svamp-cli 0.2.320 → 0.2.322

package/dist/{commands-CeFjRNKk.mjs → commands-BWWAxC-g.mjs}

@@ -1,6 +1,6 @@
 import * as path from 'path';
-import { w as wantsHelp } from './cli-C0tO-Dnx.mjs';
-import './run-CvwPIrfo.mjs';
+import { w as wantsHelp } from './cli-BPJoSvJ0.mjs';
+import './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -83,7 +83,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./run-CvwPIrfo.mjs').then(function (n) { return n.ao; });
+    const { runFrpcTunnel } = await import('./run-BXDA0YFP.mjs').then(function (n) { return n.ao; });
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -93,7 +93,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-CubsoWG-.mjs');
+  const { connectAndGetMachine } = await import('./commands-AOno1gcV.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -115,7 +115,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-CoCcX8K1.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-ri042RB5.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -151,8 +151,8 @@ async function serviceServe(args) {
     const resolvedDir = path.resolve(directory);
     console.log(`Serving ${resolvedDir}`);
     const http = await import('http');
-    const { serveStaticMount } = await import('./run-CvwPIrfo.mjs').then(function (n) { return n.ap; });
-    const { getFreePort } = await import('./run-CvwPIrfo.mjs').then(function (n) { return n.ao; });
+    const { serveStaticMount } = await import('./run-BXDA0YFP.mjs').then(function (n) { return n.ap; });
+    const { getFreePort } = await import('./run-BXDA0YFP.mjs').then(function (n) { return n.ao; });
     const server = http.createServer((req, res) => {
       const u = new URL(req.url || "/", "http://127.0.0.1");
       let rel = u.pathname;
@@ -175,7 +175,7 @@ async function serviceServe(args) {
         resolve(18080);
       });
     });
-    const { runFrpcTunnel } = await import('./run-CvwPIrfo.mjs').then(function (n) { return n.ao; });
+    const { runFrpcTunnel } = await import('./run-BXDA0YFP.mjs').then(function (n) { return n.ao; });
     void server;
     await runFrpcTunnel(name, [servePort]);
   } catch (err) {
@@ -185,7 +185,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-CubsoWG-.mjs');
+    const { connectAndGetMachine } = await import('./commands-AOno1gcV.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -225,11 +225,11 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-CubsoWG-.mjs');
+    const { connectAndGetMachine } = await import('./commands-AOno1gcV.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });
-      const { removeSessionLinkByService } = await import('./agentCommands-CoCcX8K1.mjs');
+      const { removeSessionLinkByService } = await import('./agentCommands-ri042RB5.mjs');
       removeSessionLinkByService("tunnel", name);
       console.log(`Stopped tunnel '${name}'.`);
     } catch (err) {

package/dist/{commands-BUZUle6g.mjs → commands-BW_5joei.mjs}

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
-import { f as resolveProjectRoot, I as workflowSteps, x as setWorkflowEnabled, D as isWorkflowEnabled, y as removeWorkflow, v as getWorkflow, C as listWorkflows, A as saveWorkflow, B as rawWorkflow } from './run-CvwPIrfo.mjs';
-import { w as wantsHelp } from './cli-C0tO-Dnx.mjs';
+import { f as resolveProjectRoot, I as workflowSteps, x as setWorkflowEnabled, D as isWorkflowEnabled, y as removeWorkflow, v as getWorkflow, C as listWorkflows, A as saveWorkflow, B as rawWorkflow } from './run-BXDA0YFP.mjs';
+import { w as wantsHelp } from './cli-BPJoSvJ0.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-BHcPDQCC.mjs → commands-BxG6r6us.mjs}

