svamp-cli 0.2.326 → 0.2.327

package/dist/{run-BBBr4jkI.mjs → run-DdTcDN3e.mjs}

@@ -3001,6 +3001,13 @@ function assertNonAdminMountDirSafe(directory, homeDir, resolveReal = defaultRes
     }
   }
 }
+function hiddenSegmentOf(relPath) {
+  for (const seg of relPath.split(/[\\/]+/)) {
+    if (!seg || seg === ".") continue;
+    if (seg.startsWith(".")) return seg;
+  }
+  return null;
+}
 function defaultResolveReal(p) {
   try {
     return fs.realpathSync(p);
@@ -3203,8 +3210,19 @@ class ServeManager {
    * Extract a channel capability token from the request, if one is present. A channel caller
    * key is `ck_`-prefixed; we ONLY return a token that carries that prefix so a Hypha JWT
    * bearer (used by the email-identity path) never collides with the capability authorizer.
-   * Accepted carriers: `Authorization: Bearer ck_…` header, or `?key=ck_…` query param.
-   * Returns null when no capability token is presented. NEVER log the returned value.
+   * Accepted carriers: `Authorization: Bearer ck_…` header (any verb), or `?key=ck_…` query
+   * param (READ verbs only). Returns null when no capability token is presented.
+   * NEVER log the returned value.
+   *
+   * #1047: the query carrier is restricted to GET/HEAD. A query string is a poor place for a
+   * credential — it lands in browser history, in the `Referer` of any HTML the gateway serves,
+   * and in every tunnel/intermediary access log on the path (and the gateway is reached over an
+   * frps tunnel whose logs the user does not control). This is the same exposure class #1006
+   * closed for the Hypha JWT in download URLs. It is kept for reads because a browser-embeddable
+   * URL genuinely needs it (an `<img src>` or a download link cannot set a header), but a leaked
+   * URL must not also confer PUT/DELETE over the whole project. The generated skill already
+   * documents only the Authorization form (see `fileSection` in channel/store.ts), so this
+   * narrows an unused carrier rather than breaking the documented path.
    */
   extractCapabilityToken(req, url) {
     const auth = req.headers["authorization"];
@@ -3212,6 +3230,8 @@ class ServeManager {
       const m = /^Bearer\s+(\S+)$/i.exec(auth.trim());
       if (m && m[1].startsWith("ck_")) return m[1];
     }
+    const method = (req.method || "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD") return null;
     const q = url.searchParams.get("key");
     if (q && q.startsWith("ck_")) return q;
     return null;
@@ -3857,6 +3877,14 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
     }
     const rootDir = target.cwd;
     const normRel = this.toSessionRelative(rootDir, m[2] || "");
+    if (capabilityGranted) {
+      const badSeg = hiddenSegmentOf(normRel);
+      if (badSeg) {
+        this.log(`Files-gateway DENY '${sessionId}': channel capability may not reach a hidden path (${badSeg})`);
+        deny(403, `Forbidden: channel file access may not reach hidden paths (${badSeg})`);
+        return;
+      }
+    }
     if (method === "GET" || method === "HEAD") {
       if (url.searchParams.get("list") === "1") {
         const lex = this.resolveContainedPath(rootDir, normRel);
@@ -3878,6 +3906,7 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             }
             return { name: d.name, isDir, size, mtime };
           });
+          if (capabilityGranted) entries = entries.filter((e) => !e.name.startsWith("."));
         } catch (err) {
           deny(err?.code === "ENOENT" ? 404 : 500, `Listing failed: ${err?.message || err}`);
           return;
@@ -4458,6 +4487,7 @@ var serveManager = /*#__PURE__*/Object.freeze({
     ServeManager: ServeManager,
     assertNonAdminMountDirSafe: assertNonAdminMountDirSafe,
     buildLinkSubdomain: buildLinkSubdomain,
+    hiddenSegmentOf: hiddenSegmentOf,
     resolveMountOwnerEmail: resolveMountOwnerEmail,
