svamp-cli 0.2.341 → 0.2.346

package/dist/serveAuth-DbVLRCRR.mjs

@@ -0,0 +1,418 @@
+const AUTH0_NAMESPACES = ["https://api.imjoy.io/", "https://amun.ai/"];
+const COOKIE_NAME = "svamp_serve_token";
+const SVAMP_SERVE_TOKEN_PARAM = "__svamp_serve_token";
+function stripServeAuthCookie(cookieHeader) {
+  if (!cookieHeader) return cookieHeader;
+  const kept = cookieHeader.split(";").map((s) => s.trim()).filter((s) => s && !s.toLowerCase().startsWith(COOKIE_NAME + "="));
+  return kept.length ? kept.join("; ") : void 0;
+}
+function stripServeTokenParam(pathWithQuery) {
+  const qIdx = pathWithQuery.indexOf("?");
+  if (qIdx < 0) return pathWithQuery;
+  const base = pathWithQuery.slice(0, qIdx);
+  const params = new URLSearchParams(pathWithQuery.slice(qIdx + 1));
+  params.delete(SVAMP_SERVE_TOKEN_PARAM);
+  const qs = params.toString();
+  return qs ? `${base}?${qs}` : base;
+}
+function sanitizeLoginReturn(returnUrl) {
+  const PLACEHOLDER = "https://svamp.invalid";
+  if (typeof returnUrl !== "string" || returnUrl.length === 0) return "/";
+  if (returnUrl.includes("\\")) return "/";
+  let u;
+  try {
+    u = new URL(returnUrl, PLACEHOLDER);
+  } catch {
+    return "/";
+  }
+  if (u.origin !== PLACEHOLDER) return "/";
+  if (!u.pathname.startsWith("/") || u.pathname.startsWith("//")) return "/";
+  if (u.pathname === "/__login__" || u.pathname.startsWith("/__login__/")) return "/";
+  return u.pathname + u.search + u.hash;
+}
+function sanitizeForwardHeaders(headers) {
+  const out = { ...headers };
+  const cleaned = stripServeAuthCookie(typeof out.cookie === "string" ? out.cookie : void 0);
+  if (cleaned === void 0) delete out.cookie;
+  else out.cookie = cleaned;
+  delete out.authorization;
+  return out;
+}
+const DEFAULT_CACHE_TTL_MS = 5 * 60 * 1e3;
+const DEFAULT_CACHE_MAX_SIZE = 1e3;
+function jsStringLiteral(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c").replace(/>/g, "\\u003e").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+class TokenCache {
+  cache = /* @__PURE__ */ new Map();
+  ttlMs;
+  maxSize;
+  constructor(ttlMs = DEFAULT_CACHE_TTL_MS, maxSize = DEFAULT_CACHE_MAX_SIZE) {
+    this.ttlMs = ttlMs;
+    this.maxSize = maxSize;
+  }
+  get(token) {
+    const info = this.cache.get(token);
+    if (!info) return null;
+    if (Date.now() > info.expiresAt) {
+      this.cache.delete(token);
+      return null;
+    }
+    this.cache.delete(token);
+    this.cache.set(token, info);
+    return info;
+  }
+  set(token, email) {
+    if (this.cache.size >= this.maxSize) {
+      const oldest = this.cache.keys().next().value;
+      if (oldest) this.cache.delete(oldest);
+    }
+    const ttlExpiry = Date.now() + this.ttlMs;
+    const jwtExpMs = parseJwtExpMs(token);
+    this.cache.set(token, {
+      email,
+      expiresAt: jwtExpMs !== null ? Math.min(ttlExpiry, jwtExpMs) : ttlExpiry
+    });
+  }
+  clear() {
+    this.cache.clear();
+  }
+}
+function hasCookieToken(req) {
+  return !!parseCookies(req.headers.cookie || "")[COOKIE_NAME];
+}
+function extractToken(req) {
+  const cookies = parseCookies(req.headers.cookie || "");
+  if (cookies[COOKIE_NAME]) return cookies[COOKIE_NAME];
+  const auth = req.headers.authorization;
+  if (auth?.startsWith("Bearer ") || auth?.startsWith("bearer ")) {
+    return auth.slice(7).trim();
+  }
+  const url = new URL(req.url || "/", "http://localhost");
+  return url.searchParams.get(SVAMP_SERVE_TOKEN_PARAM);
+}
+function parseCookies(header) {
+  const cookies = {};
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    if (eq > 0) {
+      const key = pair.slice(0, eq).trim();
+      const value = pair.slice(eq + 1).trim();
