlight;
+}
+async function downloadFrpc(log) {
+  try {
+    if (existsSync$1(FRPC_BIN)) unlinkSync(FRPC_BIN);
+  } catch {
+  }
+  const logger = log || console.log;
+  mkdirSync(BIN_DIR, { recursive: true });
+  const url = getFrpcDownloadUrl();
+  logger(`Downloading frpc ${FRP_VERSION} from ${url}...`);
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 6e4);
+  let response;
+  try {
+    response = await fetch(url, { signal: ctrl.signal });
+  } catch (err) {
+    const why = err?.name === "AbortError" ? "timed out after 60s" : err?.message ?? String(err);
+    throw new Error(`Failed to download frpc from ${url}: ${why}`);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (!response.ok) {
+    throw new Error(`Failed to download frpc: ${response.status} ${response.statusText}`);
+  }
+  const buffer = Buffer.from(await response.arrayBuffer());
+  if (platform() === "win32") {
+    throw new Error("Windows ZIP extraction not implemented \u2014 please install frpc manually");
+  }
+  const tmpTar = join(BIN_DIR, `frpc-${FRP_VERSION}-${process.pid}-${Math.random().toString(36).slice(2, 8)}.tar.gz`);
+  writeFileSync(tmpTar, buffer);
+  try {
+    const dirName = `frp_${FRP_VERSION}_${platform() === "darwin" ? "darwin" : "linux"}_${arch() === "x64" ? "amd64" : arch()}`;
+    execSync(
+      `tar -xzf "${tmpTar}" -C "${BIN_DIR}" --strip-components=1 "${dirName}/frpc"`,
+      { stdio: "pipe" }
+    );
+    chmodSync(FRPC_BIN, 493);
+    logger(`frpc installed at ${FRPC_BIN}`);
+  } finally {
+    try {
+      unlinkSync(tmpTar);
+    } catch {
+    }
+  }
+  return FRPC_BIN;
+}
+function tomlStr(v) {
+  return String(v).replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t");
+}
+function generateFrpcConfig(config, proxies, admin) {
+  const useWSS = config.serverPort === 443;
+  const lines = [
+    "# Auto-generated by svamp \u2014 do not edit",
+    `serverAddr = "${tomlStr(config.serverAddr)}"`,
+    `serverPort = ${config.serverPort}`,
+    "",
+    'auth.method = "token"',
+    `auth.token = "${tomlStr(config.authToken)}"`,
+    "",
+    "# Hypha JWT token for server-side authentication",
+    ...config.hyphaToken ? [`metadatas.token = "${tomlStr(config.hyphaToken)}"`] : [],
+    "",
+    "# Transport",
+    ...useWSS ? ['transport.protocol = "wss"'] : [],
+    // 15s/45s heartbeat — 2x faster failure detection than the frpc default
+    // (30s/90s). With matching server-side frps 0.68.x, dead-peer detection
+    // settles in well under a minute, so the daemon-side recreate threshold
+    // can be tightened too.
+    "transport.heartbeatInterval = 15",
+    "transport.heartbeatTimeout = 45",
+    "transport.poolCount = 5",
+    "",
+    "# Don't exit on login failure \u2014 let frpc keep retrying",
+    "loginFailExit = false",
+    "",
+    'log.to = "console"',
+    'log.level = "info"',
+    ""
+  ];
+  if (admin) {
+    lines.push("# Local admin/status API (loopback only \u2014 polled by the svamp daemon)");
+    lines.push('webServer.addr = "127.0.0.1"');
+    lines.push(`webServer.port = ${admin.port}`);
+    lines.push(`webServer.user = "${tomlStr(admin.user)}"`);
+    lines.push(`webServer.password = "${tomlStr(admin.password)}"`);
+    lines.push("");
+  }
+  for (const proxy of proxies) {
+    lines.push(`[[proxies]]`);
+    lines.push(`name = "${tomlStr(proxy.name)}"`);
+    lines.push(`type = "${tomlStr(proxy.type)}"`);
+    lines.push(`localIP = "${tomlStr(proxy.localIP || "127.0.0.1")}"`);
+    lines.push(`localPort = ${proxy.localPort}`);
+    if (proxy.subdomain) {
+      lines.push(`subdomain = "${tomlStr(proxy.subdomain)}"`);
+    }
+    if (proxy.customDomains && proxy.customDomains.length > 0) {
+      lines.push(`customDomains = [${proxy.customDomains.map((d) => `"${tomlStr(d)}"`).join(", ")}]`);
+    }
+    if (proxy.group) {
+      lines.push(`loadBalancer.group = "${tomlStr(proxy.group)}"`);
+      if (proxy.groupKey) {
+        lines.push(`loadBalancer.groupKey = "${tomlStr(proxy.groupKey)}"`);
+      }
+    }
+    if (proxy.healthCheckType) {
+      lines.push(`healthCheck.type = "${tomlStr(proxy.healthCheckType)}"`);
+      if (proxy.healthCheckType === "http" && proxy.healthCheckPath) {
+        lines.push(`healthCheck.path = "${tomlStr(proxy.healthCheckPath)}"`);
+      }
+      lines.push(`healthCheck.intervalSeconds = ${proxy.healthCheckInterval || 10}`);
+      lines.push(`healthCheck.timeoutSeconds = ${proxy.healthCheckTimeout || 3}`);
+      lines.push(`healthCheck.maxFailed = ${proxy.healthCheckMaxFailed || 3}`);
+    }
+    if (proxy.type === "http") {
+      lines.push("transport.useEncryption = false");
+      lines.push("transport.useCompression = false");
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function getFreePort() {
+  return new Promise((resolve, reject) => {
+    const srv = createServer();
+    srv.unref();
+    srv.on("error", reject);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = typeof addr === "object" && addr ? addr.port : 0;
+      srv.close(() => port ? resolve(port) : reject(new Error("no port")));
+    });
+  });
+}
+function parseFrpcStatus(payload, proxyNames) {
+  const byName = /* @__PURE__ */ new Map();
+  if (payload && typeof payload === "object") {
+    for (const group of Object.values(payload)) {
+      if (!Array.isArray(group)) continue;
+      for (const p of group) {
+        if (p && typeof p.name === "string") {
+          byName.set(p.name, { status: String(p.status ?? ""), err: p.err ? String(p.err) : void 0 });
+        }
+      }
+    }
+  }
+  const missing = [];
+  const failed = [];
+  for (const name of proxyNames) {
+    const entry = byName.get(name);
+    if (!entry) {
+      missing.push(name);
+      continue;
+    }
+    if (entry.status !== "running") failed.push({ name, status: entry.status, err: entry.err });
+  }
+  return { allRunning: missing.length === 0 && failed.length === 0, missing, failed };
+}
+class FrpcTunnel {
+  process = null;
+  _connected = false;
+  _destroyed = false;
+  // #0460: in-flight guard. `this.process` is only set AFTER the `await ensureFrpc()`
+  // inside connect(), so two connect() calls interleaved across that await (e.g. the
+  // auto-restart timer firing while an external caller also connects) both pass the
+  // `if (this.process) return` null-check and spawn a duplicate frpc child — the first
+  // is overwritten and never killed, leaving a ghost tunnel registration. This flag is
+  // set synchronously before the await and makes connect() idempotent across it.
+  _connecting = false;
+  configPath;
+  options;
+  serverConfig;
+  log;
+  logBuffer = [];
+  maxLogLines = 200;
+  proxies = [];
+  // Health tracking
+  _consecutiveErrors = 0;
+  _lastConnectedAt = 0;
+  _lastErrorAt = 0;
+  _firstErrorAt = 0;
+  _restartAttempts = 0;
+  // Persistent-conflict give-up (kth-k8s nightly review 2026-08-09). A generation that has NEVER
+  // brought a proxy online and only ever gets `router config conflict` / `already exists` has lost
+  // the vhost race to another live generation — it must STOP hammering frps ~2/min forever rather
+  // than retry indefinitely. Reset on any real `start proxy success`; only fires when a proxy was
+  // never started (so a live tunnel riding out an frps failover is never torn down).
+  _everStartedProxy = false;
+  _conflictCount = 0;
+  _conflictSince = 0;
+  _restartTimer = null;
+  // #0583: pending reconnect timer (cancelled on destroy)
+  // End-to-end probe state (set when options.probeUrl is provided).
+  _probeTimer = null;
+  _burstTimer = null;
+  // #0622: probe burst timer (cancelled on stopProbeLoop/destroy)
+  _connectTimeoutTimer = null;
+  // #0622: connect() 30s fallback (unref'd + cleared)
+  _lastProbeOkAt = 0;
+  _lastProbeFailAt = 0;
+  _probeOk = false;
+  // frpc admin/status API state (set when options.adminStatus is true).
+  _adminPort = 0;
+  _adminUser = "svamp";
+  _adminPassword = randomUUID();
+  _statusTimer = null;
+  constructor(options) {
+    this.options = options;
+    this.log = options.log || ((msg) => console.log(`[FRPC] ${msg}`));
+    const hyphaToken = options.serverConfig?.hyphaToken || process.env.HYPHA_TOKEN || "";
+    this.serverConfig = {
+      serverAddr: options.serverConfig?.serverAddr || process.env.FRPS_SERVER_ADDR || (isInCluster() ? FRPS_CLUSTER_ADDR : getFrpsServerAddr()),
+      serverPort: options.serverConfig?.serverPort || getFrpsServerPort() || DEFAULT_FRPS_PORT,
+      authToken: options.serverConfig?.authToken || process.env.FRPS_AUTH_TOKEN || FRPS_PUBLIC_TOKEN,
+      hyphaToken,
+      subDomainHost: options.serverConfig?.subDomainHost || process.env.FRPS_SUBDOMAIN_HOST || getFrpsSubdomainHost()
+    };
+    if (!this.serverConfig.hyphaToken) {
+      throw new Error(
+        'Hypha token required for frpc authentication. Run "svamp login" or set HYPHA_TOKEN.'