     sanitizeMountForRole: sanitizeMountForRole
 });
@@ -4636,8 +4666,13 @@ function applyPromptCacheTtl(spawnEnv) {
   const cacheOverride = spawnEnv.ENABLE_PROMPT_CACHING_1H ?? process.env.ENABLE_PROMPT_CACHING_1H ?? spawnEnv.FORCE_PROMPT_CACHING_5M ?? process.env.FORCE_PROMPT_CACHING_5M;
   if (cacheOverride === void 0) spawnEnv.ENABLE_PROMPT_CACHING_1H = "1";
 }
+function applyTodoTools(spawnEnv) {
+  const override = spawnEnv.CLAUDE_CODE_ENABLE_TODO_TOOLS ?? process.env.CLAUDE_CODE_ENABLE_TODO_TOOLS;
+  if (override === void 0) spawnEnv.CLAUDE_CODE_ENABLE_TODO_TOOLS = "1";
+}
 function applyClaudeProxyEnv(spawnEnv) {
   const mode = currentMode();
+  applyTodoTools(spawnEnv);
   if (mode === "hypha") {
     const proxyUrl = resolveHyphaProxyUrl();
     if (!proxyUrl) {
@@ -5692,20 +5727,22 @@ function channelKeyGrantsFileAccess(channels, token) {
     }
   };
   for (const ch of channels) {
+    if (ch.enabled === false) continue;
     if (!ch.fileAccess?.enabled) continue;
     if (eq(ch.identity?.shared_key)) return true;
     for (const caller of ch.identity?.callers || []) if (eq(caller.key)) return true;
   }
   return false;
 }
+const _channelListCache = /* @__PURE__ */ new Map();
+const _CHANNEL_CACHE_TTL_MS = 1e3;
+function invalidateChannelCache(dir) {
+  _channelListCache.delete(dir);
+}
 class ChannelStore {
   dir;
   constructor(projectDir) {
     this.dir = join$1(projectDir, ".svamp", "channels");
-    try {
-      mkdirSync$1(this.dir, { recursive: true });
-    } catch {
-    }
   }
   // #0982: reject a traversing/oversized id at the path boundary itself, so no
   // caller (RPC, HTTP, CLI) can reach outside this.dir regardless of its own checks.
@@ -5728,17 +5765,41 @@ class ChannelStore {
     const tmp = `${this._path(c.id)}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
     writeFileSync$1(tmp, JSON.stringify(c, null, 2), { mode: 384 });
     renameSync(tmp, this._path(c.id));
+    invalidateChannelCache(this.dir);
     return c;
   }
+  /**
+   * All channels in this project, parsed. Cached per directory and revalidated with ONE statSync
+   * — see the #1049/#1068 note above for why the uncached version was a daemon-wide stall.
+   */
   list() {
-    if (!existsSync(this.dir)) return [];
-    return readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
-      try {
-        return normalizeBind(JSON.parse(readFileSync(join$1(this.dir, f), "utf8")));
-      } catch {
-        return null;
-      }
-    }).filter((c) => !!c);
+    let st;
+    try {
+      const s = statSync(this.dir);
+      st = { mtimeMs: s.mtimeMs, size: s.size };
+    } catch {
+      _channelListCache.delete(this.dir);
+      return [];
+    }
+    const hit = _channelListCache.get(this.dir);
+    if (hit && hit.mtimeMs === st.mtimeMs && hit.size === st.size && Date.now() - hit.at < _CHANNEL_CACHE_TTL_MS) {
+      return hit.channels;
+    }
+    let channels;
+    try {
+      channels = readdirSync(this.dir).filter((f) => f.endsWith(".json")).map((f) => {
+        try {
+          return normalizeBind(JSON.parse(readFileSync(join$1(this.dir, f), "utf8")));
+        } catch {
+          return null;
+        }
+      }).filter((c) => !!c);
+    } catch {
+      _channelListCache.delete(this.dir);
+      return [];
+    }
+    _channelListCache.set(this.dir, { mtimeMs: st.mtimeMs, size: st.size, at: Date.now(), channels });
+    return channels;
   }
   get(id) {
     try {
@@ -5756,6 +5817,7 @@ class ChannelStore {
       const p = this._path(id);
       if (existsSync(p)) {
         rmSync$1(p);
+        invalidateChannelCache(this.dir);
         return true;
       }
       return false;
@@ -5796,6 +5858,28 @@ class ChannelStore {
       return caller;
     });
   }
+  /**
+   * #1036: revoke ONE caller's key without destroying the channel.
