svamp-cli 0.2.325 → 0.2.327

package/dist/{run-CO4F7ZaJ.mjs → run-DdTcDN3e.mjs}

@@ -8,15 +8,15 @@ import { fileURLToPath } from 'url';
 import { execFile, execSync, spawn, exec as exec$1 } from 'child_process';
 import * as crypto from 'crypto';
 import { randomUUID, createHash } from 'crypto';
-import { randomUUID as randomUUID$1, randomBytes, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
 import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync as unlinkSync$1, writeSync } from 'node:fs';
+import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:path';
+import { randomUUID as randomUUID$1, randomBytes, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
 import { exec, spawn as spawn$1, execSync as execSync$1, execFile as execFile$1, execFileSync } from 'node:child_process';
 import { promisify } from 'util';
 import * as http from 'http';
 import * as net from 'net';
 import { createServer } from 'net';
 import os, { homedir as homedir$1, platform as platform$1 } from 'node:os';
-import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:path';
 import { EventEmitter } from 'node:events';
 import { ndJsonStream, ClientSideConnection } from '@agentclientprotocol/sdk';
 import { promisify as promisify$1 } from 'node:util';
@@ -3001,6 +3001,13 @@ function assertNonAdminMountDirSafe(directory, homeDir, resolveReal = defaultRes
     }
   }
 }
+function hiddenSegmentOf(relPath) {
+  for (const seg of relPath.split(/[\\/]+/)) {
+    if (!seg || seg === ".") continue;
+    if (seg.startsWith(".")) return seg;
+  }
+  return null;
+}
 function defaultResolveReal(p) {
   try {
     return fs.realpathSync(p);
@@ -3160,6 +3167,9 @@ class ServeManager {
   hyphaServerUrl;
   /** #126: daemon-provided lookup of sessionId → { cwd, sharing, ownerEmail } for the files gateway. */
   sessionResolver = null;
+  /** Channel-capability authorizer: a `fileAccess`-enabled channel's caller key grants
+   *  whole-project file management for its session. Checked BEFORE email auth. */
+  capabilityAuthorizer = null;
   /**
    * #0944/#0945: daemon-provided "this mount no longer backs that session's Launch Pad entry"
    * hook. Fired with the OWNING session id, which is the only correct target — the CLI-side
@@ -3189,6 +3199,43 @@ class ServeManager {
   setSessionResolver(fn) {
     this.sessionResolver = fn;
   }
+  /**
+   * Register the channel-capability authorizer used by the session-files gateway to admit
+   * a `fileAccess`-enabled channel's caller key (ck_… bearer). Call once at daemon start.
+   */
+  setCapabilityAuthorizer(fn) {
+    this.capabilityAuthorizer = fn;
+  }
+  /**
+   * Extract a channel capability token from the request, if one is present. A channel caller
+   * key is `ck_`-prefixed; we ONLY return a token that carries that prefix so a Hypha JWT
+   * bearer (used by the email-identity path) never collides with the capability authorizer.
+   * Accepted carriers: `Authorization: Bearer ck_…` header (any verb), or `?key=ck_…` query
+   * param (READ verbs only). Returns null when no capability token is presented.
+   * NEVER log the returned value.
+   *
+   * #1047: the query carrier is restricted to GET/HEAD. A query string is a poor place for a
+   * credential — it lands in browser history, in the `Referer` of any HTML the gateway serves,
+   * and in every tunnel/intermediary access log on the path (and the gateway is reached over an
+   * frps tunnel whose logs the user does not control). This is the same exposure class #1006
+   * closed for the Hypha JWT in download URLs. It is kept for reads because a browser-embeddable
+   * URL genuinely needs it (an `<img src>` or a download link cannot set a header), but a leaked
+   * URL must not also confer PUT/DELETE over the whole project. The generated skill already
+   * documents only the Authorization form (see `fileSection` in channel/store.ts), so this
+   * narrows an unused carrier rather than breaking the documented path.
