svamp-cli 0.2.342 → 0.2.356

package/dist/cli.mjs

@@ -1,6 +1,7 @@
-import './run-CF4kAVPW.mjs';
-import './serviceManager-hlOVxkhW.mjs';
-import './cli-B24CmIli.mjs';
+import { c as clearStopMarker, b as stopMarkerExists, s as startDaemon, a as stopDaemon, d as daemonStatus } from './run-DDmeV9K3.mjs';
+import { ensureSupervisorViaServiceManager, LAUNCHD_LABEL } from './serviceManager-hlOVxkhW.mjs';
+import { f as flushStdout, a as flushAndExit } from './flushExit-C-i6SGjj.mjs';
+import { w as wantsHelp } from './wantsHelp-6bMOeNUz.mjs';
 import 'os';
 import 'fs/promises';
 import 'fs';
@@ -8,17 +9,2959 @@ import 'path';
 import 'url';
 import 'child_process';
 import 'crypto';
-import 'node:fs';
-import 'node:path';
+import './hookSettings-FFc1pi8j.mjs';
 import 'node:crypto';
+import './types-57J3Re0n.mjs';
+import './securityContext-Cm5UTCuD.mjs';
+import 'node:fs';
+import './machineTools-DygM1jXW.mjs';
 import 'node:child_process';
+import './model-CUHojegn.mjs';
 import 'util';
 import 'http';
 import 'net';
+import './instance-CeHz5C8v.mjs';
+import './serveAuth-4M0vwMyj.mjs';
 import 'node:os';
+import 'node:path';
+import './envFlag-COOuJ3AH.mjs';
+import './claudeAuth-C0wc1GTM.mjs';
+import './fileLock-BMPwCrB6.mjs';
+import './codexProvider-BtxYc5Rj.mjs';
+import './friendlyName-1UZcyDhu.mjs';
 import 'node:events';
+import './cron-hHGdb5kU.mjs';
+import './hyphaClient-ybivOjZo.mjs';
+import './sharingNotificationSync-qGIQ-3yf.mjs';
+import './acpBackend-UaBD4zL3.mjs';
 import '@agentclientprotocol/sdk';
+import './DefaultTransport-vfp78fug.mjs';
+import './wrapCommand-CdNawSaa.mjs';
+import './acpAgentConfig-CObOPlA8.mjs';
+import './codexAppServerBackend-VGsYtbqg.mjs';
 import 'node:util';
 import 'node:readline';
+import './pinnedCodex-XW4qvOAe.mjs';
+import './GeminiTransport-3OkhtFRO.mjs';
+import './KimiTransport-D8n009Tr.mjs';
+import './kimiProvider-DbxODebR.mjs';
+import './kimiSetup-NGsoYB5h.mjs';
+import './detectIsolation-CrV8IFDv.mjs';
 import 'node:fs/promises';
+import './pinnedNono-5ZHb6328.mjs';
+import './bootStatus-DqtNgJch.mjs';
+import './loopVerify-DALtTk2V.mjs';
+import './store-B4E6NzG6.mjs';
+import './api-BHjyC0Ph.mjs';
+import './store-fi0f-ff1.mjs';
 import 'yaml';
+
+const nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
+if (nodeMajor < 22) {
+  console.error(`Error: svamp requires Node.js >= 22 (you have ${process.version}).`);
+  console.error("  Node 22+ includes native WebSocket support needed by hypha-rpc.");
+  console.error("  Upgrade with:  nvm install 22 && nvm alias default 22");
+  await flushStdout();
+  process.exit(1);
+}
+const args = process.argv.slice(2);
+const subcommand = args[0];
+let daemonSubcommand = args[1];
+async function main() {
+  try {
+    const { getLoadedConfig } = await import('./instance-CeHz5C8v.mjs').then(function (n) { return n.i; });
+    getLoadedConfig();
+  } catch {
+  }
+  if (subcommand === "login") {
+    await loginToHypha();
+  } else if (subcommand === "logout") {
+    await logoutFromHypha();
+  } else if (subcommand === "daemon") {
+    if (daemonSubcommand === "restart") {
+      try {
+        await applyClaudeAuthFlags(args);
+        await applyDaemonShareFlag(args);
+      } catch (err) {
+        console.error(`svamp daemon restart: ${err.message || err}`);
+        await flushStdout();
+        process.exit(1);
+      }
+      const whenIdle = args.includes("--when-idle");
+      const force = args.includes("--force");
+      const mod = await import('./run-DDmeV9K3.mjs').then(function (n) { return n.h; });
+      if (whenIdle && !force) {
+        if (mod.isDaemonAlive()) {
+          mod.writePendingRestart({ reason: "svamp daemon restart --when-idle" });
+          console.log("\u2713 Scheduled a graceful restart \u2014 the daemon will restart when no session is actively thinking (max wait 1h).");
+          await flushStdout();
+          process.exit(0);
+        }
+        console.log("Daemon not running \u2014 restarting immediately.");
+      }
+      await mod.restartDaemon();
+      await flushStdout();
+      process.exit(0);
+    }
+    if (daemonSubcommand === "start") {
+      try {
+        await applyClaudeAuthFlags(args);
+        await applyDaemonShareFlag(args);
+      } catch (err) {
+        console.error(`svamp daemon start: ${err.message || err}`);
+        await flushStdout();
+        process.exit(1);
+      }
+      clearStopMarker();
+      const { spawn } = await import('child_process');
+      const { existsSync, mkdirSync, openSync, closeSync, statSync, readFileSync } = await import('fs');
+      const { join } = await import('path');
+      const os = await import('os');
+      const svampHome = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+      const logsDir = join(svampHome, "logs");
+      mkdirSync(logsDir, { recursive: true });
+      const supervisorPidFile = join(svampHome, "supervisor.pid");
+      let supervisorAlive = false;
+      try {
+        if (existsSync(supervisorPidFile)) {
+          const pid = parseInt(readFileSync(supervisorPidFile, "utf-8").trim(), 10);
+          if (pid && !isNaN(pid)) {
+            try {
+              process.kill(pid, 0);
+              supervisorAlive = true;
+            } catch {
+            }
+          }
+        }
+      } catch {
+      }
+      if (supervisorAlive) {
+        const { readBootStatus: readBootStatus2, describeSupervisorState } = await import('./bootStatus-DqtNgJch.mjs').then(function (n) { return n.e; });
+        const bootStatus = readBootStatus2(svampHome);
+        let daemonState = null;
+        try {
+          daemonState = JSON.parse(readFileSync(join(svampHome, "daemon.state.json"), "utf-8"));
+        } catch {
+        }
+        const verdict = describeSupervisorState({ bootStatus, daemonState, now: Date.now() });
+        if (verdict.kind === "healthy") {
+          console.log("Daemon already running");
+          await flushStdout();
+          process.exit(0);
+        }
+        console.error("Daemon supervisor is running but the daemon is NOT healthy:");
+        console.error(`  ${verdict.message}`);
+        console.error(`  ${verdict.hint}`);
+        await flushStdout();
+        process.exit(1);
+      }
+      try {
+        const { clearBootStatus } = await import('./bootStatus-DqtNgJch.mjs').then(function (n) { return n.e; });
+        clearBootStatus(svampHome);
+      } catch {
+      }
+      const startedViaService = await ensureSupervisorViaServiceManager();
+      const bootLogPath = join(logsDir, "daemon-boot.log");
+      if (!startedViaService) {
+        const bootFd = openSync(bootLogPath, "a");
+        const extraArgs = [];
+        if (args.includes("--no-auto-continue")) extraArgs.push("--no-auto-continue");
+        const child = spawn(process.execPath, [
+          "--no-warnings",
+          "--no-deprecation",
+          ...process.argv.slice(1, 2),
+          // the script path
+          "daemon",
+          "start-supervised",
+          ...extraArgs
+        ], {
+          detached: true,
+          stdio: ["ignore", bootFd, bootFd],
+          env: process.env
+        });
+        try {
+          closeSync(bootFd);
+        } catch {
+        }
+        child.unref();
+      }
+      const stateFile = join(svampHome, "daemon.state.json");
+      let beforeMtimeMs = -1;
+      try {
+        beforeMtimeMs = statSync(stateFile).mtimeMs;
+      } catch {
+      }
+      const { readBootStatus } = await import('./bootStatus-DqtNgJch.mjs').then(function (n) { return n.e; });
+      const beforeBootAt = readBootStatus(svampHome)?.at ?? 0;
+      let started = false;
+      let bootFailure = null;
+      for (let i = 0; i < 600; i++) {
+        await new Promise((r) => setTimeout(r, 100));
+        try {
+          const st = statSync(stateFile);
+          if (st.mtimeMs > beforeMtimeMs) {
+            started = true;
+            break;
+          }
+        } catch {
+        }
+        const bs = readBootStatus(svampHome);
+        if (bs && bs.ok === false && bs.at > beforeBootAt) {
+          bootFailure = { message: bs.message || "The daemon failed to connect to Hypha.", hint: bs.hint || "" };
+          break;
+        }
+      }
+      if (started) {
+        console.log("Daemon started successfully");
+      } else if (bootFailure) {
+        console.error(`Failed to start daemon: ${bootFailure.message}`);
+        if (bootFailure.hint) console.error(`  ${bootFailure.hint}`);
+        await flushStdout();
+        process.exit(1);
+      } else {
+        let bootHint = "";
+        try {
+          const st = statSync(bootLogPath);
+          if (st.size > 0) bootHint = `
+  Check boot log for errors: ${bootLogPath}`;
+        } catch {
+        }
+        console.error(`Failed to start daemon (timeout waiting for state file)${bootHint}`);
+        await flushStdout();
+        process.exit(1);
+      }
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "start-supervised") {
+      const { spawn: spawnChild } = await import('child_process');
+      const { appendFileSync, mkdirSync } = await import('fs');
+      const { join: pathJoin } = await import('path');
+      const osModule = await import('os');
+      const svampHome = process.env.SVAMP_HOME || pathJoin(osModule.homedir(), ".svamp");
+      mkdirSync(svampHome, { recursive: true });
+      const logsDir = pathJoin(svampHome, "logs");
+      mkdirSync(logsDir, { recursive: true });
+      const logFile = pathJoin(logsDir, "daemon-supervised.log");
+      const log = (msg) => {
+        const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [supervisor] ${msg}
+`;
+        try {
+          appendFileSync(logFile, line);
+        } catch {
+        }
+      };
+      const {
+        acquireSupervisorLockWithRetry,
+        releaseSupervisorLock,
+        findOrphanedSyncPids,
+        killOrphanedSyncs
+      } = await import('./run-DDmeV9K3.mjs').then(function (n) { return n.f; });
+      const supervisorPidFile = pathJoin(svampHome, "supervisor.pid");
+      const lock = acquireSupervisorLockWithRetry(supervisorPidFile, process.pid);
+      if (!lock.acquired) {
+        log(`Another supervisor is already running (PID ${lock.heldBy}) \u2014 exiting`);
+        console.error(`svamp daemon: another supervisor is already running (PID ${lock.heldBy}).`);
+        await flushStdout();
+        process.exit(0);
+      }
+      if (process.env.SVAMP_SKIP_ORPHAN_SCAN !== "1") {
+        try {
+          const orphans = findOrphanedSyncPids(process.pid);
+          if (orphans.length > 0) {
+            await killOrphanedSyncs(orphans, { log, gracePeriodMs: 3e3 });
+          }
+        } catch (err) {
+          log(`Orphan scan failed (non-fatal): ${err?.message || err}`);
+        }
+      }
+      clearStopMarker();
+      const extraSyncArgs = [];
+      if (args.includes("--no-auto-continue")) extraSyncArgs.push("--no-auto-continue");
+      const BASE_DELAY_MS = 2e3;
+      const MAX_DELAY_MS = 3e5;
+      const BACKOFF_RESET_UPTIME_MS = 6e4;
+      let consecutiveRapidCrashes = 0;
+      let currentChild = null;
+      let stopping = false;
+      let restarting = false;
+      const onSignal = (sig) => {
+        stopping = true;
+        if (currentChild && !currentChild.killed) {
+          currentChild.kill(sig);
+        }
+      };
+      process.on("SIGTERM", () => onSignal("SIGTERM"));
+      process.on("SIGINT", () => onSignal("SIGINT"));
+      process.on("SIGUSR1", () => onSignal("SIGUSR1"));
+      process.on("SIGUSR2", () => {
+        restarting = true;
+        log("Received SIGUSR2 \u2014 graceful restart requested");
+        if (currentChild && !currentChild.killed) {
+          currentChild.kill("SIGTERM");
+        }
+      });
+      log("Supervisor started");
+      while (!stopping) {
+        const startTime = Date.now();
+        const exitCode = await new Promise((resolve) => {
+          const child = spawnChild(process.execPath, [
+            "--no-warnings",
+            "--no-deprecation",
+            ...process.argv.slice(1, 2),
+            "daemon",
+            "start-sync",
+            ...extraSyncArgs
+          ], {
+            stdio: ["ignore", "inherit", "inherit"],
+            env: { ...process.env, SVAMP_SUPERVISED: "1" },
+            // CRITICAL for launchd KeepAlive: give the child its OWN
+            // process group/session (detached). Otherwise, if the
+            // supervisor dies abnormally (SIGKILL/OOM) while the child
+            // is alive, the child — still in the supervisor's process
+            // group — keeps launchd's job "active", so KeepAlive never
+            // relaunches the supervisor and the daemon stays dead. The
+            // orphaned child is then reaped by the new supervisor's
+            // orphan scan and its own parent-death watchdog.