@@ -1,10 +1,10 @@
-import { connectAndResolveSession } from './commands-CubsoWG-.mjs';
-import { w as wantsHelp } from './cli-C0tO-Dnx.mjs';
+import { connectAndResolveSession } from './commands-AOno1gcV.mjs';
+import { w as wantsHelp } from './cli-BPJoSvJ0.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-CvwPIrfo.mjs';
+import './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-XN2UtO-W.mjs → commands-D7iQqb-i.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { Q as parseFrontmatter, T as getSkillsServer, U as getSkillsWorkspaceName, V as getSkillsCollectionName, W as fetchWithTimeout, X as searchSkills, Y as SKILLS_DIR, Z as getSkillInfo, _ as downloadSkillFile, $ as listSkillFiles } from './run-CvwPIrfo.mjs';
+import { Q as parseFrontmatter, T as getSkillsServer, U as getSkillsWorkspaceName, V as getSkillsCollectionName, W as fetchWithTimeout, X as searchSkills, Y as SKILLS_DIR, Z as getSkillInfo, _ as downloadSkillFile, $ as listSkillFiles } from './run-BXDA0YFP.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{commands-6KY9uV6s.mjs → commands-DR8N0cmJ.mjs}

@@ -1,12 +1,12 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-CubsoWG-.mjs';
-import { w as wantsHelp } from './cli-C0tO-Dnx.mjs';
+import { connectAndGetMachine } from './commands-AOno1gcV.mjs';
+import { w as wantsHelp } from './cli-BPJoSvJ0.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-CvwPIrfo.mjs';
+import './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-BwkoaGfZ.mjs → commands-Db0PpuwO.mjs}

@@ -1,9 +1,9 @@
 import { existsSync } from 'node:fs';
 import { join, resolve } from 'node:path';
-import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-CubsoWG-.mjs';
+import { connectAndGetMachine, resolveSessionId, createWorktree, connectAndResolveSession } from './commands-AOno1gcV.mjs';
 import { execFileSync } from 'node:child_process';
-import { ag as withFileLock, u as updateIssue, j as addComment, k as addIssue, e as shortId } from './run-CvwPIrfo.mjs';
-import { w as wantsHelp } from './cli-C0tO-Dnx.mjs';
+import { ag as withFileLock, u as updateIssue, j as addComment, k as addIssue, e as shortId } from './run-BXDA0YFP.mjs';
+import { w as wantsHelp } from './cli-BPJoSvJ0.mjs';
 import 'node:os';
 import 'os';
 import 'fs/promises';

package/dist/{commands-DPi7PGxP.mjs → commands-yuhNv9AR.mjs}

@@ -1,8 +1,8 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { f as flushAndExit } from './cli-C0tO-Dnx.mjs';
-import { f as resolveProjectRoot, n as searchIssues, l as listIssues, m as isPendingIssue, i as resumeIssue, p as pauseIssue, j as addComment, u as updateIssue, h as getIssue, o as isVisibleTo, H as summarize, k as addIssue } from './run-CvwPIrfo.mjs';
+import { f as flushAndExit } from './cli-BPJoSvJ0.mjs';
+import { f as resolveProjectRoot, n as searchIssues, l as listIssues, m as isPendingIssue, i as resumeIssue, p as pauseIssue, j as addComment, u as updateIssue, h as getIssue, o as isVisibleTo, H as summarize, k as addIssue } from './run-BXDA0YFP.mjs';
 import './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{fleet-BKrbG7G-.mjs → fleet--8tb1jX3.mjs}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { ad as PINNED_CODEX_VERSION, c as connectToHypha } from './run-CvwPIrfo.mjs';
-import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-BkZfX5pW.mjs';
+import { ad as PINNED_CODEX_VERSION, c as connectToHypha } from './run-BXDA0YFP.mjs';
+import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-C8CmQv3y.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -23,7 +23,7 @@ import 'node:fs/promises';
 import 'yaml';
 
 const KIMI_NPM_PACKAGE = "@moonshot-ai/kimi-code";
-const PINNED_KIMI_VERSION = "0.34.0";
+const PINNED_KIMI_VERSION = "0.35.0";
 
