svamp-cli 0.2.346 → 0.2.358

package/dist/cli.mjs

@@ -1,4 +1,4 @@
-import { c as clearStopMarker, b as stopMarkerExists, s as startDaemon, a as stopDaemon, d as daemonStatus } from './run-DkjwF-zA.mjs';
+import { c as clearStopMarker, b as stopMarkerExists, s as startDaemon, a as stopDaemon, d as daemonStatus } from './run-DKOND4dO.mjs';
 import { ensureSupervisorViaServiceManager, LAUNCHD_LABEL } from './serviceManager-hlOVxkhW.mjs';
 import { f as flushStdout, a as flushAndExit } from './flushExit-C-i6SGjj.mjs';
 import { w as wantsHelp } from './wantsHelp-6bMOeNUz.mjs';
@@ -9,7 +9,7 @@ import 'path';
 import 'url';
 import 'child_process';
 import 'crypto';
-import './hookSettings-DYMTUgVA.mjs';
+import './hookSettings-CvvUhwCK.mjs';
 import 'node:crypto';
 import './types-57J3Re0n.mjs';
 import './securityContext-Cm5UTCuD.mjs';
@@ -21,19 +21,20 @@ import 'util';
 import 'http';
 import 'net';
 import './instance-CeHz5C8v.mjs';
-import './serveAuth-DbVLRCRR.mjs';
+import './serveAuth-4M0vwMyj.mjs';
 import 'node:os';
 import 'node:path';
 import './envFlag-COOuJ3AH.mjs';
-import './claudeAuth-iAerdaMr.mjs';
+import './claudeAuth-DMDvPNhO.mjs';
 import './fileLock-BMPwCrB6.mjs';
 import './codexProvider-BtxYc5Rj.mjs';
-import './friendlyName-1UZcyDhu.mjs';
+import './inboxGuard-CDqmIypF.mjs';
 import 'node:events';
 import './cron-hHGdb5kU.mjs';
+import './friendlyName-B-OEwt0t.mjs';
 import './hyphaClient-ybivOjZo.mjs';
 import './sharingNotificationSync-qGIQ-3yf.mjs';
-import './acpBackend-BZ1MJhQV.mjs';
+import './acpBackend-UaBD4zL3.mjs';
 import '@agentclientprotocol/sdk';
 import './DefaultTransport-vfp78fug.mjs';
 import './wrapCommand-CdNawSaa.mjs';
@@ -46,12 +47,12 @@ import './GeminiTransport-3OkhtFRO.mjs';
 import './KimiTransport-D8n009Tr.mjs';
 import './kimiProvider-DbxODebR.mjs';
 import './kimiSetup-NGsoYB5h.mjs';
-import './detectIsolation-CzoDCEnh.mjs';
+import './detectIsolation-CrV8IFDv.mjs';
 import 'node:fs/promises';
 import './pinnedNono-5ZHb6328.mjs';
 import './bootStatus-DqtNgJch.mjs';
-import './loopVerify-B47sSjxe.mjs';
-import './store-Bn0ByYev.mjs';
+import './loopVerify-CxAKJB5a.mjs';
+import './store-D8dok6_d.mjs';
 import './api-BHjyC0Ph.mjs';
 import './store-fi0f-ff1.mjs';
 import 'yaml';
@@ -89,7 +90,7 @@ async function main() {
       }
       const whenIdle = args.includes("--when-idle");
       const force = args.includes("--force");
-      const mod = await import('./run-DkjwF-zA.mjs').then(function (n) { return n.h; });
+      const mod = await import('./run-DKOND4dO.mjs').then(function (n) { return n.i; });
       if (whenIdle && !force) {
         if (mod.isDaemonAlive()) {
           mod.writePendingRestart({ reason: "svamp daemon restart --when-idle" });
@@ -255,7 +256,7 @@ async function main() {
         releaseSupervisorLock,
         findOrphanedSyncPids,
         killOrphanedSyncs
-      } = await import('./run-DkjwF-zA.mjs').then(function (n) { return n.f; });
+      } = await import('./run-DKOND4dO.mjs').then(function (n) { return n.h; });
       const supervisorPidFile = pathJoin(svampHome, "supervisor.pid");
       const lock = acquireSupervisorLockWithRetry(supervisorPidFile, process.pid);
       if (!lock.acquired) {
@@ -421,7 +422,7 @@ async function main() {
       await flushStdout();
       process.exit(0);
     } else if (daemonSubcommand === "install-nono") {
-      const { installNono } = await import('./detectIsolation-CzoDCEnh.mjs');
+      const { installNono } = await import('./detectIsolation-CrV8IFDv.mjs');
