svamp-cli 0.2.342 → 0.2.356

package/bin/skills/artifact/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: artifact
-version: 1.3.0
+version: 1.3.2
 description: Embed a rendered HTML file or live URL inline in chat via a single self-closing `<artifact src="..." />` tag — the Svamp client renders it as a sandboxed iframe with modes for inline, card, bare, and immersive.
 tags:
   - svamp
@@ -134,16 +134,30 @@ This means you can iterate freely without polluting the chat with stale renders.
 To share with a colleague, run `svamp serve`:
 
 ```bash
-# Owner-only (default — they need to log in via Hypha)
+# DEFAULT is the `link` tier — a capability URL. NO login required:
+# anyone who has the URL can read it. The hostname IS the secret.
 svamp serve dashboard ./outputs
 
-# Public link (anyone with the URL)
-svamp serve dashboard ./outputs --public
+# Login-gated (only you, via Hypha) — opt IN to this
+svamp serve dashboard ./outputs --access owner
 
-# Restrict to specific emails
+# Restrict to specific emails (they log in via Hypha)
 svamp serve dashboard ./outputs --access alice@x.com,bob@y.com
+
+# Listed publicly (anyone, no URL secrecy assumed)
+svamp serve dashboard ./outputs --public
 ```
 
+⚠️ **Do not assume the default is login-gated.** It is not — `svamp serve` prints the tier back to
+you as `link (capability URL — anyone with the URL can view)`. Before serving anything internal,
+either pass `--access owner` or accept that possession of the URL is possession of the content.
+Because the hostname is the secret, there is no way to revoke access to a `link` mount other than
+`--regenerate-url`, which mints a new one; deleting the mount does not un-publish what was already
+fetched.
+
+Use the URL exactly as `serve`/`serve list` prints it — never compose it by hand, and never append a
+path to it.
+
 Post the resulting URL as a normal markdown link. The svamp client doesn't manage shares — `svamp serve` is the dedicated tool.
 
 ## Rendering environment

package/bin/skills/crew/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: crew
-version: 0.3.0
+version: 0.3.4
 description: Coordinate work as a lead delegating features to managed worktree children — spawn a child per feature on its own branch, run it as a loop until done, and pull finished work back to the base branch with merge-and-close. Use when one session should run a project and farm out features instead of piling many sessions on one working tree.
 ---
 
@@ -13,10 +13,27 @@ the same working tree.
 
 A **crew** is emergent, not a heavy object: it is just plain sessions linked by
 `parentSessionId` + a `crew.role`. A **feature child** always (a) has the lead as its
-parent, (b) lives in its own `.dev/worktree/<n>` on its own branch, and (c) runs as a loop
-with `parent: <lead>` — i.e. **the lead is the judge** that decides when the child is done
-(this is the `parent`-routed case of the loop … until gate; the loop engine is Claude Code's
-native `/goal`, driven from `svamp session loop`).
+parent and (b) lives in its own `.dev/worktree/<n>` on its own branch.
+
+> **⚠ Whether the child is GATED depends on how you started it (#1604).**
+>
+> | You ran | Gate |
+> |---|---|
+> | `crew start "<brief>"` (no `--oracle`) | **none** — the child works, then runs `feature done` when *it* decides it is complete. Nothing judges it. |
+> | `crew start "<brief>" --oracle "<cmd>"` | a loop with `parent: <lead>` — the oracle gates each stop and **the lead is the judge** of done. |
+>
+> The CLI tells you which you got: it prints `gate: none — child runs 'feature done' when complete`
+> on the ungated path. This is deliberate, not an oversight — `featureStart` attaches the loop only
+> when there is an oracle, because a no-oracle child would otherwise fire `approved` on its very
+> first stop, which is worse than no gate at all.
+>
+> **What this means for you as a lead:** if the feature has any objective success condition, pass
+> `--oracle`. Without one you are the only thing standing between a child and a premature
+> `feature done`, so read the merge request rather than trusting the verdict.
+>
+> This block used to claim every feature child runs as a loop with the lead as judge. It did not,
+> and an agent that believed it would skip `--oracle`, skip checking on the child, and read "no
+> verdict yet" as "still working" rather than "nothing will ever judge this".
 