+   *
+   * Before this, the only removal primitive was remove(id) — so withdrawing a single leaked key
+   * meant deleting the whole channel and every other caller with it. That is a bad enough trade
+   * that in practice a leaked key just stayed live, which matters much more now that a caller key
+   * can carry whole-project file access (see channelKeyGrantsFileAccess).
+   *
+   * Same per-channel lock as the sibling mutators (#0679), so a concurrent addCaller cannot
+   * resurrect the revoked entry by writing a stale base. Returns true when a caller was removed.
+   */
+  removeCaller(id, name) {
+    return withFileLock(this._lock(id), () => {
+      const c = this.get(id);
+      if (!c?.identity?.callers) return false;
+      const before = c.identity.callers.length;
+      c.identity.callers = c.identity.callers.filter((x) => x.name !== name);
+      if (c.identity.callers.length === before) return false;
+      this._writeChannel(c);
+      return true;
+    });
+  }
 }
 function routingSession(channel, ctx) {
   const mode = bindMode(channel);
@@ -6435,6 +6519,9 @@ function getParamNames(fn) {
 const terminalSessions = /* @__PURE__ */ new Map();
 let ptyModule = null;
 const TERMINAL_IDLE_MS = 30 * 60 * 1e3;
+const TERMINAL_CLIENT_ABSENT_MS = 4 * 60 * 60 * 1e3;
+const TERMINAL_BUFFER_MAX_BYTES = 1024 * 1024;
+const TERMINAL_MAX_SESSIONS = 64;
 let terminalReaper = null;
 function ensureTerminalReaper() {
   if (terminalReaper) return;
@@ -6442,7 +6529,8 @@ function ensureTerminalReaper() {
     const now = Date.now();
     for (const [id, s] of terminalSessions) {
       if (s.exited) continue;
-      if (now - s.lastActivity > TERMINAL_IDLE_MS) {
+      const abandoned = now - (s.lastClientActivity ?? s.lastActivity) > TERMINAL_CLIENT_ABSENT_MS;
+      if (now - s.lastActivity > TERMINAL_IDLE_MS || abandoned) {
         try {
           s.pty.kill();
         } catch {
@@ -7296,8 +7384,29 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           rows,
           createdAt: Date.now(),
           lastActivity: Date.now(),
+          lastClientActivity: Date.now(),
+          outputBytes: 0,
           cwd
         };
+        if (terminalSessions.size >= TERMINAL_MAX_SESSIONS) {
+          let victim = null, oldest = Infinity;
+          for (const [id, s] of terminalSessions) {
+            const seen = s.lastClientActivity ?? s.lastActivity;
+            if (seen < oldest) {
+              oldest = seen;
+              victim = id;
+            }
+          }
+          if (victim) {
+            const v = terminalSessions.get(victim);
+            try {
+              v?.pty.kill();
+            } catch {
+            }
+            terminalSessions.delete(victim);
+            console.log(`[terminal] evicted idlest session ${victim} \u2014 at the ${TERMINAL_MAX_SESSIONS}-PTY ceiling`);
+          }
+        }
         terminalSessions.set(sessionId, session);
         ensureTerminalReaper();
         let outputBatch = "";
@@ -7308,8 +7417,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           const batch = outputBatch;
           outputBatch = "";
           session.outputBuffer.push(batch);
-          if (session.outputBuffer.length > 1e3) {
-            session.outputBuffer.splice(0, session.outputBuffer.length - 500);
+          session.outputBytes += batch.length;
+          while (session.outputBytes > TERMINAL_BUFFER_MAX_BYTES && session.outputBuffer.length > 1) {
+            session.outputBytes -= (session.outputBuffer.shift() || "").length;
           }
           if (terminalClient) {
             try {
@@ -7358,6 +7468,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const filtered = filterTerminalResponses(params.data);
         if (filtered) session.pty.write(filtered);
         session.lastActivity = Date.now();
+        session.lastClientActivity = Date.now();
         return { success: true };
       },
       /** Resize a terminal session. */
