svamp-cli 0.2.331 → 0.2.333

package/dist/{run-CSNL62FQ.mjs → run-PXdghhjy.mjs}

@@ -7,8 +7,8 @@ import path__default, { join, delimiter, resolve as resolve$1, dirname as dirnam
 import { fileURLToPath } from 'url';
 import { execFile, execSync, spawn, exec as exec$1 } from 'child_process';
 import * as crypto from 'crypto';
-import { randomUUID, createHash } from 'crypto';
-import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync as unlinkSync$1, writeSync } from 'node:fs';
+import { randomUUID, createHash, randomBytes as randomBytes$1 } from 'crypto';
+import { existsSync, readFileSync, mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, rmSync as rmSync$1, cpSync, statSync, realpathSync, readdirSync, renameSync, appendFileSync, openSync, readSync, closeSync, unlinkSync as unlinkSync$1, fstatSync, writeSync } from 'node:fs';
 import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:path';
 import { randomUUID as randomUUID$1, randomBytes, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
 import { exec, spawn as spawn$1, execSync as execSync$1, execFile as execFile$1, execFileSync } from 'node:child_process';
@@ -3738,7 +3738,7 @@ class ServeManager {
   /**
    * Get the public URL for a mount (mount-specific subdomain).
    * For `access: 'link'` mounts, the subdomain itself carries the capability —
-   * the tunnel registers a long random suffix (~128 bits of entropy), so the
+   * the tunnel registers a long random suffix (~88 bits of entropy (randomBytes(11), 22 hex chars)), so the
    * URL is identical in shape to other tiers, just longer. Content serves
    * from the root, so HTML with absolute paths (`/style.css`, `/app.js`)
    * works unchanged.
@@ -5446,10 +5446,11 @@ function cronMatches(expr, date) {
   if (c.domRestricted && c.dowRestricted) return domOk || dowOk;
   return domOk && dowOk;
 }
-function inZone(date, tz) {
-  if (!tz) return date;
-  try {
-    const p = new Intl.DateTimeFormat("en-US", {
+const _zoneFormatters = /* @__PURE__ */ new Map();
+function zoneFormatter(tz) {
+  let f = _zoneFormatters.get(tz);
+  if (!f) {
+    f = new Intl.DateTimeFormat("en-US", {
       timeZone: tz,
       hour12: false,
       year: "numeric",
@@ -5457,7 +5458,15 @@ function inZone(date, tz) {
       day: "2-digit",
       hour: "2-digit",
       minute: "2-digit"
-    }).formatToParts(date).reduce((o, x) => {
+    });
+    _zoneFormatters.set(tz, f);
+  }
+  return f;
+}
+function inZone(date, tz) {
+  if (!tz) return date;
+  try {
+    const p = zoneFormatter(tz).formatToParts(date).reduce((o, x) => {
       o[x.type] = x.value;
       return o;
     }, {});
@@ -5467,6 +5476,34 @@ function inZone(date, tz) {
     return date;
   }
 }
+function nextFire(expr, from, tz) {
+  const c = parseCron(expr);
+  if (tz && scanForMatch(c, from, void 0) === null) return null;
+  return scanForMatch(c, from, tz);
+}
+function scanForMatch(c, from, tz) {
+  const d = new Date(from.getTime());
+  d.setSeconds(0, 0);
+  d.setMinutes(d.getMinutes() + 1);
+  for (let i = 0; i < 366 * 24 * 60; i++) {
+    if (cronMatches(c, tz ? inZone(d, tz) : d)) return new Date(d.getTime());
+    d.setMinutes(d.getMinutes() + 1);
+  }
+  return null;
+}
+function describeNextFire(expr, tz, from = /* @__PURE__ */ new Date()) {
+  let next;
+  try {
+    next = nextFire(expr, from, tz);
+  } catch {
+    return null;
+  }
+  if (!next) return "never fires";
+  const shown = tz ? inZone(next, tz) : next;
+  const pad = (n) => String(n).padStart(2, "0");
+  const stamp = `${shown.getFullYear()}-${pad(shown.getMonth() + 1)}-${pad(shown.getDate())} ${pad(shown.getHours())}:${pad(shown.getMinutes())}`;
+  return `next ${stamp} ${tz || "local"}`;
+}
 function resolvePath(ctx, path) {
   return path.split(".").reduce((o, k) => o == null ? void 0 : o[k], ctx);
 }
@@ -7823,9 +7860,12 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!tunnels) throw new Error("Tunnel management not available");
         const client = tunnels.get(params.name);
         if (!client) throw new Error(`Tunnel '${params.name}' not found`);
+        const owner = handlers.listExposedTunnels?.().find((t) => t.name === params.name)?.sessionId;
         client.destroy();
         tunnels.delete(params.name);
         handlers.forgetExposedTunnel?.(params.name);
+        if (owner) handlers.dropTunnelSessionLink?.(owner, params.name);
+        handlers.scheduleServiceLinkReconcile?.();
         return { name: params.name, stopped: true };
       },
       /**
@@ -7868,6 +7908,7 @@ async function registerMachineService(server, machineId, metadata, daemonState,
           sessionId: params.sessionId,
           addedAt: Date.now()
         });
+        if (params.sessionId) handlers.scheduleServiceLinkReconcile?.();
         const urls = {};
         for (const [port, url] of tunnel.getUrls()) urls[port] = url;
         return { ...tunnel.status, urls };
@@ -7879,9 +7920,12 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         if (!tunnels) throw new Error("Tunnel management not available");
         const client = tunnels.get(params.name);
         if (!client) throw new Error(`Tunnel '${params.name}' not found`);
+        const owner = handlers.listExposedTunnels?.().find((t) => t.name === params.name)?.sessionId;
         client.destroy();
         tunnels.delete(params.name);
         handlers.forgetExposedTunnel?.(params.name);
+        if (owner) handlers.dropTunnelSessionLink?.(owner, params.name);
+        handlers.scheduleServiceLinkReconcile?.();
         return { name: params.name, stopped: true };
       },
       /**
@@ -7942,7 +7986,9 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         assertMayReplaceMount(sm, params.name, context);
         const ownerEmail2 = resolveMountOwnerEmailFor(params.ownerEmail, context);
         const access = params.access || "owner";
-        return sm.addMount(params.name, params.directory, params.sessionId, access, ownerEmail2);
+        const result = sm.addMount(params.name, params.directory, params.sessionId, access, ownerEmail2);
+        if (params.sessionId) handlers.scheduleServiceLinkReconcile?.();
+        return result;
       },
       /**
        * Apply a mount declaratively. Replaces existing mount with same name.