 ## The verbs (these are your tools)
 
@@ -25,10 +42,21 @@ svamp feature start "<brief>" [--oracle "<test cmd>"] [--base <branch>] [--actio
                              [--issue <id>] [--max N] [--model <id>]
         # (lead) create a worktree child on a new branch, run it as a loop until done
         # (oracle → parent verdict), and brief it. Prints the child id.
-        # --issue <id> links the child to an existing backlog issue: its verdict routes
-        #   ONTO that issue. This is the seam that joins crew to the backlog the loop
-        #   oracle (`svamp issue pending`) reads — without it the child's result is
-        #   invisible to the loop, so pass it whenever the feature came from an issue.
+        # --action nudge|block: how the lead learns the child reported or finished.
+        #   nudge (default) = normal urgency, the lead sees it on its next idle turn;
+        #   block = urgent, which WAKES the lead. Use block for a child whose result
+        #   gates your next step; nudge for one you will collect when convenient.
+        # --issue <id> links the child to an EXISTING backlog issue: its verdict routes
+        #   ONTO that issue instead of onto a new one. This is the seam that joins crew
+        #   to the backlog the loop oracle (`svamp issue pending`) reads.
+        #   Pass it whenever the feature came from an issue, so the verdict lands on the
+        #   item you are already tracking rather than creating a second one to reconcile.
+        #   NOT passing it does NOT make the child invisible: `crew start` auto-creates a
+        #   tracking issue at status `in_progress`, and `isPendingIssue` counts anything
+        #   that is neither `archived` nor `paused` — so an unlinked child still holds the
+        #   loop oracle RED until its issue is resolved. Do not treat an unlinked child as
+        #   fire-and-forget; a lead waiting for `svamp issue pending` to empty will wait
+        #   for it.
         # --max N bounds the child's loop iterations (a hard stop, unlike the soft
         #   progress-based cap); --model <id> picks the child's model.
 svamp feature start "<brief>" --no-worktree --dir <folder>
@@ -65,14 +93,27 @@ You coordinate the project. Keep your own working tree (the base branch, e.g. `m
   branch into the base, removes the worktree, and archives the child. On a conflict or a dirty
   worktree the merge is **deferred to rework** (the child is re-woken with guidance and left
   alive — un-merged work is never destroyed); help it resolve, then merge again.
+- **A merge can also HARD-fail.** When the failure is not something the child can fix by editing
+  (e.g. the base tree is on the wrong branch or is dirty), `feature merge` exits 1 and sends the
+  child `<crew-blocked>` instead of `<crew-rework>`. The child is told to STOP and hold; it will
+  not retry. Resolving it is **yours or the operator's** — fix the blocker in the base tree, then
+  re-run `svamp feature merge <child-id>`. A blocked child left unattended is idle, not working,
+  so do not wait for it to report again.
 - **Nudge stalled children.** If `feature list` shows a child idle with committed, ahead-of-base
   work that hasn't been reported done, send `svamp session inbox send <child> "status?"` (or
   `feature report`-style ping) to move it along.
 
 ## If you are a FEATURE CHILD
 
-You own one feature in an isolated worktree on your own branch, reporting to your lead. Your
-brief (and your loop's "until" criteria) is injected each turn.
+You own one feature in an isolated worktree on your own branch, reporting to your lead.
+
+**Your brief arrives ONCE, as the first message of this session — it is not repeated (#1607).**
+Nothing re-injects it, so keeping it in view is your job: re-read it before you decide you are done,
+and restate it in your own words in `feature report` notes so drift is visible to your lead. (If your
+lead started you *with* `--oracle`, the native `/goal` gate does restate the "until" criteria at each
+turn-end — but on the default no-oracle path there is no loop at all. See the gate table above.)
+This line previously promised per-turn injection of both; no such mechanism was ever built, and
+`docs/crew-design.md` §7 already recorded those hooks as never shipped.
 