@@ -7379,7 +7490,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const session = terminalSessions.get(params.sessionId);
         if (!session) throw new Error(`Terminal session ${params.sessionId} not found`);
         const output = session.outputBuffer.splice(0).join("");
+        session.outputBytes = 0;
         session.lastActivity = Date.now();
+        session.lastClientActivity = Date.now();
         const result = {
           output,
           exited: session.exited
@@ -8189,7 +8302,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-5ck3CDWM.mjs');
+          const { toolsForRole } = await import('./sideband-BRHu4M46.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -8294,7 +8407,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CxfUr2Qr.mjs');
+    const { queryCore } = await import('./commands-DexO3t-N.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     try {
@@ -9442,6 +9555,7 @@ function loadMessagesFromDiskReverse(messagesDir, beforeSeq, limit) {
   }
 }
 const messageCountCache = /* @__PURE__ */ new Map();
+const MESSAGE_COUNT_CACHE_MAX = 2e3;
 function countMessagesOnDisk(messagesDir, fallbackInMemory) {
   const filePath = join$1(messagesDir, "messages.jsonl");
   if (!existsSync(filePath)) return fallbackInMemory;
@@ -9469,7 +9583,13 @@ function countMessagesOnDisk(messagesDir, fallbackInMemory) {
       for (let i = 0; i < data.length; i++) if (data.charCodeAt(i) === 10) count++;
       if (data.length > 0 && data[data.length - 1] !== "\n") count++;
     }
+    messageCountCache.delete(filePath);
     messageCountCache.set(filePath, { size: st.size, mtimeMs: st.mtimeMs, count });
+    while (messageCountCache.size > MESSAGE_COUNT_CACHE_MAX) {
+      const oldest = messageCountCache.keys().next();
+      if (oldest.done) break;
+      messageCountCache.delete(oldest.value);
+    }
     return count;
   } catch {
     return fallbackInMemory;
@@ -10820,7 +10940,9 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // ── Listener Registration ──
     registerListener: async (callback, context) => {
       authorizeRequest(context, metadata.sharing, "view");
+      const MAX_LISTENERS = 64;
       listeners.push(callback);
+      while (listeners.length > MAX_LISTENERS) listeners.shift();
       const replayMessages = messages.slice(-50);
       const REPLAY_MESSAGE_TIMEOUT_MS = 1e4;
       for (const msg of replayMessages) {
@@ -13698,6 +13820,25 @@ var acpAgentConfig = /*#__PURE__*/Object.freeze({
     resolveAcpAgentConfig: resolveAcpAgentConfig
 });
 
+const COMPLETED_REQUESTS_MAX = 500;
+function recordCompletedRequest(existing, id, entry, max = COMPLETED_REQUESTS_MAX) {
+  const out = { ...existing || {} };
+  delete out[id];
+  const slim = {
+    completedAt: typeof entry.completedAt === "number" ? entry.completedAt : Date.now(),
+    status: String(entry.status ?? "")
+  };
+  if (typeof entry.tool === "string") slim.tool = entry.tool;
+  if (entry.reason !== void 0) slim.reason = entry.reason;
+  if (entry.mode !== void 0) slim.mode = entry.mode;
+  if (entry.decision !== void 0) slim.decision = entry.decision;
+  if (Array.isArray(entry.allowedTools)) slim.allowedTools = entry.allowedTools;
+  out[id] = slim;
+  const keys = Object.keys(out);
+  for (let i = 0; i < keys.length - max; i++) delete out[keys[i]];
+  return out;
+}
+
 function applyPermissionResolution(sessionService, requestId, approved) {
   const reqs = { ...sessionService._agentState?.requests };
   if (!(requestId in reqs)) return;
@@ -13707,14 +13848,12 @@ function applyPermissionResolution(sessionService, requestId, approved) {
   sessionService.updateAgentState({
     controlledByUser: false,
     requests: reqs,
-    completedRequests: {
-      ...completedReqs,
-      [requestId]: {
-        ...existingReq || {},
-        completedAt: Date.now(),
-        status: approved ? "approved" : "denied"
-      }
-    }
+    // #1041: bounded + slimmed, same as the Claude permission path in daemon/run.ts.