+            detached: true
+          });
+          currentChild = child;
+          child.on("exit", (code) => resolve(code));
+          child.on("error", (err) => {
+            log(`Failed to spawn daemon: ${err.message}`);
+            resolve(1);
+          });
+        });
+        currentChild = null;
+        const uptime = Date.now() - startTime;
+        if (stopping) {
+          log("Supervisor received stop signal, exiting");
+          break;
+        }
+        if (restarting) {
+          restarting = false;
+          consecutiveRapidCrashes = 0;
+          log("Graceful restart: respawning daemon with new binary from disk");
+          continue;
+        }
+        if (stopMarkerExists()) {
+          log(`Daemon exited (code ${exitCode}) and stop marker present \u2014 intentional stop, not restarting`);
+          break;
+        }
+        try {
+          const { readBootStatus, shouldStopForAuthExpiry, AUTH_FIX_HINT } = await import('./bootStatus-DqtNgJch.mjs').then(function (n) { return n.e; });
+          const bs = readBootStatus(svampHome);
+          if (shouldStopForAuthExpiry(bs, startTime)) {
+            log(`Daemon exited (code ${exitCode}) \u2014 Hypha credential has EXPIRED. Not restarting:`);
+            log(`  ${bs.message ?? "The Hypha token in ~/.svamp/.env has expired."}`);
+            log(`  ${bs.hint ?? AUTH_FIX_HINT}`);
+            log("  (a respawn would read the same dead token and fail identically)");
+            break;
+          }
+        } catch {
+        }
+        if (uptime > BACKOFF_RESET_UPTIME_MS) {
+          consecutiveRapidCrashes = 0;
+        } else {
+          consecutiveRapidCrashes++;
+        }
+        const backoffExp = Math.min(consecutiveRapidCrashes, 10);
+        let delay = Math.min(BASE_DELAY_MS * Math.pow(2, backoffExp), MAX_DELAY_MS);
+        delay = Math.max(BASE_DELAY_MS, Math.round(delay + (Math.random() * 0.2 - 0.1) * delay));
+        log(`Daemon exited with code ${exitCode} (uptime=${Math.round(uptime / 1e3)}s). Restarting in ${Math.round(delay / 1e3)}s...`);
+        await new Promise((resolve) => {
+          const timer = setTimeout(resolve, delay);
+          const checkStop = setInterval(() => {
+            if (stopping) {
+              clearTimeout(timer);
+              clearInterval(checkStop);
+              resolve();
+            }
+          }, 500);
+          setTimeout(() => clearInterval(checkStop), delay + 100);
+        });
+      }
+      releaseSupervisorLock(supervisorPidFile, process.pid);
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "start-sync") {
+      if (process.env.SVAMP_TEST_SYNC_EXIT !== void 0) {
+        const code = Number(process.env.SVAMP_TEST_SYNC_EXIT) || 0;
+        const lifeMs = Number(process.env.SVAMP_TEST_SYNC_LIFE_MS) || 0;
+        await new Promise((r) => setTimeout(r, lifeMs));
+        await flushStdout();
+        process.exit(code);
+      }
+      const noAutoContinue = args.includes("--no-auto-continue");
+      await startDaemon({ noAutoContinue });
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "stop") {
+      const cleanup = args.includes("--cleanup");
+      await stopDaemon({ cleanup });
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "status") {
+      daemonStatus();
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "install") {
+      await installDaemonService();
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "uninstall") {
+      await uninstallDaemonService();
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "auth") {
+      await handleDaemonAuthCommand(args.slice(2));
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "codex-auth") {
+      await handleDaemonCodexAuthCommand(args.slice(2));
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "install-nono") {
+      const { installNono } = await import('./detectIsolation-CrV8IFDv.mjs');
+      const okNono = await installNono();
+      if (!okNono) {
+        console.error("Failed to install nono. See the log above for the reason.");
+        await flushStdout();
+        process.exit(1);
+      }
+      console.log("nono installed. Sessions spawned from now on use it; existing ones keep their current sandbox.");
+      await flushStdout();
+      process.exit(0);
+    } else if (daemonSubcommand === "kimi-auth") {
+      await handleDaemonKimiAuthCommand(args.slice(2));
+      await flushStdout();
+      process.exit(0);
+    } else {
+      printDaemonHelp();
+    }
+  } else if (subcommand === "agent") {
+    await handleAgentCommand();
+  } else if (subcommand === "session") {
+    await handleSessionCommand();
+  } else if (subcommand === "machine") {
+    const { isSandboxed } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxed()) {
+      console.error("svamp machine: Machine commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    await handleMachineCommand();
+  } else if (subcommand === "fleet") {
+    const { isSandboxed } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxed()) {
+      console.error("svamp fleet: Fleet commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    await handleFleetCommand();
+  } else if (subcommand === "skills") {
+    const { isSandboxed } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxed()) {
+      console.error("svamp skills: Skills commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    await handleSkillsCommand();
+  } else if (subcommand === "service" || subcommand === "svc") {
+    const { isSandboxed } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxed()) {
+      console.error("svamp service: Service commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { handleServiceCommand } = await import('./commands-sPvRcG3J.mjs');
+    await handleServiceCommand();
+  } else if (subcommand === "serve") {
+    const { isSandboxed: isSandboxedServe } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxedServe()) {
+      console.error("svamp serve: Serve commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { handleServeCommand } = await import('./serveCommands-CLhkccJM.mjs');
+    await handleServeCommand();
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "process" || subcommand === "proc") {
+    const { isSandboxed: isSandboxedProc } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+    if (isSandboxedProc()) {
+      console.error("svamp process: Process commands are not available in sandboxed sessions.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { processCommand } = await import('./commands-BMeDrpSv.mjs');
+    let machineId;
+    const processArgs = args.slice(1);
+    const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
+    if (mIdx !== -1 && mIdx + 1 < processArgs.length) {
+      machineId = processArgs[mIdx + 1];
+    }
+    await processCommand(processArgs.filter((_a, i) => {
+      if (processArgs[i] === "--machine" || processArgs[i] === "-m") return false;
+      if (i > 0 && (processArgs[i - 1] === "--machine" || processArgs[i - 1] === "-m")) return false;
+      return true;
+    }), machineId);
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "outpost") {
+    const { outpostCommand } = await import('./commands-C13-yE2R.mjs');
+    await outpostCommand(args.slice(1));
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "issue" || subcommand === "issues") {
+    const { issueCommand } = await import('./commands-BbmypSgx.mjs');
+    await issueCommand(args.slice(1));
+    await flushAndExit(0);
+  } else if (subcommand === "workflow" || subcommand === "workflows") {
+    const { workflowCommand } = await import('./commands-CoOc4qiw.mjs');
+    await workflowCommand(args.slice(1));
+    await flushAndExit(0);
+  } else if (subcommand === "wise-agent" || subcommand === "wise") {
+    await handleWiseAgentCommand(args.slice(1));
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "feature" || subcommand === "crew") {
+    const { crewCommand } = await import('./commands-BkdbelFo.mjs');
+    await crewCommand(args.slice(1));
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "notify") {
+    const { notifyUser } = await import('./notifyCommands-CCUE18Q-.mjs');
+    const rest = args.slice(1);
+    let email;
+    const o = {};
+    for (let i = 0; i < rest.length; i++) {
+      const a = rest[i];
+      if (a === "--title" && i + 1 < rest.length) o.title = rest[++i];
+      else if (a === "--body" && i + 1 < rest.length) o.body = rest[++i];
+      else if (a === "--action" && i + 1 < rest.length) o.action = rest[++i];
+      else if (a === "--level" && i + 1 < rest.length) o.level = rest[++i];
+      else if (!a.startsWith("-") && !email) email = a;
+    }
+    await notifyUser(email, o);
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "admin") {
+    const adminSub = args[1];
+    if (adminSub === "set-collection-config") {
+      const { setCollectionConfig } = await import('./adminCommands-BvsYnRDA.mjs');
+      const rest = args.slice(2);
+      let alias;
+      let configJson;
+      for (let i = 0; i < rest.length; i++) {
+        if (rest[i] === "--config" && i + 1 < rest.length) configJson = rest[++i];
+        else if (!rest[i].startsWith("-") && !alias) alias = rest[i];
+      }
+      await setCollectionConfig(alias, configJson);
+    } else if (adminSub === "create-system-collections") {
+      const { createSystemCollections } = await import('./adminCommands-BvsYnRDA.mjs');
+      await createSystemCollections();
+    } else if (adminSub === "migrate-collection-children") {
+      const { migrateCollectionChildren } = await import('./adminCommands-BvsYnRDA.mjs');
+      const rest = args.slice(2).filter((a) => !a.startsWith("-"));
+      await migrateCollectionChildren(rest[0], rest[1]);
+    } else {
+      console.error("Usage:\n  svamp admin create-system-collections\n  svamp admin set-collection-config <alias> --config '<json>'\n  svamp admin migrate-collection-children <fromId> <toId>");
+    }
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "events") {
+    const { listEvents, ackEvent } = await import('./notifyCommands-CCUE18Q-.mjs');
+    const sub = args[1];
+    const rest = args.slice(2);
+    let email;
+    let json = false;
+    let positional;
+    for (let i = 0; i < rest.length; i++) {
+      const a = rest[i];
+      if (a === "--email" && i + 1 < rest.length) email = rest[++i];
+      else if (a === "--json") json = true;
+      else if (!a.startsWith("-") && !positional) positional = a;
+    }
+    if (sub === "list" || !sub) await listEvents({ email, json });
+    else if (sub === "ack") await ackEvent(positional, { email });
+    else console.error("Usage: svamp events list [--email <e>] [--json] | svamp events ack <id> [--email <e>]");
+    await flushStdout();
+    process.exit(0);
+  } else if (subcommand === "--help" || subcommand === "-h") {
+    printHelp();
+  } else if (!subcommand || subcommand === "start") {
+    await handleInteractiveCommand();
+  } else if (subcommand === "--version" || subcommand === "-v") {
+    const pkg = await import('./package-BrsiNutS.mjs').catch(() => ({ default: { version: "unknown" } }));
+    console.log(`svamp version: ${pkg.default.version}`);
+  } else {
+    console.error(`Unknown command: ${subcommand}`);
+    printHelp();
+    await flushStdout();
+    process.exit(1);
+  }
+}
+async function handleInteractiveCommand() {
+  const { runInteractive } = await import('./run-DCq3aEiF.mjs');
+  const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
+  let directory = process.cwd();
+  let resumeSessionId;
+  let continueSession = false;
+  let permissionMode;
+  const claudeArgs = [];
+  let pastSeparator = false;
+  for (let i = 0; i < interactiveArgs.length; i++) {
+    if (pastSeparator) {
+      claudeArgs.push(interactiveArgs[i]);
+      continue;
+    }
+    if (interactiveArgs[i] === "--") {
+      pastSeparator = true;
+      continue;
+    }
+    if ((interactiveArgs[i] === "-d" || interactiveArgs[i] === "--directory") && i + 1 < interactiveArgs.length) {
+      directory = interactiveArgs[++i];
+    } else if ((interactiveArgs[i] === "--resume" || interactiveArgs[i] === "-r") && i + 1 < interactiveArgs.length) {
+      resumeSessionId = interactiveArgs[++i];
+    } else if (interactiveArgs[i] === "--continue" || interactiveArgs[i] === "-c") {
+      continueSession = true;
+    } else if ((interactiveArgs[i] === "--permission-mode" || interactiveArgs[i] === "-p") && i + 1 < interactiveArgs.length) {
+      permissionMode = interactiveArgs[++i];
+    } else if (interactiveArgs[i] === "--help" || interactiveArgs[i] === "-h") {
+      printInteractiveHelp();
+      return;
+    }
+  }
+  await runInteractive({
+    directory,
+    resumeSessionId,
+    continueSession,
+    permissionMode,
+    claudeArgs: claudeArgs.length > 0 ? claudeArgs : void 0
+  });
+}
+async function handleAgentCommand() {
+  const agentArgs = args.slice(1);
+  if (agentArgs.length === 0 || agentArgs[0] === "--help" || agentArgs[0] === "-h") {
+    printAgentHelp();
+    return;
+  }
+  if (agentArgs[0] === "list") {
+    const { KNOWN_ACP_AGENTS, KNOWN_CODEX_AGENTS: KNOWN_CODEX_AGENTS2 } = await import('./acpAgentConfig-CObOPlA8.mjs');
+    console.log("Known agents:");
+    for (const [name, config2] of Object.entries(KNOWN_ACP_AGENTS)) {
+      console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (ACP)`);
+    }
+    for (const [name, config2] of Object.entries(KNOWN_CODEX_AGENTS2)) {
+      console.log(`  ${name.padEnd(12)} ${config2.command} ${config2.args.join(" ")}  (MCP)`);
+    }
+    console.log('\nUse "svamp agent <name>" to start an interactive session.');
+    console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
+    return;
+  }
+  const { resolveAcpAgentConfig, KNOWN_CODEX_AGENTS } = await import('./acpAgentConfig-CObOPlA8.mjs');
+  let cwd = process.cwd();
+  const filteredArgs = [];
+  for (let i = 0; i < agentArgs.length; i++) {
+    if ((agentArgs[i] === "-d" || agentArgs[i] === "--directory") && i + 1 < agentArgs.length) {
+      cwd = agentArgs[i + 1];
+      i++;
+    } else {
+      filteredArgs.push(agentArgs[i]);
+    }
+  }
+  let config;
+  try {
+    config = resolveAcpAgentConfig(filteredArgs);
+  } catch (err) {
+    console.error(err.message);
+    await flushStdout();
+    process.exit(1);
+  }
+  const logFn = (...logArgs) => {
+    if (process.env.DEBUG) console.error("[debug]", ...logArgs);
+  };
+  console.log(`Starting ${config.agentName} agent in ${cwd}...`);
+  let backend;
+  if (KNOWN_CODEX_AGENTS[config.agentName]) {
+    const { CodexAppServerBackend } = await import('./codexAppServerBackend-VGsYtbqg.mjs').then(function (n) { return n.a; });
+    backend = new CodexAppServerBackend({ cwd, log: logFn });
+  } else {
+    const { AcpBackend } = await import('./acpBackend-UaBD4zL3.mjs');
+    const { GeminiTransport } = await import('./GeminiTransport-3OkhtFRO.mjs');
+    const { KimiTransport } = await import('./KimiTransport-D8n009Tr.mjs');
+    const { DefaultTransport } = await import('./DefaultTransport-vfp78fug.mjs');
+    const transportHandler = config.agentName === "gemini" ? new GeminiTransport() : config.agentName === "kimi" ? new KimiTransport() : new DefaultTransport(config.agentName);
+    let acpEnv;
+    if (config.agentName === "kimi") {
+      const { ensureKimiProviderConfigured } = await import('./kimiSetup-NGsoYB5h.mjs');
+      const { kimiSpawnEnv } = await import('./kimiProvider-DbxODebR.mjs');
+      await ensureKimiProviderConfigured(process.env, config.command, logFn);
+      acpEnv = kimiSpawnEnv(process.env);
+    }
+    backend = new AcpBackend({
+      agentName: config.agentName,
+      cwd,
+      command: config.command,
+      args: config.args,
+      transportHandler,
+      env: acpEnv,
+      log: logFn
+    });
+  }
+  let currentText = "";
+  backend.onMessage((msg) => {
+    switch (msg.type) {
+      case "model-output":
+        if (msg.textDelta) {
+          process.stdout.write(msg.textDelta);
+          currentText += msg.textDelta;
+        } else if (msg.fullText) {
+          process.stdout.write(msg.fullText);
+        }
+        break;
+      case "status":
+        if (msg.status === "idle") {
+          if (currentText && !currentText.endsWith("\n")) {
+            process.stdout.write("\n");
+          }
+          currentText = "";
+          process.stdout.write("\n> ");
+        } else if (msg.status === "error") {
+          console.error(`
+Error: ${msg.detail}`);
+        } else if (msg.status === "stopped") {
+          console.log(`
+Agent stopped: ${msg.detail || ""}`);
+        }
+        break;
+      case "tool-call":
+        console.log(`
+[tool] ${msg.toolName}(${JSON.stringify(msg.args).substring(0, 100)})`);
+        break;
+      case "tool-result": {
+        const resultStr = typeof msg.result === "string" ? msg.result : JSON.stringify(msg.result);
+        if (resultStr.length > 200) {
+          console.log(`[tool result] ${resultStr.substring(0, 200)}...`);
+        }
+        break;
+      }
+      case "event":
+        if (msg.name === "thinking") {
+          const payload = msg.payload;
+          if (payload?.text) {
+            process.stdout.write(`\x1B[90m${payload.text}\x1B[0m`);
+          }
+        }
+        break;
+    }
+  });
+  try {
+    const result = await backend.startSession();
+    console.log(`Session started: ${result.sessionId}`);
+    process.stdout.write("> ");
+  } catch (err) {
+    const errMsg = err?.message || (typeof err === "object" ? JSON.stringify(err) : String(err));
+    console.error(`Failed to start ${config.agentName}: ${errMsg}`);
+    await flushStdout();
+    process.exit(1);
+  }
+  const readline = await import('readline');
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+    terminal: false
+  });
+  rl.on("line", async (line) => {
+    const trimmed = line.trim();
+    if (!trimmed) return;
+    if (trimmed === "/quit" || trimmed === "/exit") {
+      console.log("Shutting down...");
+      await backend.dispose();
+      await flushStdout();
+      process.exit(0);
+    }
+    if (trimmed === "/cancel") {
+      await backend.cancel("");
+      return;
+    }
+    try {
+      await backend.sendPrompt("", trimmed);
+    } catch (err) {
+      console.error(`Error: ${err.message}`);
+    }
+  });
+  rl.on("close", async () => {
+    await backend.dispose();
+    await flushStdout();
+    process.exit(0);
+  });
+  process.on("SIGINT", async () => {
+    console.log("\nShutting down...");
+    await backend.dispose();