@@ -8332,7 +8378,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
           }
           const deps = buildSessionDeps(rpc, { cwd, ownerEmail: owner });
           const sender = { name: context?.user?.email || context?.user?.id || "user", kind: "user", verified: true };
-          const { toolsForRole } = await import('./sideband-S3ycJa01.mjs');
+          const { toolsForRole } = await import('./sideband-DXyAkIaB.mjs');
           const r2 = await runWiseAgent({ message: params.message, sender, config: { tools: toolsForRole(role2) }, deps, transport, model: resolved.model });
           return fmt(r2);
         }
@@ -8421,6 +8467,33 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
   };
   const _caps = statelessDispatchCaps();
   const statelessLimiter = new StatelessDispatchLimiter(_caps.concurrent, _caps.perSender);
+  const MAX_RECEIVE_POLLS_PER_CHANNEL = Math.max(
+    1,
+    Number(process.env.SVAMP_MAX_CHANNEL_RECEIVE_POLLS) || 16
+  );
+  const _receivePolls = /* @__PURE__ */ new Map();
+  const acquireReceiveSlot = (channelId) => {
+    const n = _receivePolls.get(channelId) || 0;
+    if (n >= MAX_RECEIVE_POLLS_PER_CHANNEL) return false;
+    _receivePolls.set(channelId, n + 1);
+    return true;
+  };
+  const releaseReceiveSlot = (channelId) => {
+    const n = (_receivePolls.get(channelId) || 1) - 1;
+    if (n <= 0) _receivePolls.delete(channelId);
+    else _receivePolls.set(channelId, n);
+  };
+  const _outboxCache = /* @__PURE__ */ new Map();
+  const getOutbox = (dir) => {
+    let ob = _outboxCache.get(dir);
+    if (!ob) {
+      ob = new ChannelOutbox(dir);
+      _outboxCache.set(dir, ob);
+    } else {
+      ob.reload();
+    }
+    return ob;
+  };
   const dispatchStateless = async (c, dir, kwargs, context) => {
     const u = context?.user;
     const r = resolveSender(c, {
@@ -8437,7 +8510,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-CWkWkrZF.mjs');
+    const { queryCore } = await import('./commands-DKouDroK.mjs');
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     let thrownSessionId;
@@ -8539,15 +8612,22 @@ ${d?.error || "not found"}`;
         const waitRaw = Number(kwargs.wait ?? 25);
         const waitSec = Number.isFinite(waitRaw) ? waitRaw : 25;
         const waitMs = Math.min(Math.max(0, waitSec * 1e3), 6e4);
-        const outbox = new ChannelOutbox(dir);
-        const deadline = Date.now() + waitMs;
-        for (; ; ) {
-          const replies = outbox.since(c.id, cursor, r.sender.name, kwargs.correlationId);
-          if (replies.length || Date.now() >= deadline) {
-            return { ok: true, replies, cursor: outbox.cursor(c.id) };
+        if (!acquireReceiveSlot(c.id)) {
+          return { error: "busy: too many concurrent receive polls on this channel \u2014 retry shortly", retryable: true };
+        }
+        try {
+          const outbox = getOutbox(dir);
+          const deadline = Date.now() + waitMs;
+          for (; ; ) {
+            const replies = outbox.since(c.id, cursor, r.sender.name, kwargs.correlationId);
+            if (replies.length || Date.now() >= deadline) {
+              return { ok: true, replies, cursor: outbox.cursor(c.id) };
+            }
+            await new Promise((resolve) => setTimeout(resolve, 500));
+            outbox.reload();
           }
-          await new Promise((resolve) => setTimeout(resolve, 500));
-          outbox.reload();
+        } finally {
+          releaseReceiveSlot(c.id);
         }
       },
       // Safety-restricted file upload (#0093). Deny-by-default: only channels whose
@@ -9244,10 +9324,15 @@ const OUTPOST_EXEC_TIMEOUT_MS = 12 * 6e4;
 const OUTPOST_MAX_OUTPUT_BYTES = 1 << 20;
 function capOutpostOutput(s) {
   if (!s) return "";
-  if (s.length <= OUTPOST_MAX_OUTPUT_BYTES) return s;
-  const dropped = s.length - OUTPOST_MAX_OUTPUT_BYTES;
-  return `[svamp-daemon] output truncated: ${dropped} earlier characters dropped]
-${s.slice(-OUTPOST_MAX_OUTPUT_BYTES)}`;
+  const bytes = Buffer.byteLength(s, "utf-8");
+  if (bytes <= OUTPOST_MAX_OUTPUT_BYTES) return s;
+  const buf = Buffer.from(s, "utf-8");
+  let start = buf.length - OUTPOST_MAX_OUTPUT_BYTES;
+  while (start < buf.length && (buf[start] & 192) === 128) start++;
+  const tail = buf.subarray(start).toString("utf-8");
+  const dropped = bytes - Buffer.byteLength(tail, "utf-8");
+  return `[svamp-daemon] output truncated: ${dropped} earlier bytes dropped
+${tail}`;
 }
 class OutpostCoordinator {
   conns = /* @__PURE__ */ new Map();
@@ -9365,9 +9450,14 @@ class OutpostCoordinator {
   resolveTarget(target) {
     const live = this.listConnections();
     if (target) {
-      const hit = live.find((c) => c.machine === target || c.label === target);
-      if (!hit) return { error: `no connected outpost named "${target}" (connected: ${live.map((c) => c.machine).join(", ") || "none"})` };
-      return { machine: hit.machine };
+      const byId = live.find((c) => c.machine === target);
+      if (byId) return { machine: byId.machine };
+      const byLabel = live.filter((c) => c.label === target);
+      if (byLabel.length === 1) return { machine: byLabel[0].machine };
+      if (byLabel.length > 1) {
+        return { error: `outpost label "${target}" is ambiguous \u2014 ${byLabel.length} connected outposts share it (${byLabel.map((c) => c.machine).join(", ")}); pass the machine id instead` };
+      }
+      return { error: `no connected outpost named "${target}" (connected: ${live.map((c) => c.machine).join(", ") || "none"})` };
     }
     if (live.length === 0) return { error: "no remote outpost is connected \u2014 run the install one-liner on the remote machine first" };
     if (live.length > 1) return { error: `multiple outposts connected (${live.map((c) => c.machine).join(", ")}) \u2014 pass a target` };
@@ -9981,7 +10071,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
   ensureParticipantsChannel(initialMetadata.sharing);
   const forkClaudeOnce = async (prompt, claudeSessionId, cwd, maxTurns, timeoutMs) => {
     const { spawn } = await import('child_process');
-    const forkEnv = { ...process.env, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" };
+    const forkEnv = { ...process.env, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", DISABLE_AUTOUPDATER: "1" };
     applyClaudeProxyEnv(forkEnv);
     return new Promise((resolve) => {
       const child = spawn("claude", [
@@ -11575,6 +11665,53 @@ function buildSessionIdentityEnv(identity) {
   return env;
 }
 
+async function downloadSkillAtomically(targetDir, files, fetchFile) {
+  const stagingDir = `${targetDir}.tmp-${process.pid}-${Date.now().toString(36)}`;
+  try {
+    mkdirSync$1(stagingDir, { recursive: true });
+    for (const filePath of files) {
+      if (!filePath) continue;
+      const content = await fetchFile(filePath);
+      const localPath = join$1(stagingDir, filePath);
+      if (!localPath.startsWith(stagingDir + "/")) continue;
+      mkdirSync$1(dirname(localPath), { recursive: true });
+      writeFileSync$1(localPath, content, "utf-8");
+    }
+  } catch (err) {
+    rmSync$1(stagingDir, { recursive: true, force: true });
+    throw err;
+  }
+  const backupDir = `${targetDir}.old-${process.pid}-${Date.now().toString(36)}`;
+  let backedUp = false;
+  try {
+    if (existsSync(targetDir)) {
+      renameSync(targetDir, backupDir);
+      backedUp = true;
+    }
+    renameSync(stagingDir, targetDir);
+  } catch (err) {
+    if (backedUp && !existsSync(targetDir)) {
+      try {
+        renameSync(backupDir, targetDir);
+        backedUp = false;
+      } catch {
+      }
+    }
+    try {
+      rmSync$1(stagingDir, { recursive: true, force: true });
+    } catch {
+    }
+    if (backedUp) {
+      try {
+        rmSync$1(backupDir, { recursive: true, force: true });
+      } catch {
+      }
+    }
+    throw err;
+  }
+  if (backedUp) rmSync$1(backupDir, { recursive: true, force: true });
+}
+
 const HOTRELOAD_ENV = "SVAMP_DEV_HOTRELOAD";
 function isHotReloadEnabled(env = process.env) {
   const v = env[HOTRELOAD_ENV];
@@ -14185,7 +14322,7 @@ function codexCumulativeTokens(payload) {
   return nonCachedInput + output + Math.round(cached * 0.1);
 }
 
-const PINNED_CODEX_VERSION = "0.147.0";
+const PINNED_CODEX_VERSION = "0.149.0";
 const MIN_CODEX_STEER_VERSION = { major: 0, minor: 129, patch: 0 };
 function cmpVer(a, b) {
   return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
@@ -15216,6 +15353,15 @@ function kimiProviderConfigured(configTomlText, provider) {
   const block = nextTable < 0 ? rest : rest.slice(0, nextTable);
   return /(^|\n)\s*api_key\s*=/.test(block);
 }
+function kimiHasGlobalDefaultModel(configTomlText) {
+  if (!configTomlText) return false;
+  const firstTable = configTomlText.search(/(^|\n)\s*\[/);
+  const preamble = firstTable < 0 ? configTomlText : configTomlText.slice(0, firstTable);
+  return /(^|\n)\s*default_model\s*=/.test(preamble);
+}
+function kimiConfigComplete(configTomlText, provider) {
+  return kimiProviderConfigured(configTomlText, provider) && kimiHasGlobalDefaultModel(configTomlText);
+}
 function kimiModelMenu(env = process.env) {
   return (env.SVAMP_KIMI_MODELS || "").split(",").map((s) => s.trim()).filter(Boolean).filter((m, i, a) => a.indexOf(m) === i);
 }
@@ -15237,8 +15383,10 @@ var kimiProvider = /*#__PURE__*/Object.freeze({
     buildKimiCatalogAddArgs: buildKimiCatalogAddArgs,
     hasKimiProvider: hasKimiProvider,
     kimiClampModel: kimiClampModel,
+    kimiConfigComplete: kimiConfigComplete,
     kimiDefaultModel: kimiDefaultModel,
     kimiDefaultModelId: kimiDefaultModelId,
+    kimiHasGlobalDefaultModel: kimiHasGlobalDefaultModel,
     kimiModelMenu: kimiModelMenu,
     kimiProviderConfigured: kimiProviderConfigured,
     kimiSpawnEnv: kimiSpawnEnv,
@@ -15257,7 +15405,7 @@ async function ensureKimiProviderConfigured(env = process.env, command = "kimi",
 }) {
   const cfg = resolveKimiProvider(env);
   if (!hasKimiProvider(cfg)) return false;
-  if (kimiProviderConfigured(readKimiConfig(), cfg.provider)) return true;
+  if (kimiConfigComplete(readKimiConfig(), cfg.provider)) return true;
   const args = buildKimiCatalogAddArgs(cfg);
   if (!args) return false;
   try {
@@ -15275,7 +15423,11 @@ async function ensureKimiProviderConfigured(env = process.env, command = "kimi",
       );
     });
     log(`[kimi] configured provider '${cfg.provider}' in ${KIMI_CONFIG_PATH}`);
-    return kimiProviderConfigured(readKimiConfig(), cfg.provider);
+    const complete = kimiConfigComplete(readKimiConfig(), cfg.provider);
+    if (!complete) {
+      log(`[kimi] catalog add left ${KIMI_CONFIG_PATH} without a global default_model \u2014 \`kimi acp\` will refuse session/new ("no default model configured")`);
+    }
+    return complete;
   } catch (err) {
     log(`[kimi] provider auto-config failed (${err?.message || err}); session may need kimi-auth`);
     return false;
@@ -15783,8 +15935,28 @@ const SENSITIVE_ENV_VARS = [
   "GH_TOKEN",
   "NPM_TOKEN",
   "DOCKER_PASSWORD",
-  "DOCKER_CONFIG"
+  "DOCKER_CONFIG",
+  // #1110: svamp's own persisted credentials (written by `svamp daemon codex-auth` /
+  // `kimi-auth` / `wise-agent auth`, and by the generic LLM_* aliases).