 const SVAMP_HOME = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
 const DAEMON_STATE_FILE = join(SVAMP_HOME, "daemon.state.json");

package/dist/{headlessCli-nywi2aop.mjs → headlessCli-COD8n9AD.mjs}

@@ -1,5 +1,5 @@
-import { a0 as resolveModel, ah as describeMisconfiguration, ai as buildMachineDeps } from './run-CvwPIrfo.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-D1dsa-t0.mjs';
+import { a0 as resolveModel, ah as describeMisconfiguration, ai as buildMachineDeps } from './run-BXDA0YFP.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-CdXFW-wu.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-CvwPIrfo.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{notifyCommands-BFr80nfh.mjs → notifyCommands-DLo0ANDt.mjs}

@@ -1,4 +1,4 @@
-import { c as connectToHypha, S as SharingNotificationSync, J as parseJwtEmail } from './run-CvwPIrfo.mjs';
+import { c as connectToHypha, S as SharingNotificationSync, J as parseJwtEmail } from './run-BXDA0YFP.mjs';
 import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';

package/dist/{package-D4zdkORw.mjs → package-DK43B5gu.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.320";
+var version = "0.2.322";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -25,7 +25,7 @@ var scripts = {
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",
 	"test:e2e": "node --no-warnings test/e2e-session-tests.mjs && npx tsx test/e2e-codex-midturn-steer.mjs && npx tsx test/e2e-serve-iframe-login.mjs && npx tsx test/test-archive-preserves-claude-file.mjs && npx tsx test/test-daemon-e2e.mjs && npx tsx test/test-hypha-service.mjs && npx tsx test/test-permission-e2e.mjs && npx tsx test/test-serve-e2e.mjs && npx tsx test/test-session-archive-resume.mjs && npx tsx test/test-session-rpc-e2e.mjs && npx tsx test/test-skills-integration.mjs && npx tsx test/test-wm-refresh.mjs && npx tsx test/e2e-session-files-gateway.mjs && npx tsx test/e2e-dns-production-hosts.mjs",
 	"test:frpc": "npx tsx test/test-frpc-e2e.mjs",
-	prepublishOnly: "yarn build"
+	prepublishOnly: "node ../../scripts/bump-cli-version.mjs --check && yarn build"
 };
 var dependencies = {
 	"@agentclientprotocol/sdk": "^0.14.1",

package/dist/{pinnedClaudeCode-BkZfX5pW.mjs → pinnedClaudeCode-C8CmQv3y.mjs}

@@ -1,7 +1,7 @@
 import { spawn, exec as exec$1 } from 'node:child_process';
 import { promisify } from 'node:util';
 
-const PINNED_CLAUDE_CODE_VERSION = "2.1.227";
+const PINNED_CLAUDE_CODE_VERSION = "2.1.229";
 const exec = promisify(exec$1);
 let _reconcile = null;
 function beginClaudeVersionReconcile(log) {

package/dist/{rpc-rpH-yXR7.mjs → rpc-DMlurOlf.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, q as getRun, t as listRuns, v as getWorkflow, w as runWorkflow, x as setWorkflowEnabled, y as removeWorkflow, z as validateWorkflowName, A as saveWorkflow, B as rawWorkflow, C as listWorkflows } from './run-CvwPIrfo.mjs';
+import { f as resolveProjectRoot, q as getRun, t as listRuns, v as getWorkflow, w as runWorkflow, x as setWorkflowEnabled, y as removeWorkflow, z as validateWorkflowName, A as saveWorkflow, B as rawWorkflow, C as listWorkflows } from './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-DVtlZahE.mjs → rpc-JWRwb6oY.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, u as updateIssue, h as getIssue, i as resumeIssue, p as pauseIssue, j as addComment, k as addIssue, l as listIssues, m as isPendingIssue, n as searchIssues, o as isVisibleTo } from './run-CvwPIrfo.mjs';
+import { f as resolveProjectRoot, u as updateIssue, h as getIssue, i as resumeIssue, p as pauseIssue, j as addComment, k as addIssue, l as listIssues, m as isPendingIssue, n as searchIssues, o as isVisibleTo } from './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-CvwPIrfo.mjs → run-BXDA0YFP.mjs}