+    await flushStdout();
+    process.exit(0);
+  });
+}
+async function handleSessionCommand() {
+  const rawSessionArgs = args.slice(1);
+  let targetMachineId;
+  const sessionArgs = [];
+  for (let i = 0; i < rawSessionArgs.length; i++) {
+    if ((rawSessionArgs[i] === "--machine" || rawSessionArgs[i] === "-m") && i + 1 < rawSessionArgs.length) {
+      targetMachineId = rawSessionArgs[i + 1];
+      i++;
+    } else {
+      sessionArgs.push(rawSessionArgs[i]);
+    }
+  }
+  const sessionSubcommand = sessionArgs[0];
+  if (!sessionSubcommand || wantsHelp(sessionArgs)) {
+    printSessionHelp();
+    return;
+  }
+  const { isSandboxed, SANDBOX_SAFE_SESSION_CMDS } = await import('./sandboxDetect-Cdzsj5TC.mjs');
+  if (!SANDBOX_SAFE_SESSION_CMDS.includes(sessionSubcommand)) {
+    if (isSandboxed()) {
+      console.error(`svamp session ${sessionSubcommand}: This command is not available in sandboxed sessions.`);
+      console.error(`Available commands: ${SANDBOX_SAFE_SESSION_CMDS.join(", ")}`);
+      await flushStdout();
+      process.exit(1);
+    }
+  }
+  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionLoopExtend, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-B-yczgz_.mjs');
+  const parseFlagStr = (flag, shortFlag) => {
+    for (let i = 1; i < sessionArgs.length; i++) {
+      if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
+        return sessionArgs[i + 1];
+      }
+    }
+    return void 0;
+  };
+  const parseFlagInt = (flag, shortFlag) => {
+    const v = parseFlagStr(flag, shortFlag);
+    if (v === void 0) return void 0;
+    const n = parseInt(v, 10);
+    return isNaN(n) ? void 0 : n;
+  };
+  const hasFlag = (flag) => sessionArgs.includes(flag);
+  if (sessionSubcommand === "machines" || sessionSubcommand === "machine") {
+    await sessionMachines();
+  } else if (sessionSubcommand === "list" || sessionSubcommand === "ls") {
+    await sessionList(targetMachineId, {
+      active: hasFlag("--active"),
+      json: hasFlag("--json")
+    });
+  } else if (sessionSubcommand === "whoami" || sessionSubcommand === "env") {
+    await sessionWhoami({ json: hasFlag("--json"), all: hasFlag("--all") });
+  } else if (sessionSubcommand === "spawn") {
+    const agent = sessionArgs[1] || "claude";
+    let dir = process.cwd();
+    for (let i = 1; i < sessionArgs.length; i++) {
+      if ((sessionArgs[i] === "-d" || sessionArgs[i] === "--directory") && i + 1 < sessionArgs.length) {
+        dir = sessionArgs[i + 1];
+        i++;
+      }
+    }
+    const message = parseFlagStr("--message");
+    const wait = hasFlag("--wait");
+    const worktree = hasFlag("--worktree");
+    const isolate = hasFlag("--isolate");
+    let permissionMode = parseFlagStr("--permission-mode") || parseFlagStr("-p");
+    if (!permissionMode && hasFlag("--require-approval")) {
+      permissionMode = "default";
+    }
+    if (!permissionMode) {
+      permissionMode = "bypassPermissions";
+    }
+    const securityContextPath = parseFlagStr("--security-context");
+    const denyNetwork = hasFlag("--deny-network");
+    const parentSessionId = parseFlagStr("--parent");
+    const tagsFlag = parseFlagStr("--tags");
+    const share = [];
+    const denyRead = [];
+    const allowWrite = [];
+    const allowDomain = [];
+    const tags = [];
+    if (tagsFlag) {
+      tags.push(...tagsFlag.split(",").map((t) => t.trim()).filter(Boolean));
+    }
+    for (let i = 1; i < sessionArgs.length; i++) {
+      if (sessionArgs[i] === "--share" && i + 1 < sessionArgs.length) {
+        share.push(sessionArgs[++i]);
+      } else if (sessionArgs[i] === "--deny-read" && i + 1 < sessionArgs.length) {
+        denyRead.push(sessionArgs[++i]);
+      } else if (sessionArgs[i] === "--allow-write" && i + 1 < sessionArgs.length) {
+        allowWrite.push(sessionArgs[++i]);
+      } else if (sessionArgs[i] === "--allow-domain" && i + 1 < sessionArgs.length) {
+        allowDomain.push(sessionArgs[++i]);
+      }
+    }
+    if (denyRead.length > 0) {
+      const { describeUnenforceable } = await import('./securityContext-Cm5UTCuD.mjs');
+      const warning = describeUnenforceable("nono", { filesystem: { denyRead } });
+      if (warning) console.warn(`Warning: ${warning}`);
+    }
+    const { parseShareArg } = await import('./commands-B-yczgz_.mjs');
+    const shareEntries = share.map((s) => parseShareArg(s));
+    await sessionSpawn(agent, dir, targetMachineId, {
+      message,
+      wait,
+      worktree,
+      isolate,
+      permissionMode,
+      model: parseFlagStr("--model"),
+      securityContextPath,
+      share: shareEntries.length > 0 ? shareEntries : void 0,
+      denyRead: denyRead.length > 0 ? denyRead : void 0,
+      allowWrite: allowWrite.length > 0 ? allowWrite : void 0,
+      denyNetwork,
+      allowDomain: allowDomain.length > 0 ? allowDomain : void 0,
+      tags: tags.length > 0 ? tags : void 0,
+      parentSessionId
+    });
+  } else if (sessionSubcommand === "archive") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session archive <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionArchive(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "resume") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session resume <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionResume(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "delete" || sessionSubcommand === "rm") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session delete <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionDelete(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "info") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session info <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionInfo(sessionArgs[1], targetMachineId, {
+      json: hasFlag("--json")
+    });
+  } else if (sessionSubcommand === "messages" || sessionSubcommand === "msgs") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session messages <session-id> [--last N] [--json] [--raw] [--after N] [--limit N]");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionMessages(sessionArgs[1], targetMachineId, {
+      last: parseFlagInt("--last"),
+      json: hasFlag("--json"),
+      raw: hasFlag("--raw"),
+      after: parseFlagInt("--after"),
+      limit: parseFlagInt("--limit")
+    });
+  } else if (sessionSubcommand === "attach") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session attach <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionAttach(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "send") {
+    if (!sessionArgs[1] || !sessionArgs[2]) {
+      console.error('Usage: svamp session send <session-id> <message> [--model <id>] [--plain] [--subject "..."] [--when-idle] [--urgency urgent|normal] [--wait] [--response] [--btw] [--require-approval] [--as-issue [--issue-title "..."]] [--timeout N] [--json]');
+      console.error("  --when-idle    Deferred delivery: park the message and let the recipient handle it on its next idle turn (default is urgent \u2014 wakes immediately).");
+      console.error("  --model <id>   Switch the session model (e.g. claude-opus-4-7, claude-sonnet-4-6) before delivering the message \u2014 forces a respawn.");
+      console.error("  --as-issue     File the message as an issue in the recipient session's backlog (optionally titled with --issue-title) instead of a chat send.");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionSend(sessionArgs[1], sessionArgs[2], targetMachineId, {
+      wait: hasFlag("--wait"),
+      response: hasFlag("--response"),
+      btw: hasFlag("--btw"),
+      requireApproval: hasFlag("--require-approval"),
+      timeout: parseFlagInt("--timeout"),
+      json: hasFlag("--json"),
+      subject: parseFlagStr("--subject"),
+      whenIdle: hasFlag("--when-idle"),
+      urgency: parseFlagStr("--urgency"),
+      model: parseFlagStr("--model"),
+      plain: hasFlag("--plain"),
+      asIssue: hasFlag("--as-issue"),
+      issueTitle: parseFlagStr("--issue-title")
+    });
+  } else if (sessionSubcommand === "edit-message" || sessionSubcommand === "edit") {
+    if (!sessionArgs[1] || !sessionArgs[2] || sessionArgs[3] === void 0) {
+      console.error("Usage: svamp session edit-message <session-id> <message-id> <new-text>");
+      console.error("  Rewinds history: rewrites the message + drops everything after it, then restarts Claude.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionEditMessage } = await import('./commands-B-yczgz_.mjs');
+    await sessionEditMessage(sessionArgs[1], sessionArgs[2], sessionArgs[3], targetMachineId);
+  } else if (sessionSubcommand === "refine") {
+    if (!sessionArgs[1] || !sessionArgs[2]) {
+      console.error("Usage: svamp session refine <session-id> <instruction>");
+      console.error("  Asks the agent to revise its latest reply in place (no extra round).");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionRefineLastReply } = await import('./commands-B-yczgz_.mjs');
+    await sessionRefineLastReply(sessionArgs[1], sessionArgs[2], targetMachineId);
+  } else if (sessionSubcommand === "undo-edit" || sessionSubcommand === "undo") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session undo-edit <session-id>");
+      console.error("  Reverts the most recent edit/refine, restoring the pre-edit history.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionUndoEdit } = await import('./commands-B-yczgz_.mjs');
+    await sessionUndoEdit(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "query") {
+    const dir = sessionArgs[1];
+    const prompt = sessionArgs[2];
+    if (!dir || !prompt) {
+      console.error("Usage: svamp session query <directory> <prompt> [--timeout N] [--keep] [--json] [--permission-mode MODE] [--tag NAME]");
+      console.error("  Spawns a stateless Claude session in <directory>, sends <prompt>, prints the answer, then deletes the session.");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionQuery } = await import('./commands-B-yczgz_.mjs');
+    await sessionQuery(dir, prompt, targetMachineId, {
+      timeout: parseFlagInt("--timeout"),
+      json: hasFlag("--json"),
+      keep: hasFlag("--keep"),
+      permissionMode: parseFlagStr("--permission-mode"),
+      tag: parseFlagStr("--tag")
+    });
+  } else if (sessionSubcommand === "wait") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session wait <session-id> [--timeout N] [--json]");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionWait(sessionArgs[1], targetMachineId, {
+      timeout: parseFlagInt("--timeout"),
+      json: hasFlag("--json")
+    });
+  } else if (sessionSubcommand === "share") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session share <session-id> --add <email>[:<role>] | --remove <email> | --list | --public <view|interact|off>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionShare(sessionArgs[1], targetMachineId, {
+      add: parseFlagStr("--add"),
+      remove: parseFlagStr("--remove"),
+      list: hasFlag("--list"),
+      public: parseFlagStr("--public")
+    });
+  } else if (sessionSubcommand === "approve") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session approve <session-id> [request-id] [--json]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionApprove } = await import('./commands-B-yczgz_.mjs');
+    const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
+    await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
+      json: hasFlag("--json")
+    });
+  } else if (sessionSubcommand === "deny") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session deny <session-id> [request-id] [--json]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionDeny } = await import('./commands-B-yczgz_.mjs');
+    const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
+    await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
+      json: hasFlag("--json")
+    });
+  } else if (sessionSubcommand === "loop" || sessionSubcommand === "loop-start") {
+    const id = sessionArgs[1];
+    const maybeTask = sessionArgs[2] && !sessionArgs[2].startsWith("-") ? sessionArgs[2] : void 0;
+    const until = parseFlagStr("--until") ?? parseFlagStr("--criteria");
+    const limitOnlyFlags = ["--max", "--max-iterations", "--max-rounds", "--max-tokens-per-hour", "--max-runtime", "--max-runtime-sec"];
+    const hasLimit = limitOnlyFlags.some((f) => parseFlagInt(f) !== void 0);
+    if (!id || !maybeTask && !until && !hasLimit) {
+      console.error('Usage: svamp session loop <session-id> ["<task>"] --until "<criteria>" [--oracle "cmd"] [--max N] [--max-tokens-per-hour N] [--max-runtime-sec N]');
+      console.error("  With a task: kicks the agent off and gates it until done.");
+      console.error("  With only --until: hot-plugs the gate onto the running session (no kickoff).");
+      console.error("  With only a limit (--max / --max-tokens-per-hour / --max-runtime-sec):");
+      console.error("    updates the cap on an existing loop, and RESUMES it if a ceiling had stopped it.");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionLoopStart(id, maybeTask, targetMachineId, {
+      until,
+      oracle: parseFlagStr("--oracle"),
+      agent: hasFlag("--agent"),
+      maxIterations: parseFlagInt("--max") ?? parseFlagInt("--max-iterations") ?? parseFlagInt("--max-rounds"),
+      maxTokensPerHour: parseFlagInt("--max-tokens-per-hour"),
+      maxRuntimeSec: parseFlagInt("--max-runtime") ?? parseFlagInt("--max-runtime-sec")
+    });
+  } else if (sessionSubcommand === "loop-cancel") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session loop-cancel <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionLoopCancel(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "loop-status") {
+    if (!sessionArgs[1]) {
+      console.error("Usage: svamp session loop-status <session-id>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionLoopStatus(sessionArgs[1], targetMachineId);
+  } else if (sessionSubcommand === "loop-extend") {
+    const reason = parseFlagStr("--reason");
+    if (!sessionArgs[1] || !reason) {
+      console.error('Usage: svamp session loop-extend <session-id> --reason "<why more turns are needed>" [--turns N]');
+      await flushStdout();
+      process.exit(1);
+    }
+    await sessionLoopExtend(sessionArgs[1], reason, targetMachineId, parseFlagInt("--turns") ?? void 0);
+  } else if (sessionSubcommand === "set-title") {
+    const title = sessionArgs[1];
+    if (!title) {
+      console.error("Usage: svamp session set-title <title>");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionSetTitle } = await import('./agentCommands-D91RcjqQ.mjs');
+    await sessionSetTitle(title);
+  } else if (sessionSubcommand === "set-project-description" || sessionSubcommand === "set-project") {
+    const desc = sessionArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
+    if (!desc) {
+      console.error("Usage: svamp session set-project-description <text>");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionSetProjectDescription } = await import('./agentCommands-D91RcjqQ.mjs');
+    await sessionSetProjectDescription(desc);
+  } else if (sessionSubcommand === "set-link") {
+    const url = sessionArgs[1];
+    if (!url) {
+      console.error("Usage: svamp session set-link <url> [label]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
+    const { sessionSetLink } = await import('./agentCommands-D91RcjqQ.mjs');
+    await sessionSetLink(url, label);
+  } else if (sessionSubcommand === "link") {
+    const op = sessionArgs[1];
+    const lm = await import('./agentCommands-D91RcjqQ.mjs');
+    if (op === "add") {
+      const url = sessionArgs[2];
+      if (!url || url.startsWith("--")) {
+        console.error('Usage: svamp session link add <url> [--label "Name"] [--icon "\u{1F517}|emoji"]');
+        process.exit(1);
+      }
+      await lm.sessionLinkAdd(url, parseFlagStr("--label"), parseFlagStr("--icon"));
+    } else if (op === "list" || op === "ls" || op === void 0) {
+      await lm.sessionLinkList();
+    } else if (op === "update") {
+      const id = sessionArgs[2];
+      if (!id || id.startsWith("--")) {
+        console.error("Usage: svamp session link update <id> [--url U] [--label L] [--icon I]");
+        process.exit(1);
+      }
+      await lm.sessionLinkUpdate(id, { url: parseFlagStr("--url"), label: parseFlagStr("--label"), icon: parseFlagStr("--icon") });
+    } else if (op === "remove" || op === "rm") {
+      const id = sessionArgs[2];
+      if (!id) {
+        console.error("Usage: svamp session link remove <id>");
+        process.exit(1);
+      }
+      await lm.sessionLinkRemove(id);
+    } else {
+      console.error("Usage: svamp session link <add <url> [--label L] [--icon I] | list | update <id> [...] | remove <id>>");
+      await flushStdout();
+      process.exit(1);
+    }
+  } else if (sessionSubcommand === "notify") {
+    const message = sessionArgs[1];
+    if (!message) {
+      console.error("Usage: svamp session notify <message> [--level info|warning|error]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const level = parseFlagStr("--level") || "info";
+    const { sessionNotify } = await import('./agentCommands-D91RcjqQ.mjs');
+    await sessionNotify(message, level);
+  } else if (sessionSubcommand === "broadcast") {
+    const action = sessionArgs[1];
+    if (!action) {
+      console.error("Usage: svamp session broadcast <action> [args...]\nActions: open-canvas <url> [label], close-canvas, toast <message>");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { sessionBroadcast } = await import('./agentCommands-D91RcjqQ.mjs');
+    await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
+  } else if (sessionSubcommand === "inbox") {
+    const inboxSubcmd = sessionArgs[1];
+    const agentSessionId = process.env.SVAMP_SESSION_ID;
+    if (inboxSubcmd === "send") {
+      if (!sessionArgs[2] || !sessionArgs[3]) {
+        console.error('Usage: svamp session inbox send <target-session-id> "<body>" [--subject "..."] [--when-idle] [--urgency urgent|normal] [--json]  (urgent by default \u2014 wakes the recipient; --when-idle defers to their next idle turn)');
+        await flushStdout();
+        process.exit(1);
+      }
+      if (agentSessionId) {
+        const { inboxSend } = await import('./agentCommands-D91RcjqQ.mjs');
+        await inboxSend(sessionArgs[2], {
+          body: sessionArgs[3],
+          subject: parseFlagStr("--subject"),
+          urgency: parseFlagStr("--urgency"),
+          whenIdle: hasFlag("--when-idle")
+        });
+      } else {