+  "OPENAI_API_KEY",
+  "GEMINI_API_KEY",
+  "XAI_API_KEY",
+  "ANTHROPIC_ADMIN_KEY",
+  "LLM_API_KEY",
+  "CLOUDFLARE_API_TOKEN",
+  "R2_ACCESS_KEY_ID",
+  "R2_SECRET_ACCESS_KEY",
+  "X_API_KEY"
 ];
+const CREDENTIAL_NAME_RE = /(^|_)(KEY|APIKEY|TOKEN|SECRET|PASSWORD|CREDENTIALS)$/;
+const CREDENTIAL_SWEEP_ALLOWLIST = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN"
+]);
+function isCredentialEnvName(key) {
+  if (CREDENTIAL_SWEEP_ALLOWLIST.has(key)) return false;
+  return CREDENTIAL_NAME_RE.test(key);
+}
 async function stageCredentialsForSharing(sessionId) {
   const realHome = homedir$1();
   const realClaudeDir = join$1(realHome, ".claude");
@@ -15858,6 +16030,9 @@ function sanitizeEnvForSharing(env) {
   for (const key of SENSITIVE_ENV_VARS) {
     delete sanitized[key];
   }
+  for (const key of Object.keys(sanitized)) {
+    if (isCredentialEnvName(key)) delete sanitized[key];
+  }
   return sanitized;
 }
 async function sweepOrphanedStagedHomes(activeSessionIds) {
@@ -15900,6 +16075,7 @@ async function copyDirRecursive(src, dest) {
 
 var credentialStaging = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    isCredentialEnvName: isCredentialEnvName,
     sanitizeEnvForSharing: sanitizeEnvForSharing,
     stageCredentialsForSharing: stageCredentialsForSharing,
     sweepOrphanedStagedHomes: sweepOrphanedStagedHomes
@@ -16239,14 +16415,21 @@ class ProcessSupervisor {
       if (entry.stopping) throw new Error(`Process '${entry.spec.name}' is being stopped, try again shortly`);
       throw new Error(`Process '${entry.spec.name}' is already running`);
     }
-    entry.stopping = false;
-    this.clearTimers(entry);
-    if (entry.spec.desiredStopped) {
-      entry.spec.desiredStopped = false;
-      await this.persistSpec(entry.spec);
-    }
-    this.resetFailureTracking(entry);
-    await this.startEntry(entry, false);
+    return this.runExclusive(entry, async () => {
+      if (entry.deleted) throw new Error(`Process '${idOrName}' has been removed`);
+      if (entry.child) {
+        if (entry.stopping) throw new Error(`Process '${entry.spec.name}' is being stopped, try again shortly`);
+        throw new Error(`Process '${entry.spec.name}' is already running`);
+      }
+      entry.stopping = false;
+      this.clearTimers(entry);
+      if (entry.spec.desiredStopped) {
+        entry.spec.desiredStopped = false;
+        await this.persistSpec(entry.spec);
+      }
+      this.resetFailureTracking(entry);
+      await this.startEntry(entry, false);
+    });
   }
   /**
    * Stop a running process. Does NOT remove it from supervision.
@@ -16256,7 +16439,7 @@ class ProcessSupervisor {
    */
   /**
    * #0347: run `fn` in the entry's lifecycle critical section. Each call awaits the previous
-   * lifecycle op's SETTLEMENT before running, so stop/restart/apply/update/remove are strictly
+   * lifecycle op's SETTLEMENT before running, so start/stop/restart/apply/update/remove are strictly
    * serialized per entry and can never interleave across an `await killChild` (which is what let
    * two ops double-spawn an orphan, or resurrect a just-stopped process). The chain tail never
    * rejects (a failed op must not wedge the queue); the caller still gets the real result/error.
@@ -16473,7 +16656,7 @@ class ProcessSupervisor {
   }
   async persistSpec(spec) {
     const filePath = path__default.join(this.persistDir, `${spec.id}.json`);
-    const tmpPath = filePath + ".tmp";
+    const tmpPath = `${filePath}.tmp-${process.pid}-${randomBytes$1(4).toString("hex")}`;
     await writeFile$1(tmpPath, JSON.stringify(spec, null, 2), "utf-8");
     await rename(tmpPath, filePath);
   }
@@ -17052,7 +17235,7 @@ function searchIssues(projectRoot, query) {
   const q = query.trim();
   if (!q) return [];
   try {
-    const out = execFileSync("rg", ["-l", "-i", "--no-messages", q, issuesDir(projectRoot)], { encoding: "utf-8" });
+    const out = execFileSync("rg", ["-l", "-i", "-F", "--no-messages", "-e", q, "--", issuesDir(projectRoot)], { encoding: "utf-8" });
     const files = out.split("\n").filter(Boolean);
     const issues = [];
     for (const f of files) {
@@ -17063,9 +17246,24 @@ function searchIssues(projectRoot, query) {
       }
     }
     return issues.sort((a, b) => Number(a.id) - Number(b.id));
-  } catch {
-    const ql = q.toLowerCase();
-    return listIssues(projectRoot, { includeArchived: true }).filter((i) => i.title.toLowerCase().includes(ql) || (i.body || "").toLowerCase().includes(ql) || i.labels.some((l) => l.toLowerCase().includes(ql)));
+  } catch (e) {
+    if (e?.status === 1) return [];
+    return searchIssuesInMemory(projectRoot, q);
+  }
+}
+function searchIssuesInMemory(projectRoot, q) {
+  const ql = q.toLowerCase();
+  return listIssues(projectRoot, { includeArchived: true }).filter((i) => i.title.toLowerCase().includes(ql) || (i.body || "").toLowerCase().includes(ql) || i.labels.some((l) => l.toLowerCase().includes(ql)));
+}
+function checkVerifyCommand(projectRoot, issue) {
+  const cmd = issue?.verify?.type === "command" ? (issue.verify.text || "").trim() : "";
+  if (!cmd) return { ok: true };
+  try {
+    execSync$1(cmd, { cwd: projectRoot, stdio: "pipe", timeout: 6e5, maxBuffer: 64 * 1024 * 1024 });
+    return { ok: true, cmd };
+  } catch (e) {
+    const output = (String(e?.stdout || "") + String(e?.stderr || "")).split("\n").slice(-15).join("\n").trim();
+    return { ok: false, cmd, output };
   }
 }
 function summarize(issues) {
@@ -17092,7 +17290,8 @@ function planLogPrune(files, policy = DEFAULT_LOG_PRUNE_POLICY, nowMs = Date.now
   const overCount = keepFiles > 0 ? perStart.slice(keepFiles) : perStart;
   const tooOld = maxAgeMs > 0 ? perStart.filter((f) => nowMs - f.mtimeMs > maxAgeMs) : [];
   const deleteFiles = [...new Set([...overCount, ...tooOld].map((f) => f.name))];
-  const truncateFiles = files.filter((f) => APPEND_ONLY_LOGS.includes(f.name) && !excluded.has(f.name)).filter((f) => policy.maxBytes > 0 && f.size > policy.maxBytes).map((f) => ({ name: f.name, size: f.size }));
+  const doomed = new Set(deleteFiles);
+  const truncateFiles = files.filter((f) => (APPEND_ONLY_LOGS.includes(f.name) || isPerStartLog(f.name)) && !doomed.has(f.name)).filter((f) => policy.maxBytes > 0 && f.size > policy.maxBytes).map((f) => ({ name: f.name, size: f.size }));
   return { deleteFiles, truncateFiles };
 }
 function resolveLogPrunePolicy(env = process.env) {
@@ -17107,11 +17306,63 @@ function resolveLogPrunePolicy(env = process.env) {
     maxBytes: num(env.SVAMP_LOG_MAX_BYTES, DEFAULT_LOG_PRUNE_POLICY.maxBytes)
   };
 }
-function tailSlice(buf, tailBytes) {
-  if (buf.length <= tailBytes) return buf;
-  const cut = buf.subarray(buf.length - tailBytes);
-  const nl = cut.indexOf(10);
-  return nl >= 0 && nl + 1 < cut.length ? cut.subarray(nl + 1) : cut;
+function trimToLineStart(buf) {
+  const nl = buf.indexOf(10);
+  return nl >= 0 && nl + 1 < buf.length ? buf.subarray(nl + 1) : buf;
+}
+
+function readLogTail(path, tailBytes) {
+  const fd = openSync(path, "r");
+  try {
+    const size = fstatSync(fd).size;
+    const want = Math.min(Math.max(0, Math.floor(tailBytes)), size);
+    if (want === 0) return { data: Buffer.alloc(0), truncated: size > 0 };
+    const buf = Buffer.allocUnsafe(want);
+    const start = size - want;
+    let read = 0;
+    while (read < want) {
+      const n = readSync(fd, buf, read, want - read, start + read);
+      if (n <= 0) break;
+      read += n;
+    }
+    return { data: read === want ? buf : buf.subarray(0, read), truncated: size > want };
+  } finally {
+    closeSync(fd);
+  }
+}
+
+const CARRIER_FIELDS = ["message", "error", "detail", "reason", "description"];
+function formatLogArg(a) {
+  if (typeof a === "string") return a;
+  if (a instanceof Error) return a.stack || `${a.name}: ${a.message}`;
+  if (a === void 0) return "undefined";
+  if (a === null) return "null";
+  try {
+    const s = JSON.stringify(a);
+    if (s === void 0 || s === "{}") return String(a);
+    return s;
+  } catch {
+    try {
+      return String(a);
+    } catch {
+      return "[unserializable]";
+    }
+  }
+}
+function formatLogArgs(args) {
+  return args.map(formatLogArg).join(" ");
+}
+function describeRejectionReason(reason) {
+  if (typeof reason === "string") return reason;
+  if (reason instanceof Error) return `${reason.name}: ${reason.message}`;
+  if (reason && typeof reason === "object") {
+    for (const f of CARRIER_FIELDS) {
+      const v = reason[f];
+      if (typeof v === "string" && v.trim() !== "") return v;
+      if (v instanceof Error) return `${v.name}: ${v.message}`;
+    }
+  }
+  return formatLogArg(reason);
 }
 
 function isWorkflowEnabled(wf) {