+    completedRequests: recordCompletedRequest(completedReqs, requestId, {
+      ...existingReq || {},
+      completedAt: Date.now(),
+      status: approved ? "approved" : "denied"
+    })
   });
 }
 function bridgeAcpToSession(backend, sessionService, getMetadata, setMetadata, log, onTurnEnd, getModelLabel) {
@@ -18035,6 +18174,9 @@ function shouldRunZombieProbe(args) {
 function nextFailuresAfterZombieProbeFailure(consecutiveHeartbeatFailures) {
   return consecutiveHeartbeatFailures + 1;
 }
+function shouldRunServiceProbe(args) {
+  return !args.inGrace && !args.zombieProbeRan;
+}
 function shouldForceReconnect(consecutiveHeartbeatFailures) {
   if (consecutiveHeartbeatFailures < 2) return false;
   return consecutiveHeartbeatFailures === 2 || consecutiveHeartbeatFailures % 3 === 0;
@@ -20082,7 +20224,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-DUHUBzrj.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -20104,7 +20246,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-DUHUBzrj.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const incoming = [{
@@ -20125,7 +20267,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { dropServiceLinks } = await import('./agentCommands-DUHUBzrj.mjs');
+      const { dropServiceLinks } = await import('./agentCommands-BiSVzb5D.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       if (dropServiceLinks(config, "serve", mountName)) {
@@ -21388,15 +21530,19 @@ ${parts.join("\n")}`);
                     sessionService.updateAgentState({
                       controlledByUser: false,
                       requests: reqs,
-                      completedRequests: {
-                        ...sessionService._agentState?.completedRequests,
-                        [correlationId]: {
+                      // #1041: bounded + slimmed. `arguments: toolInput` used to
+                      // be stored here — the whole tool input, e.g. a full Write
+                      // body — in a map that grew forever and is re-walked by the
+                      // reducer on every streamed batch.
+                      completedRequests: recordCompletedRequest(
+                        sessionService._agentState?.completedRequests,
+                        correlationId,
+                        {
                           tool: toolName,
-                          arguments: toolInput,
                           completedAt: Date.now(),
                           status: result.behavior === "allow" ? "approved" : "denied"
                         }
-                      }
+                      )
                     });
                   }).catch((err) => {
                     logger.log(`[Session ${sessionId}] Permission handler error (request ${requestId}): ${err}`);
@@ -22497,11 +22643,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-Qcj4M_LQ.mjs');
+              const { issueRpc } = await import('./rpc-DXY3KqiA.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-27xBajCe.mjs');
+              const { workflowRpc } = await import('./rpc-hdw0ZlCj.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23207,11 +23353,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-Qcj4M_LQ.mjs');
+              const { issueRpc } = await import('./rpc-DXY3KqiA.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-27xBajCe.mjs');
+              const { workflowRpc } = await import('./rpc-hdw0ZlCj.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -24119,7 +24265,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const channelHttpPort = Number(process.env.SVAMP_CHANNEL_HTTP_PORT) || 0;
     if (channelHttpPort > 0) {
       try {
-        const { createChannelHttpServer } = await import('./httpServer-1XjB2h3K.mjs');
+        const { createChannelHttpServer } = await import('./httpServer-Be1Hcddr.mjs');
         const channelHttpServer = createChannelHttpServer({
           getSessionIds: () => {
             const ids = [];
@@ -24548,7 +24694,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DjAVEyn3.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-3LUL1jFD.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -24627,7 +24773,9 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         const INBOUND_SILENCE_THRESHOLD_MS = 12e4;
         const inboundSilenceMs = Date.now() - machineService.getLastInboundRpcAt();
         const hasActiveSessions = pidToTrackedSession.size > 0;
+        let zombieProbeRan = false;