 - **Work in your worktree.** Implement the feature. Commit as you go. Keep the oracle/tests green.
 - **Report.** Use `svamp feature report "<note>"` for milestones and `--blocker` when stuck —
@@ -81,8 +122,16 @@ brief (and your loop's "until" criteria) is injected each turn.
   run `svamp feature done --summary "<what changed>"`. This sends a merge-request to your lead.
 - **Do not merge your own branch or remove your own worktree** — the lead does the merge-back so
   the base tree isn't corrupted. After the lead merges, your worktree is removed and you are
-  archived. If you get a `<crew-freeze>` message, stop editing immediately. If you get a
-  `<crew-rework>` message, address the guidance and run `svamp feature done` again.
+  archived. Three control messages can arrive from your lead — they look similar and mean
+  different things, so read the tag:
+  - `<crew-freeze>` — stop editing immediately.
+  - `<crew-rework>` — the merge was **deferred**; address the guidance and run
+    `svamp feature done` again.
+  - `<crew-blocked>` — the merge **hard-failed**. "Stop editing and hold — do not keep working.
+    Once the blocker is resolved, the lead can retry `svamp feature merge`." Do **not** run
+    `svamp feature done` again: nothing you can do from here changes the outcome, and re-sending
+    a merge-request into a hard-failed state just burns loop turns toward the cost ceiling. Hold
+    until the lead retries the merge. Your un-merged work is preserved.
 
 ## Standalone (no-worktree) children — managing a fleet of folders
 

package/dist/DefaultTransport-vfp78fug.mjs

@@ -0,0 +1,47 @@
+const DEFAULT_TIMEOUTS = {
+  init: 6e4,
+  toolCall: 12e4,
+  think: 3e4
+};
+class DefaultTransport {
+  agentName;
+  constructor(agentName = "generic-acp") {
+    this.agentName = agentName;
+  }
+  getInitTimeout() {
+    return DEFAULT_TIMEOUTS.init;
+  }
+  filterStdoutLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return null;
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return null;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (typeof parsed !== "object" || parsed === null) return null;
+      return line;
+    } catch {
+      return null;
+    }
+  }
+  handleStderr(_text, _context) {
+    return { message: null };
+  }
+  getToolPatterns() {
+    return [];
+  }
+  isInvestigationTool(_toolCallId, _toolKind) {
+    return false;
+  }
+  getToolCallTimeout(_toolCallId, toolKind) {
+    if (toolKind === "think") return DEFAULT_TIMEOUTS.think;
+    return DEFAULT_TIMEOUTS.toolCall;
+  }
+  extractToolNameFromId(_toolCallId) {
+    return null;
+  }
+  determineToolName(toolName, _toolCallId, _input, _context) {
+    return toolName;
+  }
+}
+
+export { DefaultTransport };