+   */
+  extractCapabilityToken(req, url) {
+    const auth = req.headers["authorization"];
+    if (typeof auth === "string") {
+      const m = /^Bearer\s+(\S+)$/i.exec(auth.trim());
+      if (m && m[1].startsWith("ck_")) return m[1];
+    }
+    const method = (req.method || "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD") return null;
+    const q = url.searchParams.get("key");
+    if (q && q.startsWith("ck_")) return q;
+    return null;
+  }
   /**
    * #0944/#0945: register the daemon's "drop this session's Launch Pad link for this mount"
    * callback. Fired when a mount stops backing a session's Pad entry — on a real removal, and
@@ -3785,40 +3832,59 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
       deny(404, "Unknown session");
       return;
     }
-    const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
-    if (!userEmail) {
-      deny(401, "Authentication required");
-      return;
+    let capabilityGranted = false;
+    const capToken = this.extractCapabilityToken(req, url);
+    if (capToken && this.capabilityAuthorizer) {
+      try {
+        capabilityGranted = this.capabilityAuthorizer(sessionId, capToken);
+      } catch {
+        capabilityGranted = false;
+      }
     }
-    const ownerEmail = (target.ownerEmail || "").toLowerCase();
-    const isOwner = !!ownerEmail && userEmail.toLowerCase() === ownerEmail;
-    if (!isOwner) {
-      const principal = { user: { email: userEmail } };
-      let granted = false;
-      const sharing = target.sharing;
-      if (sharing && sharing.enabled) {
-        try {
-          authorizeRequest(principal, sharing, "admin");
-          granted = true;
-        } catch {
-        }
+    if (!capabilityGranted) {
+      const userEmail = this.auth ? await this.auth.authenticate(req).catch(() => null) : null;
+      if (!userEmail) {
+        deny(401, "Authentication required");
+        return;
       }
-      const machineSharing = target.machineSharing;
-      if (!granted && machineSharing && machineSharing.enabled) {
-        try {
-          authorizeRequest(principal, machineSharing, "admin");
-          granted = true;
-        } catch {
+      const ownerEmail = (target.ownerEmail || "").toLowerCase();
+      const isOwner = !!ownerEmail && userEmail.toLowerCase() === ownerEmail;
+      if (!isOwner) {
+        const principal = { user: { email: userEmail } };
+        let granted = false;
+        const sharing = target.sharing;
+        if (sharing && sharing.enabled) {
+          try {
+            authorizeRequest(principal, sharing, "admin");
+            granted = true;
+          } catch {
+          }
+        }
+        const machineSharing = target.machineSharing;
+        if (!granted && machineSharing && machineSharing.enabled) {
+          try {
+            authorizeRequest(principal, machineSharing, "admin");
+            granted = true;
+          } catch {
+          }
+        }
+        if (!granted) {
+          this.log(`Files-gateway DENY '${sessionId}': ${userEmail} not owner and not a session/machine admin`);
+          deny(403, "Access denied");
+          return;
         }
-      }
-      if (!granted) {
-        this.log(`Files-gateway DENY '${sessionId}': ${userEmail} not owner and not a session/machine admin`);
-        deny(403, "Access denied");
-        return;
       }
     }
     const rootDir = target.cwd;
     const normRel = this.toSessionRelative(rootDir, m[2] || "");
+    if (capabilityGranted) {
+      const badSeg = hiddenSegmentOf(normRel);
+      if (badSeg) {
+        this.log(`Files-gateway DENY '${sessionId}': channel capability may not reach a hidden path (${badSeg})`);
+        deny(403, `Forbidden: channel file access may not reach hidden paths (${badSeg})`);
+        return;
+      }
+    }
     if (method === "GET" || method === "HEAD") {
       if (url.searchParams.get("list") === "1") {
         const lex = this.resolveContainedPath(rootDir, normRel);
@@ -3840,6 +3906,7 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             }
             return { name: d.name, isDir, size, mtime };
           });
+          if (capabilityGranted) entries = entries.filter((e) => !e.name.startsWith("."));
         } catch (err) {
           deny(err?.code === "ENOENT" ? 404 : 500, `Listing failed: ${err?.message || err}`);
           return;
@@ -4420,6 +4487,7 @@ var serveManager = /*#__PURE__*/Object.freeze({
     ServeManager: ServeManager,
     assertNonAdminMountDirSafe: assertNonAdminMountDirSafe,
     buildLinkSubdomain: buildLinkSubdomain,
+    hiddenSegmentOf: hiddenSegmentOf,
     resolveMountOwnerEmail: resolveMountOwnerEmail,
     sanitizeMountForRole: sanitizeMountForRole
 });
@@ -4598,8 +4666,13 @@ function applyPromptCacheTtl(spawnEnv) {
   const cacheOverride = spawnEnv.ENABLE_PROMPT_CACHING_1H ?? process.env.ENABLE_PROMPT_CACHING_1H ?? spawnEnv.FORCE_PROMPT_CACHING_5M ?? process.env.FORCE_PROMPT_CACHING_5M;