       const okNono = await installNono();
       if (!okNono) {
         console.error("Failed to install nono. See the log above for the reason.");
@@ -473,7 +474,7 @@ async function main() {
       await flushStdout();
       process.exit(1);
     }
-    const { handleServiceCommand } = await import('./commands-CiRCwjkJ.mjs');
+    const { handleServiceCommand } = await import('./commands-CFBKkfX8.mjs');
     await handleServiceCommand();
   } else if (subcommand === "serve") {
     const { isSandboxed: isSandboxedServe } = await import('./sandboxDetect-Cdzsj5TC.mjs');
@@ -482,7 +483,7 @@ async function main() {
       await flushStdout();
       process.exit(1);
     }
-    const { handleServeCommand } = await import('./serveCommands-CUHUiYnZ.mjs');
+    const { handleServeCommand } = await import('./serveCommands-B-Ym_QXc.mjs');
     await handleServeCommand();
     await flushStdout();
     process.exit(0);
@@ -493,7 +494,7 @@ async function main() {
       await flushStdout();
       process.exit(1);
     }
-    const { processCommand } = await import('./commands-BOpoVBOM.mjs');
+    const { processCommand } = await import('./commands-DH_YQrAP.mjs');
     let machineId;
     const processArgs = args.slice(1);
     const mIdx = processArgs.findIndex((a) => a === "--machine" || a === "-m");
@@ -508,16 +509,16 @@ async function main() {
     await flushStdout();
     process.exit(0);
   } else if (subcommand === "outpost") {
-    const { outpostCommand } = await import('./commands-BB1Kcyt-.mjs');
+    const { outpostCommand } = await import('./commands-Bmoy6Rlw.mjs');
     await outpostCommand(args.slice(1));
     await flushStdout();
     process.exit(0);
   } else if (subcommand === "issue" || subcommand === "issues") {
-    const { issueCommand } = await import('./commands-H4PsTGn8.mjs');
+    const { issueCommand } = await import('./commands-DRxANaS5.mjs');
     await issueCommand(args.slice(1));
     await flushAndExit(0);
   } else if (subcommand === "workflow" || subcommand === "workflows") {
-    const { workflowCommand } = await import('./commands-D69mnkYu.mjs');
+    const { workflowCommand } = await import('./commands-B19lVZjm.mjs');
     await workflowCommand(args.slice(1));
     await flushAndExit(0);
   } else if (subcommand === "wise-agent" || subcommand === "wise") {
@@ -525,12 +526,12 @@ async function main() {
     await flushStdout();
     process.exit(0);
   } else if (subcommand === "feature" || subcommand === "crew") {
-    const { crewCommand } = await import('./commands-C2aODeVc.mjs');
+    const { crewCommand } = await import('./commands-nkvTnUJj.mjs');
     await crewCommand(args.slice(1));
     await flushStdout();
     process.exit(0);
   } else if (subcommand === "notify") {
-    const { notifyUser } = await import('./notifyCommands-D-IKIxiq.mjs');
+    const { notifyUser } = await import('./notifyCommands-CCUE18Q-.mjs');
     const rest = args.slice(1);
     let email;
     const o = {};
@@ -570,7 +571,7 @@ async function main() {
     await flushStdout();
     process.exit(0);
   } else if (subcommand === "events") {
-    const { listEvents, ackEvent } = await import('./notifyCommands-D-IKIxiq.mjs');
+    const { listEvents, ackEvent } = await import('./notifyCommands-CCUE18Q-.mjs');
     const sub = args[1];
     const rest = args.slice(2);
     let email;
@@ -592,7 +593,7 @@ async function main() {
   } else if (!subcommand || subcommand === "start") {
     await handleInteractiveCommand();