@@ -17135,6 +17386,12 @@ function validateWorkflowName(name) {
 function workflowPath(projectRoot, name) {
   return join$1(workflowsDir(projectRoot), `${validateWorkflowName(name)}.yaml`);
 }
+function resolveWorkflowPath(projectRoot, name) {
+  const canonical = workflowPath(projectRoot, name);
+  if (existsSync(canonical)) return canonical;
+  const alt = join$1(workflowsDir(projectRoot), `${validateWorkflowName(name)}.yml`);
+  return existsSync(alt) ? alt : canonical;
+}
 function normalizeOn(on) {
   if (!on || typeof on !== "object") {
     return void 0;
@@ -17231,7 +17488,7 @@ function listWorkflows(projectRoot) {
 function getWorkflow(projectRoot, name) {
   let p;
   try {
-    p = workflowPath(projectRoot, name);
+    p = resolveWorkflowPath(projectRoot, name);
   } catch {
     return null;
   }
@@ -17245,7 +17502,7 @@ function getWorkflow(projectRoot, name) {
 function rawWorkflow(projectRoot, name) {
   let p;
   try {
-    p = workflowPath(projectRoot, name);
+    p = resolveWorkflowPath(projectRoot, name);
   } catch {
     return null;
   }
@@ -17258,6 +17515,13 @@ function saveWorkflow(projectRoot, wf) {
   const tmp = `${path}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
   writeFileSync$1(tmp, serializeWorkflow(wf));
   renameSync(tmp, path);
+  const alt = join$1(dir, `${validateWorkflowName(wf.name)}.yml`);
+  if (alt !== path && existsSync(alt)) {
+    try {
+      unlinkSync$1(alt);
+    } catch {
+    }
+  }
 }
 function setWorkflowEnabled(projectRoot, name, enabled) {
   const wf = getWorkflow(projectRoot, name);
@@ -17269,7 +17533,7 @@ function setWorkflowEnabled(projectRoot, name, enabled) {
   return next;
 }
 function removeWorkflow(projectRoot, name) {
-  const p = workflowPath(projectRoot, name);
+  const p = resolveWorkflowPath(projectRoot, name);
   if (!existsSync(p)) return false;
   try {
     unlinkSync$1(p);
@@ -17783,6 +18047,15 @@ function isCostCeiling(kind) {
 function isHardBudgetStop(kind) {
   return isCostCeiling(kind) || kind === "iteration";
 }
+function rearmStartedAt(startedAt, completedAt, now) {
+  const fin = (v) => typeof v === "number" && Number.isFinite(v) && v > 0;
+  if (!fin(startedAt)) return startedAt;
+  if (!fin(completedAt)) return startedAt;
+  if (completedAt < startedAt) return startedAt;
+  const dormantMs = now - completedAt;
+  if (dormantMs <= 0) return startedAt;
+  return startedAt + dormantMs;
+}
 function checkLoopBudget(ledger, limits, now, startedAt) {
   const L = limits || {};
   const led = ledger || { turns: 0, tokens: 0, window: [] };
@@ -18262,6 +18535,47 @@ function isContextTooLongError(text) {
   if (t.includes("context") && t.includes("exceed") && t.includes("limit") && !t.includes("subscription")) return true;
   return false;
 }
+function shouldEvaluateProactiveCompaction(state) {
+  if (!state.enabled) return false;
+  if (state.disabled) return false;
+  if (state.turnErrored) return false;
+  if (state.compactPending) return false;
+  if (state.justCompacted) return false;
+  return true;
+}
+function compactSupportedFromSlashCommands(slashCommands) {
+  if (!Array.isArray(slashCommands) || slashCommands.length === 0) return void 0;
+  return slashCommands.some(
+    (c) => typeof c === "string" && c.trim().replace(/^\//, "").toLowerCase() === "compact"
+  );
+}
+const DEFAULT_COMPACT_NO_BOUNDARY_STRIKES = 3;
+function decideCompactUnsupported(input) {
+  const prior = Math.max(0, input.priorStrikes || 0);
+  const limit = Math.max(1, input.maxStrikes);
+  if (input.turnErrored) {
+    return { disable: false, warnUnsupported: false, strikes: prior, reason: "errored-turn" };
+  }
+  if (!input.wasAutoInjected) {
+    return {
+      disable: false,
+      warnUnsupported: input.compactSupported === false,
+      strikes: prior,
+      reason: "user-typed"
+    };
+  }
+  if (input.compactSupported === false) {
+    return { disable: true, warnUnsupported: true, strikes: prior + 1, reason: "unsupported" };
+  }
+  const strikes = prior + 1;
+  if (strikes >= limit) {
+    return { disable: true, warnUnsupported: false, strikes, reason: "strikes-exhausted" };
+  }
+  return { disable: false, warnUnsupported: false, strikes, reason: "strike" };
+}
+function describeNoBoundary(strikes, limit) {
+  return `Automatic compaction ran but reported no compaction boundary (attempt ${strikes} of ${limit}) \u2014 usually because there was nothing left to compact. Keeping automatic compaction enabled.`;
+}
 
 function fmtTokens(n) {
   return Math.max(0, Math.round(n)).toLocaleString("en-US");
@@ -18835,23 +19149,27 @@ function compareVersions(a, b) {
   return 0;
 }
 async function installSkillFromEndpoint(name, baseUrl) {
-  const resp = await fetch(baseUrl, { signal: AbortSignal.timeout(15e3) });
-  if (!resp.ok) throw new Error(`HTTP ${resp.status} from ${baseUrl}`);
-  const index = await resp.json();
+  const index = await fetchEndpointSkillIndex(baseUrl);
   const files = index.files || [];
   if (files.length === 0) throw new Error(`Skill index at ${baseUrl} has no files`);
-  const targetDir = join(CLAUDE_SKILLS_DIR, name);
-  mkdirSync(targetDir, { recursive: true });
-  for (const filePath of files) {
-    if (!filePath) continue;
-    const url = `${baseUrl}${filePath}`;
-    const fileResp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
+  await downloadSkillAtomically(join(CLAUDE_SKILLS_DIR, name), files, async (filePath) => {
+    const fileResp = await fetch(`${baseUrl}${filePath}`, { signal: AbortSignal.timeout(3e4) });
     if (!fileResp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${fileResp.status}`);
-    const content = await fileResp.text();
-    const localPath = join(targetDir, filePath);
-    if (!localPath.startsWith(targetDir + "/")) continue;
-    mkdirSync(dirname$1(localPath), { recursive: true });
-    writeFileSync(localPath, content, "utf-8");
+    return fileResp.text();
+  });
+}
+async function fetchEndpointSkillIndex(baseUrl) {
+  const resp = await fetch(baseUrl, { signal: AbortSignal.timeout(15e3) });
+  if (!resp.ok) throw new Error(`HTTP ${resp.status} from ${baseUrl}`);
+  return await resp.json();
+}
+async function fetchEndpointSkillVersion(baseUrl) {
+  try {
+    const index = await fetchEndpointSkillIndex(baseUrl);
+    const v = index?.version;
+    return typeof v === "string" && v.trim() ? v.trim() : null;
+  } catch {
+    return null;
   }
 }
 async function installSkillFromMarketplace(name) {
@@ -18875,26 +19193,11 @@ async function installSkillFromMarketplace(name) {
   }
   const files = await collectFiles();
   if (files.length === 0) throw new Error(`Skill ${name} has no files in marketplace`);
-  const targetDir = join(CLAUDE_SKILLS_DIR, name);
-  const stagingDir = `${targetDir}.tmp-${process.pid}-${Date.now().toString(36)}`;
-  try {
-    mkdirSync(stagingDir, { recursive: true });
-    for (const filePath of files) {
-      const url = `${BASE}/files/${filePath}`;
-      const resp = await fetch(url, { signal: AbortSignal.timeout(3e4) });
-      if (!resp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${resp.status}`);
-      const content = await resp.text();
-      const localPath = join(stagingDir, filePath);
-      if (!localPath.startsWith(stagingDir + "/")) continue;
-      mkdirSync(dirname$1(localPath), { recursive: true });
-      writeFileSync(localPath, content, "utf-8");
-    }
-    rmSync(targetDir, { recursive: true, force: true });
-    renameSync$1(stagingDir, targetDir);
-  } catch (err) {
-    rmSync(stagingDir, { recursive: true, force: true });
-    throw err;
-  }
+  await downloadSkillAtomically(join(CLAUDE_SKILLS_DIR, name), files, async (filePath) => {
+    const resp = await fetch(`${BASE}/files/${filePath}`, { signal: AbortSignal.timeout(3e4) });
+    if (!resp.ok) throw new Error(`Failed to download ${filePath}: HTTP ${resp.status}`);
+    return resp.text();
+  });
 }
 function getBundledSkillsDir() {
   try {
@@ -19113,9 +19416,16 @@ async function ensureAutoInstalledSkills(logger) {
       marketplaceVersion: () => fetchMarketplaceSkillVersion("svamp")
     },
     {
+      // #1192: the agent-skills endpoint's index already carries a `version` (verified live:
+      // `{"name":"hypha","version":"1.0.0","files":[...]}`), and installSkillFromEndpoint
+      // fetches that exact document anyway — it just used to discard the field. Supplying the
+      // probe moves `hypha` off the "install once, never refresh" branch, so a machine is no
+      // longer pinned forever to whatever version it first installed. Safe now that #1191
+      // gave this downloader atomic staging: a refresh that fails mid-download leaves the
+      // previous skill intact instead of half-overwriting it.