+        await sessionInboxSend(sessionArgs[2], sessionArgs[3], targetMachineId, {
+          subject: parseFlagStr("--subject"),
+          urgency: parseFlagStr("--urgency"),
+          whenIdle: hasFlag("--when-idle"),
+          json: hasFlag("--json")
+        });
+      }
+    } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
+      if (agentSessionId && !sessionArgs[2]) {
+        const { inboxList } = await import('./agentCommands-D91RcjqQ.mjs');
+        await inboxList({
+          unread: hasFlag("--unread"),
+          limit: parseFlagInt("--limit"),
+          json: hasFlag("--json")
+        });
+      } else if (sessionArgs[2]) {
+        await sessionInboxList(sessionArgs[2], targetMachineId, {
+          unread: hasFlag("--unread"),
+          limit: parseFlagInt("--limit"),
+          json: hasFlag("--json")
+        });
+      } else {
+        console.error("Usage: svamp session inbox list [session-id] [--unread] [--limit N] [--json]");
+        await flushStdout();
+        process.exit(1);
+      }
+    } else if (inboxSubcmd === "read") {
+      if (!sessionArgs[2]) {
+        console.error("Usage: svamp session inbox read <session-id|message-id> [message-id]");
+        await flushStdout();
+        process.exit(1);
+      }
+      if (agentSessionId && !sessionArgs[3]) {
+        const { inboxList } = await import('./agentCommands-D91RcjqQ.mjs');
+        await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
+      } else if (sessionArgs[3]) {
+        await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
+      } else {
+        console.error("Usage: svamp session inbox read <session-id> <message-id>");
+        await flushStdout();
+        process.exit(1);
+      }
+    } else if (inboxSubcmd === "reply") {
+      if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
+        const { inboxReply } = await import('./agentCommands-D91RcjqQ.mjs');
+        await inboxReply(sessionArgs[2], sessionArgs[3]);
+      } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
+        await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
+      } else {
+        console.error('Usage: svamp session inbox reply <session-id> <message-id> "<body>"');
+        await flushStdout();
+        process.exit(1);
+      }
+    } else if (inboxSubcmd === "clear") {
+      const clearOpts = { all: hasFlag("--all"), messageId: parseFlagStr("--message") };
+      if (agentSessionId && !sessionArgs[2]) {
+        await sessionInboxClear(agentSessionId, targetMachineId, clearOpts);
+      } else if (sessionArgs[2]) {
+        await sessionInboxClear(sessionArgs[2], targetMachineId, clearOpts);
+      } else {
+        console.error("Usage: svamp session inbox clear [session-id] [--message <message-id> | --all]");
+        console.error("  (the positional is the SESSION id; use --message <id> to purge a specific stuck message)");
+        await flushStdout();
+        process.exit(1);
+      }
+    } else {
+      console.error("Usage: svamp session inbox <send|list|read|reply|clear> [session-id] [args]");
+      await flushStdout();
+      process.exit(1);
+    }
+  } else {
+    console.error(`Unknown session command: ${sessionSubcommand}`);
+    printSessionHelp();
+    await flushStdout();
+    process.exit(1);
+  }
+  await flushStdout();
+  process.exit(0);
+}
+async function handleMachineCommand() {
+  const machineArgs = args.slice(1);
+  const machineSubcommand = machineArgs[0];
+  if (!machineSubcommand || wantsHelp(machineArgs)) {
+    printMachineHelp();
+    return;
+  }
+  if (machineSubcommand === "share") {
+    const { machineShare } = await import('./commands-B-yczgz_.mjs');
+    let machineId;
+    const shareArgs = [];
+    for (let i = 1; i < machineArgs.length; i++) {
+      if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
+        machineId = machineArgs[++i];
+      } else {
+        shareArgs.push(machineArgs[i]);
+      }
+    }
+    let add;
+    let remove;
+    let configPath;
+    let list = false;
+    let showConfig = false;
+    for (let i = 0; i < shareArgs.length; i++) {
+      if (shareArgs[i] === "--add" && i + 1 < shareArgs.length) {
+        add = shareArgs[++i];
+      } else if (shareArgs[i] === "--remove" && i + 1 < shareArgs.length) {
+        remove = shareArgs[++i];
+      } else if (shareArgs[i] === "--config" && i + 1 < shareArgs.length) {
+        configPath = shareArgs[++i];
+      } else if (shareArgs[i] === "--list") {
+        list = true;
+      } else if (shareArgs[i] === "--show-config") {
+        showConfig = true;
+      }
+    }
+    await machineShare(machineId, { add, remove, list, configPath, showConfig });
+  } else if (machineSubcommand === "exec") {
+    let machineId;
+    let cwd;
+    let all = false;
+    const cmdParts = [];
+    for (let i = 1; i < machineArgs.length; i++) {
+      if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
+        machineId = machineArgs[++i];
+      } else if (machineArgs[i] === "--cwd" && i + 1 < machineArgs.length) {
+        cwd = machineArgs[++i];
+      } else if (machineArgs[i] === "--all") {
+        all = true;
+      } else {
+        cmdParts.push(machineArgs[i]);
+      }
+    }
+    const command = cmdParts.join(" ");
+    if (!command) {
+      console.error("Usage: svamp machine exec <command> [--cwd <path>] [-m <id> | --all]");
+      await flushStdout();
+      process.exit(1);
+    }
+    if (all) {
+      const { fleetExec } = await import('./fleet-Ca-UjJNL.mjs');
+      await fleetExec(command, { cwd });
+    } else {
+      const { machineExec } = await import('./commands-B-yczgz_.mjs');
+      await machineExec(machineId, command, cwd);
+    }
+  } else if (machineSubcommand === "info") {
+    const { machineInfo } = await import('./commands-B-yczgz_.mjs');
+    let machineId;
+    for (let i = 1; i < machineArgs.length; i++) {
+      if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
+        machineId = machineArgs[++i];
+      }
+    }
+    await machineInfo(machineId);
+  } else if (machineSubcommand === "notify") {
+    const message = machineArgs[1];
+    if (!message) {
+      console.error("Usage: svamp machine notify <message> [--level info|warning|error]");
+      await flushStdout();
+      process.exit(1);
+    }
+    let level = "info";
+    for (let i = 2; i < machineArgs.length; i++) {
+      if (machineArgs[i] === "--level" && i + 1 < machineArgs.length) {
+        level = machineArgs[++i];
+        continue;
+      }
+      if (machineArgs[i] === "-m" || machineArgs[i] === "--machine" || machineArgs[i] === "--all") {
+        console.error(`svamp machine notify does not support ${machineArgs[i]} \u2014 it always notifies THIS machine's sessions.`);
+        console.error('  To reach another machine: svamp session send <id> "<message>" (or svamp machine exec -m <id>).');
+        await flushStdout();
+        process.exit(1);
+      }
+      console.error(`Unknown option for 'svamp machine notify': ${machineArgs[i]}`);
+      console.error("Usage: svamp machine notify <message> [--level info|warning|error]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const { machineNotify } = await import('./agentCommands-D91RcjqQ.mjs');
+    await machineNotify(message, level);
+  } else if (machineSubcommand === "ls") {
+    const { machineLs } = await import('./commands-B-yczgz_.mjs');
+    let machineId;
+    let showHidden = false;
+    let path;
+    for (let i = 1; i < machineArgs.length; i++) {
+      if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
+        machineId = machineArgs[++i];
+      } else if (machineArgs[i] === "--hidden" || machineArgs[i] === "-a") {
+        showHidden = true;
+      } else if (!path) {
+        path = machineArgs[i];
+      }
+    }
+    await machineLs(machineId, path, showHidden);
+  } else {
+    console.error(`Unknown machine command: ${machineSubcommand}`);
+    printMachineHelp();
+    await flushStdout();
+    process.exit(1);
+  }
+  await flushStdout();
+  process.exit(0);
+}
+async function handleFleetCommand() {
+  const fleetArgs = args.slice(1);
+  const sub = fleetArgs[0];
+  if (!sub || wantsHelp(fleetArgs)) {
+    console.log(`Usage: svamp fleet <subcommand>
+
+Subcommands (fan out across every machine in your workspace):
+  status                    Show svamp + claude-code version per machine
+  upgrade-claude [-v X]     Install Claude Code (defaults to svamp-cli's pinned version)
+  upgrade-codex [-v X]      Install Codex (defaults to svamp-cli's pinned version;
+                            the build tested for mid-turn steering, turn/steer >= 0.129)
+  upgrade-kimi [-v X]       Install Kimi Code (@moonshot-ai/kimi-code; defaults to
+                            svamp-cli's pinned version \u2014 the build tested for kimi acp).
+                            Opt-in per machine: not auto-installed, reconciles on demand.
+  upgrade-svamp [-v X] [--exclude-self] [--force]
+                            npm install -g svamp-cli@X, then restart each daemon.
+                            DEFAULT is graceful: each daemon restarts itself only
+                            when it has no actively-thinking session (never cuts an
+                            in-flight turn; 1h max-wait backstop). --force restarts
+                            immediately. --exclude-self skips this machine.
+                            (First roll onto a graceful-capable build needs --force.)
+  upgrade-nono              Reconcile the pinned nono \u2014 THE SANDBOX BOUNDARY (#1332).
+                            This is the ONLY way the pin reaches a machine that already
+                            has some nono: the installer runs only when the binary is
+                            ABSENT, so an existing machine never picks up a bump on its
+                            own. Deliberately manual, not automatic, because it is a live
+                            security boundary \u2014 CANARY ONE MACHINE FIRST. Applies to
+                            sessions started after it lands (no daemon restart).
+                            Takes NO -v: it installs PINNED_NONO_VERSION and nothing
+                            else. Passing -v is REFUSED (#1376 \u2014 it used to be echoed
+                            and then silently ignored). Roll a different nono by
+                            bumping the pin in a commit, then re-running this.
+                            'svamp fleet status' flags machines off the pin.
+  daemon-restart [--cleanup] [--force]
+                            Restart daemons. DEFAULT is graceful (waits for no
+                            actively-thinking session). --force restarts immediately,
+                            cutting any in-flight turn. --cleanup does a hard stop+start
+                            and outranks --force.
+                            (First roll onto a watcher-capable build needs --force.)
+  push-skill <name>         Install/force-refresh a skill on all machines
+
+Each row reports OK / FAIL / SKIP. Failures don't sink the batch; exit code 1
+only if at least one machine failed.
+
+Examples:
+  svamp fleet status
+  svamp fleet upgrade-claude
+  svamp fleet upgrade-codex
+  svamp fleet upgrade-kimi
+  svamp fleet upgrade-svamp -v 0.2.73
+  svamp fleet upgrade-svamp --exclude-self
+  svamp fleet push-skill hypha`);
+    await flushStdout();
+    process.exit(0);
+  }
+  const flag = (name, short) => {
+    for (let i = 1; i < fleetArgs.length; i++) {
+      if (fleetArgs[i] === `--${name}` || fleetArgs[i] === short) return fleetArgs[i + 1];
+    }
+    return void 0;
+  };
+  const hasFlag = (name) => fleetArgs.includes(`--${name}`);
+  if (sub === "status") {
+    const { fleetStatus } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetStatus();
+  } else if (sub === "upgrade-claude") {
+    const { fleetUpgradeClaude } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetUpgradeClaude({ version: flag("version", "-v") });
+  } else if (sub === "upgrade-codex") {
+    const { fleetUpgradeCodex } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetUpgradeCodex({ version: flag("version", "-v") });
+  } else if (sub === "upgrade-kimi") {
+    const { fleetUpgradeKimi } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetUpgradeKimi({ version: flag("version", "-v") });
+  } else if (sub === "upgrade-nono") {
+    const { fleetUpgradeNono } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetUpgradeNono({ version: flag("version", "-v") });
+  } else if (sub === "upgrade-svamp") {
+    const { fleetUpgradeSvamp } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetUpgradeSvamp({ version: flag("version", "-v"), excludeSelf: hasFlag("exclude-self"), force: hasFlag("force") });
+  } else if (sub === "daemon-restart") {
+    const { fleetDaemonRestart } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetDaemonRestart({ graceful: !hasFlag("cleanup"), force: hasFlag("force") });
+  } else if (sub === "push-skill") {
+    const name = fleetArgs[1];
+    const { fleetPushSkill } = await import('./fleet-Ca-UjJNL.mjs');
+    await fleetPushSkill(name);
+  } else {
+    console.error(`Unknown fleet subcommand: ${sub}`);
+    console.error('Run "svamp fleet --help" to see available subcommands.');
+    await flushStdout();
+    process.exit(1);
+  }
+  await flushStdout();
+  process.exit(process.exitCode || 0);
+}
+async function handleSkillsCommand() {
+  const skillsArgs = args.slice(1);
+  const skillsSubcommand = skillsArgs[0];
+  if (!skillsSubcommand || wantsHelp(skillsArgs)) {
+    await printSkillsHelp();
+    return;
+  }
+  const { skillsFind, skillsInstall, skillsList, skillsRemove, skillsPublish } = await import('./commands-DW5RnHZw.mjs');
+  if (skillsSubcommand === "find" || skillsSubcommand === "search") {
+    const query = skillsArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
+    if (!query) {
+      console.error("Usage: svamp skills find <query> [--json]");
+      await flushStdout();
+      process.exit(1);
+    }
+    await skillsFind(query, { json: skillsArgs.includes("--json") });
+  } else if (skillsSubcommand === "install" || skillsSubcommand === "add") {
+    if (!skillsArgs[1]) {
+      console.error("Usage: svamp skills install <name> [--force]");
+      await flushStdout();
+      process.exit(1);
+    }
+    await skillsInstall(skillsArgs[1], { force: skillsArgs.includes("--force") });
+  } else if (skillsSubcommand === "list" || skillsSubcommand === "ls") {
+    await skillsList();
+  } else if (skillsSubcommand === "remove" || skillsSubcommand === "rm") {
+    if (!skillsArgs[1]) {
+      console.error("Usage: svamp skills remove <name>");
+      await flushStdout();
+      process.exit(1);
+    }
+    await skillsRemove(skillsArgs[1]);
+  } else if (skillsSubcommand === "publish") {
+    const publishArgs = skillsArgs.slice(1).filter((a) => !a.startsWith("--"));
+    if (!publishArgs[0]) {
+      console.error("Usage: svamp skills publish <path> [--version <tag>]");
+      await flushStdout();
+      process.exit(1);
+    }
+    const versionIdx = skillsArgs.indexOf("--version");
+    const versionTag = versionIdx !== -1 ? skillsArgs[versionIdx + 1] : void 0;
+    await skillsPublish(publishArgs[0], { version: versionTag });
+  } else {
+    console.error(`Unknown skills command: ${skillsSubcommand}`);
+    await printSkillsHelp();
+    await flushStdout();
+    process.exit(1);
+  }
+  await flushStdout();
+  process.exit(0);
+}
+async function loginToHypha() {
+  if (wantsHelp(args.slice(1))) {
+    console.log("Usage: svamp login <frontend-url>   (e.g. https://svamp.aicell.io)");
+    console.log("");
+    console.log("  Authenticates this machine with Hypha and stores a long-lived token in");
+    console.log("  ~/.svamp/.env. The frontend URL serves /svamp.json, which carries the Hypha");
+    console.log("  server URL and routing config; a Hypha server URL also works (legacy mode).");
+    console.log("");
+    console.log("  A browser window opens to complete the login. Run `svamp daemon restart`");
+    console.log("  afterwards so the running daemon picks up the new token.");
+    console.log("");
+    console.log("  Env: SVAMP_LOGIN_TIMEOUT   seconds to wait for the browser step (default 120)");
+    return;
+  }
+  const anchorArg = args[1] || process.env.SVAMP_INSTANCE_URL || process.env.HYPHA_SERVER_URL;
+  if (!anchorArg) {
+    console.error("Usage: svamp login <frontend-url>   (e.g. https://svamp.aicell.io)");
+    console.error("  The frontend serves /svamp.json, which carries the Hypha server URL and");
+    console.error("  routing config. A Hypha server URL also works as a legacy fallback.");
+    await flushStdout();
+    process.exit(1);
+  }
+  const anchor = anchorArg.replace(/\/+$/, "");
+  const { loadInstanceConfig } = await import('./instance-CeHz5C8v.mjs').then(function (n) { return n.i; });
+  let cfg = null;
+  try {
+    cfg = await loadInstanceConfig({ anchor, force: true });
+  } catch {
+  }
+  const configMode = !!(cfg && typeof cfg.hyphaServerUrl === "string" && cfg.hyphaServerUrl.trim());
+  const serverUrl = configMode ? cfg.hyphaServerUrl.trim().replace(/\/+$/, "") : anchor;
+  if (configMode) {
+    console.log(`Found Svamp instance config at ${anchor}`);
+    console.log(`  Hypha server: ${serverUrl}`);
+  } else {
+    console.log(`No svamp.json found at ${anchor} \u2014 using it as the Hypha server (legacy mode).`);
+  }
+  console.log(`Logging in to Hypha server: ${serverUrl}`);
+  console.log("A browser window will open for authentication...");
+  try {
+    const mod = await import('hypha-rpc');
+    const hyphaWebsocketClient = mod.hyphaWebsocketClient || mod.default?.hyphaWebsocketClient;
+    if (!hyphaWebsocketClient?.login) {
+      throw new Error("Could not find hyphaWebsocketClient.login in hypha-rpc");
+    }
+    const token = await hyphaWebsocketClient.login({
+      server_url: serverUrl,
+      // Overridable, but the DEFAULT stays 120s deliberately. Raising it looks like an
+      // obvious kindness on this recovery path (a human has to switch to a browser and
+      // complete an OAuth round-trip while the machine is offline), but the server keeps
+      // its OWN login-key lifetime: waiting past it does not extend the window, it just
+      // parks until the key is gone and then fails inside hypha's check_login with
+      // "the JSON object must be str, bytes or bytearray, not NoneType" — strictly worse
+      // than a clean client-side timeout. Verified against hypha.aicell.io on 2026-08-30.