   } else if (subcommand === "--version" || subcommand === "-v") {
-    const pkg = await import('./package-DtuINqf5.mjs').catch(() => ({ default: { version: "unknown" } }));
+    const pkg = await import('./package-DTTWvJbp.mjs').catch(() => ({ default: { version: "unknown" } }));
     console.log(`svamp version: ${pkg.default.version}`);
   } else {
     console.error(`Unknown command: ${subcommand}`);
@@ -602,7 +603,7 @@ async function main() {
   }
 }
 async function handleInteractiveCommand() {
-  const { runInteractive } = await import('./run-ChdsgaSD.mjs');
+  const { runInteractive } = await import('./run-Bc81iurl.mjs');
   const interactiveArgs = subcommand === "start" ? args.slice(1) : args;
   let directory = process.cwd();
   let resumeSessionId;
@@ -657,15 +658,19 @@ async function handleAgentCommand() {
     }
     console.log('\nUse "svamp agent <name>" to start an interactive session.');
     console.log('Use "svamp agent -- <command> [args]" for a custom ACP agent.');
+    console.log("Tool calls are prompted on a terminal; add --auto-approve (-y) to allow them unattended.");
     return;
   }
   const { resolveAcpAgentConfig, KNOWN_CODEX_AGENTS } = await import('./acpAgentConfig-CObOPlA8.mjs');
   let cwd = process.cwd();
+  let autoApprove = false;
   const filteredArgs = [];
   for (let i = 0; i < agentArgs.length; i++) {
     if ((agentArgs[i] === "-d" || agentArgs[i] === "--directory") && i + 1 < agentArgs.length) {
       cwd = agentArgs[i + 1];
       i++;
+    } else if (agentArgs[i] === "--auto-approve" || agentArgs[i] === "--yes" || agentArgs[i] === "-y") {
+      autoApprove = true;
     } else {
       filteredArgs.push(agentArgs[i]);
     }
@@ -682,12 +687,54 @@ async function handleAgentCommand() {
     if (process.env.DEBUG) console.error("[debug]", ...logArgs);
   };
   console.log(`Starting ${config.agentName} agent in ${cwd}...`);
+  let replRl = null;
+  const stdinIsTty = Boolean(process.stdin.isTTY);
+  let approveAllForSession = autoApprove;
+  const permissionHandler = {
+    async handleToolCall(_toolCallId, toolName, input) {
+      if (approveAllForSession) {
+        return { decision: "approved" };
+      }
+      if (!stdinIsTty || !replRl) {
+        console.error(
+          `
+[permission] DENIED ${toolName}: no terminal to ask on. Re-run with --auto-approve to allow tool calls unattended, or use \`svamp session spawn ${config.agentName}\` for a managed session.`
+        );
+        return { decision: "denied" };
+      }
+      const preview = (() => {
+        try {
+          const j = JSON.stringify(input);
+          return j && j.length > 200 ? j.slice(0, 200) + "\u2026" : j || "";
+        } catch {
+          return "";
+        }
+      })();
+      const answer = await new Promise((resolve) => {
+        replRl.question(
+          `
+[permission] ${toolName} ${preview}
+  allow? [y]es / [n]o / [a]ll for this session: `,
+          (a) => resolve(String(a || "").trim().toLowerCase())
+        );
+      });
+      if (answer === "a" || answer === "all") {
+        approveAllForSession = true;
+        return { decision: "approved_for_session" };
+      }
+      if (answer === "y" || answer === "yes") return { decision: "approved" };
+      return { decision: "denied" };
+    }
+  };
+  console.log(
+    autoApprove ? "Tool calls: AUTO-APPROVED (--auto-approve)." : stdinIsTty ? "Tool calls: you will be asked to approve each one (y / n / a)." : "Tool calls: DENIED \u2014 stdin is not a terminal. Re-run with --auto-approve to allow them."