+      );
+    }
+    const machineFingerprint = getMachineFingerprint();
+    const machineHash = createHash("sha256").update(machineFingerprint).digest("hex").slice(0, 6);
+    const multiPort = options.ports.length > 1;
+    this.proxies = options.ports.map((port) => {
+      const standaloneHash = createHash("sha256").update(multiPort ? `${options.name}|${port}|${machineFingerprint}` : `${options.name}|${machineFingerprint}`).digest("hex").slice(0, 8);
+      const groupSubdomainKey = multiPort ? `${options.group}|${port}` : `${options.group}`;
+      const subdomain = options.subdomains?.get(port) || (options.group ? `${options.group}-${createHash("sha256").update(groupSubdomainKey).digest("hex").slice(0, 8)}` : `${options.name}-${standaloneHash}`);
+      const proxyName = `${options.name}-${port}-${machineHash}`;
+      return {
+        name: proxyName,
+        type: "http",
+        localIP: options.localHost || "127.0.0.1",
+        localPort: port,
+        subdomain,
+        group: options.group,
+        groupKey: options.groupKey,
+        healthCheckType: options.healthCheckType,
+        healthCheckPath: options.healthCheckPath,
+        healthCheckInterval: options.healthCheckInterval
+      };
+    });
+    const configDir = join(homedir(), ".svamp", "frpc");
+    mkdirSync(configDir, { recursive: true, mode: 448 });
+    try {
+      chmodSync(configDir, 448);
+    } catch {
+    }
+    this.configPath = join(configDir, `${options.name}.toml`);
+  }
+  /**
+   * #0583: schedule a backoff reconnect after the child went down (spawn error OR exit).
+   * Extracted from the exit handler so BOTH the spawn-'error' and 'exit' paths share it, and
+   * so it is unit-testable without a real spawn. No-op once destroyed.
+   */
+  _reconnectAfterDown(reason) {
+    if (this._destroyed) return;
+    const STABILITY_WINDOW_MS = 3e4;
+    if (this._lastConnectedAt > 0 && Date.now() - this._lastConnectedAt >= STABILITY_WINDOW_MS) {
+      this._restartAttempts = 0;
+    }
+    this._restartAttempts++;
+    const delay = Math.min(3e3 * Math.pow(2, this._restartAttempts - 1), 6e4);
+    this.log(`frpc down (${reason}), restarting in ${Math.round(delay / 1e3)}s (attempt ${this._restartAttempts})...`);
+    this._restartTimer = setTimeout(() => {
+      this._restartTimer = null;
+      if (!this._destroyed) {
+        this.connect().catch((err) => {
+          this.options.onError?.(err);
+          if (!this._destroyed && !this._restartTimer && !this.process) {
+            this._reconnectAfterDown(`reconnect setup failed: ${err?.message ?? err}`);
+          }
+        });
+      }
+    }, delay);
+  }
+  /** Connect to frps by starting the frpc process. */
+  async connect() {
+    if (this._destroyed) return;
+    if (this.process) return;
+    if (this._connecting) return;
+    this._connecting = true;
+    let frpcPath;
+    let admin;
+    try {
+      frpcPath = await ensureFrpc(this.log);
+      if (this.options.adminStatus) {
+        if (!this._adminPort) {
+          try {
+            this._adminPort = await getFreePort();
+          } catch (err) {
+            this.log(`admin port alloc failed: ${err?.message ?? err}`);
+          }
+        }
+        if (this._adminPort) admin = { port: this._adminPort, user: this._adminUser, password: this._adminPassword };
+      }
+      const configContent = generateFrpcConfig(this.serverConfig, this.proxies, admin);
+      writeFileSync(this.configPath, configContent, { mode: 384 });
+      this.log(`Config written to ${this.configPath}`);
+    } catch (err) {
+      this._connecting = false;
+      throw err;
+    }
+    if (this._destroyed) {
+      this._connecting = false;
+      return;
+    }
+    return new Promise((resolve, reject) => {
+      const child = spawn(frpcPath, ["-c", this.configPath], {
+        stdio: ["ignore", "pipe", "pipe"],
+        env: { ...process.env }
+      });
+      this.process = child;
+      if (child.pid) _livingFrpcPids.add(child.pid);
+      this._connecting = false;
+      let resolved = false;
+      const onOutput = (data) => {
+        const text = data.toString().trim();
+        if (!text) return;
+        for (const line of text.split("\n")) {
+          this.logBuffer.push(line);
+          if (this.logBuffer.length > this.maxLogLines) {
+            this.logBuffer.shift();
+          }
+        }
+        if (text.includes("start proxy success")) {
+          this._everStartedProxy = true;
+          this._conflictCount = 0;
+          this._conflictSince = 0;
+        }
+        if (text.includes("start proxy success") || text.includes("login to server success")) {
+          if (!this._connected) {
+            this._connected = true;
+            this._lastConnectedAt = Date.now();
+            this._consecutiveErrors = 0;
+            this._firstErrorAt = 0;
+            this.options.onConnect?.();
+            const probeConfigured = !!(this.options.probeUrl || this.options.probePath);
+            if (!resolved && !probeConfigured) {
+              resolved = true;
+              resolve();
+            }
+          }
+        }
+        const errorLine = text.split("\n").find((line) => line.includes("[E]"));
+        if (errorLine) {
+          this._consecutiveErrors++;
+          this._lastErrorAt = Date.now();
+          if (this._firstErrorAt === 0) this._firstErrorAt = Date.now();
+          this.options.onError?.(new Error(errorLine));
+          if (isFrpcSubdomainConflict(errorLine) && !this._everStartedProxy) {
+            if (this._conflictSince === 0) this._conflictSince = Date.now();
+            this._conflictCount++;
+            const CONFLICT_GIVEUP_ATTEMPTS = Number(process.env.SVAMP_FRPC_CONFLICT_GIVEUP_ATTEMPTS || 6);
+            const CONFLICT_GIVEUP_MS = Number(process.env.SVAMP_FRPC_CONFLICT_GIVEUP_MS || 6e4);
+            const elapsed = Date.now() - this._conflictSince;
+            if (shouldGiveUpOnConflict({
+              everStartedProxy: this._everStartedProxy,
+              conflictCount: this._conflictCount,
+              elapsedMs: elapsed,
+              minAttempts: CONFLICT_GIVEUP_ATTEMPTS,
+              minElapsedMs: CONFLICT_GIVEUP_MS
+            })) {
+              this.log(
+                `Giving up: ${this._conflictCount} subdomain conflicts over ${Math.round(elapsed / 1e3)}s with no proxy ever online \u2014 another generation owns this vhost. Stopping to avoid endless frps churn.`
+              );
+              this.options.onError?.(new Error(`frpc persistent subdomain conflict (${this._conflictCount}x) \u2014 giving up`));
+              this.destroy();
+            }
+          }
+        }
+      };
+      child.stdout?.on("data", onOutput);
+      child.stderr?.on("data", onOutput);
+      let downHandled = false;
+      const onChildDown = (rejectErr) => {
+        if (downHandled) return;
+        downHandled = true;
+        this._connected = false;
+        if (child.pid) _livingFrpcPids.delete(child.pid);
+        this.process = null;
+        this.options.onDisconnect?.();
+        if (!resolved) {
+          resolved = true;
+          reject(rejectErr);
+        }
+        this._reconnectAfterDown(rejectErr.message);
+      };
+      child.on("error", (err) => {
+        this.options.onError?.(err);
+        onChildDown(err instanceof Error ? err : new Error(String(err)));
+      });
+      child.on("exit", (code) => {
+        onChildDown(new Error(`frpc exited with code ${code}`));
+      });
+      if (this.options.probeUrl || this.options.probePath) {
+        this.startProbeLoop({
+          onFirstOk: () => {
+            if (!resolved) {
+              resolved = true;
+              resolve();
+            }
+          }
+        });
+      } else if (this.options.adminStatus && this._adminPort) {
+        this.startAdminStatusLoop();
+      }
+      if (this._connectTimeoutTimer) {
+        clearTimeout(this._connectTimeoutTimer);
+        this._connectTimeoutTimer = null;
+      }
+      this._connectTimeoutTimer = setTimeout(() => {
+        this._connectTimeoutTimer = null;
+        if (!resolved) {
+          resolved = true;
+          this.log("frpc connection timeout \u2014 continuing (may still connect)");
+          resolve();
+        }
+      }, 3e4);
+      this._connectTimeoutTimer.unref?.();
+    });
+  }
+  /** Resolve the effective probe URL, honoring probeUrl > probePath. */
+  resolveProbeUrl() {
+    if (this.options.probeUrl) return this.options.probeUrl;
+    if (this.options.probePath) {
+      const base = this.getUrls().get(this.options.ports[0]);
+      if (!base) return null;
+      const sep = this.options.probePath.startsWith("/") ? "" : "/";
+      return `${base}${sep}${this.options.probePath}`;
+    }
+    return null;
+  }
+  /**
+   * Start an end-to-end probe loop against the resolved probe URL.