+      // Raise SVAMP_LOGIN_TIMEOUT only against a server known to hold keys longer.
+      login_timeout: Number(process.env.SVAMP_LOGIN_TIMEOUT) || 120,
+      login_callback: (context) => {
+        console.log(`
+Please open this URL in your browser:
+  ${context.login_url}
+`);
+        console.log("Waiting for you to complete login in the browser...\n");
+      }
+    });
+    if (!token) {
+      console.error("Login failed \u2014 no token received");
+      await flushStdout();
+      process.exit(1);
+    }
+    const connectToServer = mod.connectToServer || mod.default && mod.default.connectToServer || hyphaWebsocketClient && hyphaWebsocketClient.connectToServer;
+    const server = await connectToServer({ server_url: serverUrl, token });
+    const workspace = server.config.workspace;
+    const userId = server.config.user?.id || workspace;
+    let longLivedToken = token;
+    try {
+      const sixMonthsInSeconds = 6 * 30 * 24 * 60 * 60;
+      longLivedToken = await server.generateToken({ expires_in: sixMonthsInSeconds, workspace });
+      console.log("Generated long-lived token (expires in ~6 months)");
+    } catch (err) {
+      console.warn("Could not generate long-lived token, using login token:", err.message || err);
+    }
+    await server.disconnect();
+    const os = await import('os');
+    const { join } = await import('path');
+    const fs = await import('fs');
+    const homeDir = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+    if (!fs.existsSync(homeDir)) {
+      fs.mkdirSync(homeDir, { recursive: true });
+    }
+    const envFile = join(homeDir, ".env");
+    const envLines = [];
+    if (fs.existsSync(envFile)) {
+      const existing = fs.readFileSync(envFile, "utf-8").split("\n");
+      for (const line of existing) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("HYPHA_TOKEN=") || trimmed.startsWith("HYPHA_WORKSPACE=") || trimmed.startsWith("HYPHA_SERVER_URL=") || trimmed.startsWith("SVAMP_INSTANCE_URL=")) {
+          continue;
+        }
+        envLines.push(line);
+      }
+    }
+    if (configMode) {
+      envLines.push(`SVAMP_INSTANCE_URL=${anchor}`);
+    } else {
+      envLines.push(`HYPHA_SERVER_URL=${serverUrl}`);
+    }
+    envLines.push(`HYPHA_TOKEN=${longLivedToken}`);
+    envLines.push(`HYPHA_WORKSPACE=${workspace}`);
+    while (envLines.length > 0 && envLines[envLines.length - 1].trim() === "") {
+      envLines.pop();
+    }
+    fs.writeFileSync(envFile, envLines.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
+    try {
+      fs.chmodSync(envFile, 384);
+    } catch {
+    }
+    console.log(`
+Login successful!`);
+    console.log(`  User: ${userId}`);
+    console.log(`  Workspace: ${workspace}`);
+    console.log(`  Token saved to: ${envFile}`);
+    console.log(`
+You can now start the daemon: svamp daemon start`);
+  } catch (err) {
+    const msg = err.message || String(err);
+    if (msg.includes("WebSocket is not defined")) {
+      console.error(`Login failed: WebSocket is not available in this Node.js version (${process.version}).`);
+      console.error(`  hypha-rpc requires Node.js >= 22 (which includes native WebSocket support).`);
+      console.error(`  Please upgrade Node.js:  nvm install 22 && nvm use 22`);
+    } else {
+      console.error("Login failed:", msg);
+    }
+    await flushStdout();
+    process.exit(1);
+  }
+}
+async function logoutFromHypha() {
+  const os = await import('os');
+  const { join } = await import('path');
+  const fs = await import('fs');
+  const homeDir = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+  const envFile = join(homeDir, ".env");
+  console.log("Stopping daemon...");
+  try {
+    await stopDaemon();
+  } catch {
+  }
+  try {
+    const { clearInstanceConfigCache } = await import('./instance-CeHz5C8v.mjs').then(function (n) { return n.i; });
+    clearInstanceConfigCache();
+  } catch {
+  }
+  if (fs.existsSync(envFile)) {
+    const existing = fs.readFileSync(envFile, "utf-8").split("\n");
+    const kept = [];
+    for (const line of existing) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("HYPHA_TOKEN=") || trimmed.startsWith("HYPHA_WORKSPACE=") || trimmed.startsWith("HYPHA_SERVER_URL=") || trimmed.startsWith("SVAMP_INSTANCE_URL=")) {
+        continue;
+      }
+      kept.push(line);
+    }
+    while (kept.length > 0 && kept[kept.length - 1].trim() === "") {
+      kept.pop();
+    }
+    if (kept.length > 0) {
+      fs.writeFileSync(envFile, kept.join("\n") + "\n", { encoding: "utf-8", mode: 384 });
+      try {
+        fs.chmodSync(envFile, 384);
+      } catch {
+      }
+    } else {
+      fs.unlinkSync(envFile);
+    }
+    console.log("Credentials removed");
+  } else {
+    console.log("No credentials found");
+  }
+  console.log("Logged out successfully");
+}
+async function installDaemonService() {
+  const os = await import('os');
+  const { join, dirname } = await import('path');
+  const fs = await import('fs');
+  const { execSync } = await import('child_process');
+  const svampHome = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+  const logsDir = join(svampHome, "logs");
+  let svampBinary = process.argv[1];
+  try {
+    const resolved = execSync(`which svamp`, { encoding: "utf-8" }).trim();
+    if (resolved) svampBinary = resolved;
+  } catch {
+  }
+  if (!fs.existsSync(svampBinary)) {
+    console.error(`Cannot find svamp binary at: ${svampBinary}`);
+    console.error("Please install svamp-cli globally first.");
+    await flushStdout();
+    process.exit(1);
+  }
+  const nodeBinDir = dirname(process.execPath);
+  const shellPath = process.env.PATH || "";
+  const supervisedPath = shellPath.includes(nodeBinDir) ? shellPath : [nodeBinDir, shellPath].filter(Boolean).join(":");
+  if (!fs.existsSync(logsDir)) fs.mkdirSync(logsDir, { recursive: true });
+  if (process.platform === "darwin") {
+    const launchAgentsDir = join(os.homedir(), "Library", "LaunchAgents");
+    const plistPath = join(launchAgentsDir, `${LAUNCHD_LABEL}.plist`);
+    if (!fs.existsSync(launchAgentsDir)) fs.mkdirSync(launchAgentsDir, { recursive: true });
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${LAUNCHD_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${svampBinary}</string>
+        <string>daemon</string>
+        <string>start-supervised</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${logsDir}/daemon-supervised.log</string>
+    <key>StandardErrorPath</key>
+    <string>${logsDir}/daemon-supervised.log</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>PATH</key>
+        <string>${supervisedPath}</string>
+        <key>SVAMP_HOME</key>
+        <string>${svampHome}</string>
+    </dict>
+</dict>
+</plist>
+`;
+    fs.writeFileSync(plistPath, plist, "utf-8");
+    console.log(`Plist written: ${plistPath}`);
+    const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+    try {
+      execSync(`launchctl bootout gui/${uid}/${LAUNCHD_LABEL} 2>/dev/null`, { stdio: "ignore" });
+    } catch {
+    }
+    execSync(`launchctl bootstrap gui/${uid} "${plistPath}"`);
+    try {
+      execSync(`launchctl enable gui/${uid}/${LAUNCHD_LABEL} 2>/dev/null`, { stdio: "ignore" });
+    } catch {
+    }
+    try {
+      execSync(`launchctl kickstart gui/${uid}/${LAUNCHD_LABEL} 2>/dev/null`, { stdio: "ignore" });
+    } catch {
+    }
+    console.log(`
+Svamp daemon service installed and started!`);
+    console.log(`  Service: ${LAUNCHD_LABEL}`);
+    console.log(`  Auto-restart on crash: enabled`);
+    console.log(`  Log file: ${logsDir}/daemon-supervised.log`);
+    console.log(`
+To stop the service:   svamp daemon stop`);
+    console.log(`To uninstall:          svamp daemon uninstall`);
+  } else if (process.platform === "linux") {
+    const hasSystemd = (() => {
+      try {
+        execSync("systemctl --user status 2>/dev/null", { stdio: "pipe" });
+        return true;
+      } catch {
+        return false;
+      }
+    })();
+    if (hasSystemd) {
+      const systemdUserDir = join(os.homedir(), ".config", "systemd", "user");
+      const unitPath = join(systemdUserDir, "svamp-daemon.service");
+      if (!fs.existsSync(systemdUserDir)) fs.mkdirSync(systemdUserDir, { recursive: true });
+      const unit = `[Unit]
+Description=Svamp Daemon \u2014 AI workspace on Hypha Cloud
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+ExecStart=${svampBinary} daemon start-supervised
+Environment=PATH=${supervisedPath}
+Environment=SVAMP_HOME=${svampHome}
+Restart=on-failure
+RestartSec=3
+StandardOutput=append:${logsDir}/daemon-supervised.log
+StandardError=append:${logsDir}/daemon-supervised.log
+
+[Install]
+WantedBy=default.target
+`;
+      fs.writeFileSync(unitPath, unit, "utf-8");
+      execSync("systemctl --user daemon-reload");
+      execSync("systemctl --user enable --now svamp-daemon.service");
+      console.log(`
+Svamp daemon service installed and started!`);
+      console.log(`  Service: svamp-daemon.service (systemd user)`);
+      console.log(`  Unit file: ${unitPath}`);
+      console.log(`  Auto-restart on crash: enabled`);
+      console.log(`  Log file: ${logsDir}/daemon-supervised.log`);
+      console.log(`
+To stop the service:   svamp daemon stop`);
+      console.log(`To uninstall:          svamp daemon uninstall`);
+    } else {
+      console.log(`
+No systemd detected. The built-in supervisor is cross-platform.`);
+      console.log(`
+For Docker, set your container CMD to:`);
+      console.log(`  ${svampBinary} daemon start-supervised`);
+      console.log(`
+Or run in the background:`);
+      console.log(`  svamp daemon start`);
+      console.log(`
+To stop the daemon:    svamp daemon stop`);
+    }
+  } else {
+    console.log(`
+The built-in supervisor is cross-platform.`);
+    console.log(`
+Run: svamp daemon start`);
+    console.log(`
+To stop: svamp daemon stop`);
+  }
+}
+async function uninstallDaemonService() {
+  const os = await import('os');
+  const { join } = await import('path');
+  const fs = await import('fs');
+  const { execSync } = await import('child_process');
+  if (process.platform === "darwin") {
+    const plistPath = join(os.homedir(), "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    if (!fs.existsSync(plistPath)) {
+      console.log("Svamp daemon service is not installed.");
+      return;
+    }
+    const uid = typeof process.getuid === "function" ? process.getuid() : 0;
+    try {
+      execSync(`launchctl bootout gui/${uid}/${LAUNCHD_LABEL} 2>/dev/null`, { stdio: "pipe" });
+    } catch {
+      try {
+        execSync(`launchctl unload "${plistPath}" 2>/dev/null`, { stdio: "pipe" });
+      } catch {
+      }
+    }
+    fs.unlinkSync(plistPath);
+    console.log("Svamp daemon service uninstalled (launchd).");
+    console.log("The daemon has been stopped and will no longer auto-start.");
+  } else if (process.platform === "linux") {
+    const unitPath = join(os.homedir(), ".config", "systemd", "user", "svamp-daemon.service");
+    const svampHome = process.env.SVAMP_HOME || join(os.homedir(), ".svamp");
+    const wrapperPath = join(svampHome, "daemon-supervisor.sh");
+    let removed = false;
+    if (fs.existsSync(unitPath)) {
+      try {
+        execSync("systemctl --user disable --now svamp-daemon.service", { stdio: "pipe" });
+      } catch {
+      }
+      fs.unlinkSync(unitPath);
+      try {
+        execSync("systemctl --user daemon-reload", { stdio: "pipe" });
+      } catch {
+      }
+      console.log("Svamp daemon service uninstalled (systemd).");
+      removed = true;
+    }
+    if (fs.existsSync(wrapperPath)) {
+      fs.unlinkSync(wrapperPath);
+      if (!removed) console.log("Svamp daemon supervisor script removed.");
+      removed = true;
+    }
+    if (!removed) {
+      console.log("Svamp daemon service is not installed.");
+    }
+  } else {
+    console.error(`Daemon service uninstall is not supported on ${process.platform}.`);
+    await flushStdout();
+    process.exit(1);
+  }
+}
+function printHelp() {
+  console.log(`
+svamp \u2014 AI workspace on Hypha Cloud
+
+Quick start \u2014 spawn an agent to do a task (autonomous by default):
+  svamp session spawn claude -d ./project --message "fix tests" --wait
+
+  Note: as of 0.2.69 spawn defaults to permission mode "bypassPermissions" so the
+  child agent doesn't get stuck on tool-approval prompts. Pass --require-approval
+  (or -p default / -p acceptEdits) when you want a human to gate tool use.
+
+Commands:
+  svamp                              Start interactive Claude session (synced to cloud)
+  svamp login [url]                  Login to Hypha (opens browser, stores token)
+  svamp logout                       Logout (stop daemon, remove credentials)
+  svamp daemon start                 Start the background daemon (required for sessions)
+  svamp daemon status                Show daemon status
+  svamp daemon --help                Show all daemon commands
+
+  Session management (requires daemon running):
+  svamp session spawn <agent> [opts] Spawn a new agent session (agents: claude, gemini, codex, kimi)
+  svamp session send <id> <message>  Send message to a session (urgent by default \u2014 wakes the recipient; --when-idle to defer to their next idle turn)
+  svamp session query <dir> <prompt> Stateless one-shot: spawn \u2192 ask \u2192 answer \u2192 delete
+  svamp session wait <id>            Wait for agent to become idle
+  svamp session messages <id>        Show message history (--last N, --json, --raw)
+  svamp session info <id>            Show session status & pending permissions
+  svamp session list                 List sessions
+  svamp session whoami               Show your environment: peers on this machine & other machines, how to reach them
+  svamp session archive <id>         Archive a session (preserves history, resumable later)
+  svamp session resume <id>          Resume an archived session
+  svamp session delete <id>          Permanently delete a session (cannot be undone)
+  svamp session attach <id>          Attach interactive terminal (stdin/stdout)
+  svamp session approve/deny <id>    Approve or deny pending permission requests
+  svamp session --help               Show ALL session commands and detailed options
+
+  Crew (lead delegates features to managed worktree children):
+  svamp feature start "<brief>"      Spawn a worktree child of this lead + loop gate (oracle\u2192parent)
+  svamp feature list                 This lead's feature children (branch, ahead/behind, status)
+  svamp feature done|report          (run by a child) signal completion / report progress to the lead
+  svamp feature merge <child>        (run by the lead) verify \u2192 merge \u2192 remove worktree \u2192 archive child
+  svamp feature --help               Show all crew commands and options
+
+  File serving:
+  svamp serve <name> [directory]     Serve a directory at its OWN public subdomain
+  svamp serve remove <name>          Remove a served mount
+  svamp serve list [--all]           List served mounts
+  svamp serve info                   Server status (per-mount URLs come from 'serve list')
+  svamp serve --help                 Show all serve commands
+
+  Other:
+  svamp issue --help                 Issue backlog (add, list, work, close, pending, guide)
+  svamp workflow --help              Automation workflows (schedule / event / idle triggers)
+  svamp process --help               Process supervisor (apply, list, start, stop, logs)
+  svamp machine --help               Machine sharing & security contexts
+  svamp fleet --help                 Fan-out commands across all your machines (status, upgrade-claude, upgrade-codex, upgrade-kimi, upgrade-nono, upgrade-svamp, daemon-restart, push-skill)
+  svamp skills --help                Skills marketplace (find, install, publish)
+  svamp service --help               Service exposure (HTTP services from sandboxes)
+  svamp outpost --help               Connect a remote machine (FDE outpost): up, exec, list, install
+  svamp wise --help                  WISE voice & meeting agent (ask, join-meeting, announce, meetings, voice)
+  svamp notify <email> \u2026             Send a cross-user notification (bell inbox); --title/--body/--action/--level
+  svamp events list|ack              Read / dismiss your notification bell inbox
+  svamp admin \u2026                      System-collection ops (create-system-collections, set-collection-config, migrate-collection-children)
+  svamp agent <name>                 Start local agent session (no daemon needed)
+  svamp --version                    Show version
+
+Interactive mode:
+  Run 'svamp' with no arguments to start Claude in your terminal with cloud sync.