package/dist/GeminiTransport-3OkhtFRO.mjs

@@ -0,0 +1,130 @@
+const GEMINI_TIMEOUTS = {
+  init: 12e4,
+  toolCall: 12e4,
+  investigation: 6e5,
+  think: 3e4,
+  idle: 500
+};
+const GEMINI_TOOL_PATTERNS = [
+  {
+    name: "change_title",
+    patterns: ["change_title", "change-title", "svamp__change_title", "mcp__svamp__change_title"],
+    inputFields: ["title"],
+    emptyInputDefault: true
+  },
+  {
+    name: "set_session_link",
+    patterns: ["set_session_link", "set-session-link", "svamp__set_session_link", "mcp__svamp__set_session_link"],
+    inputFields: ["url"]
+  },
+  {
+    name: "save_memory",
+    patterns: ["save_memory", "save-memory"],
+    inputFields: ["memory", "content"]
+  },
+  {
+    name: "think",
+    patterns: ["think"],
+    inputFields: ["thought", "thinking"]
+  }
+];
+const AVAILABLE_MODELS = [
+  "gemini-2.5-pro",
+  "gemini-2.5-flash",
+  "gemini-2.5-flash-lite"
+];
+class GeminiTransport {
+  agentName = "gemini";
+  getInitTimeout() {
+    return GEMINI_TIMEOUTS.init;
+  }
+  filterStdoutLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return null;
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return null;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (typeof parsed !== "object" || parsed === null) return null;
+      return line;
+    } catch {
+      return null;
+    }
+  }
+  handleStderr(text, context) {
+    const trimmed = text.trim();
+    if (!trimmed) return { message: null, suppress: true };
+    if (trimmed.includes("status 429") || trimmed.includes('code":429') || trimmed.includes("rateLimitExceeded") || trimmed.includes("RESOURCE_EXHAUSTED")) {
+      return { message: null, suppress: false };
+    }
+    if (trimmed.includes("status 404") || trimmed.includes('code":404')) {
+      const msg = {
+        type: "status",
+        status: "error",
+        detail: `Model not found. Available models: ${AVAILABLE_MODELS.join(", ")}`
+      };
+      return { message: msg };
+    }
+    if (context.hasActiveInvestigation) {
+      const hasError = trimmed.includes("timeout") || trimmed.includes("Timeout") || trimmed.includes("failed") || trimmed.includes("Failed") || trimmed.includes("error") || trimmed.includes("Error");
+      if (hasError) {
+        return { message: null, suppress: false };
+      }
+    }
+    return { message: null };
+  }
+  getToolPatterns() {
+    return GEMINI_TOOL_PATTERNS;
+  }
+  isInvestigationTool(toolCallId, toolKind) {
+    const lowerId = toolCallId.toLowerCase();
+    return lowerId.includes("codebase_investigator") || lowerId.includes("investigator") || typeof toolKind === "string" && toolKind.includes("investigator");
+  }
+  getToolCallTimeout(toolCallId, toolKind) {
+    if (this.isInvestigationTool(toolCallId, toolKind)) return GEMINI_TIMEOUTS.investigation;
+    if (toolKind === "think") return GEMINI_TIMEOUTS.think;
+    return GEMINI_TIMEOUTS.toolCall;
+  }
+  getIdleTimeout() {
+    return GEMINI_TIMEOUTS.idle;
+  }
+  extractToolNameFromId(toolCallId) {
+    const lowerId = toolCallId.toLowerCase();
+    for (const toolPattern of GEMINI_TOOL_PATTERNS) {
+      for (const pattern of toolPattern.patterns) {
+        if (lowerId.includes(pattern.toLowerCase())) {
+          return toolPattern.name;
+        }
+      }
+    }
+    return null;
+  }
+  isEmptyInput(input) {
+    if (!input) return true;
+    if (Array.isArray(input)) return input.length === 0;
+    if (typeof input === "object") return Object.keys(input).length === 0;
+    return false;
+  }
+  determineToolName(toolName, toolCallId, input, _context) {
+    if (toolName !== "other" && toolName !== "Unknown tool") return toolName;
+    const idToolName = this.extractToolNameFromId(toolCallId);
+    if (idToolName) return idToolName;
+    if (input && typeof input === "object" && !Array.isArray(input)) {
+      const inputKeys = Object.keys(input);
+      for (const toolPattern of GEMINI_TOOL_PATTERNS) {
+        if (toolPattern.inputFields) {
+          const hasMatchingField = toolPattern.inputFields.some(
+            (field) => inputKeys.some((key) => key.toLowerCase() === field.toLowerCase())
+          );
+          if (hasMatchingField) return toolPattern.name;
+        }
+      }
+    }
+    if (this.isEmptyInput(input) && toolName === "other") {
+      const defaultTool = GEMINI_TOOL_PATTERNS.find((p) => p.emptyInputDefault);
+      if (defaultTool) return defaultTool.name;
+    }
+    return toolName;
+  }
+}
+
+export { GEMINI_TIMEOUTS, GeminiTransport };