@@ -2398,14 +2398,16 @@ h1{font-size:1.15rem;word-break:break-all}ul{list-style:none;padding:0}li{paddin
 a{color:#0969da;text-decoration:none}a:hover{text-decoration:underline}</style></head>
 <body><h1>${esc(base)}</h1><ul>${rows || "<li>(empty)</li>"}</ul></body></html>`;
 }
+const CORS_ALLOW_HEADERS = "Authorization, *";
 const CORS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
-  "Access-Control-Allow-Headers": "*"
+  "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS
 };
 function serveStaticMount(req, res, opts) {
   const { rootDir, relPath, mountUrlPrefix } = opts;
   const browse = opts.browse !== false;
+  const attachment = opts.attachment === true;
   const method = (req.method || "GET").toUpperCase();
   if (method === "OPTIONS") {
     res.writeHead(204, CORS);
@@ -2426,7 +2428,7 @@ function serveStaticMount(req, res, opts) {
     return;
   }
   if (rootStat.isFile()) {
-    sendFile(req, res, rootDir, rootStat);
+    sendFile(req, res, rootDir, rootStat, attachment);
     return;
   }
   if (hasBlockedDotSegment(relPath)) {
@@ -2466,7 +2468,7 @@ function serveStaticMount(req, res, opts) {
       try {
         const ist = fs.statSync(indexPath);
         if (ist.isFile()) {
-          sendFile(req, res, indexPath, ist);
+          sendFile(req, res, indexPath, ist, attachment);
           return;
         }
       } catch {
@@ -2492,7 +2494,7 @@ function serveStaticMount(req, res, opts) {
     return;
   }
   if (st.isFile()) {
-    sendFile(req, res, target, st);
+    sendFile(req, res, target, st, attachment);
     return;
   }
   res.writeHead(404, CORS);
@@ -2501,7 +2503,12 @@ function serveStaticMount(req, res, opts) {
 function etagFor(st) {
   return `"${st.size.toString(16)}-${Math.floor(st.mtimeMs).toString(16)}"`;
 }
-function sendFile(req, res, filePath, st) {
+function attachmentDisposition(filePath) {
+  const name = path.basename(filePath) || "download";
+  const ascii = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_") || "download";
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+function sendFile(req, res, filePath, st, attachment = false) {
   const method = (req.method || "GET").toUpperCase();
   const etag = etagFor(st);
   const lastMod = new Date(st.mtimeMs).toUTCString();
@@ -2511,8 +2518,9 @@ function sendFile(req, res, filePath, st) {
     "Accept-Ranges": "bytes",
     ETag: etag,
     "Last-Modified": lastMod,
-    "Cache-Control": "no-cache"
+    "Cache-Control": "no-cache",
     // revalidate via ETag; content can change under a mount
+    ...attachment ? { "Content-Disposition": attachmentDisposition(filePath) } : {}
   };
   const inm = req.headers["if-none-match"];
   const ims = req.headers["if-modified-since"];
@@ -2559,6 +2567,8 @@ function pipeStream(stream, res) {
 
