svamp-cli 0.2.321 → 0.2.323

package/dist/{commands-D9-YqAI3.mjs → commands-CZLE29kn.mjs}

@@ -1,10 +1,10 @@
-import { connectAndResolveSession } from './commands-slA1eX13.mjs';
-import { w as wantsHelp } from './cli-xMKB7O8k.mjs';
+import { connectAndResolveSession } from './commands-C8im5Q2J.mjs';
+import { w as wantsHelp } from './cli-C3GwCq0z.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-CKLatoxa.mjs';
+import './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-DfRahEsO.mjs → commands-CygFvR0a.mjs}

@@ -1,12 +1,12 @@
 import { writeFileSync, readFileSync } from 'fs';
 import { resolve } from 'path';
-import { connectAndGetMachine } from './commands-slA1eX13.mjs';
-import { w as wantsHelp } from './cli-xMKB7O8k.mjs';
+import { connectAndGetMachine } from './commands-C8im5Q2J.mjs';
+import { w as wantsHelp } from './cli-C3GwCq0z.mjs';
 import 'node:fs';
 import 'node:child_process';
 import 'node:path';
 import 'node:os';
-import './run-CKLatoxa.mjs';
+import './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'url';

package/dist/{commands-BxHc_Exm.mjs → commands-DLQwUjpD.mjs}

@@ -1,8 +1,8 @@
 import { execSync } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { f as flushAndExit } from './cli-xMKB7O8k.mjs';
-import { f as resolveProjectRoot, n as searchIssues, l as listIssues, m as isPendingIssue, i as resumeIssue, p as pauseIssue, j as addComment, u as updateIssue, h as getIssue, o as isVisibleTo, H as summarize, k as addIssue } from './run-CKLatoxa.mjs';
+import { f as flushAndExit } from './cli-C3GwCq0z.mjs';
+import { f as resolveProjectRoot, n as searchIssues, l as listIssues, m as isPendingIssue, i as resumeIssue, p as pauseIssue, j as addComment, u as updateIssue, h as getIssue, o as isVisibleTo, H as summarize, k as addIssue } from './run-BiwqH1hw.mjs';
 import './serviceManager-hlOVxkhW.mjs';
 import 'os';
 import 'fs/promises';

package/dist/{commands-CXgDZgqh.mjs → commands-DVvR4X4G.mjs}

@@ -1,6 +1,6 @@
 import { spawnSync } from 'node:child_process';
-import { f as resolveProjectRoot, I as workflowSteps, x as setWorkflowEnabled, D as isWorkflowEnabled, y as removeWorkflow, v as getWorkflow, C as listWorkflows, A as saveWorkflow, B as rawWorkflow } from './run-CKLatoxa.mjs';
-import { w as wantsHelp } from './cli-xMKB7O8k.mjs';
+import { f as resolveProjectRoot, I as workflowSteps, x as setWorkflowEnabled, D as isWorkflowEnabled, y as removeWorkflow, v as getWorkflow, C as listWorkflows, A as saveWorkflow, B as rawWorkflow } from './run-BiwqH1hw.mjs';
+import { w as wantsHelp } from './cli-C3GwCq0z.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{commands-Fvgfzyo3.mjs → commands-LMbH3V-v.mjs}