package/dist/KimiTransport-D8n009Tr.mjs

@@ -0,0 +1,141 @@
+const KIMI_TIMEOUTS = {
+  init: 12e4,
+  toolCall: 12e4,
+  investigation: 6e5,
+  think: 3e4,
+  idle: 500
+};
+const KIMI_TOOL_PATTERNS = [
+  {
+    name: "change_title",
+    patterns: ["change_title", "change-title", "svamp__change_title", "mcp__svamp__change_title"],
+    inputFields: ["title"],
+    emptyInputDefault: true
+  },
+  {
+    name: "set_session_link",
+    patterns: ["set_session_link", "set-session-link", "svamp__set_session_link", "mcp__svamp__set_session_link"],
+    inputFields: ["url"]
+  },
+  {
+    name: "save_memory",
+    patterns: ["save_memory", "save-memory"],
+    inputFields: ["memory", "content"]
+  },
+  {
+    name: "think",
+    patterns: ["think"],
+    inputFields: ["thought", "thinking"]
+  }
+];
+const AVAILABLE_MODELS = [
+  "moonshotai/kimi-k2.5",
+  "moonshotai/kimi-k3",
+  "moonshotai/kimi-k2.7-code",
+  "moonshotai/kimi-k2-thinking",
+  "moonshotai/kimi-k2-turbo-preview",
+  "kimi-for-coding/kimi-for-coding"
+];
+class KimiTransport {
+  agentName = "kimi";
+  getInitTimeout() {
+    return KIMI_TIMEOUTS.init;
+  }
+  filterStdoutLine(line) {
+    const trimmed = line.trim();
+    if (!trimmed) return null;
+    if (!trimmed.startsWith("{") && !trimmed.startsWith("[")) return null;
+    try {
+      const parsed = JSON.parse(trimmed);
+      if (typeof parsed !== "object" || parsed === null) return null;
+      return line;
+    } catch {
+      return null;
+    }
+  }
+  handleStderr(text, context) {
+    const trimmed = text.trim();
+    if (!trimmed) return { message: null, suppress: true };
+    if (trimmed.includes("no provider configured") || trimmed.includes("Authentication required") || trimmed.includes("Invalid Authentication") || trimmed.includes("authentication_error") || trimmed.includes("401")) {
+      const msg = {
+        type: "status",
+        status: "error",
+        detail: "Kimi has no valid provider configured. Run `svamp daemon kimi-auth use-moonshot <api-key>` (or `use-coding` / `set`) on this machine, then restart the daemon."
+      };
+      return { message: msg };
+    }
+    if (trimmed.includes("status 429") || trimmed.includes('code":429') || trimmed.includes("429") || trimmed.includes("rate limit") || trimmed.includes("RESOURCE_EXHAUSTED")) {
+      return { message: null, suppress: false };
+    }
+    if (trimmed.includes("status 404") || trimmed.includes('code":404') || trimmed.includes("model_not_found")) {
+      const msg = {
+        type: "status",
+        status: "error",
+        detail: `Model not found. Example Kimi models: ${AVAILABLE_MODELS.join(", ")}`
+      };
+      return { message: msg };
+    }
+    if (context.hasActiveInvestigation) {
+      const hasError = trimmed.includes("timeout") || trimmed.includes("Timeout") || trimmed.includes("failed") || trimmed.includes("Failed") || trimmed.includes("error") || trimmed.includes("Error");
+      if (hasError) {
+        return { message: null, suppress: false };
+      }
+    }
+    return { message: null };
+  }
+  getToolPatterns() {
+    return KIMI_TOOL_PATTERNS;
+  }
+  isInvestigationTool(toolCallId, toolKind) {
+    const lowerId = toolCallId.toLowerCase();
+    return lowerId.includes("codebase_investigator") || lowerId.includes("investigator") || typeof toolKind === "string" && toolKind.includes("investigator");
+  }
+  getToolCallTimeout(toolCallId, toolKind) {
+    if (this.isInvestigationTool(toolCallId, toolKind)) return KIMI_TIMEOUTS.investigation;
+    if (toolKind === "think") return KIMI_TIMEOUTS.think;
+    return KIMI_TIMEOUTS.toolCall;
+  }
+  getIdleTimeout() {
+    return KIMI_TIMEOUTS.idle;
+  }
+  extractToolNameFromId(toolCallId) {
+    const lowerId = toolCallId.toLowerCase();
+    for (const toolPattern of KIMI_TOOL_PATTERNS) {
+      for (const pattern of toolPattern.patterns) {
+        if (lowerId.includes(pattern.toLowerCase())) {
+          return toolPattern.name;
+        }
+      }
+    }
+    return null;
+  }
+  isEmptyInput(input) {
+    if (!input) return true;
+    if (Array.isArray(input)) return input.length === 0;
+    if (typeof input === "object") return Object.keys(input).length === 0;
+    return false;
+  }
+  determineToolName(toolName, toolCallId, input, _context) {
+    if (toolName !== "other" && toolName !== "Unknown tool") return toolName;
+    const idToolName = this.extractToolNameFromId(toolCallId);
+    if (idToolName) return idToolName;
+    if (input && typeof input === "object" && !Array.isArray(input)) {
+      const inputKeys = Object.keys(input);
+      for (const toolPattern of KIMI_TOOL_PATTERNS) {
+        if (toolPattern.inputFields) {
+          const hasMatchingField = toolPattern.inputFields.some(
+            (field) => inputKeys.some((key) => key.toLowerCase() === field.toLowerCase())
+          );
+          if (hasMatchingField) return toolPattern.name;
+        }
+      }
+    }
+    if (this.isEmptyInput(input) && toolName === "other") {
+      const defaultTool = KIMI_TOOL_PATTERNS.find((p) => p.emptyInputDefault);
+      if (defaultTool) return defaultTool.name;
+    }
+    return toolName;
+  }
+}
+
+export { KIMI_TIMEOUTS, KimiTransport };