 var staticFileServer = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    CORS_ALLOW_HEADERS: CORS_ALLOW_HEADERS,
+    attachmentDisposition: attachmentDisposition,
     containedPath: containedPath,
     contentTypeFor: contentTypeFor,
     directoryListingHtml: directoryListingHtml,
@@ -3746,7 +3756,9 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
     const CORS = {
       "Access-Control-Allow-Origin": "*",
       "Access-Control-Allow-Methods": "GET, HEAD, PUT, DELETE, OPTIONS",
-      "Access-Control-Allow-Headers": "*",
+      // #0963: MUST name Authorization explicitly — the `*` wildcard does not cover it, and the
+      // uploader authenticates with a Bearer header on a cross-origin PUT. See CORS_ALLOW_HEADERS.
+      "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS,
       "Access-Control-Expose-Headers": "Content-Length, Content-Range, ETag",
       "Access-Control-Max-Age": "600"
     };
@@ -3795,9 +3807,10 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
       }
     }
     const rootDir = target.cwd;
+    const normRel = this.toSessionRelative(rootDir, m[2] || "");
     if (method === "GET" || method === "HEAD") {
       if (url.searchParams.get("list") === "1") {
-        const lex = containedPath(rootDir, relPath.replace(/^\/+/, ""));
+        const lex = containedPath(rootDir, normRel);
         if (!lex) {
           deny(403, "Forbidden");
           return;
@@ -3824,11 +3837,12 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
         res.end(method === "HEAD" ? void 0 : JSON.stringify({ path: relPath, entries }));
         return;
       }
-      serveStaticMount(req, res, { rootDir, relPath, mountUrlPrefix: "", browse: false});
+      const asAttachment = url.searchParams.get("download") === "1";
+      serveStaticMount(req, res, { rootDir, relPath: normRel ? `/${normRel}` : "/", mountUrlPrefix: "", browse: false, attachment: asAttachment});
       return;
     }
     if (method === "PUT" || method === "DELETE") {
-      const filePath = this.resolveContainedPath(rootDir, relPath);
+      const filePath = this.resolveContainedPath(rootDir, normRel);
       if (!filePath) {
         deny(403, "Forbidden: path escapes session root");
         return;
@@ -3890,6 +3904,27 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
     }
     deny(405, "Method not allowed");
   }
+  /**
+   * #126 root-cause fix: the frontend builds gateway URLs from the file's ABSOLUTE path (the
+   * session cwd + name), e.g. `/s/<id>/Users/me/proj/big.bin` for a file at
+   * `/Users/me/proj/big.bin` in a session whose cwd is `/Users/me/proj`. A URL path can't carry
+   * the leading slash, so a naive join against cwd DOUBLE-NESTS it
+   * (`/Users/me/proj/Users/me/proj/big.bin`) — the file uploads with a 201 but lands in the wrong
+   * place (and downloads 404). The RPC path never hit this because Node's `resolve(cwd, absPath)`
+   * returns the absolute path as-is. Mirror that semantics here: reconstruct the remainder as an