+  Messages from the web app auto-switch to remote mode. Space-Space returns to local.
+
+Environment variables:
+  HYPHA_SERVER_URL     Hypha server URL (required for cloud sync)
+  HYPHA_TOKEN          Hypha auth token (stored by login command)
+  HYPHA_WORKSPACE      Hypha workspace / user ID (stored by login command)
+  SVAMP_HOME           Config directory (default: ~/.svamp)
+`);
+}
+function printDaemonHelp() {
+  console.log(`
+svamp daemon \u2014 Daemon management
+
+Usage:
+  svamp daemon start                  Start the daemon (detached)
+  svamp daemon start --no-auto-continue  Start without auto-continuing interrupted sessions
+  svamp daemon stop                   Stop the daemon (sessions preserved for restart)
+  svamp daemon stop --cleanup         Stop and mark all sessions as stopped
+  svamp daemon restart                Restart now \u2014 picks up new binary, sessions resume seamlessly
+  svamp daemon restart --when-idle    Restart only once no session is actively thinking (deferred; 1h max-wait)
+  svamp daemon status                 Show daemon status
+  svamp daemon install                Install as login service (macOS/Linux) \u2014 auto-start at login
+  svamp daemon uninstall              Remove login service
+  svamp daemon auth                   Show Claude API auth mode used for spawned sessions
+  svamp daemon auth use-hypha-proxy <URL>
+                                      Route Claude through the Hypha LLM proxy with HYPHA_TOKEN.
+                                      URL is required (no default) \u2014 e.g. https://proxy.hypha.aicell.io
+                                      for the hypha-cloud cluster, or your own deployment's proxy.
+  svamp daemon auth use-login         Use ~/.claude credentials (run "claude login" to set them)
+  svamp daemon auth set <URL> <KEY>   Use a custom Anthropic gateway (base URL must not end in /v1)
+  svamp daemon codex-auth --help      Configure how Codex authenticates (status/set/use-openai/use-chatgpt/clear)
+  svamp daemon kimi-auth --help       Configure how Kimi Code authenticates (status/use-moonshot/use-coding/set/clear)
+  svamp daemon install-nono           Install/reconcile THIS machine onto the pinned, checksum-verified
+                                      nono \u2014 the sandbox boundary. installNono() otherwise runs only
+                                      when the binary is ABSENT, so an existing machine never picks up
+                                      a new pin. Roll deliberately; 'svamp fleet upgrade-nono' fans
+                                      this out (no -v \u2014 it always installs the pin, #1376).
+
+Claude auth flags (take effect on next start/restart):
+  svamp daemon start --use-hypha-proxy <URL>   (or --hypha-proxy-url URL)
+  svamp daemon start --use-claude-login
+  svamp daemon start --anthropic-base-url URL --anthropic-api-key KEY
+
+Machine sharing (seed at boot \u2014 equivalent to running 'svamp machine share --add'
+for each email; idempotent, never removes):
+  svamp daemon start --share alice@example.com,bob@example.com
+  svamp daemon start --share alice@example.com --share bob@example.com
+`);
+}
+async function applyClaudeAuthFlags(argv) {
+  const hasHypha = argv.includes("--use-hypha-proxy");
+  const hasLogin = argv.includes("--use-claude-login") || argv.includes("--use-login");
+  const baseUrlIdx = argv.indexOf("--anthropic-base-url");
+  const apiKeyIdx = argv.indexOf("--anthropic-api-key");
+  const hasCustom = baseUrlIdx !== -1 || apiKeyIdx !== -1;
+  const chosen = [hasHypha, hasLogin, hasCustom].filter(Boolean).length;
+  if (chosen === 0) return;
+  if (chosen > 1) {
+    throw new Error(
+      "--use-hypha-proxy, --use-claude-login, and --anthropic-base-url/--anthropic-api-key are mutually exclusive"
+    );
+  }
+  const mod = await import('./claudeAuth-C0wc1GTM.mjs');
+  if (hasHypha) {
+    let url;
+    const hyphaIdx = argv.indexOf("--use-hypha-proxy");
+    if (hyphaIdx !== -1 && argv[hyphaIdx + 1] && !argv[hyphaIdx + 1].startsWith("-")) {
+      url = argv[hyphaIdx + 1];
+    }
+    const urlFlagIdx = argv.indexOf("--hypha-proxy-url");
+    if (urlFlagIdx !== -1) {
+      const v = argv[urlFlagIdx + 1];
+      if (!v || v.startsWith("-")) throw new Error("--hypha-proxy-url requires a value");
+      url = v;
+    }
+    if (!url) {
+      throw new Error(
+        `--use-hypha-proxy requires a proxy URL (no default). Pass it as \`--use-hypha-proxy ${mod.EXAMPLE_HYPHA_PROXY_URL}\` or \`--hypha-proxy-url ${mod.EXAMPLE_HYPHA_PROXY_URL}\`.`
+      );
+    }
+    mod.setClaudeAuthHyphaProxy(url);
+    console.log(`Claude auth configured: hypha-proxy (${url}; uses HYPHA_TOKEN live at each spawn).`);
+    return;
+  }
+  if (hasLogin) {
+    mod.setClaudeAuthLogin();
+    console.log('Claude auth configured: login (uses ~/.claude credentials \u2014 run "claude login" if needed).');
+    return;
+  }
+  if (baseUrlIdx === -1 || apiKeyIdx === -1) {
+    throw new Error("--anthropic-base-url and --anthropic-api-key must be passed together");
+  }
+  const baseUrl = argv[baseUrlIdx + 1];
+  const apiKey = argv[apiKeyIdx + 1];
+  if (!baseUrl || baseUrl.startsWith("--")) throw new Error("--anthropic-base-url requires a value");
+  if (!apiKey || apiKey.startsWith("--")) throw new Error("--anthropic-api-key requires a value");
+  mod.setClaudeAuthCustom(baseUrl, apiKey);
+  console.log(`Claude auth configured: custom (base URL ${baseUrl}).`);
+}
+const DAEMON_SHARE_ENV_KEY = "SVAMP_SHARE_EMAILS";
+async function applyDaemonShareFlag(argv) {
+  const collected = [];
+  for (let i = 0; i < argv.length; i++) {
+    if (argv[i] === "--share" && i + 1 < argv.length) {
+      const value = argv[++i];
+      for (const part of value.split(",")) {
+        const email = part.trim();
+        if (!email) continue;
+        if (!email.includes("@")) {
+          throw new Error(`--share value "${email}" is not a valid email address`);
+        }
+        collected.push(email);
+      }
+    }
+  }
+  if (collected.length === 0) return;
+  const { updateEnvFile } = await import('./claudeAuth-C0wc1GTM.mjs');
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = collected.filter((e) => {
+    const k = e.toLowerCase();
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+  updateEnvFile({ [DAEMON_SHARE_ENV_KEY]: deduped.join(",") });
+  console.log(`Machine sharing seed updated: ${deduped.join(", ")} (will be added at next daemon start).`);
+}
+async function handleWiseAgentCommand(rest) {
+  const sub = wantsHelp(rest) ? "--help" : rest[0];
+  if (sub === "ask") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const sessionId = valueOf(["--session", "-s"]);
+    const machineId = valueOf(["--machine", "-m"]);
+    const json = rest.includes("--json");
+    const consumed = /* @__PURE__ */ new Set();
+    ["--session", "-s", "--machine", "-m"].forEach((f) => {
+      const i = rest.indexOf(f);
+      if (i >= 0) {
+        consumed.add(String(i));
+        consumed.add(String(i + 1));
+      }
+    });
+    const message = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
+    const { wiseAskCli } = await import('./commands-B-yczgz_.mjs');
+    await wiseAskCli(machineId, message, sessionId, { json });
+    return;
+  }
+  if (sub === "voice") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const { runWiseVoiceCli } = await import('./headlessCli-C8HzQvis.mjs');
+    await runWiseVoiceCli({ voice: valueOf(["--voice"]), wakeKeywordPath: valueOf(["--wake"]), model: valueOf(["--model"]) });
+    return;
+  }
+  if (sub === "join-meeting" || sub === "join") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const machineId = valueOf(["--machine", "-m"]);
+    const sessionId = rest.includes("--global") ? void 0 : valueOf(["--session", "-s"]);
+    const json = rest.includes("--json");
+    const mode = valueOf(["--mode"]);
+    const mission = valueOf(["--mission"]);
+    const url = rest.slice(1).find((a) => /^https?:\/\//.test(a)) || "";
+    const { wiseJoinMeetingCli } = await import('./commands-B-yczgz_.mjs');
+    await wiseJoinMeetingCli(machineId, url, sessionId, { json, mode, mission });
+    return;
+  }
+  if (sub === "leave-meeting" || sub === "leave") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const { wiseLeaveMeetingCli } = await import('./commands-B-yczgz_.mjs');
+    await wiseLeaveMeetingCli(valueOf(["--machine", "-m"]), valueOf(["--session", "-s"]), { json: rest.includes("--json") });
+    return;
+  }
+  if (sub === "announce") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const sessionId = valueOf(["--session", "-s"]) || process.env.SVAMP_SESSION_ID;
+    const machineId = valueOf(["--machine", "-m"]);
+    const json = rest.includes("--json");
+    const consumed = /* @__PURE__ */ new Set();
+    ["--session", "-s", "--machine", "-m"].forEach((f) => {
+      const i = rest.indexOf(f);
+      if (i >= 0) {
+        consumed.add(String(i));
+        consumed.add(String(i + 1));
+      }
+    });
+    const text = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
+    const { wiseAnnounceCli } = await import('./commands-B-yczgz_.mjs');
+    await wiseAnnounceCli(machineId, text, sessionId, { json });
+    return;
+  }
+  if (sub === "meetings") {
+    const valueOf = (flags) => {
+      for (const f of flags) {
+        const i = rest.indexOf(f);
+        if (i >= 0 && rest[i + 1]) return rest[i + 1];
+      }
+      return void 0;
+    };
+    const { wiseMeetingsCli } = await import('./commands-B-yczgz_.mjs');
+    await wiseMeetingsCli(valueOf(["--machine", "-m"]), { json: rest.includes("--json") });
+    return;
+  }
+  if (sub === "--help" || sub === "-h") {
+    console.log(`Usage:
+  svamp wise ask "<message>" [--session <id>] [-m <machine>] [--json]
+      Fast WISE turn \u2014 GLOBAL machine-manager by default (daemon status, run
+      commands, inspect/spawn/drive any session); --session <id> scopes to one.
+  svamp wise join-meeting <zoom|meet|teams url> [--session <id>|--global] [--mode listen|text|voice] [--mission "<prompt>"] [-m <machine>]
+      --mode listen=silent (transcribe only), text=reply in meeting chat, voice=speak aloud (default).
+      --mission optional focus prompt for the agent; omit for a general meeting mission.
+  svamp wise leave-meeting [--session <id>] [-m <machine>]
+  svamp wise announce "<text>" [--session <id>] [-m <machine>]
+      Post a chat message into the live meeting (defaults --session to
+      $SVAMP_SESSION_ID, so the deep agent can announce when work is done).
+  svamp wise meetings [-m <machine>]
+      List the meeting agents currently active on the machine.
+
+  svamp wise voice [--voice <name>] [--wake <keyword.ppn>] [--model <id>]
+      HEADLESS voice on this machine (mic + speaker, no browser). Needs \`sox\`.
+      --wake <keyword.ppn> = always-on "Hey WISE" (needs PICOVOICE_ACCESS_KEY);
+      omit it for a single always-listening session (Ctrl-C to stop).
+
+svamp wise-agent auth <command>
+
+Configure the server-side WISE Agent's fast model (text companion to the deep agent).
+
+  status                     Show the effective provider / model / base URL / key.
+  use-openai [KEY]           Route via OpenAI (default provider). Optional API key.
+  use-hypha-proxy [URL]      Route via the Hypha LLM proxy (quota-governed).
+  use-claude-haiku [URL]     Fallback: Claude Haiku via the proxy (no OpenAI key).
+  set <BASE_URL> <KEY>       Custom OpenAI-compatible gateway: base URL + key together.
+  set-key <KEY>              Set just the API key.
+  set-model <model>          Override the model id (e.g. gpt-5-mini).
+  set-base-url <url>         Override the OpenAI-compatible base URL.
+
+Env equivalents (read from ~/.svamp/.env or the daemon's environment):
+  OPENAI_API_KEY / WISE_AGENT_API_KEY   \xB7 OPENAI_BASE_URL / WISE_AGENT_BASE_URL
+  WISE_AGENT_PROVIDER \xB7 WISE_AGENT_MODEL \xB7 SVAMP_HYPHA_PROXY_URL \xB7 HYPHA_TOKEN
+
+Persisted to ~/.svamp/.env. Run \`svamp daemon restart\` afterwards to apply.
+If none is set, hitting a WISE Agent channel returns a clear "not configured" error.`);
+    return;
+  }
+  if (rest[0] && rest[0] !== "auth") {
+    console.error("Usage: svamp wise-agent auth <status|use-openai|use-hypha-proxy|use-claude-haiku|set-model|set-base-url>");
+    process.exitCode = 1;
+    return;
+  }
+  const authArgs = rest.slice(1);
+  const mod = await import('./auth-CRz8TsEl.mjs');
+  let action;
+  try {
+    action = mod.parseWiseAgentAuthArgs(authArgs);
+  } catch (e) {
+    console.error(e?.message || String(e));
+    process.exitCode = 1;
+    return;
+  }
+  if (action) {
+    const { updateEnvFile } = await import('./claudeAuth-C0wc1GTM.mjs');
+    const updates = mod.buildWiseAgentEnvUpdates(action);
+    updateEnvFile(updates);
+    for (const [k, v] of Object.entries(updates)) {
+      if (v === void 0) delete process.env[k];
+      else process.env[k] = v;
+    }
+    console.log("Updated ~/.svamp/.env. Run `svamp daemon restart` to apply.");
+  }
+  const status = mod.describeWiseAgentAuth(process.env);
+  console.log(`WISE Agent: provider=${status.provider} model=${status.model} base=${status.baseUrl} key=${status.keyRedacted}`);
+}
+async function handleDaemonAuthCommand(argv) {
+  const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
+  const mod = await import('./claudeAuth-C0wc1GTM.mjs');
+  if (sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(`
+svamp daemon auth \u2014 Configure how Claude subprocesses authenticate
+
+Subcommands:
+  svamp daemon auth                      Show current mode + base URL + redacted API key
+  svamp daemon auth use-hypha-proxy <URL>
+                                         Route Claude through the Hypha LLM proxy using HYPHA_TOKEN.
+                                         URL is REQUIRED \u2014 there is no hardcoded default. Use
+                                         https://proxy.hypha.aicell.io for the hypha-cloud cluster, or
+                                         your own deployment's proxy. Persisted as SVAMP_HYPHA_PROXY_URL.
+                                         Token is resolved live at each spawn, so a
+                                         \`svamp login\` refresh takes effect immediately.
+  svamp daemon auth use-login            Use ~/.claude credentials written by \`claude login\`.
+                                         Removes managed ANTHROPIC_BASE_URL / ANTHROPIC_API_KEY.
+  svamp daemon auth set <URL> <KEY>      Use a custom Anthropic gateway. URL must NOT end
+                                         in /v1 (the SDK appends it automatically).
+
+All mutations are persisted to ~/.svamp/.env. Run \`svamp daemon restart\` afterwards
+(or use the equivalent flags on \`svamp daemon start/restart\` to configure + restart in
+one step: --use-hypha-proxy / --use-claude-login / --anthropic-base-url URL --anthropic-api-key KEY).