         if (shouldRunZombieProbe({ hasActiveSessions, inboundSilenceMs, consecutiveHeartbeatFailures, inGrace, thresholdMs: INBOUND_SILENCE_THRESHOLD_MS })) {
+          zombieProbeRan = true;
           logger.log(`No inbound RPC for ${Math.round(inboundSilenceMs / 1e3)}s with ${pidToTrackedSession.size} active session(s) \u2014 zombie probe`);
           try {
             const machineServiceId = `${server.config.client_id}:default`;
@@ -24640,7 +24788,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
             consecutiveHeartbeatFailures = nextFailuresAfterZombieProbeFailure(consecutiveHeartbeatFailures);
           }
         }
-        if (!inGrace) {
+        if (shouldRunServiceProbe({ inGrace, zombieProbeRan })) {
           try {
             const pingStart = Date.now();
             const machineServiceId = `${server.config.client_id}:default`;

package/dist/{scheduler-DjAVEyn3.mjs → scheduler-3LUL1jFD.mjs}

@@ -1,4 +1,4 @@
-import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-BBBr4jkI.mjs';
+import { f as resolveProjectRoot, C as listWorkflows, D as isWorkflowEnabled, E as workflowSchedules, F as inZone, w as runWorkflow, G as cronMatches } from './run-DdTcDN3e.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';

package/dist/{serveCommands-BK-wWc_i.mjs → serveCommands-DUJ4eojk.mjs}

@@ -1,6 +1,6 @@
 import * as path from 'path';
-import { w as wantsHelp } from './cli-PWoHWBkF.mjs';
-import './run-BBBr4jkI.mjs';
+import { w as wantsHelp } from './cli-CQlIsRxF.mjs';
+import './run-DdTcDN3e.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -77,7 +77,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CxfUr2Qr.mjs');
+  const { connectAndGetMachine } = await import('./commands-DexO3t-N.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -110,7 +110,7 @@ async function serveAdd(args, machineId) {
     }
     if (sessionId && result?.url) {
       try {
-        const { autoAddSessionLink } = await import('./agentCommands-DUHUBzrj.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-BiSVzb5D.mjs');
         autoAddSessionLink(String(result.url), name, void 0, { kind: "serve", name });
       } catch {
       }
@@ -124,7 +124,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CxfUr2Qr.mjs');
+  const { connectAndGetMachine } = await import('./commands-DexO3t-N.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -206,7 +206,7 @@ async function serveApply(args, machineId) {
     console.log(`URL: ${result.url}`);
     if (params.sessionId && result?.url) {
       try {
-        const { autoAddSessionLink } = await import('./agentCommands-DUHUBzrj.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-BiSVzb5D.mjs');
         const prevSession = process.env.SVAMP_SESSION_ID;
         process.env.SVAMP_SESSION_ID = String(params.sessionId);
         try {
@@ -227,7 +227,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CxfUr2Qr.mjs');
+  const { connectAndGetMachine } = await import('./commands-DexO3t-N.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -237,7 +237,7 @@ async function serveRemove(args, machineId) {
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     await machine.serveRemove({ name });
-    const { removeSessionLinkByService } = await import('./agentCommands-DUHUBzrj.mjs');
+    const { removeSessionLinkByService } = await import('./agentCommands-BiSVzb5D.mjs');
     removeSessionLinkByService("serve", name);
     console.log(`Mount '${name}' removed.`);
   } catch (err) {
@@ -249,7 +249,7 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-CxfUr2Qr.mjs');
+  const { connectAndGetMachine } = await import('./commands-DexO3t-N.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
   const sessionId = getFlag(args, "--session");
@@ -283,7 +283,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-CxfUr2Qr.mjs');
+  const { connectAndGetMachine } = await import('./commands-DexO3t-N.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();

package/dist/{sideband-5ck3CDWM.mjs → sideband-BRHu4M46.mjs}

@@ -1,4 +1,4 @@
-import { R as READ_ONLY_TOOLS, M as loadMachineContext, N as buildMachineInstructions, O as machineToolsForRole, P as buildMachineTools } from './run-BBBr4jkI.mjs';
+import { R as READ_ONLY_TOOLS, M as loadMachineContext, N as buildMachineInstructions, O as machineToolsForRole, P as buildMachineTools } from './run-DdTcDN3e.mjs';
 import 'node:child_process';
 import 'os';
 import 'fs/promises';