       name: "hypha",
-      install: () => installSkillFromEndpoint("hypha", `${getSkillsServer()}/ws/agent-skills/`)
-      // hypha skill ships from a different endpoint without a version probe yet.
+      install: () => installSkillFromEndpoint("hypha", `${getSkillsServer()}/ws/agent-skills/`),
+      marketplaceVersion: () => fetchEndpointSkillVersion(`${getSkillsServer()}/ws/agent-skills/`)
     },
     {
       // `<artifact>` block rendering — see packages/svamp-app/.../Artifact.tsx.
@@ -19328,17 +19638,23 @@ function isLoopActive(directory, sessionId) {
   const s = readLoopState(directory, sessionId);
   return !!s && s.active !== false && s.phase !== "dormant" && !isTerminalLoopPhase(s.phase);
 }
-function loopOwnerSession(directory, sessionId) {
-  const s = readLoopState(directory, sessionId);
-  if (!s || s.active === false || s.phase === "dormant" || isTerminalLoopPhase(s.phase)) return null;
-  return typeof s.session_id === "string" ? s.session_id : null;
-}
 function isLoopActiveForSession(directory, sessionId) {
   const s = readLoopState(directory, sessionId);
   if (!s || s.active === false || s.phase === "dormant" || isTerminalLoopPhase(s.phase)) return false;
   if (typeof s.session_id !== "string") return true;
   return s.session_id === sessionId;
 }
+function loopExistsForSession(directory, sessionId) {
+  const s = readLoopState(directory, sessionId);
+  if (!s || s.active === false || isTerminalLoopPhase(s.phase)) return false;
+  if (typeof s.session_id !== "string") return true;
+  return s.session_id === sessionId;
+}
+function loopOwnerSessionIncludingDormant(directory, sessionId) {
+  const s = readLoopState(directory, sessionId);
+  if (!s || s.active === false || isTerminalLoopPhase(s.phase)) return null;
+  return typeof s.session_id === "string" ? s.session_id : null;
+}
 function isLoopArmedForSession(directory, sessionId) {
   const s = readLoopState(directory, sessionId);
   if (!s || s.active === false || s.phase !== "dormant") return false;
@@ -19675,13 +19991,13 @@ function createSvampConfigChecker(directory, sessionId, getMetadata, setMetadata
   };
   let announcedLoopStart = (() => {
     const s = readLoopState(directory, sessionId);
-    return s && (s.phase === "done" || s.phase === "gave_up") ? s.started_at ?? "\u2205" : null;
+    return s && (s.phase === "done" || s.phase === "gave_up") ? String(s.started_at ?? "\u2205") : null;
   })();
   const loopChecker = () => {
     try {
       const s = readLoopState(directory, sessionId);
       if (!s || s.phase !== "done" && s.phase !== "gave_up") return;
-      const key = s.started_at ?? "\u2205";
+      const key = String(s.started_at ?? "\u2205");
       if (key === announcedLoopStart) return;
       announcedLoopStart = key;
       const iter = s.ledger && typeof s.ledger.turns === "number" && s.ledger.turns > 0 ? s.ledger.turns : typeof s.iteration === "number" ? s.iteration : 0;
@@ -20052,7 +20368,7 @@ function ensureHomeDir() {
     mkdirSync(LOGS_DIR, { recursive: true });
   }
 }
-function pruneDaemonLogs() {
+function pruneDaemonLogs(exclude = []) {
   try {
     const policy = resolveLogPrunePolicy(process.env);
     const entries = readdirSync$1(LOGS_DIR).map((name) => {
@@ -20063,7 +20379,7 @@ function pruneDaemonLogs() {
         return null;
       }
     }).filter((e) => e !== null);
-    const plan = planLogPrune(entries, policy);
+    const plan = planLogPrune(entries, policy, Date.now(), exclude);
     for (const name of plan.deleteFiles) {
       try {
         unlinkSync(join(LOGS_DIR, name));
@@ -20073,7 +20389,9 @@ function pruneDaemonLogs() {
     for (const { name } of plan.truncateFiles) {
       try {
         const p = join(LOGS_DIR, name);
-        const kept = tailSlice(readFileSync$1(p), Math.floor(policy.maxBytes / 8));
+        const keepBytes = Math.floor(policy.maxBytes / 8);
+        const tail = readLogTail(p, keepBytes);
+        const kept = tail.truncated ? trimToLineStart(tail.data) : tail.data;
         writeFileSync(p, kept);
       } catch {
       }
@@ -20085,10 +20403,13 @@ function createLogger() {
   ensureHomeDir();
   pruneDaemonLogs();
   const logFile = join(LOGS_DIR, `daemon-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.log`);
+  const sweepMs = Math.max(6e4, Number(process.env.SVAMP_LOG_PRUNE_INTERVAL_MS) || 36e5);
+  const sweepTimer = setInterval(() => pruneDaemonLogs([basename$1(logFile)]), sweepMs);
+  if (typeof sweepTimer.unref === "function") sweepTimer.unref();
   return {
     logFilePath: logFile,
     log: (...args) => {
-      const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
+      const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${formatLogArgs(args)}
 `;
       fs$1.appendFile(logFile, line).catch(() => {
       });
@@ -20097,7 +20418,7 @@ function createLogger() {
       }
     },
     error: (...args) => {
-      const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${args.map((a) => typeof a === "string" ? a : JSON.stringify(a)).join(" ")}
+      const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ERROR: ${formatLogArgs(args)}
 `;
       fs$1.appendFile(logFile, line).catch(() => {
       });
@@ -20254,7 +20575,7 @@ async function startDaemon(options) {
   const UNHANDLED_REJECTION_WINDOW_MS = 6e4;
   process.on("unhandledRejection", (reason) => {
     if (shutdownRequested) return;
-    const msg = String(reason);
+    const msg = describeRejectionReason(reason);
     logger.error("Unhandled rejection:", reason);
     const isTransient = TRANSIENT_REJECTION_PATTERNS.some((p) => msg.toLowerCase().includes(p.toLowerCase()));
     const isSessionLoss = msg.toLowerCase().includes("session does not exist");
@@ -20383,7 +20704,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CovUtOYv.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BVz1k2R2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const entries = Array.from(urls.entries());
@@ -20405,7 +20726,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { reconcileServiceLinks } = await import('./agentCommands-CovUtOYv.mjs');
+      const { reconcileServiceLinks } = await import('./agentCommands-BVz1k2R2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       const incoming = [{
@@ -20426,7 +20747,7 @@ async function startDaemon(options) {
     try {
       const dir = loadSessionIndex()[sessionId]?.directory;
       if (!dir) return;
-      const { dropServiceLinks } = await import('./agentCommands-CovUtOYv.mjs');
+      const { dropServiceLinks } = await import('./agentCommands-BVz1k2R2.mjs');
       const configPath = getSvampConfigPath(dir, sessionId);
       const config = readSvampConfig(configPath);
       if (dropServiceLinks(config, "serve", mountName)) {
@@ -20437,6 +20758,73 @@ async function startDaemon(options) {
       logger.log(`[serve] Link drop failed for mount ${mountName}: ${err?.message || err}`);
     }
   }
+  async function dropTunnelSessionLink(sessionId, tunnelName) {
+    if (!sessionId) return;
+    try {
+      const dir = loadSessionIndex()[sessionId]?.directory;
+      if (!dir) return;
+      const { dropServiceLinks } = await import('./agentCommands-BVz1k2R2.mjs');
+      const configPath = getSvampConfigPath(dir, sessionId);
+      const config = readSvampConfig(configPath);
+      if (dropServiceLinks(config, "tunnel", tunnelName)) {
+        writeSvampConfig(configPath, config);
+        logger.log(`[exposed-tunnels] Dropped Launch Pad link for tunnel ${tunnelName} \u2190 session ${sessionId}`);
+      }
+    } catch (err) {
+      logger.log(`[exposed-tunnels] Link drop failed for tunnel ${tunnelName}: ${err?.message || err}`);
+    }
+  }
+  async function reconcileAllServiceLinks() {
+    try {
+      const { reconcileServiceLinksExact } = await import('./agentCommands-BVz1k2R2.mjs');
+      const desiredBySession = /* @__PURE__ */ new Map();
+      const push = (sessionId, entry) => {
+        if (!sessionId || !entry.url) return;
+        const list = desiredBySession.get(sessionId) ?? [];
+        list.push(entry);
+        desiredBySession.set(sessionId, list);
+      };
+      for (const m of serveManager$1.listMounts()) {
+        if (m?.sessionId && m?.url) push(m.sessionId, { url: String(m.url), label: m.name, service: { kind: "serve", name: m.name } });
+      }
+      const specBySession = /* @__PURE__ */ new Map();
+      for (const spec of loadExposedTunnels()) if (spec.sessionId) specBySession.set(spec.name, spec.sessionId);
+      for (const [name, tunnel] of tunnels) {
+        const sessionId = specBySession.get(name);
+        if (!sessionId) continue;
+        const urls = Array.from(tunnel.getUrls().entries());
+        for (const [port, url] of urls) {
+          push(sessionId, { url: String(url), label: urls.length > 1 ? `${name}:${port}` : name, service: { kind: "tunnel", name } });
+        }
+      }
+      const sessionIds = /* @__PURE__ */ new Set([...Object.keys(loadSessionIndex()), ...desiredBySession.keys()]);
+      for (const sessionId of sessionIds) {
+        try {
+          const dir = loadSessionIndex()[sessionId]?.directory;
+          if (!dir) continue;
+          const configPath = getSvampConfigPath(dir, sessionId);
+          const config = readSvampConfig(configPath);
+          const desired = desiredBySession.get(sessionId) ?? [];
+          if (reconcileServiceLinksExact(config, ["serve", "tunnel"], desired)) {