+      cookies[key] = value;
+    }
+  }
+  return cookies;
+}
+function parseJwtExpMs(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf-8"));
+    return typeof payload.exp === "number" ? payload.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+function parseJwtEmail(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf-8")
+    );
+    if (payload.exp && payload.exp * 1e3 < Date.now()) return null;
+    for (const ns of AUTH0_NAMESPACES) {
+      const email = payload[ns + "email"];
+      if (typeof email === "string" && email) return email.toLowerCase();
+    }
+    if (typeof payload.email === "string" && payload.email) return payload.email.toLowerCase();
+    return null;
+  } catch {
+    return null;
+  }
+}
+function isStructurallyLiveJwt(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return false;
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf-8")
+    );
+    if (payload.exp && payload.exp * 1e3 < Date.now()) return false;
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function verifyTokenViaHypha(token, hyphaServerUrl) {
+  try {
+    const baseUrl = hyphaServerUrl.replace(/\/$/, "");
+    const url = `${baseUrl}/public/services/ws/parse_token`;
+    const resp = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ token }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!resp.ok) return null;
+    const data = await resp.json();
+    if (data?.is_anonymous === true) return null;
+    const email = data?.email;
+    if (typeof email === "string" && email) return email.toLowerCase();
+    return null;
+  } catch {
+    return null;
+  }
+}
+class ServeAuth {
+  cache;
+  hyphaServerUrl;
+  constructor(options) {
+    this.hyphaServerUrl = options.hyphaServerUrl.replace(/\/$/, "");
+    this.cache = new TokenCache(
+      options.cacheTtlMs || DEFAULT_CACHE_TTL_MS,
+      options.cacheMaxSize || DEFAULT_CACHE_MAX_SIZE
+    );
+  }
+  /**
+   * Authenticate a request and return the user's email, or null if not authenticated.
+   */
+  async authenticate(req) {
+    const token = extractToken(req);
+    if (!token) return null;
+    const cached = this.cache.get(token);
+    if (cached) return cached.email;
+    if (!isStructurallyLiveJwt(token)) return null;
+    const serverEmail = await verifyTokenViaHypha(token, this.hyphaServerUrl);
+    if (serverEmail) {
+      this.cache.set(token, serverEmail);
+      return serverEmail;
+    }
+    return null;
+  }
+  /**
+   * Check if a user email is authorized for a mount's access level.
+   * Note: 'link' mounts are gated by the auth proxy at the path-segment
+   * level (capability token), not by this method — they should never reach
+   * here. We treat them as deny-by-default just in case.
+   */
+  isAuthorized(email, access, ownerEmail) {
+    if (access === "public") return true;
+    if (access === "link") return false;
+    if (!email) return false;
+    if (access === "owner") {
+      return !!ownerEmail && email.toLowerCase() === ownerEmail.toLowerCase();
+    }
+    return access.some((e) => e.toLowerCase() === email.toLowerCase());
+  }
+  /**
+   * Generate the login page HTML.
+   *
+   * Uses the Hypha-Login HTTP endpoints directly (no SDK / no WebSocket):
+   *   1. GET  /public/services/hypha-login/start          → { login_url, key }
+   *   2. open popup to login_url so the user signs in
+   *   3. GET  /public/services/hypha-login/check?key=…    → token (long-polled)
+   *
+   * This matches the proven pattern in svamp-app/.../share/[id].tsx and
+   * removes a class of hangs we previously saw when the JS SDK never
+   * invoked its `login_callback` (button-stuck-after-click symptom).