@@ -1,6 +1,6 @@
 import * as path from 'path';
-import { w as wantsHelp } from './cli-xMKB7O8k.mjs';
-import './run-CKLatoxa.mjs';
+import { w as wantsHelp } from './cli-C3GwCq0z.mjs';
+import './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -83,7 +83,7 @@ async function serviceExpose(args) {
     process.exit(1);
   }
   if (foreground) {
-    const { runFrpcTunnel } = await import('./run-CKLatoxa.mjs').then(function (n) { return n.ao; });
+    const { runFrpcTunnel } = await import('./run-BiwqH1hw.mjs').then(function (n) { return n.ao; });
     await runFrpcTunnel(name, ports, void 0, {
       group,
       groupKey,
@@ -93,7 +93,7 @@ async function serviceExpose(args) {
     });
     return;
   }
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const { server, machine } = await connectAndGetMachine();
   try {
     const status = await machine.tunnelStart({
@@ -115,7 +115,7 @@ async function serviceExpose(args) {
         console.log(`  port ${port}: ${url}`);
       }
       if (process.env.SVAMP_SESSION_ID) {
-        const { autoAddSessionLink } = await import('./agentCommands-Cve_0_8K.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-CjbndvZ2.mjs');
         let added = 0;
         for (const [port, url] of urlEntries) {
           const label = urlEntries.length > 1 ? `${name}:${port}` : name;
@@ -151,8 +151,8 @@ async function serviceServe(args) {
     const resolvedDir = path.resolve(directory);
     console.log(`Serving ${resolvedDir}`);
     const http = await import('http');
-    const { serveStaticMount } = await import('./run-CKLatoxa.mjs').then(function (n) { return n.ap; });
-    const { getFreePort } = await import('./run-CKLatoxa.mjs').then(function (n) { return n.ao; });
+    const { serveStaticMount } = await import('./run-BiwqH1hw.mjs').then(function (n) { return n.ap; });
+    const { getFreePort } = await import('./run-BiwqH1hw.mjs').then(function (n) { return n.ao; });
     const server = http.createServer((req, res) => {
       const u = new URL(req.url || "/", "http://127.0.0.1");
       let rel = u.pathname;
@@ -175,7 +175,7 @@ async function serviceServe(args) {
         resolve(18080);
       });
     });
-    const { runFrpcTunnel } = await import('./run-CKLatoxa.mjs').then(function (n) { return n.ao; });
+    const { runFrpcTunnel } = await import('./run-BiwqH1hw.mjs').then(function (n) { return n.ao; });
     void server;
     await runFrpcTunnel(name, [servePort]);
   } catch (err) {
@@ -185,7 +185,7 @@ async function serviceServe(args) {
 }
 async function serviceList(_args) {
   try {
-    const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+    const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       const tunnels = await machine.tunnelList({});
@@ -225,11 +225,11 @@ async function serviceDelete(args) {
     process.exit(1);
   }
   try {
-    const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+    const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
     const { server, machine } = await connectAndGetMachine();
     try {
       await machine.tunnelStop({ name });
-      const { removeSessionLinkByService } = await import('./agentCommands-Cve_0_8K.mjs');
+      const { removeSessionLinkByService } = await import('./agentCommands-CjbndvZ2.mjs');
       removeSessionLinkByService("tunnel", name);
       console.log(`Stopped tunnel '${name}'.`);
     } catch (err) {

package/dist/{commands-D1d9snmv.mjs → commands-gQM3K8Yf.mjs}

@@ -1,7 +1,7 @@
 import os from 'os';
 import fs__default from 'fs';
 import { resolve, join, relative } from 'path';
-import { Q as parseFrontmatter, T as getSkillsServer, U as getSkillsWorkspaceName, V as getSkillsCollectionName, W as fetchWithTimeout, X as searchSkills, Y as SKILLS_DIR, Z as getSkillInfo, _ as downloadSkillFile, $ as listSkillFiles } from './run-CKLatoxa.mjs';
+import { Q as parseFrontmatter, T as getSkillsServer, U as getSkillsWorkspaceName, V as getSkillsCollectionName, W as fetchWithTimeout, X as searchSkills, Y as SKILLS_DIR, Z as getSkillInfo, _ as downloadSkillFile, $ as listSkillFiles } from './run-BiwqH1hw.mjs';
 import 'fs/promises';
 import 'url';
 import 'child_process';

package/dist/{fleet-umFHXPoE.mjs → fleet-C68s3qVt.mjs}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';
-import { ad as PINNED_CODEX_VERSION, c as connectToHypha } from './run-CKLatoxa.mjs';
-import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-BkZfX5pW.mjs';
+import { ad as PINNED_CODEX_VERSION, c as connectToHypha } from './run-BiwqH1hw.mjs';
+import { PINNED_CLAUDE_CODE_VERSION } from './pinnedClaudeCode-C8CmQv3y.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -23,7 +23,7 @@ import 'node:fs/promises';
 import 'yaml';
 
 const KIMI_NPM_PACKAGE = "@moonshot-ai/kimi-code";
-const PINNED_KIMI_VERSION = "0.34.0";
+const PINNED_KIMI_VERSION = "0.35.0";
 
 const SVAMP_HOME = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
 const DAEMON_STATE_FILE = join(SVAMP_HOME, "daemon.state.json");