+            writeSvampConfig(configPath, config);
+            logger.log(`[launchpad] Reconciled service links for session ${sessionId} (${desired.length} live)`);
+          }
+        } catch (err) {
+          logger.log(`[launchpad] Reconcile failed for session ${sessionId}: ${err?.message || err}`);
+        }
+      }
+    } catch (err) {
+      logger.log(`[launchpad] Service-link sweep failed: ${err?.message || err}`);
+    }
+  }
+  let serviceLinkReconcileTimer;
+  function scheduleServiceLinkReconcile(delayMs = 1200) {
+    if (serviceLinkReconcileTimer) clearTimeout(serviceLinkReconcileTimer);
+    serviceLinkReconcileTimer = setTimeout(() => {
+      serviceLinkReconcileTimer = void 0;
+      void reconcileAllServiceLinks();
+    }, delayMs);
+  }
   async function createExposedTunnel(spec) {
     const { FrpcTunnel } = await Promise.resolve().then(function () { return frpc; });
     const tunnel = new FrpcTunnel({
@@ -20469,8 +20857,18 @@ async function startDaemon(options) {
   ensureAutoInstalledCommands(logger);
   (async () => {
     try {
-      const { beginClaudeVersionReconcile } = await import('./pinnedClaudeCode-BO0Qs_kE.mjs');
-      beginClaudeVersionReconcile((msg) => logger.log(msg));
+      const { beginClaudeVersionReconcile, CLAUDE_VERSION_RECHECK_MS } = await import('./pinnedClaudeCode-C43KnZ-Q.mjs');
+      const onResult = (result) => {
+        if (result?.kind === "install-failed" || result?.kind === "skipped" || result?.kind === "not-installed") {
+          logger.log(`[claude-version] WARNING \u2014 machine is NOT on the pinned Claude Code (${result.kind}). Sessions are running an untested build.`);
+        }
+      };
+      beginClaudeVersionReconcile((msg) => logger.log(msg), { onResult });
+      const jitter = Math.floor(Math.random() * 5 * 6e4);
+      const timer = setInterval(() => {
+        beginClaudeVersionReconcile((msg) => logger.log(msg), { onResult });
+      }, CLAUDE_VERSION_RECHECK_MS + jitter);
+      timer.unref?.();
     } catch (e) {
       logger.log(`[claude-version] check failed: ${e?.message || e}`);
     }
@@ -20963,7 +21361,7 @@ ${v.guidance ? v.guidance + "\n" : ""}Criteria: ${v.criteria || "(none)"}
           const cwd = sessionMetadata.path || directory;
           const model = process.env.SVAMP_TOPIC_MODEL;
           try {
-            const forkEnv = { ...process.env, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1" };
+            const forkEnv = { ...process.env, CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", DISABLE_AUTOUPDATER: "1" };
             applyClaudeProxyEnv(forkEnv);
             const child = spawn("claude", [
               "--print",
@@ -21402,6 +21800,9 @@ ${parts.join("\n")}`);
         let autoCompactWasAutoInjected = false;
         let autoCompactDisabled = false;
         let autoCompactRecoveryTried = false;
+        let justCompactedTurn = false;
+        let compactNoBoundaryStrikes = 0;
+        let compactSupported = void 0;
         let noIsolationWarned = false;
         const RATELIMIT_CFG = getRateLimitRetryConfig();
         let currentTurnMessage;
@@ -21847,15 +22248,30 @@ ${parts.join("\n")}`);
                       pendingCompactTurn = false;
                       const wasAuto = autoCompactWasAutoInjected;
                       autoCompactWasAutoInjected = false;
-                      if (wasAuto) {
+                      const d = decideCompactUnsupported({
+                        wasAutoInjected: wasAuto,
+                        turnErrored: !!msg.is_error,
+                        compactSupported,
+                        priorStrikes: compactNoBoundaryStrikes,
+                        maxStrikes: DEFAULT_COMPACT_NO_BOUNDARY_STRIKES
+                      });
+                      compactNoBoundaryStrikes = d.strikes;
+                      if (d.disable) {
                         autoCompactDisabled = true;
-                        logger.log(`[Session ${sessionId}] Auto /compact unsupported by this Claude Code \u2014 disabling the auto-compaction backstop for this session`);
+                        logger.log(`[Session ${sessionId}] Disabling the auto-compaction backstop for this session (${d.reason})`);
+                      }
+                      logger.log(`[Session ${sessionId}] /compact produced no compaction boundary (reason=${d.reason}, strikes=${d.strikes}, supported=${String(compactSupported)}, errored=${!!msg.is_error})`);
+                      if (d.warnUnsupported) {
+                        sessionService.pushMessage(
+                          { type: "message", message: compactUnsupportedWarning(), level: "warning" },
+                          "event"
+                        );
+                      } else if (wasAuto && d.reason !== "errored-turn") {
+                        sessionService.pushMessage(
+                          { type: "message", message: describeNoBoundary(d.strikes, DEFAULT_COMPACT_NO_BOUNDARY_STRIKES), level: "warning" },
+                          "event"
+                        );
                       }
-                      logger.log(`[Session ${sessionId}] /compact produced no compaction boundary \u2014 Claude Code likely too old to handle it in stream-json mode`);
-                      sessionService.pushMessage(
-                        { type: "message", message: compactUnsupportedWarning(), level: "warning" },
-                        "event"
-                      );
                     }
                     if (!msg.is_error) {
                       resetRateLimitStreak();
@@ -21946,7 +22362,15 @@ ${parts.join("\n")}`);
                       logger.log(`[Session ${sessionId}] ${taskInfo}`);
                       sessionService.pushMessage({ type: "session_event", message: taskInfo }, "session");
                     }
-                    if (!msg.is_error && !pendingCompactTurn && !autoCompactDisabled && autoCompactEnabled) {
+                    const mayEvaluateLayer1 = shouldEvaluateProactiveCompaction({
+                      justCompacted: justCompactedTurn,
+                      compactPending: pendingCompactTurn,
+                      turnErrored: !!msg.is_error,
+                      disabled: autoCompactDisabled,
+                      enabled: autoCompactEnabled
+                    });
+                    justCompactedTurn = false;
+                    if (mayEvaluateLayer1) {
                       try {
                         const observed = computeObservedContext(msg.usage);
                         const decision = decideProactiveCompaction({
@@ -22010,6 +22434,7 @@ ${parts.join("\n")}`);
                   userMessagePending = false;
                   if (msg.slash_commands && Array.isArray(msg.slash_commands)) {
                     sessionMetadata = { ...sessionMetadata, slashCommands: msg.slash_commands };
+                    compactSupported = compactSupportedFromSlashCommands(msg.slash_commands);
                   }
                   if (typeof msg.model === "string" && msg.model.length > 0) {
                     lastMainModel = msg.model;
@@ -22063,6 +22488,8 @@ ${parts.join("\n")}`);
                   pendingCompactTurn = false;
                   autoCompactWasAutoInjected = false;
                   autoCompactRecoveryTried = false;
+                  justCompactedTurn = true;
+                  compactNoBoundaryStrikes = 0;
                   const compactLine = describeCompaction(msg.compact_metadata);
                   logger.log(`[Session ${sessionId}] ${compactLine}`);
                   sessionService.pushMessage(
@@ -22879,11 +23306,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CVBhR9Cj.mjs');
+              const { issueRpc } = await import('./rpc-UomHF39a.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-OmhzsDGP.mjs');
+              const { workflowRpc } = await import('./rpc-CoPRGZkJ.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23103,13 +23530,28 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
                 active: true,
                 phase: "continue",
                 iteration: 0,
+                started_at: rearmStartedAt(s.started_at, s.completed_at, Date.now()),
+                // #1170
                 completed_at: void 0,
                 gave_up_reason: void 0,
                 verify_errors: 0,
                 // fresh verification budget on re-arm
                 stall_hinted: false,
-                resumed_at: Date.now()
+                resumed_at: Date.now(),
                 // #0156: re-arm the stall hint
+                // A re-arm starts a NEW work batch, so the previous batch's progress
+                // baseline must not carry over. assessLoopProgress tracks a MONOTONIC
+                // MINIMUM over the retained history, and a durable loop only parks
+                // dormant once the oracle reads 0 pending — so the old tail is
+                // `pending: 0` and best === 0 forever. Without this reset the first
+                // new marker (pending >= 1) can never beat it, the loop reads STUCK
+                // from checkpoint 3 onward while it is genuinely resolving issues,
+                // `auto_resumes` never resets (updateLoopProgress keys that off the
+                // same signal), and the finite #0958 cap burns down to a terminal
+                // gave_up. That contradicts the invariant that a slow-but-PRODUCTIVE
+                // loop is never killed by the cap.