   if (cacheOverride === void 0) spawnEnv.ENABLE_PROMPT_CACHING_1H = "1";
 }
+function applyTodoTools(spawnEnv) {
+  const override = spawnEnv.CLAUDE_CODE_ENABLE_TODO_TOOLS ?? process.env.CLAUDE_CODE_ENABLE_TODO_TOOLS;
+  if (override === void 0) spawnEnv.CLAUDE_CODE_ENABLE_TODO_TOOLS = "1";
+}
 function applyClaudeProxyEnv(spawnEnv) {
   const mode = currentMode();
+  applyTodoTools(spawnEnv);
   if (mode === "hypha") {
     const proxyUrl = resolveHyphaProxyUrl();
     if (!proxyUrl) {
@@ -5613,6 +5686,12 @@ function validateChannel(c) {
   if (m === "fixed" && c.identity.fixed?.name && unsafe.test(c.identity.fixed.name)) errs.push(`identity.fixed.name must not contain < > " ' & or newlines`);
   for (const cl of c.identity?.callers || []) if (unsafe.test(cl.name || "")) errs.push(`caller name "${cl.name}" must not contain < > " ' & or newlines`);
   errs.push(...validateUploadConfig(c));
+  if (c.fileAccess !== void 0) {
+    if (typeof c.fileAccess !== "object" || c.fileAccess === null || Array.isArray(c.fileAccess))
+      errs.push("fileAccess must be an object");
+    else if (c.fileAccess.enabled !== void 0 && typeof c.fileAccess.enabled !== "boolean")
+      errs.push("fileAccess.enabled must be a boolean");
+  }
   return errs;
 }
 function normalizeBind(c) {
@@ -5636,14 +5715,34 @@ function channelAsyncRepliable(c) {
   if ((c.action?.kind ?? "message") !== "message") return false;
   return bindMode(c) !== "stateless";
 }
+function channelKeyGrantsFileAccess(channels, token) {
+  if (!token || !token.startsWith("ck_")) return false;
+  const presented = createHash$1("sha256").update(token).digest();
+  const eq = (candidate) => {
+    if (!candidate) return false;
+    try {
+      return timingSafeEqual(presented, createHash$1("sha256").update(candidate).digest());
+    } catch {
+      return false;
+    }
+  };
+  for (const ch of channels) {
+    if (ch.enabled === false) continue;
+    if (!ch.fileAccess?.enabled) continue;
+    if (eq(ch.identity?.shared_key)) return true;
+    for (const caller of ch.identity?.callers || []) if (eq(caller.key)) return true;
+  }
+  return false;
+}
+const _channelListCache = /* @__PURE__ */ new Map();
+const _CHANNEL_CACHE_TTL_MS = 1e3;
+function invalidateChannelCache(dir) {
+  _channelListCache.delete(dir);
+}
 class ChannelStore {
   dir;
   constructor(projectDir) {
     this.dir = join$1(projectDir, ".svamp", "channels");
-    try {
-      mkdirSync$1(this.dir, { recursive: true });
-    } catch {
-    }
   }
   // #0982: reject a traversing/oversized id at the path boundary itself, so no
   // caller (RPC, HTTP, CLI) can reach outside this.dir regardless of its own checks.
@@ -5664,19 +5763,43 @@ class ChannelStore {
     if (errs.length) throw new Error("invalid channel: " + errs.join("; "));
     mkdirSync$1(this.dir, { recursive: true });
     const tmp = `${this._path(c.id)}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-    writeFileSync$1(tmp, JSON.stringify(c, null, 2));
+    writeFileSync$1(tmp, JSON.stringify(c, null, 2), { mode: 384 });
     renameSync(tmp, this._path(c.id));
+    invalidateChannelCache(this.dir);
     return c;
   }
+  /**
+   * All channels in this project, parsed. Cached per directory and revalidated with ONE statSync
+   * — see the #1049/#1068 note above for why the uncached version was a daemon-wide stall.
+   */
   list() {
-    if (!existsSync(this.dir)) return [];
-    return readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
-      try {
-        return normalizeBind(JSON.parse(readFileSync(join$1(this.dir, f), "utf8")));
-      } catch {
-        return null;
-      }
-    }).filter((c) => !!c);
+    let st;
+    try {
+      const s = statSync(this.dir);
+      st = { mtimeMs: s.mtimeMs, size: s.size };
+    } catch {
+      _channelListCache.delete(this.dir);
+      return [];
+    }
+    const hit = _channelListCache.get(this.dir);
+    if (hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size && Date.now() - hit.at < _CHANNEL_CACHE_TTL_MS) {
+      return hit.channels;
+    }
+    let channels;
+    try {
+      channels = readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
+        try {
+          return normalizeBind(JSON.parse(readFileSync(join$1(this.dir, f), "utf8")));
+        } catch {
+          return null;
+        }
+      }).filter((c) => !!c);
+    } catch {
+      _channelListCache.delete(this.dir);
+      return [];
+    }
+    _channelListCache.set(this.dir, { mtimeMs: st.mtimeMs, size: st.size, at: Date.now(), channels });
+    return channels;
   }
   get(id) {
     try {
@@ -5694,6 +5817,7 @@ class ChannelStore {
       const p = this._path(id);
       if (existsSync(p)) {
         rmSync$1(p);
+        invalidateChannelCache(this.dir);
         return true;
       }
       return false;
@@ -5734,6 +5858,28 @@ class ChannelStore {
       return caller;
     });
   }
+  /**
+   * #1036: revoke ONE caller's key without destroying the channel.