+   * Updates _probeOk + timestamps and fires onProbeFail on transitions.
+   * Called from connect(); cleaned up in destroy().
+   */
+  startProbeLoop(opts = {}) {
+    const probeUrl = this.resolveProbeUrl();
+    if (!probeUrl) return;
+    this.stopProbeLoop();
+    const intervalMs = this.options.probeIntervalMs ?? 3e4;
+    let firstOkFired = false;
+    let inFlight = false;
+    const runProbe = async () => {
+      if (this._destroyed || inFlight) return;
+      inFlight = true;
+      try {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), 1e4);
+        let resp;
+        try {
+          resp = await fetch(probeUrl, {
+            method: "GET",
+            signal: ctrl.signal,
+            // Don't follow redirects — we just want any 2xx/3xx.
+            redirect: "manual",
+            headers: { "User-Agent": "svamp-frpc-probe/1" }
+          });
+        } finally {
+          clearTimeout(timer);
+        }
+        if (resp.status < 400) {
+          const wasFailing = !this._probeOk;
+          this._probeOk = true;
+          this._lastProbeOkAt = Date.now();
+          if (wasFailing) {
+            this.log(`probe ok: ${probeUrl} (${resp.status})`);
+          }
+          if (!firstOkFired && opts.onFirstOk) {
+            firstOkFired = true;
+            opts.onFirstOk();
+          }
+        } else {
+          throw new Error(`probe got ${resp.status}`);
+        }
+      } catch (err) {
+        const wasOk = this._probeOk;
+        this._probeOk = false;
+        this._lastProbeFailAt = Date.now();
+        if (wasOk) {
+          this.log(`probe failed: ${err?.message || err}`);
+          this.options.onProbeFail?.(err instanceof Error ? err : new Error(String(err)));
+        }
+      } finally {
+        inFlight = false;
+      }
+    };
+    const initialDelays = [500, 2e3, 5e3, 1e4];
+    let burstIdx = 0;
+    if (this._burstTimer) clearInterval(this._burstTimer);
+    this._burstTimer = setInterval(() => {
+      if (this._destroyed || firstOkFired || burstIdx >= initialDelays.length) {
+        if (this._burstTimer) {
+          clearInterval(this._burstTimer);
+          this._burstTimer = null;
+        }
+        return;
+      }
+      burstIdx++;
+      void runProbe();
+    }, 1500);
+    if (intervalMs > 0) {
+      this._probeTimer = setInterval(runProbe, intervalMs);
+    }
+    void runProbe();
+  }
+  stopProbeLoop() {
+    if (this._probeTimer) {
+      clearInterval(this._probeTimer);
+      this._probeTimer = null;
+    }
+    if (this._burstTimer) {
+      clearInterval(this._burstTimer);
+      this._burstTimer = null;
+    }
+  }
+  /**
+   * Poll frpc's loopback admin API (`/api/status`) to track whether this
+   * tunnel's proxies are registered ("running"). Feeds the same `_probeOk` /
+   * staleness fields the daemon health loop watches, so a ghosted/stuck proxy
+   * is detected and recreated even with no HTTP health endpoint on the backend.
+   *
+   * Conservative semantics (critical infra — must not churn healthy tunnels):
+   *  - all proxies "running"        → ok (refresh lastProbeOkAt)
+   *  - a proxy present but not running, or missing after a grace period
+   *                                 → fail (sets lastProbeFailAt; daemon recreates after staleness)
+   *  - admin API unreachable        → INCONCLUSIVE: leave _probeOk untouched
+   *                                   (a transient blip can't flip ok→fail)
+   */
+  startAdminStatusLoop() {
+    this.stopAdminStatusLoop();
+    if (!this._adminPort) return;
+    const proxyNames = this.proxies.map((p) => p.name);
+    const intervalMs = this.options.probeIntervalMs ?? 3e4;
+    const startedAt = Date.now();
+    const auth = "Basic " + Buffer.from(`${this._adminUser}:${this._adminPassword}`).toString("base64");
+    this._probeOk = true;
+    this._lastProbeOkAt = Date.now();
+    let inFlight = false;
+    const poll = async () => {
+      if (this._destroyed || inFlight || !this.process) return;
+      inFlight = true;
+      try {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), 5e3);
+        let payload;
+        try {
+          const resp = await fetch(`http://127.0.0.1:${this._adminPort}/api/status`, {
+            headers: { Authorization: auth },
+            signal: ctrl.signal
+          });
+          if (!resp.ok) throw new Error(`admin status ${resp.status}`);
+          payload = await resp.json();
+        } finally {
+          clearTimeout(timer);
+        }
+        const { allRunning, missing, failed } = parseFrpcStatus(payload, proxyNames);
+        const graceElapsed = Date.now() - startedAt > 2e4;
+        if (allRunning || !failed.length && !graceElapsed) {
+          const wasFailing = !this._probeOk;
+          this._probeOk = true;
+          this._lastProbeOkAt = Date.now();
+          if (wasFailing) this.log(`admin status ok: all proxies running`);
+        } else {
+          const wasOk = this._probeOk;
+          this._probeOk = false;
+          this._lastProbeFailAt = Date.now();
+          if (wasOk) {
+            const detail = [
+              ...failed.map((f) => `${f.name}=${f.status}${f.err ? ` (${f.err})` : ""}`),
+              ...missing.map((m) => `${m}=missing`)
+            ].join(", ");
+            this.log(`admin status fail: ${detail}`);
+            this.options.onProbeFail?.(new Error(`frpc proxy not running: ${detail}`));
+          }
+        }
+      } catch {
+      } finally {
+        inFlight = false;
+      }
+    };
+    if (intervalMs > 0) this._statusTimer = setInterval(poll, intervalMs);
+    setTimeout(() => void poll(), 3e3);
+  }
+  stopAdminStatusLoop() {
+    if (this._statusTimer) {
+      clearInterval(this._statusTimer);
+      this._statusTimer = null;
+    }
+  }
+  /** Disconnect and stop the frpc process. */
+  destroy() {
+    this._destroyed = true;
+    this._connected = false;
+    this.stopProbeLoop();
+    this.stopAdminStatusLoop();
+    if (this._restartTimer) {
+      clearTimeout(this._restartTimer);
+      this._restartTimer = null;
+    }
+    if (this._connectTimeoutTimer) {
+      clearTimeout(this._connectTimeoutTimer);
+      this._connectTimeoutTimer = null;
+    }
+    if (this.process) {
+      if (this.process.pid) _livingFrpcPids.delete(this.process.pid);
+      this.process.kill("SIGTERM");
+      const p = this.process;
+      const killTimer = setTimeout(() => {
+        try {
+          if (p.exitCode === null && p.signalCode === null) p.kill("SIGKILL");
+        } catch {
+        }
+      }, 5e3);
+      killTimer.unref?.();
+      p.once("exit", () => clearTimeout(killTimer));
+      this.process = null;
+    }
+    try {
+      unlinkSync(this.configPath);
+    } catch {
+    }
+  }
+  /** Whether the frpc tunnel is connected. */
+  get isConnected() {
+    return this._connected && this.process !== null;
+  }
+  /** Snapshot of tunnel health for monitoring. */
+  get status() {
+    return {
+      connected: this.isConnected,
+      pid: this.process?.pid ?? null,
+      name: this.options.name,
+      ports: this.options.ports,
+      serverAddr: this.serverConfig.serverAddr,
+      recentLogs: this.logBuffer.slice(-10),
+      consecutiveErrors: this._consecutiveErrors,
+      lastConnectedAt: this._lastConnectedAt,
+      lastErrorAt: this._lastErrorAt,
+      firstErrorAt: this._firstErrorAt,
+      restartAttempts: this._restartAttempts,
+      failingDurationMs: this._firstErrorAt > 0 ? Date.now() - this._firstErrorAt : 0,
+      probe: this.resolveProbeUrl() || this.options.adminStatus && this._adminPort ? {
+        url: this.resolveProbeUrl() || `frpc-admin:${this._adminPort}/api/status`,
+        ok: this._probeOk,
+        lastOkAt: this._lastProbeOkAt,
+        lastFailAt: this._lastProbeFailAt,
+        stalenessMs: this._lastProbeOkAt > 0 ? Date.now() - this._lastProbeOkAt : 0
+      } : void 0
+    };
+  }
+  /** Update the Hypha token. Rewrites config; takes effect on next frpc restart. */
+  updateToken(newToken) {
+    this.serverConfig.hyphaToken = newToken;