+   * absolute path; if it IS the cwd or lives under it, the caller meant an absolute path — return
+   * it relative to cwd. Otherwise it's already cwd-relative. Returns a cwd-relative path with no
+   * leading slash (containment is still enforced downstream by `containedPath`/`resolveContainedPath`).
+   */
+  toSessionRelative(rootDir, remainder) {
+    const rel = (remainder || "").replace(/^\/+/, "");
+    if (!rel) return "";
+    const base = path.resolve(rootDir);
+    const asAbsolute = path.resolve("/", rel);
+    if (asAbsolute === base) return "";
+    if (asAbsolute.startsWith(base + path.sep)) return asAbsolute.slice(base.length + 1);
+    return rel;
+  }
   /**
    * #126: resolve a session-relative path against `rootDir` with lexical + symlink containment
    * (mirrors the static PUT handler's resolveContained). Allows a not-yet-existing target (for
@@ -4133,7 +4168,7 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             });
             return;
           }
-          const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": "*" };
+          const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS };
           if (url.pathname === "/" || basePath === "/") {
             res.writeHead(200, { ...cors, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
             res.end(this.mountListHtml());
@@ -7994,7 +8029,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-D1dsa-t0.mjs');
+          const { toolsForRole } = await import('./sideband-CdXFW-wu.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -8099,7 +8134,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CubsoWG-.mjs');
+    const { queryCore } = await import('./commands-AOno1gcV.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -17412,7 +17447,7 @@ function summarizeExtensions(extensions, maxExtensions = DEFAULT_LOOP_MAX_EXTENS
   return `${n} extension${n === 1 ? "" : "s"} granted (+${turns} turns)${reasons ? `: ${reasons}` : ""}`;
 }
 const DEFAULT_LOOP_STUCK_CHECKPOINTS = 3;
-const DEFAULT_LOOP_MAX_AUTORESUMES = Number.POSITIVE_INFINITY;
+const DEFAULT_LOOP_MAX_AUTORESUMES = 3;
 const PROGRESS_HISTORY_CAP = 12;
 function resolveStuckLimit(envValue) {
   const n = Number(envValue);
@@ -17421,6 +17456,8 @@ function resolveStuckLimit(envValue) {
 }
 function resolveMaxAutoResumes(envValue) {
   if (envValue == null || envValue.trim() === "") return DEFAULT_LOOP_MAX_AUTORESUMES;
+  const s = envValue.trim().toLowerCase();
+  if (s === "unbounded" || s === "inf" || s === "infinity" || s === "-1") return Number.POSITIVE_INFINITY;
   const n = Number(envValue);
   if (Number.isFinite(n) && n >= 0) return Math.floor(n);
   return DEFAULT_LOOP_MAX_AUTORESUMES;
@@ -17796,6 +17833,7 @@ function nextFailuresAfterZombieProbeFailure(consecutiveHeartbeatFailures) {
   return consecutiveHeartbeatFailures + 1;
 }
 function shouldForceReconnect(consecutiveHeartbeatFailures) {
+  if (consecutiveHeartbeatFailures < 2) return false;
   return consecutiveHeartbeatFailures === 2 || consecutiveHeartbeatFailures % 3 === 0;
 }
 