+   *
+   * Before this, the only removal primitive was remove(id) — so withdrawing a single leaked key
+   * meant deleting the whole channel and every other caller with it. That is a bad enough trade
+   * that in practice a leaked key just stayed live, which matters much more now that a caller key
+   * can carry whole-project file access (see channelKeyGrantsFileAccess).
+   *
+   * Same per-channel lock as the sibling mutators (#0679), so a concurrent addCaller cannot
+   * resurrect the revoked entry by writing a stale base. Returns true when a caller was removed.
+   */
+  removeCaller(id, name) {
+    return withFileLock(this._lock(id), () => {
+      const c = this.get(id);
+      if (!c?.identity?.callers) return false;
+      const before = c.identity.callers.length;
+      c.identity.callers = c.identity.callers.filter((x) => x.name !== name);
+      if (c.identity.callers.length === before) return false;
+      this._writeChannel(c);
+      return true;
+    });
+  }
 }
 function routingSession(channel, ctx) {
   const mode = bindMode(channel);
@@ -5846,6 +5992,32 @@ curl -X POST "${uploadUrl}" \\
   -d '{"kwargs": {"channel": "${channel.id}", "filename": "report.pdf", "content_base64": "<base64>", "content_type": "application/pdf", "from": "your-name", "key": "${key}"}}'
 \`\`\``;
   })() : "";
+  const filesBase = ctx?.filesEndpoint;
+  const fileSection = channel.fileAccess?.enabled && filesBase ? `
+
+## Managing project files
+This channel also grants **full file management of the whole project folder** \u2014 list,
+download, upload, and delete any file in the working directory (this is NOT the sandboxed
+\`upload\` above). Authenticate every request with your channel key as a Bearer token:
+
+Base: \`${filesBase}\` \u2014 append a project-relative path (URL-encode as needed).
+
+- **List a directory:** \`GET ${filesBase}/<dir>/?list=1\` \u2192 JSON of entries
+- **Download a file:** \`GET ${filesBase}/<path>\`
+- **Upload / overwrite:** \`PUT ${filesBase}/<path>\` with the raw file bytes as the body
+- **Delete a file:** \`DELETE ${filesBase}/<path>\`
+
+\`\`\`bash
+# list the project root
+curl -H "Authorization: Bearer ${key}" "${filesBase}/?list=1"
+# download a file
+curl -H "Authorization: Bearer ${key}" "${filesBase}/README.md" -o README.md
+# upload / overwrite a file (raw bytes)
+curl -X PUT -H "Authorization: Bearer ${key}" --data-binary @local.txt "${filesBase}/notes/local.txt"
+# delete a file
+curl -X DELETE -H "Authorization: Bearer ${key}" "${filesBase}/notes/local.txt"
+\`\`\`
+> \u26A0\uFE0F Anyone holding this key can read, write, and **delete** any file in this project. Revoke it when you're done.` : "";
   return `---
 name: ${name}
 description: ${desc}
@@ -5878,7 +6050,7 @@ curl -X POST "${sendUrl}" \\
   -d '{"kwargs": {"channel": "${channel.id}", "message": "your message here", "from": "your-name", "key": "${key}"${sessionKv}}}'
 \`\`\`
 
-Always-current copy of this skill (all ids filled in): ${skillUrl}${uploadSection}${queueSection}`;
+Always-current copy of this skill (all ids filled in): ${skillUrl}${uploadSection}${fileSection}${queueSection}`;
 }
 
 function keysMatch(a, b) {
@@ -6347,6 +6519,9 @@ function getParamNames(fn) {
 const terminalSessions = /* @__PURE__ */ new Map();
 let ptyModule = null;
 const TERMINAL_IDLE_MS = 30 * 60 * 1e3;
+const TERMINAL_CLIENT_ABSENT_MS = 4 * 60 * 60 * 1e3;
+const TERMINAL_BUFFER_MAX_BYTES = 1024 * 1024;
+const TERMINAL_MAX_SESSIONS = 64;
 let terminalReaper = null;
 function ensureTerminalReaper() {
   if (terminalReaper) return;
@@ -6354,7 +6529,8 @@ function ensureTerminalReaper() {
     const now = Date.now();
     for (const [id, s] of terminalSessions) {
       if (s.exited) continue;
-      if (now - s.lastActivity > TERMINAL_IDLE_MS) {
+      const abandoned = now - (s.lastClientActivity ?? s.lastActivity) > TERMINAL_CLIENT_ABSENT_MS;
+      if (now - s.lastActivity > TERMINAL_IDLE_MS || abandoned) {
         try {
           s.pty.kill();
         } catch {
@@ -7208,8 +7384,29 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           rows,
           createdAt: Date.now(),
           lastActivity: Date.now(),
+          lastClientActivity: Date.now(),
+          outputBytes: 0,
           cwd