+    const admin = this.options.adminStatus && this._adminPort ? { port: this._adminPort, user: this._adminUser, password: this._adminPassword } : void 0;
+    const configContent = generateFrpcConfig(this.serverConfig, this.proxies, admin);
+    writeFileSync(this.configPath, configContent, { mode: 384 });
+    this.log("Config updated with fresh token");
+  }
+  /** Get the public URLs for each port. */
+  getUrls() {
+    const urls = /* @__PURE__ */ new Map();
+    const base = this.serverConfig.subDomainHost || "svc.hypha.amun.ai";
+    for (const proxy of this.proxies) {
+      const subdomain = proxy.subdomain || proxy.name;
+      urls.set(proxy.localPort, `https://${subdomain}.${base}`);
+    }
+    return urls;
+  }
+}
+async function runFrpcTunnel(name, ports, serverConfig, tunnelOptions) {
+  const portList = ports.join(", ");
+  const tunnel = new FrpcTunnel({
+    name,
+    ports,
+    serverConfig,
+    ...tunnelOptions,
+    onConnect: () => {
+      console.log(`Tunnel connected: ${name} \u2192 localhost:[${portList}]`);
+      const urls = tunnel.getUrls();
+      for (const [port, url] of urls) {
+        console.log(`  ${port} \u2192 ${url}`);
+      }
+    },
+    onDisconnect: () => {
+      console.log("Tunnel disconnected, frpc will auto-reconnect...");
+    },
+    onError: (err) => {
+      console.error(`Tunnel error: ${err.message}`);
+    }
+  });
+  const cleanup = () => {
+    console.log("\nTunnel shutting down...");
+    tunnel.destroy();
+    process.exit(0);
+  };
+  process.on("SIGINT", cleanup);
+  process.on("SIGTERM", cleanup);
+  try {
+    await tunnel.connect();
+    console.log(`Tunnel is active. Press Ctrl+C to stop.`);
+    await new Promise(() => {
+    });
+  } catch (err) {
+    console.error(`Failed to establish tunnel: ${err.message}`);
+    process.exit(1);
+  }
+}
+
+var frpc = /*#__PURE__*/Object.freeze({
+    __proto__: null,
+    FrpcTunnel: FrpcTunnel,
+    ensureFrpc: ensureFrpc,
+    generateFrpcConfig: generateFrpcConfig,
+    getFreePort: getFreePort,
+    isFrpcSubdomainConflict: isFrpcSubdomainConflict,
+    killOrphanedFrpc: killOrphanedFrpc,
+    parseFrpcStatus: parseFrpcStatus,
+    runFrpcTunnel: runFrpcTunnel,
+    selectOrphanedFrpcPids: selectOrphanedFrpcPids,
+    shouldGiveUpOnConflict: shouldGiveUpOnConflict
+});
+
 const MIME = {
   ".html": "text/html; charset=utf-8",
   ".htm": "text/html; charset=utf-8",
@@ -1928,188 +2950,6 @@ function escapeHtml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
 
-function svampHome() {
-  return process.env.SVAMP_HOME || join(homedir(), ".svamp");
-}
-function cacheFile() {
-  return join(svampHome(), "instance-config.json");
-}
-const CONFIG_FILENAME = "svamp.json";
-let _config = null;
-let _loaded = false;
-let _cacheChecked = false;
-function stripSlash$1(u) {
-  return u.replace(/\/+$/, "");
-}
-function getInstanceUrl() {
-  const raw = (process.env.SVAMP_INSTANCE_URL || "").trim();
-  return raw ? stripSlash$1(raw) : void 0;
-}
-function configUrlsFor(anchor) {
-  const base = stripSlash$1(anchor);
-  return [`${base}/${CONFIG_FILENAME}`, `${base}/.well-known/${CONFIG_FILENAME}`];
-}
-async function fetchConfig(anchor) {
-  for (const url of configUrlsFor(anchor)) {
-    try {
-      const resp = await fetch(url, { signal: AbortSignal.timeout(8e3) });
-      if (!resp.ok) continue;
-      const data = await resp.json();
-      if (data && typeof data === "object" && !Array.isArray(data)) {
-        return data;
-      }
-    } catch {
-    }
-  }
-  return null;
-}
-function readCache() {
-  try {
-    if (existsSync$1(cacheFile())) {
-      const data = JSON.parse(readFileSync$1(cacheFile(), "utf-8"));
-      if (data && typeof data === "object" && !Array.isArray(data)) return data;
-    }
-  } catch {
-  }
-  return null;
-}
-function writeCache(cfg) {
-  try {
-    mkdirSync(svampHome(), { recursive: true });
-    writeFileSync(cacheFile(), JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-  } catch {
-  }
-}
-function applyConfig(cfg) {
-  _config = cfg;
-  if (cfg.hyphaServerUrl && typeof cfg.hyphaServerUrl === "string") {
-    process.env.HYPHA_SERVER_URL = stripSlash$1(cfg.hyphaServerUrl.trim());
-  }
-}
-async function loadInstanceConfig(opts = {}) {
-  if (_loaded && !opts.force) return _config;
-  const anchor = opts.anchor ? stripSlash$1(opts.anchor) : getInstanceUrl();
-  if (anchor) {
-    const fetched = await fetchConfig(anchor);
-    if (fetched) {
-      applyConfig(fetched);
-      writeCache(fetched);
-      _loaded = true;
-      _cacheChecked = true;
-      return _config;
-    }
-  }
-  const cached = readCache();
-  if (cached) applyConfig(cached);
-  _loaded = true;
-  _cacheChecked = true;
-  return _config;
-}
-function getLoadedConfig() {
-  if (!_loaded && !_cacheChecked) {
-    const cached = readCache();
-    if (cached) applyConfig(cached);
-    _cacheChecked = true;
-  }
-  return _config;
-}
-function clearInstanceConfigCache() {
-  _config = null;
-  _loaded = false;
-  _cacheChecked = false;
-  try {
-    if (existsSync$1(cacheFile())) rmSync(cacheFile());
-  } catch {
-  }
-}
-function __setConfigForTest(cfg) {
-  _config = cfg;
-  _loaded = true;
-  _cacheChecked = true;
-  if (cfg) applyConfig(cfg);
-}
-function __resetForTest() {
-  _config = null;
-  _loaded = false;
-  _cacheChecked = false;
-}
-
-var instanceConfig = /*#__PURE__*/Object.freeze({
-    __proto__: null,
-    CONFIG_FILENAME: CONFIG_FILENAME,
-    __resetForTest: __resetForTest,
-    __setConfigForTest: __setConfigForTest,
-    clearInstanceConfigCache: clearInstanceConfigCache,
-    configUrlsFor: configUrlsFor,
-    getInstanceUrl: getInstanceUrl,
-    getLoadedConfig: getLoadedConfig,
-    loadInstanceConfig: loadInstanceConfig
-});
-
-function stripSlash(u) {
-  return u.replace(/\/+$/, "");
-}
-function getHyphaServerUrl() {
-  const fromCfg = getLoadedConfig()?.hyphaServerUrl;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
-  const env = (process.env.HYPHA_SERVER_URL || "").trim();
-  return env ? stripSlash(env) : void 0;
-}
-function getFrpsSubdomainHost() {
-  const fromCfg = getLoadedConfig()?.frps?.subdomainHost;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
-  const env = (process.env.FRPS_SUBDOMAIN_HOST || "").trim();
-  if (env) return env;
-  throw new Error(
-    'frps subdomain host is not configured. Serve a svamp.json with "frps.subdomainHost" at your frontend URL (svamp login <frontend-url>), or set FRPS_SUBDOMAIN_HOST (legacy). It is deployment-specific and never guessed.'
-  );
-}
-function getFrpsServerAddr() {
-  const fromCfg = getLoadedConfig()?.frps?.serverAddr;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
-  const env = (process.env.FRPS_SERVER_ADDR || "").trim();
-  if (env) return env;
-  return `frps-ctrl.${getFrpsSubdomainHost()}`;
-}
-function getFrpsServerPort() {
-  const fromCfg = getLoadedConfig()?.frps?.serverPort;
-  if (typeof fromCfg === "number" && Number.isFinite(fromCfg)) return fromCfg;
-  const env = parseInt(process.env.FRPS_SERVER_PORT || "", 10);
-  return Number.isFinite(env) ? env : void 0;
-}
-function getSvampWebBaseUrl() {
-  const fromCfg = getLoadedConfig()?.web?.baseUrl;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
-  const env = (process.env.SVAMP_WEB_URL || "").trim();
-  if (env) return stripSlash(env);
-  const instance = getInstanceUrl();
-  if (instance) return instance;
-  throw new Error(
-    'Svamp web base URL is not configured. Serve a svamp.json with "web.baseUrl", log in with your frontend URL (svamp login <frontend-url>), or set SVAMP_WEB_URL (legacy).'
-  );
-}
-function getSkillsServerUrl() {
-  const fromCfg = getLoadedConfig()?.skills?.server;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return stripSlash(fromCfg.trim());
-  const env = (process.env.HYPHA_SKILLS_SERVER || "").trim();
-  if (env) return stripSlash(env);
-  const server = getHyphaServerUrl();
-  if (server) return server;
-  throw new Error(
-    "Cannot determine skills marketplace server. Serve a svamp.json or set HYPHA_SERVER_URL."