+  );
   let backend;
   if (KNOWN_CODEX_AGENTS[config.agentName]) {
     const { CodexAppServerBackend } = await import('./codexAppServerBackend-VGsYtbqg.mjs').then(function (n) { return n.a; });
     backend = new CodexAppServerBackend({ cwd, log: logFn });
   } else {
-    const { AcpBackend } = await import('./acpBackend-BZ1MJhQV.mjs');
+    const { AcpBackend } = await import('./acpBackend-UaBD4zL3.mjs');
     const { GeminiTransport } = await import('./GeminiTransport-3OkhtFRO.mjs');
     const { KimiTransport } = await import('./KimiTransport-D8n009Tr.mjs');
     const { DefaultTransport } = await import('./DefaultTransport-vfp78fug.mjs');
@@ -706,7 +753,9 @@ async function handleAgentCommand() {
       args: config.args,
       transportHandler,
       env: acpEnv,
-      log: logFn
+      log: logFn,
+      permissionHandler
+      // #1715 — without one, AcpBackend cancels every tool call (#1630)
     });
   }
   let currentText = "";
@@ -772,6 +821,7 @@ Agent stopped: ${msg.detail || ""}`);
     output: process.stdout,
     terminal: false
   });
+  replRl = rl;
   rl.on("line", async (line) => {
     const trimmed = line.trim();
     if (!trimmed) return;
@@ -829,7 +879,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
   }
-  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionLoopExtend, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, sessionInboxClear } = await import('./commands-D1pZq3d4.mjs');
+  const { sessionList, sessionWhoami, sessionSpawn, sessionArchive, sessionResume, sessionDelete, sessionInfo, sessionMessages, sessionAttach, sessionMachines, sessionSend, sessionWait, sessionShare, sessionLoopStart, sessionLoopCancel, sessionLoopStatus, sessionLoopExtend, sessionInboxSend, sessionInboxList, sessionInboxRead, sessionInboxReply, replyPositionals, sendPositionals, sessionInboxClear } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
   const parseFlagStr = (flag, shortFlag) => {
     for (let i = 1; i < sessionArgs.length; i++) {
       if ((sessionArgs[i] === flag || shortFlag) && i + 1 < sessionArgs.length) {
@@ -845,6 +895,16 @@ async function handleSessionCommand() {
     return isNaN(n) ? void 0 : n;
   };
   const hasFlag = (flag) => sessionArgs.includes(flag);
+  const { parseUrgencyValue } = await import('./inboxGuard-CDqmIypF.mjs');
+  const urgencyFlag = async () => {
+    const parsed = parseUrgencyValue(parseFlagStr("--urgency"), { present: hasFlag("--urgency") });
+    if (!parsed.ok) {
+      console.error(parsed.message);
+      await flushStdout();
+      process.exit(1);
+    }
+    return parsed.value;
+  };
   if (sessionSubcommand === "machines" || sessionSubcommand === "machine") {
     await sessionMachines();
   } else if (sessionSubcommand === "list" || sessionSubcommand === "ls") {
@@ -902,7 +962,7 @@ async function handleSessionCommand() {
       const warning = describeUnenforceable("nono", { filesystem: { denyRead } });
       if (warning) console.warn(`Warning: ${warning}`);
     }
-    const { parseShareArg } = await import('./commands-D1pZq3d4.mjs');
+    const { parseShareArg } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     const shareEntries = share.map((s) => parseShareArg(s));
     await sessionSpawn(agent, dir, targetMachineId, {
       message,
@@ -971,7 +1031,8 @@ async function handleSessionCommand() {
     }
     await sessionAttach(sessionArgs[1], targetMachineId);
   } else if (sessionSubcommand === "send") {
-    if (!sessionArgs[1] || !sessionArgs[2]) {
+    const sendPos = sendPositionals(sessionArgs.slice(1));
+    if (!sendPos[0] || !sendPos[1]) {
       console.error('Usage: svamp session send <session-id> <message> [--model <id>] [--plain] [--subject "..."] [--when-idle] [--urgency urgent|normal] [--wait] [--response] [--btw] [--require-approval] [--as-issue [--issue-title "..."]] [--timeout N] [--json]');
       console.error("  --when-idle    Deferred delivery: park the message and let the recipient handle it on its next idle turn (default is urgent \u2014 wakes immediately).");
       console.error("  --model <id>   Switch the session model (e.g. claude-opus-4-7, claude-sonnet-4-6) before delivering the message \u2014 forces a respawn.");
@@ -979,7 +1040,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    await sessionSend(sessionArgs[1], sessionArgs[2], targetMachineId, {
+    await sessionSend(sendPos[0], sendPos[1], targetMachineId, {
       wait: hasFlag("--wait"),
       response: hasFlag("--response"),
       btw: hasFlag("--btw"),
@@ -988,7 +1049,7 @@ async function handleSessionCommand() {
       json: hasFlag("--json"),
       subject: parseFlagStr("--subject"),
       whenIdle: hasFlag("--when-idle"),
-      urgency: parseFlagStr("--urgency"),
+      urgency: await urgencyFlag(),
       model: parseFlagStr("--model"),