         };
+        if (terminalSessions.size >= TERMINAL_MAX_SESSIONS) {
+          let victim = null, oldest = Infinity;
+          for (const [id, s] of terminalSessions) {
+            const seen = s.lastClientActivity ?? s.lastActivity;
+            if (seen < oldest) {
+              oldest = seen;
+              victim = id;
+            }
+          }
+          if (victim) {
+            const v = terminalSessions.get(victim);
+            try {
+              v?.pty.kill();
+            } catch {
+            }
+            terminalSessions.delete(victim);
+            console.log(`[terminal] evicted idlest session ${victim} \u2014 at the ${TERMINAL_MAX_SESSIONS}-PTY ceiling`);
+          }
+        }
         terminalSessions.set(sessionId, session);
         ensureTerminalReaper();
         let outputBatch = "";
@@ -7220,8 +7417,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           const batch = outputBatch;
           outputBatch = "";
           session.outputBuffer.push(batch);
-          if (session.outputBuffer.length > 1e3) {
-            session.outputBuffer.splice(0, session.outputBuffer.length - 500);
+          session.outputBytes += batch.length;
+          while (session.outputBytes > TERMINAL_BUFFER_MAX_BYTES && session.outputBuffer.length > 1) {
+            session.outputBytes -= (session.outputBuffer.shift() || "").length;
           }
           if (terminalClient) {
             try {
@@ -7270,6 +7468,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const filtered = filterTerminalResponses(params.data);
         if (filtered) session.pty.write(filtered);
         session.lastActivity = Date.now();
+        session.lastClientActivity = Date.now();
         return { success: true };
       },
       /** Resize a terminal session. */
@@ -7291,7 +7490,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const session = terminalSessions.get(params.sessionId);
         if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
         const output = session.outputBuffer.splice(0).join("");
+        session.outputBytes = 0;
         session.lastActivity = Date.now();
+        session.lastClientActivity = Date.now();
         const result = {
           output,
           exited: session.exited
@@ -8101,7 +8302,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-CadJ3gg1.mjs');
+          const { toolsForRole } = await import('./sideband-BRHu4M46.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -8206,7 +8407,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-D4R66JMe.mjs');
+    const { queryCore } = await import('./commands-DexO3t-N.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -9354,6 +9555,7 @@ function loadMessagesFromDiskReverse(messagesDir, beforeSeq, limit) {
   }
 }
 const messageCountCache = /* @__PURE__ */ new Map();
+const MESSAGE_COUNT_CACHE_MAX = 2e3;
 function countMessagesOnDisk(messagesDir, fallbackInMemory) {
   const filePath = join$1(messagesDir, "messages.jsonl");
   if (!existsSync(filePath)) return fallbackInMemory;
@@ -9381,7 +9583,13 @@ function countMessagesOnDisk(messagesDir, fallbackInMemory) {
       for (let i = 0; i < data.length; i++) if (data.charCodeAt(i) === 10) count++;
       if (data.length > 0 && data[data.length - 1] !== "\n") count++;
     }
+    messageCountCache.delete(filePath);
     messageCountCache.set(filePath, { size: st.size, mtimeMs: st.mtimeMs, count });
+    while (messageCountCache.size > MESSAGE_COUNT_CACHE_MAX) {
+      const oldest = messageCountCache.keys().next();
+      if (oldest.done) break;
+      messageCountCache.delete(oldest.value);
+    }
     return count;
   } catch {
     return fallbackInMemory;
@@ -9674,7 +9882,11 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     key: c.identity?.shared_key,
     // The session this skill is being copied FROM — baked into `dynamic` channel
     // instructions as the routing target so the copied link lands in THIS session.
-    session: sessionId
+    session: sessionId,
+    // For a fileAccess-enabled channel, the session-files REST gateway prefix
+    // (`<base>/s/<sessionId>/`) so generateSkillBody can render the file curl block.
+    // Null until the always-on gateway tunnel is up ⇒ the file section is omitted.