package/dist/{headlessCli-DgJ15daM.mjs → headlessCli-0_H-JwW2.mjs}

@@ -1,5 +1,5 @@
-import { a0 as resolveModel, ah as describeMisconfiguration, ai as buildMachineDeps } from './run-CKLatoxa.mjs';
-import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-CFbMRvzr.mjs';
+import { a0 as resolveModel, ah as describeMisconfiguration, ai as buildMachineDeps } from './run-BiwqH1hw.mjs';
+import { handleRealtimeEvent, initMachineVoiceSession } from './sideband-L0YNMJhj.mjs';
 import { WebSocket } from 'ws';
 import { execSync, spawn } from 'child_process';
 import 'os';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-CKLatoxa.mjs';
+export { c as connectToHypha, a as createSessionStore, d as daemonStatus, g as getHyphaServerUrl, r as registerMachineService, s as startDaemon, b as stopDaemon } from './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{notifyCommands-Cip4lIYS.mjs → notifyCommands-r0r8eyxA.mjs}

@@ -1,4 +1,4 @@
-import { c as connectToHypha, S as SharingNotificationSync, J as parseJwtEmail } from './run-CKLatoxa.mjs';
+import { c as connectToHypha, S as SharingNotificationSync, J as parseJwtEmail } from './run-BiwqH1hw.mjs';
 import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';

package/dist/{package-DJRwvqcx.mjs → package-BGIfEYpX.mjs}

@@ -1,5 +1,5 @@
 var name = "svamp-cli";
-var version = "0.2.321";
+var version = "0.2.323";
 var description = "Svamp CLI — AI workspace daemon on Hypha Cloud";
 var author = "Amun AI AB";
 var license = "SEE LICENSE IN LICENSE";
@@ -25,7 +25,7 @@ var scripts = {
 	"dev:daemon": "tsx src/cli.ts daemon start-sync",
 	"test:e2e": "node --no-warnings test/e2e-session-tests.mjs && npx tsx test/e2e-codex-midturn-steer.mjs && npx tsx test/e2e-serve-iframe-login.mjs && npx tsx test/test-archive-preserves-claude-file.mjs && npx tsx test/test-daemon-e2e.mjs && npx tsx test/test-hypha-service.mjs && npx tsx test/test-permission-e2e.mjs && npx tsx test/test-serve-e2e.mjs && npx tsx test/test-session-archive-resume.mjs && npx tsx test/test-session-rpc-e2e.mjs && npx tsx test/test-skills-integration.mjs && npx tsx test/test-wm-refresh.mjs && npx tsx test/e2e-session-files-gateway.mjs && npx tsx test/e2e-dns-production-hosts.mjs",
 	"test:frpc": "npx tsx test/test-frpc-e2e.mjs",
-	prepublishOnly: "yarn build"
+	prepublishOnly: "node ../../scripts/bump-cli-version.mjs --check && yarn build"
 };
 var dependencies = {
 	"@agentclientprotocol/sdk": "^0.14.1",

package/dist/{pinnedClaudeCode-BkZfX5pW.mjs → pinnedClaudeCode-C8CmQv3y.mjs}

@@ -1,7 +1,7 @@
 import { spawn, exec as exec$1 } from 'node:child_process';
 import { promisify } from 'node:util';
 
-const PINNED_CLAUDE_CODE_VERSION = "2.1.227";
+const PINNED_CLAUDE_CODE_VERSION = "2.1.229";
 const exec = promisify(exec$1);
 let _reconcile = null;
 function beginClaudeVersionReconcile(log) {

package/dist/{rpc-CLoO6Z5Z.mjs → rpc-BosOiRY-.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, u as updateIssue, h as getIssue, i as resumeIssue, p as pauseIssue, j as addComment, k as addIssue, l as listIssues, m as isPendingIssue, n as searchIssues, o as isVisibleTo } from './run-CKLatoxa.mjs';
+import { f as resolveProjectRoot, u as updateIssue, h as getIssue, i as resumeIssue, p as pauseIssue, j as addComment, k as addIssue, l as listIssues, m as isPendingIssue, n as searchIssues, o as isVisibleTo } from './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{rpc-Bz9w7JV9.mjs → rpc-DP4CiR0g.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, q as getRun, t as listRuns, v as getWorkflow, w as runWorkflow, x as setWorkflowEnabled, y as removeWorkflow, z as validateWorkflowName, A as saveWorkflow, B as rawWorkflow, C as listWorkflows } from './run-CKLatoxa.mjs';
+import { f as resolveProjectRoot, q as getRun, t as listRuns, v as getWorkflow, w as runWorkflow, x as setWorkflowEnabled, y as removeWorkflow, z as validateWorkflowName, A as saveWorkflow, B as rawWorkflow, C as listWorkflows } from './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{run-CKLatoxa.mjs → run-BiwqH1hw.mjs}