@@ -19431,6 +19469,7 @@ async function startDaemon(options) {
     };
   });
   let consecutiveHeartbeatFailures = 0;
+  let lastReconnectAt = 0;
   process.on("SIGINT", () => requestShutdown("os-signal"));
   process.on("SIGTERM", () => requestShutdown("os-signal"));
   process.on("SIGUSR1", () => requestShutdown("os-signal-cleanup"));
@@ -19627,7 +19666,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CoCcX8K1.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-ri042RB5.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -19649,7 +19688,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CoCcX8K1.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-ri042RB5.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const incoming = [{
@@ -19670,7 +19709,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { dropServiceLinks } = await import('./agentCommands-CoCcX8K1.mjs');
+      const { dropServiceLinks } = await import('./agentCommands-ri042RB5.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       if (dropServiceLinks(config, "serve", mountName)) {
@@ -19713,7 +19752,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-BkZfX5pW.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-C8CmQv3y.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -20467,8 +20506,9 @@ ${parts.join("\n")}`);
                 progressHistory: progress_history || [],
                 stuckLimit: resolveStuckLimit(process.env.SVAMP_LOOP_STUCK_CHECKPOINTS),
                 autoResumes: typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0,
-                // #0320: extensions also raise a FINITE auto-resume cap (one extra resume each). With
-                // the unbounded #0319 default this is a no-op (Infinity + n = Infinity).
+                // #0320: extensions also raise the FINITE auto-resume cap (one extra resume each).
+                // #0958: the cap is finite by default now, so this genuinely enlarges it (was a
+                // no-op under the old Infinity default).
                 maxAutoResumes: resolveMaxAutoResumes(process.env.SVAMP_LOOP_MAX_AUTORESUMES) + grantedExtensionCount(ls.extensions, resolveMaxExtensions(process.env.SVAMP_LOOP_MAX_EXTENSIONS)),
                 stuckReason: result.reason
               });
@@ -20486,12 +20526,13 @@ ${parts.join("\n")}`);
                   max_iterations: ls.max_iterations,
                   budget,
                   started_at: startedAt,
-                  // #0319: a PROGRESSING loop resets its hold counter so the evaluator-guided re-kick
-                  // mechanism re-engages fresh (it's making headway, not stuck); an auto-resume keeps it.
+                  // #0319/#0958: a PROGRESSING loop resets its hold counter AND its consecutive-fruitless
+                  // auto-resume counter — it's making headway, not wedged, so the finite auto-resume cap
+                  // (#0958) only ever bounds a genuine back-to-back stall, never a slow-but-productive loop.
                   holds: decision.kind === "progress" ? 0 : holds,
                   ledger,
                   progress_history,
-                  auto_resumes: nextAuto,
+                  auto_resumes: decision.kind === "progress" ? 0 : nextAuto,
                   extensions,
                   durable: ls.durable,
                   verify_errors: 0
@@ -22041,11 +22082,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DVtlZahE.mjs');
+              const { issueRpc } = await import('./rpc-JWRwb6oY.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-rpH-yXR7.mjs');
+              const { workflowRpc } = await import('./rpc-DMlurOlf.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -22752,11 +22793,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-DVtlZahE.mjs');
+              const { issueRpc } = await import('./rpc-JWRwb6oY.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-rpH-yXR7.mjs');
+              const { workflowRpc } = await import('./rpc-DMlurOlf.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23155,12 +23196,13 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
                 progressHistory: ls.progress_history || [],
                 stuckLimit: resolveStuckLimit(process.env.SVAMP_LOOP_STUCK_CHECKPOINTS),
                 autoResumes: typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0,
-                // #0320: extensions also raise a FINITE auto-resume cap (no-op under the unbounded default).
+                // #0320/#0958: extensions raise the FINITE auto-resume cap (genuinely enlarges it now
+                // that the default is finite — was a no-op under the old unbounded default).
                 maxAutoResumes: resolveMaxAutoResumes(process.env.SVAMP_LOOP_MAX_AUTORESUMES) + grantedExtensionCount(ls.extensions, acpMaxExt),
                 stuckReason: result.reason
               });
               if (decision.action === "continue") {
-                const nextAuto = (typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0) + (decision.consumeAutoResume ? 1 : 0);
+                const nextAuto = decision.kind === "progress" ? 0 : (typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0) + (decision.consumeAutoResume ? 1 : 0);
                 writeGoalLoopState(directory, sessionId, { ...ls, active: true, phase: "continue", holds, started_at: startedAt, ledger, auto_resumes: nextAuto });
                 const label = decision.kind === "autoresume" ? "\u{1F501} Auto-resuming stalled loop" : "\u{1F501} Loop still progressing";
                 sessionService.pushMessage({ type: "message", message: `${label} \u2014 ${decision.reason}` }, "event");
@@ -23807,7 +23849,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-BkZfX5pW.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-C8CmQv3y.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -24056,7 +24098,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-CYyGe6kn.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-CkYMjhum.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -24096,7 +24138,6 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     runOAuthAccountRefresh();
     const backendAccountRefreshInterval = setInterval(runOAuthAccountRefresh, 5 * 6e4);
     let heartbeatRunning = false;
-    let lastReconnectAt = 0;
     let heartbeatCycle = 0;
     const heartbeatInterval = setInterval(async () => {
       if (heartbeatRunning) return;

package/dist/{run-C22c9FOe.mjs → run-RYTtTBDy.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { aj as applyClaudeProxyEnv, ak as composeSessionId, al as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, am as generateHookSettings } from './run-CvwPIrfo.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { aj as applyClaudeProxyEnv, ak as composeSessionId, al as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, am as generateHookSettings } from './run-BXDA0YFP.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{scheduler-CYyGe6kn.mjs → scheduler-CkYMjhum.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-CvwPIrfo.mjs';
+import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-BXDA0YFP.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';