-  );
-}
-function getSkillsWorkspace() {
-  const fromCfg = getLoadedConfig()?.skills?.workspace;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
-  return (process.env.HYPHA_SKILLS_WORKSPACE || "").trim() || "hypha-cloud";
-}
-function getSkillsCollection() {
-  const fromCfg = getLoadedConfig()?.skills?.collection;
-  if (typeof fromCfg === "string" && fromCfg.trim()) return fromCfg.trim();
-  return (process.env.HYPHA_SKILLS_COLLECTION || "").trim() || "marketplace";
-}
-
 const SESSION_FILES_MOUNT = "svamp-session-files";
 function generateLinkToken() {
   return crypto.randomBytes(11).toString("hex");
@@ -2819,6 +3659,7 @@ class ServeManager {
     if (this.proxyServer) return;
     killOrphanedCaddy((m) => this.log(m));
     reapOrphanedManagedProcesses(this.managedPidDir, (m) => this.log(m));
+    killOrphanedFrpc((m) => this.log(m));
     this.port = await tryReservePort(this.persistedPort);
     if (this.persistedPort && this.port !== this.persistedPort) {
       this.log(`\u26A0 Previous serve port ${this.persistedPort} unavailable \u2014 using ${this.port}. Downstream configs referencing the old port will need updating.`);
@@ -3428,7 +4269,7 @@ Connection: close\r
     const mount = this.mounts.get(mountName);
     const subdomainOverride = mount?.access === "link" && mount.linkToken ? /* @__PURE__ */ new Map([[this.port, buildLinkSubdomain(subdomainSafe, mount.linkToken)]]) : void 0;
     try {
-      const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
+      const { FrpcTunnel } = await Promise.resolve().then(function () { return frpc; });
       let tunnel;
       tunnel = new FrpcTunnel({
         name: tunnelName,
@@ -3526,7 +4367,7 @@ function writeEnvLines(lines) {
   }
   writeFileSync$1(file, lines.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    chmodSync(file, 384);
+    chmodSync$1(file, 384);
   } catch {
   }
 }
@@ -3794,7 +4635,7 @@ function saveAccounts(accounts, svampHome) {
   const payload = { version: 1, accounts };
   writeFileSync$1(file, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    chmodSync(file, 384);
+    chmodSync$1(file, 384);
   } catch {
   }
 }
@@ -3849,7 +4690,7 @@ function upsertAccount(input, svampHome) {
   const now = Date.now();
   const existing = input.id ? accounts.find((a) => a.id === input.id) : void 0;
   const account = {
-    id: existing?.id || input.id || randomUUID(),
+    id: existing?.id || input.id || randomUUID$1(),
     label: input.label.trim(),
     vendor,
     method,
@@ -4108,7 +4949,7 @@ const ANTHROPIC_REDIRECT_URI = "https://console.anthropic.com/oauth/code/callbac
 const ANTHROPIC_SCOPES = "user:profile user:inference user:sessions:claude_code user:mcp_servers user:file_upload";
 function generatePkce() {
   const verifier = randomBytes(32).toString("base64url");
-  const challenge = createHash("sha256").update(verifier).digest("base64url");
+  const challenge = createHash$1("sha256").update(verifier).digest("base64url");
   return { verifier, challenge };
 }
 function buildAnthropicAuthUrl(challenge, state) {
@@ -4217,14 +5058,14 @@ function startAnthropicFlow(label) {
   pruneFlows();
   const { verifier, challenge } = generatePkce();
   const state = randomBytes(32).toString("base64url");
-  const flowId = randomUUID();
+  const flowId = randomUUID$1();
   const authorizeUrl = buildAnthropicAuthUrl(challenge, state);
   flows.set(flowId, { id: flowId, vendor: "anthropic", label, createdAt: Date.now(), status: "pending", state, verifier });
   return { flowId, authorizeUrl };
 }
 function startOpenAiDeviceFlow(label, log, svampHome) {
   pruneFlows();
-  const flowId = randomUUID();
+  const flowId = randomUUID$1();
   const codexHome = join$1(oauthFlowDir(flowId, svampHome), "codex");
   mkdirSync$1(codexHome, { recursive: true });
   const flow = { id: flowId, vendor: "openai", label, createdAt: Date.now(), status: "pending", codexHome, outputBuffer: "" };
@@ -6587,7 +7428,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const tunnels = handlers.tunnels;
         if (!tunnels) throw new Error("Tunnel management not available");
         if (tunnels.has(params.name)) throw new Error(`Tunnel '${params.name}' already running`);
-        const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
+        const { FrpcTunnel } = await Promise.resolve().then(function () { return frpc; });
         const tunnel = new FrpcTunnel({
           name: params.name,
           ports: params.ports,
@@ -6846,7 +7687,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           const sessionRpc = handlers.getSessionRPCHandlers?.(sid);
           if (sessionRpc?.saveChannel) {
             try {
-              const sharedKey = createHash("sha256").update(sid + (process.env.INTERNAL_API_SECRET || "")).digest("hex").slice(0, 32);
+              const sharedKey = createHash$1("sha256").update(sid + (process.env.INTERNAL_API_SECRET || "")).digest("hex").slice(0, 32);
               const meetingChannel = {
                 id: `meeting-${sid}`,
                 name: `Meeting WISE (${sid})`,
@@ -7080,7 +7921,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-gQ7oQEsx.mjs');
+          const { toolsForRole } = await import('./sideband-C1db5sMF.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -7179,13 +8020,13 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       hyphaWorkspace: u?.scope?.current_workspace
     });
     if (r.error || !r.sender) return { error: r.error || "unauthorized" };
-    const callId = "call_" + randomUUID().slice(0, 10);
+    const callId = "call_" + randomUUID$1().slice(0, 10);
     const senderKey = (r.sender.name || "anonymous").toLowerCase();
     if (!statelessLimiter.tryAcquire(senderKey)) {
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-wQYdc5EK.mjs');
+    const { queryCore } = await import('./commands-BY1lmXaM.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -7325,7 +8166,7 @@ ${d?.error || "not found"}`;
         try {
           const saved = writeUpload(dir, v.target, dec.data);
           try {
-            new ChannelStore(dir).recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId: "up_" + randomUUID().slice(0, 10), outcome: "uploaded" });
+            new ChannelStore(dir).recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId: "up_" + randomUUID$1().slice(0, 10), outcome: "uploaded" });
           } catch {
           }
           return { ok: true, name: saved.name, path: saved.relPath, bytes: saved.bytes };
@@ -7434,7 +8275,7 @@ function writeInboundContext(sessionId, ctx) {
   try {
     const p = ctxPath(sessionId);
     mkdirSync$1(join$1(SVAMP_HOME$2, "inbound"), { recursive: true });
-    const tmp = `${p}.${process.pid}.${randomUUID()}.tmp`;
+    const tmp = `${p}.${process.pid}.${randomUUID$1()}.tmp`;
     writeFileSync$1(tmp, JSON.stringify({ ...ctx, deliveredAt: Date.now() }));
     renameSync(tmp, p);
   } catch {
@@ -7519,7 +8360,7 @@ function writeAwaiting(sessionId, map) {
   try {
     mkdirSync$1(join$1(SVAMP_HOME$2, "awaiting"), { recursive: true });
     const p = awaitPath(sessionId);
-    const tmp = `${p}.${process.pid}.${randomUUID()}.tmp`;
+    const tmp = `${p}.${process.pid}.${randomUUID$1()}.tmp`;
     writeFileSync$1(tmp, JSON.stringify(map));
     renameSync(tmp, p);
   } catch {
@@ -7781,7 +8622,7 @@ function ensureOutpostToken(projectDir, session) {
   mkdirSync$1(dirname(file), { recursive: true });
   writeFileSync$1(file, JSON.stringify(rec, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    chmodSync(file, 384);
+    chmodSync$1(file, 384);
   } catch {
   }
   return rec;
@@ -7859,7 +8700,7 @@ function savePairings(pairings, svampHome) {
   const payload = { version: 1, pairings };
   writeFileSync$1(file, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
   try {
-    chmodSync(file, 384);
+    chmodSync$1(file, 384);
   } catch {
   }
 }
@@ -8571,11 +9412,11 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     if (role === "agent") {
       const data = { ...content };
       if ((data.type === "assistant" || data.type === "user") && !data.uuid) {
-        data.uuid = randomUUID();
+        data.uuid = randomUUID$1();
       }
       wrappedContent = { role: "agent", content: { type: "output", data } };
     } else if (role === "event") {
-      wrappedContent = { role: "agent", content: { type: "event", id: randomUUID(), data: content } };
+      wrappedContent = { role: "agent", content: { type: "event", id: randomUUID$1(), data: content } };
     } else if (role === "session") {
       wrappedContent = { role: "session", content: { type: "session", data: content } };
     } else {
@@ -8583,7 +9424,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       wrappedContent = { role: "user", content: { type: "text", text } };
     }
     const msg = {
-      id: randomUUID(),
+      id: randomUUID$1(),
       seq: nextSeq++,
       content: wrappedContent,
       localId: null,
@@ -8621,7 +9462,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     const msg = {
       // #0816: CSPRNG — this id routes `svamp session inbox reply`, so a predictable
       // one lets a third party target another agent's reply thread.