+                progress_history: [],
+                auto_resumes: 0
               });
             } catch {
             }
@@ -23591,11 +24033,11 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
               });
             },
             onIssue: async (params) => {
-              const { issueRpc } = await import('./rpc-CVBhR9Cj.mjs');
+              const { issueRpc } = await import('./rpc-UomHF39a.mjs');
               return issueRpc(params?.cwd || directory, params || {}, { notifySession: notifyIssueOwner, rekickLoopOwner });
             },
             onWorkflow: async (params) => {
-              const { workflowRpc } = await import('./rpc-OmhzsDGP.mjs');
+              const { workflowRpc } = await import('./rpc-CoPRGZkJ.mjs');
               return workflowRpc(params?.cwd || directory, params || {});
             },
             onRipgrep: async (args, cwd) => {
@@ -23938,7 +24380,7 @@ ${capturedError}${buildClaudeErrorHint(capturedError)}`;
           };
           try {
             if (!ls.acp_budget_warned && acpCumTokens === 0 && (ledger?.turns || 0) >= 1 && ls.budget && (ls.budget.max_tokens || ls.budget.max_tokens_per_hour)) {
-              sessionService.pushMessage({ type: "message", message: "\u26A0\uFE0F A token/rate cost cap (--max-tokens / --max-tokens-per-hour) is INERT for this agent \u2014 it exposes no token usage, so this loop is bounded only by --max (iterations) and --max-runtime-sec. Set one of those to cap cost.", level: "warning" }, "event");
+              sessionService.pushMessage({ type: "message", message: "\u26A0\uFE0F The token/rate cost cap (--max-tokens-per-hour) is INERT for this agent \u2014 it exposes no token usage, so this loop is bounded only by --max (iterations) and --max-runtime-sec. Set one of those to cap cost.", level: "warning" }, "event");
               ls.acp_budget_warned = true;
             }
             const acpMaxExt = resolveMaxExtensions(process.env.SVAMP_LOOP_MAX_EXTENSIONS);
@@ -24259,7 +24701,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       const wasInMemory = teardownTrackedSession(sessionId);
       idleTriggerTracker.forget(sessionId);
       const markedArchived = markSessionAsArchived(sessionId);
-      if (loopDir && isLoopActiveForSession(loopDir, sessionId)) {
+      if (loopDir && loopExistsForSession(loopDir, sessionId)) {
         deactivateLoop(loopDir, sessionId);
         logger.log(`Deactivated loop for archived session ${sessionId}`);
       }
@@ -24317,7 +24759,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       teardownTrackedSession(sessionId);
       idleTriggerTracker.forget(sessionId);
       deletePersistedSession(sessionId);
-      if (loopDir && isLoopActiveForSession(loopDir, sessionId)) {
+      if (loopDir && loopExistsForSession(loopDir, sessionId)) {
         deactivateLoop(loopDir, sessionId);
       }
       logger.log(`Session ${sessionId} deleted`);
@@ -24460,7 +24902,11 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       sharingNotificationSync,
       persistExposedTunnel,
       forgetExposedTunnel,
-      listExposedTunnels: () => loadExposedTunnels().map((t) => ({ name: t.name, ports: t.ports, group: t.group, sessionId: t.sessionId, addedAt: t.addedAt }))
+      listExposedTunnels: () => loadExposedTunnels().map((t) => ({ name: t.name, ports: t.ports, group: t.group, sessionId: t.sessionId, addedAt: t.addedAt })),
+      dropTunnelSessionLink: (sessionId, tunnelName) => {
+        void dropTunnelSessionLink(sessionId, tunnelName);
+      },
+      scheduleServiceLinkReconcile: () => scheduleServiceLinkReconcile()
     });
     const machineService = await registerMachineService(
       server,
@@ -24592,6 +25038,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       } catch (err) {
         logger.log(`[serve] mount link reconcile failed: ${err?.message || err}`);
       }
+      scheduleServiceLinkReconcile(3e3);
     }).catch((err) => logger.error(`[serve] mount restore failed: ${err?.message || err}`));
     const daemonOwnerEmail = parseJwtEmail(process.env.HYPHA_TOKEN || "") || null;
     serveManager$1.setSessionResolver((sessionId) => {
@@ -24658,7 +25105,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         try {
           for (const ent of readdirSync$1(join(p.directory, ".svamp"), { withFileTypes: true })) {
             if (!ent.isDirectory() || knownSessionIds.has(ent.name)) continue;
-            const owner = loopOwnerSession(p.directory, ent.name);
+            const owner = loopOwnerSessionIncludingDormant(p.directory, ent.name);
             if (owner && !knownSessionIds.has(owner)) {
               deactivateLoop(p.directory, ent.name);
               logger.log(`[loop] Deactivated stale loop-state for ${ent.name} in ${p.directory} (owner no longer known)`);
@@ -24666,7 +25113,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
           }
         } catch {
         }
-        const legacyOwner = loopOwnerSession(p.directory);
+        const legacyOwner = loopOwnerSessionIncludingDormant(p.directory);
         if (legacyOwner && !knownSessionIds.has(legacyOwner)) {
           deactivateLoop(p.directory);
           logger.log(`[loop] Deactivated stale legacy loop-state in ${p.directory} (owner session ${legacyOwner} no longer known)`);
@@ -24675,7 +25122,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (persistedSessions.length > 0) {
       try {
-        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-BO0Qs_kE.mjs');
+        const { awaitClaudeVersionReady } = await import('./pinnedClaudeCode-C43KnZ-Q.mjs');
         await awaitClaudeVersionReady();
       } catch {
       }
@@ -24727,7 +25174,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
                 try {
                   const lp = join(getLoopDir(persisted.directory, persisted.sessionId), "loop-state.json");
                   const cur = readLoopState(persisted.directory, persisted.sessionId);
-                  if (cur) atomicWriteLoopState(lp, { ...cur, active: true, phase: "continue", completed_at: void 0, verify_errors: 0, resumed_at: Date.now() });
+                  if (cur) atomicWriteLoopState(lp, { ...cur, active: true, phase: "continue", completed_at: void 0, verify_errors: 0, resumed_at: Date.now(), progress_history: [], auto_resumes: 0 });
                 } catch {
                 }
               }
@@ -24865,13 +25312,16 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     }
     if (sessionsToLoopResume.length > 0 && !options?.noAutoContinue) {
       logger.log(`Resuming loop for ${sessionsToLoopResume.length} session(s)...`);
-      for (const { sessionId, directory: sessDir } of sessionsToLoopResume) {
+      const LOOP_RESUME_STEP_MS = Number(process.env.SVAMP_AUTO_CONTINUE_STEP_MS) || 300;
+      const LOOP_RESUME_MAX_SPREAD_MS = Number(process.env.SVAMP_AUTO_CONTINUE_MAX_SPREAD_MS) || 6e4;
+      sessionsToLoopResume.forEach(({ sessionId, directory: sessDir }, loopResumeIndex) => {
+        const loopResumeDelay = 2e3 + Math.min(loopResumeIndex * LOOP_RESUME_STEP_MS, LOOP_RESUME_MAX_SPREAD_MS) + Math.floor(Math.random() * LOOP_RESUME_STEP_MS);
         try {
           const tracked = Array.from(pidToTrackedSession.values()).find((s) => s.svampSessionId === sessionId);
           const rpc = tracked?.sessionRPCHandlers;
           if (!rpc) {
             logger.log(`Session ${sessionId} RPC handlers not found for loop resume`);
-            continue;
+            return;
           }
           const loopTurnFingerprint = () => {
             try {
@@ -24897,7 +25347,7 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
               if (!isLoopActiveForSession(sessDir, sessionId)) return;