+    filesEndpoint: callbacks.onFilesEndpoint?.() ?? void 0
   });
   const skillUrlsFor = (c) => {
     if (!channelsServiceId) return { skillUrl: void 0, sendUrl: void 0 };
@@ -10250,10 +10462,17 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
         return { error: e?.message || String(e) };
       }
     },
-    recordMeetingActivity: async (params) => {
+    recordMeetingActivity: async (params, context) => {
       const c = channelStore.get(params.channel);
       if (!c || c.enabled === false) return { error: "channel not found" };
-      const r = resolveSender(c, { key: params.key, from: params.from });
+      const u = context?.user;
+      const r = resolveSender(c, {
+        key: params.key,
+        from: params.from,
+        hyphaUser: u && u.is_anonymous !== true ? u.email || u.id : void 0,
+        hyphaAnonymous: u?.is_anonymous === true,
+        hyphaWorkspace: u?.scope?.current_workspace
+      });
       if (r.error || !r.sender) return { error: r.error || "unauthorized" };
       const text = String(params.text || "").replace(/\s+/g, " ").trim().slice(0, 1e3);
       if (!text) return { ok: true };
@@ -10721,7 +10940,9 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // ── Listener Registration ──
     registerListener: async (callback, context) => {
       authorizeRequest(context, metadata.sharing, "view");
+      const MAX_LISTENERS = 64;
       listeners.push(callback);
+      while (listeners.length > MAX_LISTENERS) listeners.shift();
       const replayMessages = messages.slice(-50);
       const REPLAY_MESSAGE_TIMEOUT_MS = 1e4;
       for (const msg of replayMessages) {
@@ -11463,6 +11684,25 @@ function handleClaudeMessage(ctx, msg) {
   }
 }
 
+function sessionQueueMax(env = process.env) {
+  return Math.max(10, Number(env.SVAMP_SESSION_QUEUE_MAX) || 200);
+}
+function appendToMessageQueue(existing, entry, max = sessionQueueMax()) {
+  const next = [...existing, entry];
+  if (next.length <= max) return { queue: next, dropped: 0 };
+  const overflow = next.length - max;
+  let budget = overflow;
+  const kept = [];
+  for (const item of next) {
+    if (budget > 0 && item !== entry && item.inboxHop !== void 0) {
+      budget--;
+      continue;
+    }
+    kept.push(item);
+  }
+  return { queue: kept, dropped: overflow - budget };
+}
+
 const KNOWN_AGENT_LAUNCHERS = ["claude", "codex", "gemini", "kimi"];
 function agentLauncherExists(cmd, env = process.env) {
   if (!cmd) return false;
@@ -13580,6 +13820,25 @@ var acpAgentConfig = /*#__PURE__*/Object.freeze({
     resolveAcpAgentConfig: resolveAcpAgentConfig
 });
 
+const COMPLETED_REQUESTS_MAX = 500;
+function recordCompletedRequest(existing, id, entry, max = COMPLETED_REQUESTS_MAX) {
+  const out = { ...existing || {} };
+  delete out[id];
+  const slim = {
+    completedAt: typeof entry.completedAt === "number" ? entry.completedAt : Date.now(),
+    status: String(entry.status ?? "")
+  };
+  if (typeof entry.tool === "string") slim.tool = entry.tool;
+  if (entry.reason !== void 0) slim.reason = entry.reason;
+  if (entry.mode !== void 0) slim.mode = entry.mode;
+  if (entry.decision !== void 0) slim.decision = entry.decision;
+  if (Array.isArray(entry.allowedTools)) slim.allowedTools = entry.allowedTools;
+  out[id] = slim;
+  const keys = Object.keys(out);
+  for (let i = 0; i < keys.length - max; i++) delete out[keys[i]];
+  return out;
+}
+
 function applyPermissionResolution(sessionService, requestId, approved) {
   const reqs = { ...sessionService._agentState?.requests };
   if (!(requestId in reqs)) return;
@@ -13589,14 +13848,12 @@ function applyPermissionResolution(sessionService, requestId, approved) {
   sessionService.updateAgentState({
     controlledByUser: false,
     requests: reqs,
-    completedRequests: {
-      ...completedReqs,
-      [requestId]: {
-        ...existingReq || {},
-        completedAt: Date.now(),
-        status: approved ? "approved" : "denied"
-      }
-    }
+    // #1041: bounded + slimmed, same as the Claude permission path in daemon/run.ts.