-      messageId: "op_" + randomUUID().slice(0, 10),
+      messageId: "op_" + randomUUID$1().slice(0, 10),
       body: `A remote machine connected as an outpost: ${xmlEscape(who)} (${xmlEscape(plat)}). You can now run shell commands on it \u2014 its output returns synchronously, like a local command. Run one with: svamp outpost exec "uname -a"`,
       timestamp: Date.now(),
       read: false,
@@ -8866,10 +9707,10 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     const wrappedContent = parsed && parsed.role === "user" ? { role: "user", content: parsed.content } : { role: "user", content: { type: "text", text: typeof parsed === "string" ? parsed : JSON.stringify(parsed) } };
     if (isBtwEcho) wrappedContent.meta = { btw: true };
     const msg = {
-      id: randomUUID(),
+      id: randomUUID$1(),
       seq: nextSeq++,
       content: wrappedContent,
-      localId: effectiveLocalId || randomUUID(),
+      localId: effectiveLocalId || randomUUID$1(),
       createdAt: Date.now(),
       updatedAt: Date.now()
     };
@@ -9259,7 +10100,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
         hyphaWorkspace: u?.scope?.current_workspace
       });
       if (r.error || !r.sender) return { error: r.error || "unauthorized" };
-      const callId = "call_" + randomUUID().slice(0, 10);
+      const callId = "call_" + randomUUID$1().slice(0, 10);
       const ownerEmail = metadata.sharing?.owner;
       const ownerCtx = ownerEmail ? { user: { email: ownerEmail, id: ownerEmail } } : void 0;
       try {
@@ -9344,7 +10185,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       if (dec.error || !dec.data) return { error: dec.error || "invalid content" };
       const v = validateUpload({ projectDir: metadata.path, channel: c, filename: params.filename, bytes: dec.data.length, contentType: params.content_type });
       if (v.error || !v.target) return { error: v.error || "upload rejected" };
-      const callId = "call_" + randomUUID().slice(0, 10);
+      const callId = "call_" + randomUUID$1().slice(0, 10);
       try {
         const saved = writeUpload(metadata.path, v.target, dec.data);
         channelStore.recordCall(c.id, { sender: r.sender.name, verified: r.sender.verified, callId, outcome: "uploaded" });
@@ -11067,10 +11908,10 @@ function computeCollectionConfigUpdate(existingConfig, extra) {
   return { changed, merged: { ...cfg, ...extra } };
 }
 function emailHash(email) {
-  return createHash("sha256").update(email.toLowerCase()).digest("hex").slice(0, 12);
+  return createHash$1("sha256").update(email.toLowerCase()).digest("hex").slice(0, 12);
 }
 function sessionIdHash(sessionId) {
-  return createHash("sha256").update(sessionId).digest("hex").slice(0, 12);
+  return createHash$1("sha256").update(sessionId).digest("hex").slice(0, 12);
 }
 function roleLabel(role) {
   switch (role) {
@@ -11190,7 +12031,7 @@ class SharingNotificationSync {
     const shareType = params.shareType || "session";
     const typeLabel = shareType === "machine" ? "Machine" : "Session";
     await this.publishUserEvent({
-      id: randomUUID(),
+      id: randomUUID$1(),
       recipientEmail: params.recipientEmail.toLowerCase(),
       type: "sharing-invite",
       source: {
@@ -11240,7 +12081,7 @@ class SharingNotificationSync {
     } catch {
     }
     await this.publishUserEvent({
-      id: randomUUID(),
+      id: randomUUID$1(),
       recipientEmail: recipientEmail.toLowerCase(),
       type: "sharing-revoked",
       source: {
@@ -11898,7 +12739,7 @@ class AcpBackend {
   }
   async startSession(initialPrompt) {
     if (this.disposed) throw new Error("Backend has been disposed");
-    const sessionId = randomUUID();
+    const sessionId = randomUUID$1();
     this.emit({ type: "status", status: "starting" });
     let startupStatusErrorEmitted = false;
     try {
@@ -12048,7 +12889,7 @@ class AcpBackend {
           const extendedParams = params;
           const toolCall = extendedParams.toolCall;
           let toolName = toolCall?.kind || toolCall?.toolName || extendedParams.kind || "Unknown tool";
-          const toolCallId = toolCall?.id || randomUUID();
+          const toolCallId = toolCall?.id || randomUUID$1();
           const permissionId = toolCallId;
           let input = {};
           if (toolCall) {
@@ -13289,7 +14130,7 @@ class CodexAppServerBackend {
   }
   listeners = [];
   client;
-  sessionId = randomUUID();
+  sessionId = randomUUID$1();
   log;
   model;
   // #0438: codex's own approval policy + sandbox, derived from the svamp permission mode. Mutable
@@ -13434,7 +14275,7 @@ class CodexAppServerBackend {
     }
   }
   handleApproval(req) {
-    const id = req.callId || randomUUID();
+    const id = req.callId || randomUUID$1();
     const reason = req.type === "exec" ? `Execute: ${(req.command ?? []).join(" ")}` : req.type === "patch" ? "Apply file changes" : req.toolName ? `Tool: ${req.toolName}` : "Codex requires approval";
     const payload = req.type === "exec" ? { toolName: "CodexBash", input: { command: req.command, cwd: req.cwd } } : req.type === "patch" ? { toolName: "CodexPatch", input: { fileChanges: req.fileChanges } } : { toolName: req.toolName ?? "CodexTool", input: req.input };
     this.emit({ type: "permission-request", id, reason, payload });
@@ -13480,7 +14321,7 @@ class CodexAppServerBackend {
         break;
       }
       case "exec_command_begin": {
-        const callId = String(event.call_id ?? event.callId ?? randomUUID());
+        const callId = String(event.call_id ?? event.callId ?? randomUUID$1());
         const command = Array.isArray(event.command) ? event.command.join(" ") : String(event.command ?? "");
         this.emit({ type: "tool-call", toolName: "CodexBash", callId, args: { command, cwd: event.cwd } });
         break;
@@ -13491,7 +14332,7 @@ class CodexAppServerBackend {
         break;
       }
       case "patch_apply_begin": {
-        const callId = String(event.call_id ?? event.callId ?? randomUUID());
+        const callId = String(event.call_id ?? event.callId ?? randomUUID$1());
         const { filePath, patch, kind } = summarizeCodexChanges(event.changes);
         this.emit({ type: "tool-call", toolName: "CodexPatch", callId, args: {
           filePath: filePath ?? event.file_path ?? event.filePath ?? null,
@@ -13511,7 +14352,7 @@ class CodexAppServerBackend {
         break;
       }
       case "mcp_tool_call_begin": {
-        const callId = String(event.call_id ?? event.callId ?? randomUUID());
+        const callId = String(event.call_id ?? event.callId ?? randomUUID$1());
         this.emit({ type: "tool-call", toolName: String(event.tool ?? "CodexMcpTool"), callId, args: { server: event.server, arguments: event.arguments } });
         break;
       }
@@ -14459,7 +15300,7 @@ async function stageCredentialsForSharing(sessionId) {
     } catch {
     }
   }
-  if (!credentialsCopied && platform() === "darwin") {
+  if (!credentialsCopied && platform$1() === "darwin") {
     const stagedCredFile = join$1(stagedClaudeDir, ".credentials.json");
     const hasExistingCredentials = existsSync(stagedCredFile);
     if (!hasExistingCredentials) {
@@ -14851,7 +15692,7 @@ class ProcessSupervisor {
     }
     const fullSpec = {
       ...spec,
-      id: randomUUID$1(),
+      id: randomUUID(),
       createdAt: Date.now()
     };
     const entry = this.makeEntry(fullSpec);
@@ -15614,7 +16455,7 @@ function _updateIssueUnlocked(projectRoot, id, patch) {
   if (wasArchived !== nowArchived) {
     const oldPath = issuePath(projectRoot, cur.id, wasArchived);
     try {
-      if (existsSync(oldPath)) unlinkSync(oldPath);
+      if (existsSync(oldPath)) unlinkSync$1(oldPath);
     } catch {
     }
   }
@@ -15890,7 +16731,7 @@ function removeWorkflow(projectRoot, name) {
   const p = workflowPath(projectRoot, name);
   if (!existsSync(p)) return false;
   try {
-    unlinkSync(p);
+    unlinkSync$1(p);
     return true;
   } catch {
     return false;
@@ -16906,7 +17747,7 @@ process.stdin.resume();
   const cleanup = () => {
     for (const p of cleanupPaths) {
       try {
-        if (existsSync(p)) unlinkSync(p);
+        if (existsSync(p)) unlinkSync$1(p);
       } catch {
       }
     }
@@ -17552,7 +18393,7 @@ function readPendingRestart() {
 }
 function clearPendingRestart() {
   try {
-    if (existsSync$1(PENDING_RESTART_FILE)) unlinkSync$1(PENDING_RESTART_FILE);
+    if (existsSync$1(PENDING_RESTART_FILE)) unlinkSync(PENDING_RESTART_FILE);
   } catch {
   }
 }
@@ -17565,7 +18406,7 @@ function writeStopMarker(reason) {
 }
 function clearStopMarker() {
   try {
-    if (existsSync$1(DAEMON_STOP_MARKER_FILE)) unlinkSync$1(DAEMON_STOP_MARKER_FILE);
+    if (existsSync$1(DAEMON_STOP_MARKER_FILE)) unlinkSync(DAEMON_STOP_MARKER_FILE);
   } catch {
   }
 }
@@ -17962,7 +18803,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
         url: String(l.url).trim(),
         ...l.icon ? { icon: String(l.icon) } : {},
         // #0266: carry the service backing ({kind,name}) so the Launch Pad can decommission it.