+`);
+    return;
+  }
+  if (sub === "status" || sub === "show") {
+    const s = mod.getClaudeAuthStatus();
+    console.log(`Claude auth mode: ${s.mode}`);
+    if (s.baseUrl) console.log(`  ANTHROPIC_BASE_URL: ${s.baseUrl}`);
+    if (s.apiKeyPreview) console.log(`  ANTHROPIC_API_KEY : ${s.apiKeyPreview}`);
+    if (s.mode === "login") {
+      console.log('  (Claude subprocesses will use credentials from ~/.claude \u2014 run "claude login" to set them.)');
+    }
+    if (s.hyphaProxyUrlMissing) {
+      console.log(`  WARNING: mode=hypha but no proxy URL configured \u2014 run "svamp daemon auth use-hypha-proxy <URL>" (e.g. ${mod.EXAMPLE_HYPHA_PROXY_URL}).`);
+    }
+    if (s.hyphaTokenMissing) {
+      console.log('  WARNING: mode=hypha but HYPHA_TOKEN is not set \u2014 run "svamp login" first.');
+    }
+    return;
+  }
+  if (sub === "use-hypha-proxy") {
+    const url = argv[1] && !argv[1].startsWith("-") ? argv[1] : void 0;
+    if (!url) {
+      console.error("Usage: svamp daemon auth use-hypha-proxy <URL>");
+      console.error(`  A proxy URL is required (no default). Example: svamp daemon auth use-hypha-proxy ${mod.EXAMPLE_HYPHA_PROXY_URL}`);
+      await flushStdout();
+      process.exit(1);
+    }
+    mod.setClaudeAuthHyphaProxy(url);
+    console.log(`Claude auth set to hypha-proxy (${url}). Run "svamp daemon restart" to apply.`);
+    return;
+  }
+  if (sub === "use-login" || sub === "use-claude-login") {
+    mod.setClaudeAuthLogin();
+    console.log('Claude auth set to login (~/.claude credentials). Run "svamp daemon restart" to apply.');
+    return;
+  }
+  if (sub === "set") {
+    const baseUrl = argv[1];
+    const apiKey = argv[2];
+    if (!baseUrl || !apiKey) {
+      console.error("Usage: svamp daemon auth set <base-url> <api-key>");
+      await flushStdout();
+      process.exit(1);
+    }
+    mod.setClaudeAuthCustom(baseUrl, apiKey);
+    console.log(`Claude auth set to custom (${baseUrl}). Run "svamp daemon restart" to apply.`);
+    return;
+  }
+  console.error(`Unknown subcommand: svamp daemon auth ${sub}`);
+  console.error("Available: status, use-hypha-proxy, use-login, set <URL> <KEY>");
+  await flushStdout();
+  process.exit(1);
+}
+async function handleDaemonCodexAuthCommand(argv) {
+  const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
+  const { updateEnvFile } = await import('./claudeAuth-C0wc1GTM.mjs');
+  const { resolveCodexProvider } = await import('./codexProvider-BtxYc5Rj.mjs');
+  const redact = (k) => k && k.length > 10 ? `${k.slice(0, 6)}\u2026${k.slice(-4)}` : k ? "***" : "(unset)";
+  if (sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(`
+svamp daemon codex-auth \u2014 Configure how Codex authenticates (parallels \`svamp daemon auth\`)
+
+  svamp daemon codex-auth                         Show current Codex auth (provider / native)
+  svamp daemon codex-auth set <BASE_URL> <KEY> [MODEL]
+                                                  Use a custom OpenAI-compatible gateway (e.g. the
+                                                  Hypha proxy or a third-party endpoint). The gateway
+                                                  must speak the OpenAI Responses API. Persisted as
+                                                  SVAMP_CODEX_API_BASE / SVAMP_CODEX_API_KEY / SVAMP_CODEX_MODEL.
+  svamp daemon codex-auth use-openai [KEY]        \`codex login --with-api-key\` (arg or $OPENAI_API_KEY),
+                                                  and clear any custom gateway.
+  svamp daemon codex-auth use-chatgpt             \`codex login\` (ChatGPT OAuth \u2014 interactive), clear gateway.
+  svamp daemon codex-auth clear                   Remove the custom gateway (fall back to ~/.codex/auth.json).
+
+Persisted to ~/.svamp/.env. Run \`svamp daemon restart\` afterwards to apply.
+The generic LLM_API_BASE / LLM_API_KEY / LLM_MODEL env vars are also honored if already present.
+`);
+    return;
+  }
+  if (sub === "status" || sub === "show") {
+    const p = resolveCodexProvider(process.env);
+    const { existsSync } = await import('node:fs');
+    const nativeAuth = existsSync(`${process.env.HOME}/.codex/auth.json`);
+    if (p.apiBase && p.apiKey) {
+      console.log("Codex auth: custom OpenAI-compatible gateway");
+      console.log(`  base_url : ${p.apiBase}`);
+      console.log(`  api_key  : ${redact(p.apiKey)}`);
+      console.log(`  model    : ${p.model ?? "(codex default)"}`);
+    } else {
+      console.log(`Codex auth: native (${nativeAuth ? "~/.codex/auth.json present" : "NOT logged in \u2014 run codex-auth use-openai / use-chatgpt"})`);
+    }
+    return;
+  }
+  if (sub === "set") {
+    const [baseUrl, apiKey, model] = [argv[1], argv[2], argv[3]];
+    if (!baseUrl || !apiKey) {
+      console.error("Usage: svamp daemon codex-auth set <base-url> <api-key> [model]");
+      console.error("  e.g. svamp daemon codex-auth set https://tokenfans.ai/v1 sk-... gpt-5.5");
+      await flushStdout();
+      process.exit(1);
+    }
+    updateEnvFile({ SVAMP_CODEX_API_BASE: baseUrl, SVAMP_CODEX_API_KEY: apiKey, SVAMP_CODEX_MODEL: model || "" });
+    console.log(`Codex auth set to custom gateway (${baseUrl}${model ? `, model=${model}` : ""}). Run "svamp daemon restart" to apply.`);
+    return;
+  }
+  if (sub === "use-openai") {
+    const key = argv[1] || process.env.OPENAI_API_KEY;
+    if (!key) {
+      console.error("Usage: svamp daemon codex-auth use-openai <OPENAI_API_KEY>  (or set $OPENAI_API_KEY)");
+      process.exit(1);
+    }
+    const { spawnSync } = await import('node:child_process');
+    const r = spawnSync("codex", ["login", "--with-api-key"], { input: key, encoding: "utf8", stdio: ["pipe", "inherit", "inherit"] });
+    if (r.status !== 0) {
+      console.error("codex login failed \u2014 is codex installed? (`npm i -g @openai/codex`)");
+      process.exit(1);
+    }
+    updateEnvFile({ SVAMP_CODEX_API_BASE: "", SVAMP_CODEX_API_KEY: "", SVAMP_CODEX_MODEL: "" });
+    console.log("Codex authenticated via OpenAI API key (~/.codex/auth.json); cleared any custom gateway.");
+    return;
+  }
+  if (sub === "use-chatgpt" || sub === "use-login") {
+    const { spawnSync } = await import('node:child_process');
+    console.log("Launching `codex login` (ChatGPT OAuth \u2014 follow the browser prompt)\u2026");
+    const r = spawnSync("codex", ["login"], { stdio: "inherit" });
+    if (r.status !== 0) {
+      console.error("codex login failed.");
+      process.exit(1);
+    }
+    updateEnvFile({ SVAMP_CODEX_API_BASE: "", SVAMP_CODEX_API_KEY: "", SVAMP_CODEX_MODEL: "" });
+    console.log("Codex authenticated via ChatGPT; cleared any custom gateway.");
+    return;
+  }
+  if (sub === "clear") {
+    updateEnvFile({ SVAMP_CODEX_API_BASE: "", SVAMP_CODEX_API_KEY: "", SVAMP_CODEX_MODEL: "" });
+    console.log('Cleared the custom Codex gateway (falls back to ~/.codex/auth.json). Run "svamp daemon restart".');
+    return;
+  }
+  console.error(`Unknown subcommand: svamp daemon codex-auth ${sub}`);
+  console.error("Available: status, set <URL> <KEY> [MODEL], use-openai [KEY], use-chatgpt, clear");
+  await flushStdout();
+  process.exit(1);
+}
+async function handleDaemonKimiAuthCommand(argv) {
+  const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
+  const { updateEnvFile } = await import('./claudeAuth-C0wc1GTM.mjs');
+  const { resolveKimiProvider, buildKimiCatalogAddArgs, DEFAULT_KIMI_PROVIDER } = await import('./kimiProvider-DbxODebR.mjs');
+  const redact = (k) => k && k.length > 10 ? `${k.slice(0, 6)}\u2026${k.slice(-4)}` : k ? "***" : "(unset)";
+  const PRESETS = {
+    "use-moonshot": { provider: "moonshotai", base: "https://api.moonshot.ai/v1", label: "Moonshot AI (moonshotai)" },
+    "use-moonshot-cn": { provider: "moonshotai-cn", base: "https://api.moonshot.cn/v1", label: "Moonshot AI China (moonshotai-cn)" },
+    "use-coding": { provider: "kimi-for-coding", base: "https://api.kimi.com/coding", label: "Kimi for Coding (kimi-for-coding)" }
+  };
+  if (sub === "--help" || sub === "-h" || sub === "help") {
+    console.log(`
+svamp daemon kimi-auth \u2014 Configure how Kimi (MoonshotAI) authenticates (parallels \`svamp daemon codex-auth\`)
+
+  svamp daemon kimi-auth                          Show current Kimi provider / key (redacted)
+  svamp daemon kimi-auth set <API_KEY> [--provider <id>] [--base-url <url>] [--model <alias>]
+                                                  Configure an explicit provider (default id: ${DEFAULT_KIMI_PROVIDER}).
+  svamp daemon kimi-auth use-moonshot <API_KEY>   Preset: Moonshot AI  (provider=moonshotai, api.moonshot.ai/v1)
+  svamp daemon kimi-auth use-moonshot-cn <API_KEY> Preset: Moonshot AI China (provider=moonshotai-cn)
+  svamp daemon kimi-auth use-coding <API_KEY>     Preset: Kimi for Coding (provider=kimi-for-coding, api.kimi.com/coding)
+  svamp daemon kimi-auth clear                    Remove svamp's stored Kimi credentials.
+
+Persisted to ~/.svamp/.env (SVAMP_KIMI_API_KEY / _PROVIDER / _API_BASE / _MODEL) AND written to
+~/.kimi-code/config.toml via \`kimi provider catalog add\`. Run \`svamp daemon restart\` afterwards to apply.
+The generic LLM_API_KEY / LLM_API_BASE / LLM_MODEL env vars are also honored as a fallback.
+`);
+    return;
+  }
+  if (sub === "status" || sub === "show") {
+    const p = resolveKimiProvider(process.env);
+    const { existsSync } = await import('node:fs');
+    const nativeAuth = existsSync(`${process.env.HOME}/.kimi-code/config.toml`);
+    if (p.apiKey) {
+      console.log("Kimi auth: svamp-configured provider");
+      console.log(`  provider : ${p.provider}`);
+      console.log(`  api_key  : ${redact(p.apiKey)}`);
+      console.log(`  base_url : ${p.apiBase ?? "(catalog default)"}`);
+      console.log(`  model    : ${p.model ?? "(provider default)"}`);
+    } else {
+      console.log(`Kimi auth: not configured by svamp (${nativeAuth ? "~/.kimi-code/config.toml present \u2014 using your own `kimi login` / `kimi provider`" : "no ~/.kimi-code/config.toml \u2014 run kimi-auth use-moonshot <key> or `kimi login`"})`);
+    }
+    return;
+  }
+  const applyProvider = async (provider, apiKey, base, model, label) => {
+    updateEnvFile({
+      SVAMP_KIMI_API_KEY: apiKey,
+      SVAMP_KIMI_PROVIDER: provider,
+      SVAMP_KIMI_API_BASE: base || "",
+      SVAMP_KIMI_MODEL: model || ""
+    });
+    const args2 = buildKimiCatalogAddArgs({ provider, apiKey, apiBase: base, model });
+    let localOk = false;
+    if (args2) {
+      const { spawnSync } = await import('node:child_process');
+      const r = spawnSync("kimi", args2, {
+        stdio: ["ignore", "inherit", "inherit"],
+        env: { ...process.env, KIMI_CLI_NO_AUTO_UPDATE: "1" },
+        timeout: 3e4
+      });
+      localOk = r.status === 0;
+      if (!localOk) {
+        console.warn("  (note: `kimi provider catalog add` did not succeed locally \u2014 is kimi installed? `npm i -g @moonshot-ai/kimi-code`.");
+        console.warn("   The daemon will retry the config at session spawn from the stored env.)");
+      }
+    }
+    console.log(`Kimi auth set: ${label} (provider=${provider}${base ? `, base=${base}` : ""}${model ? `, model=${model}` : ""}).`);
+    console.log(`  api_key: ${redact(apiKey)}${localOk ? " \u2014 written to ~/.kimi-code/config.toml." : ""}`);
+    console.log('Run "svamp daemon restart" to apply to the daemon.');
+  };
+  if (sub === "set") {
+    const rest = argv.slice(1);
+    let key = "";
+    let provider = DEFAULT_KIMI_PROVIDER;
+    let base;
+    let model;
+    for (let i = 0; i < rest.length; i++) {
+      const a = rest[i];
+      if (a === "--provider") {
+        provider = rest[++i];
+      } else if (a === "--base-url" || a === "--base") {
+        base = rest[++i];
+      } else if (a === "--model") {
+        model = rest[++i];
+      } else if (!a.startsWith("--") && !key) {
+        key = a;
+      }
+    }
+    if (!key) {
+      console.error("Usage: svamp daemon kimi-auth set <api-key> [--provider <id>] [--base-url <url>] [--model <alias>]");
+      console.error("  e.g. svamp daemon kimi-auth set sk-... --provider moonshotai --model moonshotai/kimi-k2.5");
+      await flushStdout();
+      process.exit(1);
+    }
+    await applyProvider(provider, key, base, model, `custom provider '${provider}'`);
+    return;
+  }
+  if (PRESETS[sub]) {
+    const key = argv[1];
+    if (!key) {
+      console.error(`Usage: svamp daemon kimi-auth ${sub} <api-key>`);
+      await flushStdout();
+      process.exit(1);
+    }
+    const preset = PRESETS[sub];
+    await applyProvider(preset.provider, key, preset.base, void 0, preset.label);
+    return;
+  }
+  if (sub === "clear") {
+    updateEnvFile({ SVAMP_KIMI_API_KEY: "", SVAMP_KIMI_PROVIDER: "", SVAMP_KIMI_API_BASE: "", SVAMP_KIMI_MODEL: "" });
+    console.log(`Cleared svamp's stored Kimi credentials (~/.kimi-code/config.toml left as-is). Run "svamp daemon restart".`);
+    return;
+  }
+  console.error(`Unknown subcommand: svamp daemon kimi-auth ${sub}`);
+  console.error("Available: status, set <KEY> [--provider p] [--base-url u] [--model m], use-moonshot <KEY>, use-moonshot-cn <KEY>, use-coding <KEY>, clear");
+  await flushStdout();
+  process.exit(1);
+}
+function printSessionHelp() {
+  console.log(`
+svamp session \u2014 Spawn and manage AI agent sessions
+
+QUICK START \u2014 Spawn a session, give it a task, get results:
+
+  # One-liner: spawn agent, send task, wait for completion (autonomous by default)
+  svamp session spawn claude -d ./my-project --message "fix the failing tests" --wait
+
+  # The command prints the session ID (e.g., "abc12345-..."). Use it to:
+  svamp session messages abc1 --last 10         # read output (prefix match on ID)
+  svamp session send abc1 "now run lint" --wait  # send follow-up, wait for done
+  svamp session archive abc1                     # archive when finished (resumable)
+  svamp session resume abc1                      # bring an archived session back
+
+  # Spawn on a remote/cloud machine:
+  svamp session spawn claude -d /workspace -m cloud-box --message "deploy" --wait
+
+AGENTS:
+  claude    Claude Code \u2014 full coding agent (default)
+  gemini    Google Gemini via ACP protocol
+  codex     OpenAI Codex via app-server (streaming, resume, custom providers)
+  kimi      MoonshotAI Kimi Code via ACP (auth: svamp daemon kimi-auth)
+
+  Usage: svamp session spawn <agent> [options]
+  The <agent> argument is required. Use "claude" if unsure.