+    completedRequests: recordCompletedRequest(completedReqs, requestId, {
+      ...existingReq || {},
+      completedAt: Date.now(),
+      status: approved ? "approved" : "denied"
+    })
   });
 }
 function bridgeAcpToSession(backend, sessionService, getMetadata, setMetadata, log, onTurnEnd, getModelLabel) {
@@ -17917,6 +18174,9 @@ function shouldRunZombieProbe(args) {
 function nextFailuresAfterZombieProbeFailure(consecutiveHeartbeatFailures) {
   return consecutiveHeartbeatFailures + 1;
 }
+function shouldRunServiceProbe(args) {
+  return !args.inGrace && !args.zombieProbeRan;
+}
 function shouldForceReconnect(consecutiveHeartbeatFailures) {
   if (consecutiveHeartbeatFailures < 2) return false;
   return consecutiveHeartbeatFailures === 2 || consecutiveHeartbeatFailures % 3 === 0;
@@ -19964,7 +20224,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-BE3bFu8e.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -19986,7 +20246,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-BE3bFu8e.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const incoming = [{
@@ -20007,7 +20267,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { dropServiceLinks } = await import('./agentCommands-BE3bFu8e.mjs');
+      const { dropServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       if (dropServiceLinks(config, "serve", mountName)) {
@@ -20050,7 +20310,7 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-8SZDu7O-.mjs');
+      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-BO0Qs_kE.mjs');
       beginClaudeVersionReconcile((msg) => logger.log(msg));
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
@@ -21270,15 +21530,19 @@ ${parts.join("\n")}`);
                     sessionService.updateAgentState({
                       controlledByUser: false,
                       requests: reqs,
-                      completedRequests: {
-                        ...sessionService._agentState?.completedRequests,
-                        [correlationId]: {
+                      // #1041: bounded + slimmed. `arguments: toolInput` used to
+                      // be stored here — the whole tool input, e.g. a full Write
+                      // body — in a map that grew forever and is re-walked by the
+                      // reducer on every streamed batch.
+                      completedRequests: recordCompletedRequest(
+                        sessionService._agentState?.completedRequests,
+                        correlationId,
+                        {
                           tool: toolName,
-                          arguments: toolInput,
                           completedAt: Date.now(),
                           status: result.behavior === "allow" ? "approved" : "denied"
                         }
-                      }
+                      )
                     });
                   }).catch((err) => {
                     logger.log(`[Session ${sessionId}] Permission handler error (request ${requestId}): ${err}`);
@@ -22314,11 +22578,13 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               } else {
                 logger.log(`[Session ${sessionId}] Queuing inbox message for idle processing`);
                 const existingQueue = sessionMetadata.messageQueue || [];
-                sessionMetadata = {
-                  ...sessionMetadata,
-                  messageQueue: [...existingQueue, { id: message.messageId, text: formatted, displayText: formatted, createdAt: Date.now(), inboxHop: message.hopCount ?? 0, inboxThreadId: message.threadId || message.messageId }]
-                };
+                const { queue: cappedQueue, dropped } = appendToMessageQueue(existingQueue, { id: message.messageId, text: formatted, displayText: formatted, createdAt: Date.now(), inboxHop: message.hopCount ?? 0, inboxThreadId: message.threadId || message.messageId });
+                sessionMetadata = { ...sessionMetadata, messageQueue: cappedQueue };
                 sessionService.updateMetadata(sessionMetadata);
+                if (dropped > 0) {
+                  logger.log(`[Session ${sessionId}] Inbox queue over ${sessionQueueMax()}; dropped ${dropped} oldest queued inbox message(s)`);
+                  sessionService.pushMessage({ type: "message", message: `Inbox queue full (${sessionQueueMax()}) \u2014 dropped ${dropped} older queued message(s).`, level: "warning" }, "event");
+                }
                 if (!sessionWasProcessing) {
                   setTimeout(() => processMessageQueueRef?.(), 200);
                 }
@@ -22377,11 +22643,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-D_pFjWr1.mjs');
+              const { issueRpc } = await import('./rpc-DXY3KqiA.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-D9LFUW93.mjs');
+              const { workflowRpc } = await import('./rpc-hdw0ZlCj.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -22992,11 +23258,13 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               } else {
                 logger.log(`[${agentName} Session ${sessionId}] Queuing inbox message for idle processing`);
                 const existingQueue = sessionMetadata.messageQueue || [];
-                sessionMetadata = {
-                  ...sessionMetadata,
-                  messageQueue: [...existingQueue, { id: message.messageId, text: formatted, displayText: formatted, createdAt: Date.now(), inboxHop: message.hopCount ?? 0, inboxThreadId: message.threadId || message.messageId }]