-        ...l.service && typeof l.service.name === "string" && (l.service.kind === "tunnel" || l.service.kind === "process") ? { service: { kind: l.service.kind, name: String(l.service.name) } } : {}
+        ...l.service && typeof l.service.name === "string" && (l.service.kind === "tunnel" || l.service.kind === "process" || l.service.kind === "serve") ? { service: { kind: l.service.kind, name: String(l.service.name) } } : {}
       }));
       const cur = meta.sessionLinks;
       if (JSON.stringify(cur || []) !== JSON.stringify(links)) {
@@ -18099,7 +18940,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
             }
             if (wasStopped) {
               const eq = getMetadata().messageQueue || [];
-              setMetadata((m) => ({ ...m, messageQueue: [...eq, { id: randomUUID$1(), text: loopResumeMessage(directory, sessionId), displayText: "\u{1F501} Resuming loop (extended)", createdAt: Date.now() }] }));
+              setMetadata((m) => ({ ...m, messageQueue: [...eq, { id: randomUUID(), text: loopResumeMessage(directory, sessionId), displayText: "\u{1F501} Resuming loop (extended)", createdAt: Date.now() }] }));
               onLoopActivated?.();
             }
             sessionService.pushMessage({ type: "message", message: `\u{1F501} Loop extended (+${grant.extension.grantedTurns} turns, ${grant.used}/${grant.max} used)${wasStopped ? " \u2014 resuming" : ""}. Reason: ${grant.extension.reason}`, level: "warning" }, "event");
@@ -18155,7 +18996,7 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
             } catch {
             }
             const eq = getMetadata().messageQueue || [];
-            setMetadata((m) => ({ ...m, messageQueue: [...eq, { id: randomUUID$1(), text: loopResumeMessage(directory, sessionId), displayText: "\u{1F501} Resuming loop", createdAt: Date.now() }] }));
+            setMetadata((m) => ({ ...m, messageQueue: [...eq, { id: randomUUID(), text: loopResumeMessage(directory, sessionId), displayText: "\u{1F501} Resuming loop", createdAt: Date.now() }] }));
             onLoopActivated?.();
           }
           if (!wasStopped && (newMax != null || bumpedBudget)) {
@@ -18188,14 +19029,14 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
         }
         writeGoalLoopState(directory, sessionId, { active: true, phase: "running", durable, iteration: 0, task: condition, goal_task: task, until, oracle, max_iterations: hardMax, budget, started_at: Date.now(), holds: 0, ledger: { turns: 0, tokens: 0, window: [] }, progress_history: [], auto_resumes: 0, verify_errors: 0 });
         const existingQueue = getMetadata().messageQueue || [];
-        setMetadata((m) => ({ ...m, messageQueue: [...existingQueue, { id: randomUUID$1(), text: `/goal ${condition}`, displayText: `\u{1F3AF} Goal: ${(task || until || "").slice(0, 100)}`, createdAt: Date.now() }] }));
+        setMetadata((m) => ({ ...m, messageQueue: [...existingQueue, { id: randomUUID(), text: `/goal ${condition}`, displayText: `\u{1F3AF} Goal: ${(task || until || "").slice(0, 100)}`, createdAt: Date.now() }] }));
         onLoopActivated?.();
         sessionService.pushMessage({ type: "message", message: `\u{1F3AF} Goal set: ${condition.slice(0, 180)}${condition.length > 180 ? "\u2026" : ""}` }, "event");
         logger.log(`[svampConfig] /goal set: "${condition.slice(0, 80)}"`);
       } else {
         writeGoalLoopState(directory, sessionId, { active: false, phase: "cancelled", completed_at: Date.now() });
         const existingQueue = getMetadata().messageQueue || [];
-        setMetadata((m) => ({ ...m, messageQueue: [...existingQueue, { id: randomUUID$1(), text: "/goal clear", displayText: "\u{1F3AF} Goal cleared", createdAt: Date.now() }] }));
+        setMetadata((m) => ({ ...m, messageQueue: [...existingQueue, { id: randomUUID(), text: "/goal clear", displayText: "\u{1F3AF} Goal cleared", createdAt: Date.now() }] }));
         onLoopActivated?.();
         sessionService.pushMessage({ type: "message", message: "Goal cleared." }, "event");
         logger.log(`[svampConfig] /goal cleared`);
@@ -18268,17 +19109,17 @@ function deletePersistedSession(sessionId) {
   if (entry) {
     const sessionFile = getSessionFilePath(entry.directory, sessionId);
     try {
-      if (existsSync$1(sessionFile)) unlinkSync$1(sessionFile);
+      if (existsSync$1(sessionFile)) unlinkSync(sessionFile);
     } catch {
     }
     const messagesFile = getSessionMessagesPath(entry.directory, sessionId);
     try {
-      if (existsSync$1(messagesFile)) unlinkSync$1(messagesFile);
+      if (existsSync$1(messagesFile)) unlinkSync(messagesFile);
     } catch {
     }
     const configFile = getSvampConfigPath(entry.directory, sessionId);
     try {
-      if (existsSync$1(configFile)) unlinkSync$1(configFile);
+      if (existsSync$1(configFile)) unlinkSync(configFile);
     } catch {
     }
     const sessionDir = getSessionDir(entry.directory, sessionId);
@@ -18372,7 +19213,7 @@ function pruneDaemonLogs() {
     const plan = planLogPrune(entries, policy);
     for (const name of plan.deleteFiles) {
       try {
-        unlinkSync$1(join(LOGS_DIR, name));
+        unlinkSync(join(LOGS_DIR, name));
       } catch {
       }
     }
@@ -18621,7 +19462,7 @@ async function startDaemon(options) {
       machineId = readFileSync$1(machineIdFile, "utf-8").trim();
     }
     if (!machineId) {
-      machineId = `machine-${os$1.hostname()}-${randomUUID$1().slice(0, 8)}`;
+      machineId = `machine-${os$1.hostname()}-${randomUUID().slice(0, 8)}`;
       try {
         writeFileSync(machineIdFile, machineId, "utf-8");
       } catch {
@@ -18669,7 +19510,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-DdOSpUEW.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BJeGwkeX.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -18686,8 +19527,29 @@ async function startDaemon(options) {
       logger.log(`[exposed-tunnels] Link reconcile failed for ${tunnelName}: ${err?.message || err}`);
     }
   }
+  async function reconcileMountSessionLink(sessionId, mountName, url) {
+    if (!sessionId || !url) return;
+    try {
+      const dir = loadSessionIndex()[sessionId]?.directory;
+      if (!dir) return;
+      const { reconcileServiceLinks } = await import('./agentCommands-BJeGwkeX.mjs');
+      const configPath = getSvampConfigPath(dir, sessionId);
+      const config = readSvampConfig(configPath);
+      const incoming = [{
+        url: String(url),
+        label: mountName,
+        service: { kind: "serve", name: mountName }
+      }];
+      if (reconcileServiceLinks(config, incoming)) {
+        writeSvampConfig(configPath, config);
+        logger.log(`[serve] Reconciled Launch Pad link for mount ${mountName} \u2192 session ${sessionId}`);
+      }
+    } catch (err) {
+      logger.log(`[serve] Link reconcile failed for mount ${mountName}: ${err?.message || err}`);
+    }
+  }
   async function createExposedTunnel(spec) {
-    const { FrpcTunnel } = await import('./frpc-CNZJM3qC.mjs');
+    const { FrpcTunnel } = await Promise.resolve().then(function () { return frpc; });
     const tunnel = new FrpcTunnel({
       name: spec.name,
       ports: spec.ports,
@@ -18715,7 +19577,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-CnCpensV.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-dbXgsGNK.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -18764,7 +19626,7 @@ async function startDaemon(options) {
           logger.log(`[supervision] parent ${parentId.slice(0, 8)} not live \u2014 recording verdict on the backlog issue only (no in-memory wake)`);
         }
         if (send) Promise.resolve(send({
-          messageId: randomUUID$1(),
+          messageId: randomUUID(),
           from: `agent:${v.sessionId}`,
           fromSession: v.sessionId,
           to: parentId,
@@ -18802,7 +19664,7 @@ ${v.guidance ? v.guidance + "\n" : ""}Criteria: ${v.criteria || "(none)"}
           return;
         }
         Promise.resolve(send({
-          messageId: randomUUID$1(),
+          messageId: randomUUID(),
           from: "system:issues",
           subject: "issue follow-up",
           body: text,
@@ -19370,7 +20232,7 @@ ${parts.join("\n")}`);
           sessionMetadata = {
             ...sessionMetadata,
             messageQueue: [...existingQueue, {
-              id: randomUUID$1(),
+              id: randomUUID(),
               text,
               displayText: "\u{1F501} Resuming loop",
               createdAt: Date.now()
@@ -19382,7 +20244,7 @@ ${parts.join("\n")}`);
           const existingQueue = sessionMetadata.messageQueue || [];
           sessionMetadata = {
             ...sessionMetadata,
-            messageQueue: [...existingQueue, { id: randomUUID$1(), text, displayText, createdAt: Date.now() }]
+            messageQueue: [...existingQueue, { id: randomUUID(), text, displayText, createdAt: Date.now() }]
           };
           sessionService.updateMetadata(sessionMetadata);
         };
@@ -20498,7 +21360,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                   // NOT re-push a display bubble (that second copy has localId:null and the
                   // frontend can't reconcile it → the message appears TWICE). Only re-send to
                   // the model. Inbox/loop items (no flag) still get their displayText push.