@@ -2398,14 +2398,17 @@ h1{font-size:1.15rem;word-break:break-all}ul{list-style:none;padding:0}li{paddin
 a{color:#0969da;text-decoration:none}a:hover{text-decoration:underline}</style></head>
 <body><h1>${esc(base)}</h1><ul>${rows || "<li>(empty)</li>"}</ul></body></html>`;
 }
+const CORS_ALLOW_HEADERS = "Authorization, *";
 const CORS = {
   "Access-Control-Allow-Origin": "*",
   "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS",
-  "Access-Control-Allow-Headers": "*"
+  "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS
 };
 function serveStaticMount(req, res, opts) {
   const { rootDir, relPath, mountUrlPrefix } = opts;
   const browse = opts.browse !== false;
+  const attachment = opts.attachment === true;
+  const allowHidden = opts.allowHidden === true;
   const method = (req.method || "GET").toUpperCase();
   if (method === "OPTIONS") {
     res.writeHead(204, CORS);
@@ -2426,10 +2429,10 @@ function serveStaticMount(req, res, opts) {
     return;
   }
   if (rootStat.isFile()) {
-    sendFile(req, res, rootDir, rootStat);
+    sendFile(req, res, rootDir, rootStat, attachment);
     return;
   }
-  if (hasBlockedDotSegment(relPath)) {
+  if (!allowHidden && hasBlockedDotSegment(relPath)) {
     res.writeHead(404, CORS);
     res.end("Not Found");
     return;
@@ -2466,7 +2469,7 @@ function serveStaticMount(req, res, opts) {
       try {
         const ist = fs.statSync(indexPath);
         if (ist.isFile()) {
-          sendFile(req, res, indexPath, ist);
+          sendFile(req, res, indexPath, ist, attachment);
           return;
         }
       } catch {
@@ -2492,7 +2495,7 @@ function serveStaticMount(req, res, opts) {
     return;
   }
   if (st.isFile()) {
-    sendFile(req, res, target, st);
+    sendFile(req, res, target, st, attachment);
     return;
   }
   res.writeHead(404, CORS);
@@ -2501,7 +2504,12 @@ function serveStaticMount(req, res, opts) {
 function etagFor(st) {
   return `"${st.size.toString(16)}-${Math.floor(st.mtimeMs).toString(16)}"`;
 }
-function sendFile(req, res, filePath, st) {
+function attachmentDisposition(filePath) {
+  const name = path.basename(filePath) || "download";
+  const ascii = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_") || "download";
+  return `attachment; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
+function sendFile(req, res, filePath, st, attachment = false) {
   const method = (req.method || "GET").toUpperCase();
   const etag = etagFor(st);
   const lastMod = new Date(st.mtimeMs).toUTCString();
@@ -2511,8 +2519,9 @@ function sendFile(req, res, filePath, st) {
     "Accept-Ranges": "bytes",
     ETag: etag,
     "Last-Modified": lastMod,
-    "Cache-Control": "no-cache"
+    "Cache-Control": "no-cache",
     // revalidate via ETag; content can change under a mount
+    ...attachment ? { "Content-Disposition": attachmentDisposition(filePath) } : {}
   };
   const inm = req.headers["if-none-match"];
   const ims = req.headers["if-modified-since"];
@@ -2559,6 +2568,8 @@ function pipeStream(stream, res) {
 