-                };
+                const { queue: cappedQueue, dropped } = appendToMessageQueue(existingQueue, { id: message.messageId, text: formatted, displayText: formatted, createdAt: Date.now(), inboxHop: message.hopCount ?? 0, inboxThreadId: message.threadId || message.messageId });
+                sessionMetadata = { ...sessionMetadata, messageQueue: cappedQueue };
                 sessionService.updateMetadata(sessionMetadata);
+                if (dropped > 0) {
+                  logger.log(`[${agentName} Session ${sessionId}] Inbox queue over ${sessionQueueMax()}; dropped ${dropped} oldest queued inbox message(s)`);
+                  sessionService.pushMessage({ type: "message", message: `Inbox queue full (${sessionQueueMax()}) \u2014 dropped ${dropped} older queued message(s).`, level: "warning" }, "event");
+                }
                 if (sessionMetadata.lifecycleState === "idle" && acpBackendReady) {
                   const queue = sessionMetadata.messageQueue;
                   if (queue && queue.length > 0) {
@@ -23085,11 +23353,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-D_pFjWr1.mjs');
+              const { issueRpc } = await import('./rpc-DXY3KqiA.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-D9LFUW93.mjs');
+              const { workflowRpc } = await import('./rpc-hdw0ZlCj.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23997,7 +24265,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const channelHttpPort = Number(process.env.SVAMP_CHANNEL_HTTP_PORT) || 0;
     if (channelHttpPort > 0) {
       try {
-        const { createChannelHttpServer } = await import('./httpServer-1XjB2h3K.mjs');
+        const { createChannelHttpServer } = await import('./httpServer-Be1Hcddr.mjs');
         const channelHttpServer = createChannelHttpServer({
           getSessionIds: () => {
             const ids = [];
@@ -24113,11 +24381,27 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       }
       return null;
     });
+    serveManager$1.setCapabilityAuthorizer((sessionId, token) => {
+      if (!token || !token.startsWith("ck_")) return false;
+      let cwd = null;
+      for (const [, session] of pidToTrackedSession) {
+        if (session.svampSessionId === sessionId && !session.stopped && session.directory) {
+          cwd = session.directory;
+          break;
+        }
+      }
+      if (!cwd) return false;
+      try {
+        return channelKeyGrantsFileAccess(new ChannelStore(cwd).list(), token);
+      } catch {
+        return false;
+      }
+    });
     const sessionFilesToken = createHash("sha256").update(`session-files:${machineId}`).digest("hex").slice(0, 20);
     serveManager$1.ensureSessionFilesGateway(sessionFilesToken).then((base) => logger.log(`[serve] session-files gateway: ${base || "(tunnel pending)"}`)).catch((err) => logger.error(`[serve] session-files gateway failed: ${err?.message || err}`));
     const persistedSessions = loadPersistedSessions();
+    const knownIds = new Set(persistedSessions.map((s) => s.sessionId).concat(Object.keys(loadSessionIndex())));
     try {
-      const knownIds = new Set(persistedSessions.map((s) => s.sessionId).concat(Object.keys(loadSessionIndex())));
       const { removed } = await sweepOrphanedStagedHomes(knownIds);
       if (removed.length > 0) {
         logger.log(`Cleaned up ${removed.length} orphaned staged home(s) from prior runs.`);
@@ -24128,7 +24412,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const sessionsToAutoContinue = [];
     const sessionsToLoopResume = [];
     {
-      const knownSessionIds = new Set(persistedSessions.map((p) => p.sessionId));
+      const knownSessionIds = knownIds;
       const sweptDirs = /* @__PURE__ */ new Set();
       for (const p of persistedSessions) {
         if (sweptDirs.has(p.directory)) continue;
@@ -24153,7 +24437,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-8SZDu7O-.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-BO0Qs_kE.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -24410,7 +24694,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-bgEMu7PK.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-3LUL1jFD.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -24489,7 +24773,9 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         const INBOUND_SILENCE_THRESHOLD_MS = 12e4;
         const inboundSilenceMs = Date.now() - machineService.getLastInboundRpcAt();
         const hasActiveSessions = pidToTrackedSession.size > 0;
+        let zombieProbeRan = false;
         if (shouldRunZombieProbe({ hasActiveSessions, inboundSilenceMs, consecutiveHeartbeatFailures, inGrace, thresholdMs: INBOUND_SILENCE_THRESHOLD_MS })) {
+          zombieProbeRan = true;
           logger.log(`No inbound RPC for ${Math.round(inboundSilenceMs / 1e3)}s with ${pidToTrackedSession.size} active session(s) \u2014 zombie probe`);
           try {
             const machineServiceId = `${server.config.client_id}:default`;
@@ -24502,7 +24788,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
             consecutiveHeartbeatFailures = nextFailuresAfterZombieProbeFailure(consecutiveHeartbeatFailures);
           }
         }
-        if (!inGrace) {
+        if (shouldRunServiceProbe({ inGrace, zombieProbeRan })) {
           try {
             const pingStart = Date.now();
             const machineServiceId = `${server.config.client_id}:default`;