-                  messageQueue: [...existingQueue, { id: randomUUID$1(), text, createdAt: Date.now(), alreadyStored: true }]
+                  messageQueue: [...existingQueue, { id: randomUUID(), text, createdAt: Date.now(), alreadyStored: true }]
                 };
                 sessionService.updateMetadata(sessionMetadata);
                 signalProcessing(false);
@@ -20655,7 +21517,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                 const existingQueue = sessionMetadata.messageQueue || [];
                 sessionMetadata = {
                   ...sessionMetadata,
-                  messageQueue: [...existingQueue, { id: randomUUID$1(), text, createdAt: Date.now(), alreadyStored: true }]
+                  messageQueue: [...existingQueue, { id: randomUUID(), text, createdAt: Date.now(), alreadyStored: true }]
                 };
                 sessionService.updateMetadata(sessionMetadata);
                 signalProcessing(true);
@@ -21032,11 +21894,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-Cx6KsBYC.mjs');
+              const { issueRpc } = await import('./rpc-TXF-di9u.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-CclCeDcu.mjs');
+              const { workflowRpc } = await import('./rpc-FGp88Yxp.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -21269,7 +22131,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           enqueueLoopContinue();
           processMessageQueueRef?.();
         };
-        pidToTrackedSession.set(randomUUID$1(), trackedSession);
+        pidToTrackedSession.set(randomUUID(), trackedSession);
         sessionMetadata = { ...sessionMetadata, lifecycleState: "idle" };
         sessionService.updateMetadata(sessionMetadata);
         logger.log(`Session ${sessionId} registered on Hypha, waiting for first message to spawn Claude`);
@@ -21474,7 +22336,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                   ...sessionMetadata,
                   // #0411: alreadyStored — see Claude path. deliverUserMessageCore already stored
                   // this user message; the drain must not re-push a localId:null duplicate.
-                  messageQueue: [...existingQueue, { id: randomUUID$1(), text, createdAt: Date.now(), alreadyStored: true }]
+                  messageQueue: [...existingQueue, { id: randomUUID(), text, createdAt: Date.now(), alreadyStored: true }]
                 };
                 sessionService.updateMetadata(sessionMetadata);
                 return;
@@ -21486,7 +22348,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                     ...sessionMetadata,
                     // #0411: alreadyStored — deliverUserMessageCore already stored this
                     // user message; the drain must not re-push a localId:null duplicate.
-                    messageQueue: [...existingQueue, { id: randomUUID$1(), text, createdAt: Date.now(), alreadyStored: true }]
+                    messageQueue: [...existingQueue, { id: randomUUID(), text, createdAt: Date.now(), alreadyStored: true }]
                   };
                   sessionService.updateMetadata(sessionMetadata);
                 };
@@ -21743,11 +22605,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-Cx6KsBYC.mjs');
+              const { issueRpc } = await import('./rpc-TXF-di9u.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-CclCeDcu.mjs');
+              const { workflowRpc } = await import('./rpc-FGp88Yxp.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -22285,7 +23147,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
             });
           }
         };
-        pidToTrackedSession.set(randomUUID$1(), trackedSession);
+        pidToTrackedSession.set(randomUUID(), trackedSession);
         let acpInboxReconcileTimer = null;
         const reconcileAcpIdleInbox = () => {
           if (acpStopped) {
@@ -22730,7 +23592,15 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     };
     writeDaemonStateFile(localState);
     logger.log("Daemon state file written \u2014 daemon is up; restoring mounts/sessions in background");
-    serveManager$1.restore().catch((err) => logger.error(`[serve] mount restore failed: ${err?.message || err}`));
+    serveManager$1.restore().then(async () => {
+      try {
+        for (const m of serveManager$1.listMounts()) {
+          if (m?.sessionId && m?.url) await reconcileMountSessionLink(m.sessionId, m.name, m.url);
+        }
+      } catch (err) {
+        logger.log(`[serve] mount link reconcile failed: ${err?.message || err}`);
+      }
+    }).catch((err) => logger.error(`[serve] mount restore failed: ${err?.message || err}`));
     const daemonOwnerEmail = parseJwtEmail(process.env.HYPHA_TOKEN || "") || null;
     serveManager$1.setSessionResolver((sessionId) => {
       for (const [, session] of pidToTrackedSession) {
@@ -22750,7 +23620,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       }
       return null;
     });
-    const sessionFilesToken = createHash$1("sha256").update(`session-files:${machineId}`).digest("hex").slice(0, 20);
+    const sessionFilesToken = createHash("sha256").update(`session-files:${machineId}`).digest("hex").slice(0, 20);
     serveManager$1.ensureSessionFilesGateway(sessionFilesToken).then((base) => logger.log(`[serve] session-files gateway: ${base || "(tunnel pending)"}`)).catch((err) => logger.error(`[serve] session-files gateway failed: ${err?.message || err}`));
     const persistedSessions = loadPersistedSessions();
     try {
@@ -22790,7 +23660,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-CnCpensV.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-dbXgsGNK.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -23035,7 +23905,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-Wzzed1CU.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-b-ysyKIj.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -23669,4 +24539,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { SKILLS_DIR as $, setWorkflowEnabled as A, removeWorkflow as B, validateWorkflowName as C, saveWorkflow as D, rawWorkflow as E, listWorkflows as F, isWorkflowEnabled as G, workflowSchedules as H, inZone as I, cronMatches as J, summarize as K, workflowSteps as L, parseJwtEmail as M, computeCollectionConfigUpdate as N, SYSTEM_COLLECTION_CONFIG as O, loadMachineContext as P, buildMachineInstructions as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, machineToolsForRole as T, buildMachineTools as U, parseFrontmatter as V, getSkillsServer as W, getSkillsWorkspaceName as X, getSkillsCollectionName as Y, fetchWithTimeout as Z, searchSkills as _, createSessionStore as a, getSkillInfo as a0, downloadSkillFile as a1, listSkillFiles as a2, resolveModel as a3, clearStopMarker as a4, stopMarkerExists as a5, formatHandle as a6, normalizeAllowedUser as a7, loadSecurityContextConfig as a8, resolveSecurityContext as a9, KimiTransport$1 as aA, kimiProvider as aB, kimiSetup as aC, api as aD, run as aE, buildSecurityContextFromFlags as aa, mergeSecurityContexts as ab, buildSessionShareUrl as ac, computeOutboundHop as ad, registerAwaitingReply as ae, buildMachineShareUrl as af, parseHandle as ag, handleMatchesMetadata as ah, PINNED_CODEX_VERSION as ai, withFileLock as aj, describeMisconfiguration as ak, buildMachineDeps as al, applyClaudeProxyEnv as am, composeSessionId as an, generateFriendlyName as ao, generateHookSettings as ap, staticFileServer as aq, instanceConfig as ar, claudeAuth as as, codexProvider as at, projectInfo as au, DefaultTransport$1 as av, acpBackend as aw, acpAgentConfig as ax, codexAppServerBackend as ay, GeminiTransport$1 as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, getFrpsSubdomainHost as e, getFrpsServerPort as f, getHyphaServerUrl$1 as g, getFrpsServerAddr as h, shortId as i, resolveProjectRoot as j, getIssue as k, resumeIssue as l, addComment as m, addIssue as n, listIssues as o, pauseIssue as p, isPendingIssue as q, registerMachineService as r, startDaemon as s, searchIssues as t, updateIssue as u, isVisibleTo as v, getRun as w, listRuns as x, getWorkflow as y, runWorkflow as z };
+export { listSkillFiles as $, saveWorkflow as A, rawWorkflow as B, listWorkflows as C, isWorkflowEnabled as D, workflowSchedules as E, inZone as F, cronMatches as G, summarize as H, workflowSteps as I, parseJwtEmail as J, computeCollectionConfigUpdate as K, SYSTEM_COLLECTION_CONFIG as L, loadMachineContext as M, buildMachineInstructions as N, machineToolsForRole as O, buildMachineTools as P, parseFrontmatter as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, getSkillsServer as T, getSkillsWorkspaceName as U, getSkillsCollectionName as V, fetchWithTimeout as W, searchSkills as X, SKILLS_DIR as Y, getSkillInfo as Z, downloadSkillFile as _, createSessionStore as a, resolveModel as a0, clearStopMarker as a1, stopMarkerExists as a2, formatHandle as a3, normalizeAllowedUser as a4, loadSecurityContextConfig as a5, resolveSecurityContext as a6, buildSecurityContextFromFlags as a7, mergeSecurityContexts as a8, buildSessionShareUrl as a9, kimiSetup as aA, api as aB, run as aC, computeOutboundHop as aa, registerAwaitingReply as ab, buildMachineShareUrl as ac, parseHandle as ad, handleMatchesMetadata as ae, PINNED_CODEX_VERSION as af, withFileLock as ag, describeMisconfiguration as ah, buildMachineDeps as ai, applyClaudeProxyEnv as aj, composeSessionId as ak, generateFriendlyName as al, generateHookSettings as am, instanceConfig as an, frpc as ao, staticFileServer as ap, claudeAuth as aq, codexProvider as ar, projectInfo as as, DefaultTransport$1 as at, acpBackend as au, acpAgentConfig as av, codexAppServerBackend as aw, GeminiTransport$1 as ax, KimiTransport$1 as ay, kimiProvider as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, shortId as e, resolveProjectRoot as f, getHyphaServerUrl$1 as g, getIssue as h, resumeIssue as i, addComment as j, addIssue as k, listIssues as l, isPendingIssue as m, searchIssues as n, isVisibleTo as o, pauseIssue as p, getRun as q, registerMachineService as r, startDaemon as s, listRuns as t, updateIssue as u, getWorkflow as v, runWorkflow as w, setWorkflowEnabled as x, removeWorkflow as y, validateWorkflowName as z };