 var staticFileServer = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    CORS_ALLOW_HEADERS: CORS_ALLOW_HEADERS,
+    attachmentDisposition: attachmentDisposition,
     containedPath: containedPath,
     contentTypeFor: contentTypeFor,
     directoryListingHtml: directoryListingHtml,
@@ -3746,7 +3757,9 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
     const CORS = {
       "Access-Control-Allow-Origin": "*",
       "Access-Control-Allow-Methods": "GET, HEAD, PUT, DELETE, OPTIONS",
-      "Access-Control-Allow-Headers": "*",
+      // #0963: MUST name Authorization explicitly — the `*` wildcard does not cover it, and the
+      // uploader authenticates with a Bearer header on a cross-origin PUT. See CORS_ALLOW_HEADERS.
+      "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS,
       "Access-Control-Expose-Headers": "Content-Length, Content-Range, ETag",
       "Access-Control-Max-Age": "600"
     };
@@ -3825,7 +3838,8 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
         res.end(method === "HEAD" ? void 0 : JSON.stringify({ path: relPath, entries }));
         return;
       }
-      serveStaticMount(req, res, { rootDir, relPath: normRel ? `/${normRel}` : "/", mountUrlPrefix: "", browse: false});
+      const asAttachment = url.searchParams.get("download") === "1";
+      serveStaticMount(req, res, { rootDir, relPath: normRel ? `/${normRel}` : "/", mountUrlPrefix: "", browse: false, attachment: asAttachment, allowHidden: true});
       return;
     }
     if (method === "PUT" || method === "DELETE") {
@@ -4155,7 +4169,7 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             });
             return;
           }
-          const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": "*" };
+          const cors = { "Access-Control-Allow-Origin": "*", "Access-Control-Allow-Methods": "GET, HEAD, OPTIONS", "Access-Control-Allow-Headers": CORS_ALLOW_HEADERS };
           if (url.pathname === "/" || basePath === "/") {
             res.writeHead(200, { ...cors, "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
             res.end(this.mountListHtml());
@@ -8016,7 +8030,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-CFbMRvzr.mjs');
+          const { toolsForRole } = await import('./sideband-L0YNMJhj.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -8121,7 +8135,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-slA1eX13.mjs');
+    const { queryCore } = await import('./commands-C8im5Q2J.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -10435,17 +10449,29 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       return { ...lastActivity, sessionId, pendingPermissions };
     },
     // ── File Operations (optional, admin-only) ──
+    // #0965: file BYTES now travel over the HTTP files-gateway (the always-on frp tunnel,
+    // GET/HEAD/PUT/DELETE + ?list=1 in serveManager), NOT this hypha-rpc control WebSocket. A
+    // large base64 body over RPC died on any WS blip and starved the session heartbeat. So
+    // `writeFile`, `writeFileChunk` and `listDirectory` below are DEPRECATED — no current
+    // frontend calls them; they're retained only so a cached/stale PWA build still has a
+    // working handler (there is no client-version guard). EXCEPTIONS that stay first-class:
+    //   • `readFile` — control-plane, NOT file transfer: the CLI `loop status` and the
+    //     frontend `getSessionLoopStatus` read small `.svamp/<id>/loop/*.json` files through
+    //     it. Keeping loop status off the file tunnel avoids coupling the loop UI to it.
+    //   • `filesEndpoint` — resolves the gateway URL the frontend uses for all of the above.
     readFile: async (path, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onReadFile) throw new Error("readFile not supported");
       return await callbacks.onReadFile(path);
     },
+    /** @deprecated #0965 — use the HTTP files-gateway (PUT). Retained for cached-PWA skew only. */
     writeFile: async (path, content, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onWriteFile) throw new Error("writeFile not supported");
       await callbacks.onWriteFile(path, content);
       return { success: true };
     },
+    /** @deprecated #0965 — superseded by the HTTP files-gateway (PUT). Retained for cached-PWA skew only. */
     writeFileChunk: async (path, content, uploadId, chunkIndex, totalChunks, isLast, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onWriteFileChunk) throw new Error("writeFileChunk not supported");
@@ -10459,6 +10485,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       authorizeRequest(context, metadata.sharing, "admin");
       return { url: callbacks.onFilesEndpoint?.() ?? null };
     },
+    /** @deprecated #0965 — use the HTTP files-gateway (GET ?list=1). Retained for cached-PWA skew only. */
     listDirectory: async (path, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!callbacks.onListDirectory) throw new Error("listDirectory not supported");
@@ -17434,7 +17461,7 @@ function summarizeExtensions(extensions, maxExtensions = DEFAULT_LOOP_MAX_EXTENS
   return `${n} extension${n === 1 ? "" : "s"} granted (+${turns} turns)${reasons ? `: ${reasons}` : ""}`;
 }
 const DEFAULT_LOOP_STUCK_CHECKPOINTS = 3;
-const DEFAULT_LOOP_MAX_AUTORESUMES = Number.POSITIVE_INFINITY;
+const DEFAULT_LOOP_MAX_AUTORESUMES = 3;
 const PROGRESS_HISTORY_CAP = 12;
 function resolveStuckLimit(envValue) {
   const n = Number(envValue);
@@ -17443,6 +17470,8 @@ function resolveStuckLimit(envValue) {
 }
 function resolveMaxAutoResumes(envValue) {
   if (envValue == null || envValue.trim() === "") return DEFAULT_LOOP_MAX_AUTORESUMES;
+  const s = envValue.trim().toLowerCase();
+  if (s === "unbounded" || s === "inf" || s === "infinity" || s === "-1") return Number.POSITIVE_INFINITY;