package/dist/acpAgentConfig-CObOPlA8.mjs

@@ -0,0 +1,48 @@
+const KNOWN_ACP_AGENTS = {
+  gemini: { command: "gemini", args: ["--experimental-acp"] },
+  kimi: { command: "kimi", args: ["acp"] }
+};
+const KNOWN_CODEX_AGENTS = {
+  codex: { command: "codex", args: ["app-server", "--listen", "stdio://"] }
+};
+function resolveAcpAgentConfig(cliArgs) {
+  if (cliArgs.length === 0) {
+    throw new Error("Usage: svamp agent <agent-name> or svamp agent -- <command> [args]");
+  }
+  if (cliArgs[0] === "--") {
+    const command = cliArgs[1];
+    if (!command) {
+      throw new Error('Missing command after "--". Usage: svamp agent -- <command> [args]');
+    }
+    return {
+      agentName: command,
+      command,
+      args: cliArgs.slice(2)
+    };
+  }
+  const agentName = cliArgs[0];
+  const knownAcp = KNOWN_ACP_AGENTS[agentName];
+  if (knownAcp) {
+    const passthroughArgs = cliArgs.slice(1).filter(Boolean);
+    return {
+      agentName,
+      command: knownAcp.command,
+      args: [...knownAcp.args, ...passthroughArgs]
+    };
+  }
+  const knownCodex = KNOWN_CODEX_AGENTS[agentName];
+  if (knownCodex) {
+    return {
+      agentName,
+      command: knownCodex.command,
+      args: [...knownCodex.args, ...cliArgs.slice(1)]
+    };
+  }
+  return {
+    agentName,
+    command: agentName,
+    args: cliArgs.slice(1)
+  };
+}
+
+export { KNOWN_ACP_AGENTS, KNOWN_CODEX_AGENTS, resolveAcpAgentConfig };