+   */
+  getLoginPageHtml(redirectUrl) {
+    return `<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in \u2014 Svamp File Server</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;background:#f6f8fa;color:#24292f;padding:16px}
+.card{background:#fff;border:1px solid #d0d7de;border-radius:12px;padding:32px;max-width:420px;width:100%;text-align:center;box-shadow:0 4px 12px rgba(31,35,40,0.06)}
+h1{font-size:1.25rem;margin-bottom:8px}
+.subtitle{color:#656d76;font-size:0.9rem;margin-bottom:24px}
+button{background:#0969da;color:#fff;border:none;border-radius:8px;padding:12px 24px;font-size:1rem;cursor:pointer;font-weight:500;width:100%}
+button:hover{background:#0860c4}
+button:disabled{background:#94d3a2;cursor:wait}
+.status{margin-top:16px;color:#656d76;font-size:0.85rem;min-height:20px;word-break:break-word}
+.error{color:#cf222e}
+.ok{color:#1a7f37}
+a{color:#0969da;text-decoration:none}
+a:hover{text-decoration:underline}
+</style>
+</head><body>
+<div class="card">
+  <h1>Sign in required</h1>
+  <p class="subtitle">This resource is private. Sign in with your Hypha account to continue.</p>
+  <button id="login-btn">Sign in with Hypha</button>
+  <div class="status" id="status"></div>
+</div>
+<script>
+const hyphaServer = ${jsStringLiteral(this.hyphaServerUrl)};
+const redirectUrl = ${jsStringLiteral(redirectUrl)};
+const cookieName = ${jsStringLiteral(COOKIE_NAME)};
+const tokenParam = ${jsStringLiteral(SVAMP_SERVE_TOKEN_PARAM)};
+
+const btn = document.getElementById('login-btn');
+const statusEl = document.getElementById('status');
+
+function setError(msg) {
+    statusEl.innerHTML = '<span class="error">' + msg + '</span>';
+    btn.disabled = false;
+}
+
+btn.addEventListener('click', async () => {
+    // Open the popup SYNCHRONOUSLY inside the click handler so the browser's
+    // popup blocker treats it as user-initiated. The HTTP request below is
+    // awaited, by which time the user-gesture flag has cleared and any
+    // window.open() call would be silently blocked.
+    const popup = window.open('about:blank', '_blank');
+    if (!popup) {
+        setError('Popup was blocked by the browser. Please allow popups for this site and retry.');
+        return;
+    }
+    try { popup.document.write('<html><body style="font-family:system-ui;padding:24px;color:#656d76">Opening Hypha sign-in\u2026</body></html>'); } catch (e) {}
+
+    btn.disabled = true;
+    statusEl.textContent = 'Contacting Hypha\u2026';
+
+    try {
+        // 1. Ask the Hypha-Login service for a login URL + polling key.
+        const startResp = await fetch(hyphaServer + '/public/services/hypha-login/start');
+        if (!startResp.ok) throw new Error('Login start failed: HTTP ' + startResp.status);
+        const ctx = await startResp.json();
+        if (!ctx || !ctx.login_url || !ctx.key) throw new Error('Login start returned no URL/key');
+
+        // 2. Redirect the popup to the actual login UI.
+        statusEl.textContent = 'Waiting for you to sign in\u2026';
+        try { popup.location.href = ctx.login_url; }
+        catch (e) { window.open(ctx.login_url, '_blank'); }
+
+        // 3. Long-poll the check endpoint until the user finishes signing in.
+        //    Each request waits up to 3 s server-side; we retry for ~3 minutes total.
+        const checkBase = hyphaServer + '/public/services/hypha-login/check';
+        let token = null;
+        for (let i = 0; i < 60; i++) {
+            if (popup.closed) {
+                // User dismissed the popup before completing \u2014 keep polling briefly
+                // (the report endpoint may still fire even if window is gone).