+
+COMMANDS:
+
+  Lifecycle:
+    spawn <agent> [-d <path>] [--model <id>] [options]   Spawn a new agent session
+                                          (--model e.g. claude-fable-5, claude-opus-4-8)
+    archive <id>                          Archive a session (resumable; preserves --resume token)
+    resume <id>                           Resume an archived session (spawns agent with --resume)
+    delete <id>                           Permanently delete a session (cannot be undone)
+    list [--active] [--json]              List sessions (alias: ls)
+    machines                              List discoverable machines
+    info <id> [--json]                    Show status & pending permissions
+
+  Discover:
+    whoami [--json]                       Your environment: this session, same-machine peers,
+                                          same-user sessions on other machines, and how to reach them (alias: env)
+
+  Communicate:
+    send <id> <message> [--model <id>] [--plain] [--subject "..."] [--when-idle] [--wait] [--response] [--btw]
+         [--require-approval] [--as-issue [--issue-title "..."]] [--timeout N] [--json] [--urgency urgent|normal]
+                                          Send a message to a running session.
+                                          By default this is URGENT: it wakes the recipient so they
+                                          handle it promptly. Pass --when-idle to defer instead \u2014
+                                          the message lands in the peer's inbox and is processed on
+                                          their next idle turn (no interrupt). Loop safeguard: a send
+                                          issued from a turn that was itself triggered by an inbox
+                                          message is always forced non-urgent (no recursive wake
+                                          cascades); the daemon's per-sender rate limit + circuit
+                                          breaker further bound any storm.
+                                            --when-idle         defer: handle on the recipient's
+                                                                next idle turn (opposite of the
+                                                                urgent default)
+                                            --wait              block until the agent goes idle
+                                            --response          block AND print the agent's
+                                                                text answer (implies --wait)
+                                            --btw               side-channel one-shot query via
+                                                                /btw \u2014 does NOT touch the
+                                                                running session's context window
+                                            --require-approval  do NOT pre-flight the target to
+                                                                bypassPermissions. Without this,
+                                                                send with --wait/--response auto-
+                                                                ensures bypass so the agent does
+                                                                not stall on tool prompts.
+    query <directory> <prompt> [--timeout N] [--keep] [--json] [--permission-mode MODE] [--tag NAME]
+                                          Stateless one-shot: spawn fresh Claude in
+                                          <directory>, send <prompt>, print answer,
+                                          delete the session. No existing session is
+                                          affected. Use for reproducible Q&A.
+    messages <id> [--last N] [--json]     Read message history (alias: msgs)
+    wait <id> [--timeout N] [--json]      Wait for agent to become idle
+    attach <id>                           Attach interactive terminal (stdin/stdout)
+
+  Permissions (when agent pauses for approval):
+    approve <id> [request-id] [--json]    Approve pending tool permission(s)
+    deny <id> [request-id] [--json]       Deny pending tool permission(s)
+
+  Sharing:
+    share <id> --list                     List shared users
+    share <id> --add <email>[:<role>]     Share with user. role = view|interact|admin
+                                          (default admin = owner-equivalent). #1246: the
+                                          :role suffix is HONORED \u2014 it used to be dropped.
+    share <id> --remove <email>           Remove shared user
+    share <id> --public <view|interact|off>  Set public link access
+
+  Loop (self-verifying gate \u2014 iterate/gate until criteria are met):
+    loop <id> ["<task>"] --until "<criteria>" [opts]
+                                          Attach a Stop gate. WITH a task \u2192 kick the agent
+                                          off and gate until done. WITHOUT (only --until) \u2192
+                                          HOT-PLUG onto the running session (no kickoff).
+                                          opts: --oracle "cmd" --agent --parent <id> --max N
+    loop-cancel <id>                      Cancel the loop / release the gate
+    loop-status <id>                      Show loop phase + iteration + extensions
+    loop-extend <id> --reason "<why>"     Extend the SOFT cap (+turns, bounded) with a reason
+
+  Session UI / Links:
+    set-title <id> "<title>"              Set the session's topic (shown in lists)
+    set-project-description <id> "<t>"    Set the project blurb shown on the project header
+    link add <id> "<url>" [--label L]     Launch Pad: add a viewable link (dedups by URL)
+    link list|update|remove <id> [...]    Launch Pad: manage the session's links
+    set-link <id> "<url>" "<label>"       Single-link alias of the link add verb
+    notify <id> "<msg>" [--level L]       Push a notification to the session's user
+    broadcast <id> <kind> [args]          Broadcast a UI event (e.g. open-canvas) to viewers
+    edit-message <id> <msg-id> "<text>"   Rewrite a past user message (edit history)
+    refine <id> <msg-id> "<hint>"         Ask the agent to refine a past message
+    undo-edit <id> <msg-id>               Undo the last edit to a message
+
+  Inbox:
+    inbox send <id> "<body>" [opts]       Send a message to session inbox
+    inbox list <id> [--unread] [--json]   List inbox messages
+    inbox read <id> <msg-id>              Read and mark a message
+    inbox reply <id> <msg-id> "<body>"    Reply to sender's session
+    inbox clear <id> [--all]              Clear read (or all) messages
+
+SPAWN OPTIONS:
+  -d, --directory <path>          Working directory (REQUIRED for meaningful work)
+  -p, --permission-mode <mode>    Permission mode (see below). Default: "bypassPermissions"
+  --require-approval              Opt into human-in-the-loop approval (alias for -p default).
+                                  Without this flag, the agent runs autonomously.
+  --message <msg>                 Send this message to the agent immediately after spawn
+  --wait                          Block until agent finishes (idle). Combine with --message
+                                  for fire-and-forget: spawn \u2192 task \u2192 wait \u2192 done.
+  --timeout <sec>                 Timeout for --wait (default: no timeout)
+  --worktree                      Create isolated git worktree branch (.dev/worktree/<name>)
+  --tags <tag1,tag2>              Comma-separated tags for session grouping
+  --parent <sessionId>            Set parent session (auto-set from SVAMP_SESSION_ID env)
+
+PERMISSION MODES:
+  bypassPermissions    \u2605 Default. Auto-approve everything. No prompts, no pauses.
+                       Right choice for automation, CI, agent-spawning-agent.
+  acceptEdits          Auto-approve file edits. Still pauses for bash & dangerous tools.
+  default              \u26A0 Agent PAUSES and waits for human approval before each tool use.
+                       The agent will be stuck (exit code 2) until you run approve/deny.
+                       Use only when a human is actively watching the session.
+
+  Tip: pass --require-approval (or -p default) when you want a human gate.
+
+PERMISSION WORKFLOW (only relevant for "default" and "acceptEdits" modes):
+  1. svamp session wait <id> --json    \u2192 exit code 2 means permission pending
+  2. svamp session info <id> --json    \u2192 shows pendingPermissions array
+  3. svamp session approve <id>        \u2192 approve all pending (or approve <id> <rid>)
+  4. svamp session deny <id>           \u2192 deny all pending (or deny <id> <rid>)
+
+ISOLATION & SHARING OPTIONS (for spawn):
+  --isolate                       Force OS-level sandbox (even without sharing)
+  --security-context <path>       Apply security context config (JSON file)
+  --share <email>[:<role>]        Share session with user (repeatable). role = view|interact|admin;
+                                  default admin (owner-equivalent). #1246: roles ARE enforced.
+  --deny-network                  Block all network access
+  --deny-read <path>              Deny reading path (repeatable)
+                                  WARNING: NOT ENFORCED by any sandbox backend (#0878).
+  --allow-write <path>            Allow writing path (repeatable)
+                                  WARNING: NOT ENFORCED under docker/podman (#0878).
+  --allow-domain <domain>         Allow network domain (repeatable)
+                                  WARNING: NOT ENFORCED under docker/podman (#0878).
+  (#1387: allowedDirectories does NOT restrict \u2014 it GRANTS extra paths on top of the
+   whole-workspace --allow-cwd. There is no securityContext field that narrows reads
+   today; keep sensitive paths OUTSIDE the session workspace. See
+   docs/sharing-and-security.md.)
+
+MESSAGES OPTIONS:
+  --last N       Show last N messages only
+  --after N      Start after sequence number N (for pagination)
+  --limit N      Max messages to fetch (default: 50, capped at 500 by the daemon)
+  --json         Output as JSON array of {id, seq, role, text, createdAt}
+  --raw          With --json: include full raw objects (tool_use, tool_result, thinking)
+
+LOOP OPTIONS (for loop):
+  --until <text>                  Success criteria \u2014 how we'll know it's done (the gate's goal)
+  --criteria <text>               Alias for --until
+  --oracle <cmd>                  Pass/fail command (tests/build/lint) the gate runs each iteration
+  --agent                         Force the independent evaluator on (it is on by default, so this
+                                  is a no-op kept for compatibility)
+  --max <n>                       HARD iteration cap. OMITTED = NO iteration cap at all \u2014 the loop
+                                  then stops only on a cost/runtime ceiling or an explicit stop.
+                                  Pass one on any unattended run.
+  (The independent evaluator that judges "done" is ALWAYS on \u2014 it is the loop's anti-shortcut gate.
+   The kill switch is the SVAMP_LOOP_VERIFY=0 environment variable, deliberately not a flag.
+   A crew child's verdict routes to its lead via the session parent that svamp crew start sets
+   at spawn \u2014 there is no per-loop routing flag.)
+  --max-tokens-per-hour <n>       HARD cost ceiling: stop the loop above this rolling hourly token rate
+  --max-runtime-sec <n>           HARD cost ceiling: stop the loop after this much wall-clock runtime
+  (the two HARD ceilings above always win first \u2014 set one on any long unattended loop)
+  (omit the task and pass only --until to HOT-PLUG the gate onto a running session)
+
+EXIT CODES (for wait, send --wait, spawn --wait):
+  0   Agent is idle (task completed successfully)
+  1   Error (timeout, connection failure, session not found)
+  2   Agent is waiting for permission approval \u2014 use approve/deny to unblock
+
+ATTACH COMMANDS (inside an attached session):
+  /quit, /detach    Detach (session keeps running)
+  /abort, /cancel   Cancel current agent turn
+  /kill             Stop the session entirely
+  /info             Show session status
+
+GLOBAL OPTIONS:
+  --machine <id>, -m <id>   Target a specific machine (prefix match supported)
+
+ID MATCHING:
+  Session and machine IDs support prefix matching.
+  "abc1" matches "abc12345-6789-..." \u2014 you only need enough characters to be unique.
+
+EXAMPLES:
+
+  # === Common: Spawn agent to do a task and wait ===
+  # Default is bypassPermissions \u2014 no -p flag needed for autonomous runs.
+  svamp session spawn claude -d ./my-project \\
+    --message "fix all TypeScript errors, run tsc to verify" --wait
+
+  # === Multi-step: Spawn, then send messages interactively ===
+  ID=$(svamp session spawn claude -d ./proj)
+  svamp session send $ID "first, read the README" --wait
+  svamp session send $ID "now implement the feature described there" --wait
+  svamp session messages $ID --last 20
+
+  # === Spawn child session from another agent (e.g., in a bash tool) ===
+  # bypassPermissions is the default; --wait blocks until done.
+  svamp session spawn claude -d /tmp/test-project \\
+    --message "run the test suite and report results" --wait
+  svamp session messages <child-id> --last 5
+
+  # === Human-in-the-loop: require approval for every tool ===
+  svamp session spawn claude -d ./proj --require-approval \\
+    --message "refactor auth module"
+  svamp session wait abc1 --json       # exit code 2 = permission pending
+  svamp session approve abc1           # approve all pending
+  svamp session wait abc1              # wait for completion
+
+  # === Spawn on a remote machine ===
+  svamp session spawn claude -d /workspace -m my-cloud-box \\
+    --message "deploy to staging" --wait
+
+  # === Isolated session with network restrictions ===
+  svamp session spawn claude -d /tmp/sandbox --isolate --deny-network
+
+  # === Loop: self-verifying gate (task \u2192 kickoff; --until only \u2192 hot-plug) ===
+  svamp session loop abc1 "Fix all linting errors" \\
+    --until "eslint reports zero errors" --oracle "npm run lint" --max 15
+  svamp session loop abc1 --until "all tests pass" --oracle "npm test"   # hot-plug onto a running session
+`);
+}
+function printMachineHelp() {
+  console.log(`
+svamp machine \u2014 Machine management
+
+Usage:
+  svamp machine info                                 Show machine info & status
+  svamp machine exec <command> [--cwd <path>]        Run command on one machine
+  svamp machine exec <command> --all                 Run on EVERY machine (fan-out)
+  svamp machine ls [path] [--hidden]                 List directory on machine
+  svamp machine share --list                         List shared users
+  svamp machine share --add <email>[:<role>]         Share machine with user
+  svamp machine share --remove <email>               Remove shared user
+  svamp machine share --config <path>                Apply security context config
+  svamp machine share --show-config                  Show current security context config
+  svamp machine notify <message> [--level ...]       Notify THIS machine's sessions (local-only, no -m/--all)
+
+Options:
+  --machine <id>, -m <id>  Target a specific machine (prefix match supported).
+                           Applies to info/exec/ls \u2014 NOT to notify, which is local-only.
+  --cwd <path>             Working directory for exec (default: home dir)
+  --hidden, -a             Show hidden files in ls
+
+Examples:
+  svamp machine info
+  svamp machine exec "ls -la /tmp"
+  svamp machine exec "df -h" -m cloud-box --cwd /
+  svamp machine exec "uptime" --all
+  svamp machine ls /home/user/projects
+  svamp machine ls --hidden -m cloud-box
+  svamp machine share --add alice@example.com:admin
+  svamp machine share --config ./security-context.json
+`);
+}
+async function printSkillsHelp() {
+  let browseUrl = "<HYPHA_SERVER_URL>/<workspace>/artifacts/marketplace (set HYPHA_SERVER_URL)";
+  try {
+    const { getArtifactBaseUrl, getSkillsCollectionName } = await import('./api-BHjyC0Ph.mjs');
+    browseUrl = `${getArtifactBaseUrl()}/${getSkillsCollectionName()}`;
+  } catch {
+  }
+  console.log(`
+svamp skills \u2014 Agent skills marketplace
+
+Usage:
+  svamp skills find <query> [--json]              Search for skills in the marketplace
+  svamp skills install <name> [--force]           Install skill to ~/.claude/skills/<name>/
+  svamp skills list                               List locally installed skills
+  svamp skills remove <name>                      Remove an installed skill
+  svamp skills publish <path> [--version <tag>]   Publish a skill to the marketplace
+
+Skills are stored in ~/.claude/skills/ and automatically detected by Claude Code.
+Each skill contains a SKILL.md file with instructions and metadata.
+Skills use git-backed storage \u2014 you can also clone and push via git.
+
+Browse online: ${browseUrl}
+
+Examples:
+  svamp skills find "code review"
+  svamp skills install code-review
+  svamp skills publish ./my-skill/
+  svamp skills publish ./my-skill/ --version v1.0
+`);
+}
+function printInteractiveHelp() {
+  console.log(`
+svamp \u2014 Interactive Claude session with cloud sync
+
+Usage:
+  svamp [-d <path>] [--resume <id>] [--continue] [--permission-mode <mode>] [-- <claude-args>]
+  svamp start [-d <path>] [...]
+
+Options:
+  -d, --directory <path>     Working directory (default: cwd)
+  -r, --resume <id>          Resume a Claude session by ID
+  -c, --continue             Continue the last Claude session
+  -p, --permission-mode <m>  Permission mode: default, acceptEdits, bypassPermissions, plan
+  --                         Pass remaining args to Claude CLI
+
+Modes:
+  Local mode    Full interactive Claude terminal UI (default)
+  Remote mode   Processes messages from the web app
+
+Switching:
+  When a message arrives from the web app \u2192 automatically switches to remote mode
+  Space Space   Switch from remote mode back to local mode
+  Ctrl-C Ctrl-C Exit from remote mode
+
+The session is synced to Hypha Cloud so it's visible in the web app.
+Works offline if no Hypha credentials are configured.
+`);
+}
+function printAgentHelp() {
+  console.log(`
+svamp agent \u2014 Interactive agent sessions (local, no daemon required)
+
+Usage:
+  svamp agent list                 List known agents
+  svamp agent <name> [-d <path>]   Start interactive agent session
+  svamp agent -- <cmd> [args]      Start custom ACP agent
+
+Examples:
+  svamp agent gemini               Start Gemini agent in current directory
+  svamp agent gemini -d /tmp/proj  Start Gemini agent in /tmp/proj
+  svamp agent kimi                 Start Kimi (MoonshotAI) agent
+  svamp agent codex                Start Codex agent
+  svamp agent -- mycli --acp       Start custom ACP-compatible agent
+
+Known agents: gemini (ACP), kimi (ACP), codex (MCP)
+`);
+}
+main().catch(async (err) => {
+  console.error("Fatal error:", err);
+  await flushStdout();
+  process.exit(1);
+});