svamp-cli 0.2.328 → 0.2.329

package/README.md

@@ -92,7 +92,7 @@ svamp session deny <id>                        # Deny pending permission
 
 ```bash
 svamp session share <id> --list
-svamp session share <id> --add <email>[:<role>]    # Roles: view, interact, admin
+svamp session share <id> --add <email>             # Added users get FULL (owner-equivalent) access
 svamp session share <id> --remove <email>
 ```
 
@@ -100,24 +100,45 @@ svamp session share <id> --remove <email>
 
 ```bash
 svamp session spawn claude -d <path> --isolate
-svamp session spawn claude -d <path> --share alice@example.com:admin
+svamp session spawn claude -d <path> --share alice@example.com
 svamp session spawn claude -d <path> --security-context ./context.json
 svamp session spawn claude -d <path> --deny-network
 svamp session spawn claude -d <path> --deny-read /etc --allow-write /tmp/work
 svamp session spawn claude -d <path> --allow-domain api.anthropic.com
 ```
 
+> **⚠ Not all of these are enforced (#0878).** `--deny-read` is accepted but enforced by **no** sandbox
+> backend; `--allow-write` and `--allow-domain` are **not enforced** under the docker/podman isolation
+> backends. Do not rely on them as containment. To actually restrict what a session can read, narrow
+> `allowedDirectories` in a `--security-context` file. See
+> [`docs/sharing-and-security.md`](../../docs/sharing-and-security.md) for the full
+> enforced-vs-advisory table (kept there, not duplicated here, so the two cannot drift).
+
 #### Loop (Self-Verifying Iterative Automation)
 
 ```bash
-svamp session loop-start <id> "<task>" [--criteria "..."] [--oracle "cmd"] [--max 20] [--evaluator on|off]
+svamp session loop <id> "<task>" --until "<completion criteria>" [--max N]
 svamp session loop-cancel <id>
 svamp session loop-status <id>
+svamp session loop-extend <id> --reason "<why>"    # raise the soft iteration cap
 ```
 
-The loop iterates a task until it's *objectively* done: a Claude Code `Stop`-hook gate keeps the agent
-working until an **oracle** (a real pass/fail command) passes AND an **independent evaluator** subagent
-confirms completion. Task/plan/progress live in a git-visible `LOOP.md`. Powered by the `loop` skill.
+The loop iterates a task until it's *objectively* done. The engine is Claude Code's **native `/goal`**
+command: svamp composes a completion condition (your task + `--until` + an optional oracle command +
+a turn cap) and arms `/goal` on the session; Claude's own session-scoped `Stop` hook then keeps the
+agent working until a fresh, independent evaluator confirms the condition holds. Loop status is
+mirrored to `.svamp/<session-id>/loop/loop-state.json` (`engine: 'goal'`) for the UI and the CLI.
+
+An issue-backlog loop (oracle = `svamp issue pending`) is **durable**: when the backlog empties it goes
+`dormant` — armed and watching, driving zero turns — and re-arms when an issue is added or reopened.
+
+> Historical: an earlier custom engine used a `stop-gate.mjs` hook, an evaluator subagent and a
+> git-visible `LOOP.md`, shipped as a `loop` skill. That engine was **retired** — `/goal` is the sole
+> engine, `skills/loop/` was deleted, and the daemon now strips those leftover hooks on spawn. The
+> `loop-start` / `--criteria` / `--evaluator` spellings survive only as aliases.
+
+**Claude only** — `/goal` is a Claude Code feature, so ACP agents (Gemini, Kimi) kick a loop off but
+do not self-verify.
 
 ### Machine Management
 

package/dist/{adminCommands-DotiO7jx.mjs → adminCommands-C-p7ayqB.mjs}

@@ -1,4 +1,4 @@
-import { c as connectToHypha, K as computeCollectionConfigUpdate, L as SYSTEM_COLLECTION_CONFIG } from './run-CSV6OgQ8.mjs';
+import { c as connectToHypha, L as computeCollectionConfigUpdate, M as SYSTEM_COLLECTION_CONFIG } from './run-1CHjd0_g.mjs';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import os from 'node:os';

package/dist/{agentCommands-DefL1pIo.mjs → agentCommands-B4sCl_5R.mjs}

@@ -2,7 +2,7 @@ import { existsSync, readFileSync, mkdirSync, writeFileSync, renameSync } from '
 import { join, dirname } from 'node:path';
 import os from 'node:os';
 import { requireNotSandboxed } from './sandboxDetect-DNTcbgWD.mjs';
-import { e as shortId } from './run-CSV6OgQ8.mjs';
+import { e as shortId } from './run-1CHjd0_g.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -96,7 +96,7 @@ async function sessionSetTitle(title) {
 }
 async function sessionSetProjectDescription(description) {
   const dir = process.cwd();
-  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-CSV6OgQ8.mjs').then(function (n) { return n.as; });
+  const { projectName, writeProjectInfo, sanitizeDescription, projectInfoPath } = await import('./run-1CHjd0_g.mjs').then(function (n) { return n.at; });
   const desc = sanitizeDescription(description, 240);
   if (!desc) {
     console.error("Project description is empty.");
@@ -369,7 +369,7 @@ async function sessionBroadcast(action, args) {
   console.log(`Broadcast sent: ${action}`);
 }
 async function connectToMachineService() {
-  const { connectAndGetMachine } = await import('./commands-DEZLlXJ3.mjs');
+  const { connectAndGetMachine } = await import('./commands-rKfH5E8g.mjs');
   return connectAndGetMachine();
 }
 function buildInboxMessage(args) {
@@ -452,7 +452,7 @@ async function inboxSend(targetSessionId, opts) {
     console.error("Message body is required.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-DEZLlXJ3.mjs');
+  const { connectAndResolveSession } = await import('./commands-rKfH5E8g.mjs');
   let server;
   try {
     const { targetId, messageId } = await inboxSendCore(
@@ -507,7 +507,7 @@ async function inboxReply(messageId, body, opts) {
     console.error("SVAMP_SESSION_ID not set. This command must be run inside a Svamp session.");
     process.exit(1);
   }
-  const { connectAndResolveSession } = await import('./commands-DEZLlXJ3.mjs');
+  const { connectAndResolveSession } = await import('./commands-rKfH5E8g.mjs');
   const { server: localServer, machine: localMachine } = await connectToMachineService();
   let localDisconnected = false;
   const disconnectLocal = async () => {

package/dist/{auth-DLK3tc_f.mjs → auth-X_CjxN_J.mjs}

@@ -1,4 +1,4 @@
-import { a0 as resolveModel } from './run-CSV6OgQ8.mjs';
+import { a1 as resolveModel } from './run-1CHjd0_g.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';