+            }
+            try {
+                const r = await fetch(checkBase + '?key=' + encodeURIComponent(ctx.key) + '&timeout=3');
+                if (r.ok) {
+                    const body = await r.json();
+                    const t = typeof body === 'string' ? body : (body && (body.token || body));
+                    if (typeof t === 'string' && t.length > 20) { token = t; break; }
+                }
+            } catch (e) { /* transient \u2014 retry */ }
+        }
+
+        if (!token) throw new Error('Timed out waiting for sign-in. Please try again.');
+
+        // 4. Set the cookie so subsequent requests to this origin are authenticated.
+        //    Over HTTPS use SameSite=None; Secure so the cookie is still sent when
+        //    this page is framed cross-site (e.g. embedded as an <artifact> iframe
+        //    in the Svamp app) \u2014 SameSite=Lax would be dropped in that third-party
+        //    context. Fall back to Lax on plain HTTP (SameSite=None requires Secure).
+        const isHttps = location.protocol === 'https:';
+        const sameSite = isHttps ? '; SameSite=None; Secure' : '; SameSite=Lax';
+        document.cookie = cookieName + '=' + token + '; path=/' + sameSite;
+
+        // Also carry the token in the redirect URL as a fallback: browsers that
+        // block third-party cookies entirely (Safari ITP, Chrome 3p-cookie
+        // phaseout) won't send the cookie above when we're framed cross-site, but
+        // the proxy also accepts the param on the request. Harmless when the
+        // cookie works \u2014 extractToken() prefers the cookie.
+        //
+        // Use the dedicated __svamp_serve_token name (not plain "token") so it
+        // can never collide with any token the originally-requested URL had
+        // for its own purposes. URLSearchParams handles encoding and preserves
+        // everything else (hash, other query params).
+        //
+        // #1492: this used to say "redirectUrl is always a validated same-origin path, so new URL()
+        // is safe" and then append the user's Hypha JWT to whatever came out. That assumption was
+        // false \u2014 the server validated the RAW ?return= string while this line normalizes it, and
+        // normalization can turn a string the server accepted into a protocol-relative cross-origin
+        // URL ('/..//evil.com' -> pathname '//evil.com'). The token then went to the attacker.
+        // The server-side guard is fixed (sanitizeLoginReturn), and we ALSO re-check here at the
+        // point of use: a security boundary should not depend on another layer's validation of a
+        // value it is about to act on, especially when that value carries a credential.
+        var u = new URL(redirectUrl, location.origin);
+        u.searchParams.set(tokenParam, token);
+        var dest = u.pathname + u.search + u.hash;
+        var finalUrl;
+        try { finalUrl = new URL(dest, location.origin); } catch (e) { finalUrl = null; }
+        if (!finalUrl || finalUrl.origin !== location.origin) {
+            var safe = new URL('/', location.origin);
+            safe.searchParams.set(tokenParam, token);
+            dest = safe.pathname + safe.search;
+        }
+
+        try { popup.close(); } catch (e) {}
+        statusEl.innerHTML = '<span class="ok">Signed in. Redirecting\u2026</span>';
+        setTimeout(() => { window.location.replace(dest); }, 300);
+    } catch (err) {
+        try { popup.close(); } catch (e) {}
+        setError('Login failed: ' + (err && err.message ? err.message : err));
+    }
+});
+<\/script>
+</body></html>`;
+  }
+  /**
+   * Render an "access denied" page for a request that IS authenticated (valid
+   * Hypha token) but whose email is not authorized for the mount — or for a
+   * misconfigured owner mount with no resolvable owner. This is served as a
+   * 403; it deliberately does NOT redirect to the login page, which would
+   * loop forever and tell the user nothing about why they were rejected.