   const n = Number(envValue);
   if (Number.isFinite(n) && n >= 0) return Math.floor(n);
   return DEFAULT_LOOP_MAX_AUTORESUMES;
@@ -19651,7 +19680,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-Cve_0_8K.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-CjbndvZ2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -19673,7 +19702,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-Cve_0_8K.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-CjbndvZ2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const incoming = [{
@@ -19694,7 +19723,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { dropServiceLinks } = await import('./agentCommands-Cve_0_8K.mjs');
+      const { dropServiceLinks } = await import('./agentCommands-CjbndvZ2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       if (dropServiceLinks(config, "serve", mountName)) {
@@ -19737,7 +19766,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-BkZfX5pW.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-C8CmQv3y.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -20491,8 +20520,9 @@ ${parts.join("\n")}`);
                 progressHistory: progress_history || [],
                 stuckLimit: resolveStuckLimit(process.env.SVAMP_LOOP_STUCK_CHECKPOINTS),
                 autoResumes: typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0,
-                // #0320: extensions also raise a FINITE auto-resume cap (one extra resume each). With
-                // the unbounded #0319 default this is a no-op (Infinity + n = Infinity).
+                // #0320: extensions also raise the FINITE auto-resume cap (one extra resume each).
+                // #0958: the cap is finite by default now, so this genuinely enlarges it (was a
+                // no-op under the old Infinity default).
                 maxAutoResumes: resolveMaxAutoResumes(process.env.SVAMP_LOOP_MAX_AUTORESUMES) + grantedExtensionCount(ls.extensions, resolveMaxExtensions(process.env.SVAMP_LOOP_MAX_EXTENSIONS)),
                 stuckReason: result.reason
               });
@@ -20510,12 +20540,13 @@ ${parts.join("\n")}`);
                   max_iterations: ls.max_iterations,
                   budget,
                   started_at: startedAt,
-                  // #0319: a PROGRESSING loop resets its hold counter so the evaluator-guided re-kick
-                  // mechanism re-engages fresh (it's making headway, not stuck); an auto-resume keeps it.
+                  // #0319/#0958: a PROGRESSING loop resets its hold counter AND its consecutive-fruitless
+                  // auto-resume counter — it's making headway, not wedged, so the finite auto-resume cap
+                  // (#0958) only ever bounds a genuine back-to-back stall, never a slow-but-productive loop.
                   holds: decision.kind === "progress" ? 0 : holds,
                   ledger,
                   progress_history,
-                  auto_resumes: nextAuto,
+                  auto_resumes: decision.kind === "progress" ? 0 : nextAuto,
                   extensions,
                   durable: ls.durable,
                   verify_errors: 0
@@ -22065,11 +22096,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CLoO6Z5Z.mjs');
+              const { issueRpc } = await import('./rpc-BosOiRY-.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-Bz9w7JV9.mjs');
+              const { workflowRpc } = await import('./rpc-DP4CiR0g.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -22776,11 +22807,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CLoO6Z5Z.mjs');
+              const { issueRpc } = await import('./rpc-BosOiRY-.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-Bz9w7JV9.mjs');
+              const { workflowRpc } = await import('./rpc-DP4CiR0g.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23179,12 +23210,13 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
                 progressHistory: ls.progress_history || [],
                 stuckLimit: resolveStuckLimit(process.env.SVAMP_LOOP_STUCK_CHECKPOINTS),
                 autoResumes: typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0,
-                // #0320: extensions also raise a FINITE auto-resume cap (no-op under the unbounded default).
+                // #0320/#0958: extensions raise the FINITE auto-resume cap (genuinely enlarges it now
+                // that the default is finite — was a no-op under the old unbounded default).
                 maxAutoResumes: resolveMaxAutoResumes(process.env.SVAMP_LOOP_MAX_AUTORESUMES) + grantedExtensionCount(ls.extensions, acpMaxExt),
                 stuckReason: result.reason
               });
               if (decision.action === "continue") {
-                const nextAuto = (typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0) + (decision.consumeAutoResume ? 1 : 0);
+                const nextAuto = decision.kind === "progress" ? 0 : (typeof ls.auto_resumes === "number" ? ls.auto_resumes : 0) + (decision.consumeAutoResume ? 1 : 0);
                 writeGoalLoopState(directory, sessionId, { ...ls, active: true, phase: "continue", holds, started_at: startedAt, ledger, auto_resumes: nextAuto });
                 const label = decision.kind === "autoresume" ? "\u{1F501} Auto-resuming stalled loop" : "\u{1F501} Loop still progressing";
                 sessionService.pushMessage({ type: "message", message: `${label} \u2014 ${decision.reason}` }, "event");
@@ -23831,7 +23863,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-BkZfX5pW.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-C8CmQv3y.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -24080,7 +24112,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-Bs0nAlhs.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-BN9GuvGN.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {

package/dist/{run-CxuKTe0N.mjs → run-DAo9Lw4D.mjs}

@@ -1,4 +1,4 @@
-import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { aj as applyClaudeProxyEnv, ak as composeSessionId, al as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, am as generateHookSettings } from './run-CKLatoxa.mjs';
+import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import { aj as applyClaudeProxyEnv, ak as composeSessionId, al as generateFriendlyName, c as connectToHypha, a as createSessionStore, r as registerMachineService, am as generateHookSettings } from './run-BiwqH1hw.mjs';
 import os from 'node:os';
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync, watch } from 'node:fs';

package/dist/{scheduler-Bs0nAlhs.mjs → scheduler-BN9GuvGN.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-CKLatoxa.mjs';
+import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-Bi7DJs-3.mjs → serveCommands-C_E-RAiL.mjs}

@@ -1,6 +1,6 @@
 import * as path from 'path';
-import { w as wantsHelp } from './cli-xMKB7O8k.mjs';
-import './run-CKLatoxa.mjs';
+import { w as wantsHelp } from './cli-C3GwCq0z.mjs';
+import './run-BiwqH1hw.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -77,7 +77,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -110,7 +110,7 @@ async function serveAdd(args, machineId) {
     }
     if (sessionId && result?.url) {
       try {
-        const { autoAddSessionLink } = await import('./agentCommands-Cve_0_8K.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-CjbndvZ2.mjs');
         autoAddSessionLink(String(result.url), name, void 0, { kind: "serve", name });
       } catch {
       }
@@ -124,7 +124,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -206,7 +206,7 @@ async function serveApply(args, machineId) {
     console.log(`URL: ${result.url}`);
     if (params.sessionId && result?.url) {
       try {
-        const { autoAddSessionLink } = await import('./agentCommands-Cve_0_8K.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-CjbndvZ2.mjs');
         const prevSession = process.env.SVAMP_SESSION_ID;
         process.env.SVAMP_SESSION_ID = String(params.sessionId);
         try {
@@ -227,7 +227,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -237,7 +237,7 @@ async function serveRemove(args, machineId) {
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     await machine.serveRemove({ name });
-    const { removeSessionLinkByService } = await import('./agentCommands-Cve_0_8K.mjs');
+    const { removeSessionLinkByService } = await import('./agentCommands-CjbndvZ2.mjs');
     removeSessionLinkByService("serve", name);
     console.log(`Mount '${name}' removed.`);
   } catch (err) {
@@ -249,7 +249,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -283,7 +283,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-slA1eX13.mjs');
+  const { connectAndGetMachine } = await import('./commands-C8im5Q2J.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();