               const fpBefore = loopTurnFingerprint();
               await sendResume("");
-              const graceMs = Math.max(5e3, Number(process.env.SVAMP_LOOP_RESUME_WATCHDOG_MS) || 45e3);
+              const graceMs = Math.max(5e3, Number(process.env.SVAMP_LOOP_RESUME_WATCHDOG_MS) || 45e3) + Math.min(loopResumeIndex * LOOP_RESUME_STEP_MS, LOOP_RESUME_MAX_SPREAD_MS);
               setTimeout(() => {
                 try {
                   if (!isLoopActiveForSession(sessDir, sessionId)) return;
@@ -24914,11 +25364,11 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
             } catch (err) {
               logger.log(`Failed to resume loop for session ${sessionId}: ${err.message}`);
             }
-          }, 2e3);
+          }, loopResumeDelay);
         } catch (err) {
           logger.log(`Failed to find session service for loop resume ${sessionId}: ${err.message}`);
         }
-      }
+      });
     }
     (async () => {
       try {
@@ -24928,27 +25378,17 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
         logger.log(`[ARTIFACT SYNC] Background init failed: ${err.message}`);
       }
     })();
-    let appToken;
-    try {
-      appToken = await server.generateToken({});
-      logger.log(`App connection token generated`);
-    } catch (err) {
-      logger.log("Could not generate token (server may not support it):", err);
-    }
     console.log("Svamp daemon started successfully!");
     console.log(`  Machine ID: ${machineId}`);
     console.log(`  Hypha server: ${hyphaServerUrl}`);
     console.log(`  Workspace: ${server.config.workspace}`);
-    if (appToken) {
-      console.log(`  App token: ${appToken}`);
-    }
     console.log(`  Service: svamp-machine-${machineId}`);
     console.log(`  Log file: ${logger.logFilePath}`);
     const HEARTBEAT_INTERVAL_MS = 1e4;
     const PING_TIMEOUT_MS = 15e3;
     const POST_RECONNECT_GRACE_MS = 2e4;
     const RECONNECT_JITTER_MS = 2500;
-    const { WorkflowScheduler } = await import('./scheduler-DDw3YLzH.mjs');
+    const { WorkflowScheduler } = await import('./scheduler-gMWmsAgp.mjs');
     const workflowProjectRoots = () => {
       const dirs = /* @__PURE__ */ new Set();
       for (const s of pidToTrackedSession.values()) {
@@ -24987,6 +25427,9 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
     };
     runOAuthAccountRefresh();
     const backendAccountRefreshInterval = setInterval(runOAuthAccountRefresh, 5 * 6e4);
+    const serviceLinkSweepInterval = setInterval(() => {
+      void reconcileAllServiceLinks();
+    }, 6e4);
     let heartbeatRunning = false;
     let heartbeatCycle = 0;
     const heartbeatInterval = setInterval(async () => {
@@ -25239,6 +25682,8 @@ ${oracle.output.trim().slice(0, 500)}`, "\u{1F501} Continuing loop");
       clearInterval(heartbeatInterval);
       clearInterval(workflowSchedulerInterval);
       clearInterval(backendAccountRefreshInterval);
+      clearInterval(serviceLinkSweepInterval);
+      if (serviceLinkReconcileTimer) clearTimeout(serviceLinkReconcileTimer);
       if (proxyTokenRefreshInterval) clearInterval(proxyTokenRefreshInterval);
       if (oauthRefreshInterval) clearInterval(oauthRefreshInterval);
       if (unhandledRejectionResetTimer) clearTimeout(unhandledRejectionResetTimer);
@@ -25583,4 +26028,4 @@ var run = /*#__PURE__*/Object.freeze({
     writeStopMarker: writeStopMarker
 });
 
-export { downloadSkillFile as $, validateWorkflowName as A, saveWorkflow as B, rawWorkflow as C, listWorkflows as D, isWorkflowEnabled as E, workflowSchedules as F, inZone as G, cronMatches as H, summarize as I, workflowSteps as J, parseJwtEmail as K, computeCollectionConfigUpdate as L, SYSTEM_COLLECTION_CONFIG as M, loadMachineContext as N, buildMachineInstructions as O, machineToolsForRole as P, buildMachineTools as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, parseFrontmatter as T, getSkillsServer as U, getSkillsWorkspaceName as V, getSkillsCollectionName as W, fetchWithTimeout as X, searchSkills as Y, SKILLS_DIR as Z, getSkillInfo as _, createSessionStore as a, listSkillFiles as a0, resolveModel as a1, formatHandle as a2, normalizeAllowedUser as a3, loadSecurityContextConfig as a4, resolveSecurityContext as a5, buildSecurityContextFromFlags as a6, mergeSecurityContexts as a7, buildSessionShareUrl as a8, computeOutboundHop as a9, kimiProvider as aA, kimiSetup as aB, api as aC, supervisorLock as aD, run as aE, registerAwaitingReply as aa, buildMachineShareUrl as ab, parseHandle as ac, handleMatchesMetadata as ad, PINNED_CODEX_VERSION as ae, clearStopMarker as af, stopMarkerExists as ag, withFileLock as ah, describeMisconfiguration as ai, buildMachineDeps as aj, applyClaudeProxyEnv as ak, composeSessionId as al, generateFriendlyName as am, generateHookSettings as an, instanceConfig as ao, frpc as ap, staticFileServer as aq, claudeAuth as ar, codexProvider as as, projectInfo as at, DefaultTransport$1 as au, acpBackend as av, acpAgentConfig as aw, codexAppServerBackend as ax, GeminiTransport$1 as ay, KimiTransport$1 as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, shortId as e, resolveProjectRoot as f, getHyphaServerUrl$1 as g, getIssue as h, resumeIssue as i, addComment as j, addIssue as k, listIssues as l, isPendingIssue as m, searchIssues as n, isVisibleTo as o, pauseIssue as p, getRun as q, registerMachineService as r, startDaemon as s, listRuns as t, updateIssue as u, getWorkflow as v, runWorkflow as w, setWorkflowEnabled as x, removeWorkflow as y, validateCronExpr as z };
+export { SKILLS_DIR as $, validateCronExpr as A, validateWorkflowName as B, saveWorkflow as C, rawWorkflow as D, listWorkflows as E, isWorkflowEnabled as F, workflowSchedules as G, inZone as H, cronMatches as I, summarize as J, workflowSteps as K, describeNextFire as L, parseJwtEmail as M, computeCollectionConfigUpdate as N, SYSTEM_COLLECTION_CONFIG as O, loadMachineContext as P, buildMachineInstructions as Q, READ_ONLY_TOOLS as R, SharingNotificationSync as S, machineToolsForRole as T, buildMachineTools as U, parseFrontmatter as V, getSkillsServer as W, getSkillsWorkspaceName as X, getSkillsCollectionName as Y, fetchWithTimeout as Z, searchSkills as _, createSessionStore as a, getSkillInfo as a0, downloadSkillFile as a1, listSkillFiles as a2, resolveModel as a3, formatHandle as a4, normalizeAllowedUser as a5, loadSecurityContextConfig as a6, resolveSecurityContext as a7, buildSecurityContextFromFlags as a8, mergeSecurityContexts as a9, GeminiTransport$1 as aA, KimiTransport$1 as aB, kimiProvider as aC, kimiSetup as aD, api as aE, supervisorLock as aF, run as aG, buildSessionShareUrl as aa, computeOutboundHop as ab, registerAwaitingReply as ac, buildMachineShareUrl as ad, parseHandle as ae, handleMatchesMetadata as af, PINNED_CODEX_VERSION as ag, clearStopMarker as ah, stopMarkerExists as ai, withFileLock as aj, describeMisconfiguration as ak, buildMachineDeps as al, applyClaudeProxyEnv as am, composeSessionId as an, generateFriendlyName as ao, generateHookSettings as ap, instanceConfig as aq, frpc as ar, staticFileServer as as, claudeAuth as at, codexProvider as au, projectInfo as av, DefaultTransport$1 as aw, acpBackend as ax, acpAgentConfig as ay, codexAppServerBackend as az, stopDaemon as b, connectToHypha as c, daemonStatus as d, shortId as e, resolveProjectRoot as f, getHyphaServerUrl$1 as g, getIssue as h, checkVerifyCommand as i, resumeIssue as j, addComment as k, addIssue as l, listIssues as m, isPendingIssue as n, searchIssues as o, pauseIssue as p, isVisibleTo as q, registerMachineService as r, startDaemon as s, getRun as t, updateIssue as u, listRuns as v, getWorkflow as w, runWorkflow as x, setWorkflowEnabled as y, removeWorkflow as z };