+   */
+  getAccessDeniedHtml(opts) {
+    const { email, access, ownerEmail, misconfigured } = opts;
+    const loginHref = `/__login__?return=${encodeURIComponent(opts.returnUrl || "/")}`;
+    let requirement;
+    if (misconfigured) {
+      requirement = `This resource is set to <b>owner-only</b> access, but the server never resolved an owner email (the daemon authenticated with a token that has no email claim). No account can satisfy this \u2014 it is a server-side misconfiguration, not a problem with your account. Fix it by re-creating the mount with an explicit email allowlist, e.g. <code>access: ["${escapeHtml(email || "you@example.com")}"]</code>.`;
+    } else if (access === "owner") {
+      requirement = `This resource is restricted to its owner${ownerEmail ? ` (<code>${escapeHtml(ownerEmail)}</code>)` : ""}.`;
+    } else if (Array.isArray(access)) {
+      const list = access.map((e) => `<code>${escapeHtml(e)}</code>`).join(", ");
+      requirement = `This resource is restricted to: ${list}.`;
+    } else {
+      requirement = "This resource is restricted.";
+    }
+    const signedInLine = email ? `You are signed in as <code>${escapeHtml(email)}</code>, which is not on the allow list.` : `You are not signed in.`;
+    return `<!DOCTYPE html>
+<html><head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Access denied \u2014 Svamp File Server</title>
+<style>
+*{box-sizing:border-box;margin:0;padding:0}
+body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;background:#f6f8fa;color:#24292f;padding:16px}
+.card{background:#fff;border:1px solid #d0d7de;border-radius:12px;padding:32px;max-width:480px;width:100%;box-shadow:0 4px 12px rgba(31,35,40,0.06)}
+h1{font-size:1.25rem;margin-bottom:8px}
+.lead{color:#cf222e;font-weight:600;margin-bottom:16px}
+p{color:#3d444d;font-size:0.92rem;line-height:1.5;margin-bottom:14px}
+code{background:#f6f8fa;border:1px solid #d0d7de;border-radius:6px;padding:1px 6px;font-size:0.85em}
+a.btn{display:inline-block;background:#0969da;color:#fff;border-radius:8px;padding:10px 20px;font-weight:500;text-decoration:none;margin-top:4px}
+a.btn:hover{background:#0860c4}
+</style>
+</head><body>
+<div class="card">
+  <h1>${misconfigured ? "\u26D4 Access not possible" : "\u26D4 Access denied"}</h1>
+  <p class="lead">${signedInLine}</p>
+  <p>${requirement}</p>
+  ${misconfigured ? "" : `<a class="btn" href="${loginHref}">Sign in with a different account</a>`}
+</div>
+</body></html>`;
+  }
+  destroy() {
+    this.cache.clear();
+  }
+}
+function escapeHtml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+
+export { ServeAuth as S, stripServeTokenParam as a, sanitizeForwardHeaders as b, stripServeAuthCookie as c, hasCookieToken as h, parseJwtEmail as p, sanitizeLoginReturn as s };

package/dist/{serveCommands-DpF0xKvz.mjs → serveCommands-CUHUiYnZ.mjs}

@@ -1,27 +1,5 @@
 import * as path from 'path';
-import { w as wantsHelp } from './cli-pFCLXDrP.mjs';
-import './run-LHJh7jLy.mjs';
-import 'os';
-import 'fs/promises';
-import 'fs';
-import 'url';
-import 'child_process';
-import 'crypto';
-import 'node:fs';
-import 'node:path';
-import 'node:crypto';
-import 'node:child_process';
-import 'util';
-import 'http';
-import 'net';
-import 'node:os';
-import 'node:events';
-import '@agentclientprotocol/sdk';
-import 'node:util';
-import 'node:readline';
-import 'node:fs/promises';
-import 'yaml';
-import './serviceManager-hlOVxkhW.mjs';
+import { w as wantsHelp } from './wantsHelp-6bMOeNUz.mjs';
 
 function getFlag(args, flag) {
   const idx = args.indexOf(flag);
@@ -30,11 +8,12 @@ function getFlag(args, flag) {
 function hasFlag(args, ...flags) {
   return flags.some((f) => args.includes(f));
 }
+const VALUE_FLAGS = /* @__PURE__ */ new Set(["--access", "--machine", "-m", "--session"]);
 function positionalArgs(args) {
   const result = [];
   for (let i = 0; i < args.length; i++) {
     if (args[i].startsWith("-")) {
-      if (!args[i].startsWith("--no-") && i + 1 < args.length && !args[i + 1].startsWith("-")) {
+      if (VALUE_FLAGS.has(args[i]) && i + 1 < args.length && !args[i + 1].startsWith("-")) {
         i++;
       }
       continue;
@@ -77,7 +56,7 @@ async function handleServeCommand() {
   }
 }
 async function serveAdd(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C4whLEwv.mjs');
+  const { connectAndGetMachine } = await import('./commands-D1pZq3d4.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -114,7 +93,7 @@ async function serveAdd(args, machineId) {
     }
     if (sessionId && result?.url) {
       try {
-        const agentCommands = await import('./agentCommands-B7JaByb0.mjs');
+        const agentCommands = await import('./agentCommands-B2Nl7Fof.mjs');
         if (regenerateUrl) agentCommands.removeSessionLinkByService("serve", name, sessionId);
         agentCommands.autoAddSessionLink(String(result.url), name, void 0, { kind: "serve", name });
       } catch {
@@ -129,7 +108,7 @@ async function serveAdd(args, machineId) {
   }
 }
 async function serveApply(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C4whLEwv.mjs');
+  const { connectAndGetMachine } = await import('./commands-D1pZq3d4.mjs');
   const fs = await import('fs');
   const yaml = await import('yaml');
   const file = positionalArgs(args)[0];
@@ -214,7 +193,7 @@ async function serveApply(args, machineId) {
     console.log(`URL: ${result.url}`);
     if (params.sessionId && result?.url) {
       try {
-        const { autoAddSessionLink } = await import('./agentCommands-B7JaByb0.mjs');
+        const { autoAddSessionLink } = await import('./agentCommands-B2Nl7Fof.mjs');
         const prevSession = process.env.SVAMP_SESSION_ID;
         process.env.SVAMP_SESSION_ID = String(params.sessionId);
         try {
@@ -235,7 +214,7 @@ async function serveApply(args, machineId) {
   }
 }
 async function serveRemove(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C4whLEwv.mjs');
+  const { connectAndGetMachine } = await import('./commands-D1pZq3d4.mjs');
   const pos = positionalArgs(args);
   const name = pos[0];
   if (!name) {
@@ -245,7 +224,7 @@ async function serveRemove(args, machineId) {
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     await machine.serveRemove({ name });
-    const { removeSessionLinkByService } = await import('./agentCommands-B7JaByb0.mjs');
+    const { removeSessionLinkByService } = await import('./agentCommands-B2Nl7Fof.mjs');
     removeSessionLinkByService("serve", name);
     console.log(`Mount '${name}' removed.`);
   } catch (err) {
@@ -257,10 +236,10 @@ async function serveRemove(args, machineId) {
   }
 }
 async function serveList(args, machineId) {
-  const { connectAndGetMachine } = await import('./commands-C4whLEwv.mjs');
+  const { connectAndGetMachine } = await import('./commands-D1pZq3d4.mjs');
   const all = hasFlag(args, "--all", "-a");
   const json = hasFlag(args, "--json");
-  const sessionId = getFlag(args, "--session");
+  const sessionId = getFlag(args, "--session") ?? process.env.SVAMP_SESSION_ID;
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const mounts = await machine.serveList({ sessionId, all });
@@ -291,7 +270,7 @@ async function serveList(args, machineId) {
   }
 }
 async function serveInfo(machineId) {
-  const { connectAndGetMachine } = await import('./commands-C4whLEwv.mjs');
+  const { connectAndGetMachine } = await import('./commands-D1pZq3d4.mjs');
   const { machine, server } = await connectAndGetMachine(machineId);
   try {
     const info = await machine.serveInfo();
@@ -384,4 +363,4 @@ Declarative apply (svamp serve apply <yaml>):
 `);
 }
 
-export { handleServeCommand };
+export { handleServeCommand, positionalArgs };