       plain: hasFlag("--plain"),
       asIssue: hasFlag("--as-issue"),
@@ -1001,7 +1062,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionEditMessage } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionEditMessage } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await sessionEditMessage(sessionArgs[1], sessionArgs[2], sessionArgs[3], targetMachineId);
   } else if (sessionSubcommand === "refine") {
     if (!sessionArgs[1] || !sessionArgs[2]) {
@@ -1010,7 +1071,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionRefineLastReply } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionRefineLastReply } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await sessionRefineLastReply(sessionArgs[1], sessionArgs[2], targetMachineId);
   } else if (sessionSubcommand === "undo-edit" || sessionSubcommand === "undo") {
     if (!sessionArgs[1]) {
@@ -1019,7 +1080,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionUndoEdit } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionUndoEdit } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await sessionUndoEdit(sessionArgs[1], targetMachineId);
   } else if (sessionSubcommand === "query") {
     const dir = sessionArgs[1];
@@ -1030,7 +1091,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionQuery } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionQuery } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await sessionQuery(dir, prompt, targetMachineId, {
       timeout: parseFlagInt("--timeout"),
       json: hasFlag("--json"),
@@ -1066,7 +1127,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionApprove } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionApprove } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     const approveReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionApprove(sessionArgs[1], approveReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -1077,7 +1138,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionDeny } = await import('./commands-D1pZq3d4.mjs');
+    const { sessionDeny } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     const denyReqId = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
     await sessionDeny(sessionArgs[1], denyReqId, targetMachineId, {
       json: hasFlag("--json")
@@ -1086,10 +1147,14 @@ async function handleSessionCommand() {
     const id = sessionArgs[1];
     const maybeTask = sessionArgs[2] && !sessionArgs[2].startsWith("-") ? sessionArgs[2] : void 0;
     const until = parseFlagStr("--until") ?? parseFlagStr("--criteria");
-    if (!id || !maybeTask && !until) {
+    const limitOnlyFlags = ["--max", "--max-iterations", "--max-rounds", "--max-tokens-per-hour", "--max-runtime", "--max-runtime-sec"];
+    const hasLimit = limitOnlyFlags.some((f) => parseFlagInt(f) !== void 0);
+    if (!id || !maybeTask && !until && !hasLimit) {
       console.error('Usage: svamp session loop <session-id> ["<task>"] --until "<criteria>" [--oracle "cmd"] [--max N] [--max-tokens-per-hour N] [--max-runtime-sec N]');
       console.error("  With a task: kicks the agent off and gates it until done.");
       console.error("  With only --until: hot-plugs the gate onto the running session (no kickoff).");
+      console.error("  With only a limit (--max / --max-tokens-per-hour / --max-runtime-sec):");
+      console.error("    updates the cap on an existing loop, and RESUMES it if a ceiling had stopped it.");
       await flushStdout();
       process.exit(1);
     }
@@ -1130,7 +1195,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionSetTitle } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { sessionSetTitle } = await import('./agentCommands-C_KvvYFp.mjs');
     await sessionSetTitle(title);
   } else if (sessionSubcommand === "set-project-description" || sessionSubcommand === "set-project") {
     const desc = sessionArgs.slice(1).filter((a) => !a.startsWith("--")).join(" ");
@@ -1139,7 +1204,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionSetProjectDescription } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { sessionSetProjectDescription } = await import('./agentCommands-C_KvvYFp.mjs');
     await sessionSetProjectDescription(desc);
   } else if (sessionSubcommand === "set-link") {
     const url = sessionArgs[1];
@@ -1149,11 +1214,11 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const label = sessionArgs[2] && !sessionArgs[2].startsWith("--") ? sessionArgs[2] : void 0;
-    const { sessionSetLink } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { sessionSetLink } = await import('./agentCommands-C_KvvYFp.mjs');
     await sessionSetLink(url, label);
   } else if (sessionSubcommand === "link") {
     const op = sessionArgs[1];
-    const lm = await import('./agentCommands-B2Nl7Fof.mjs');
+    const lm = await import('./agentCommands-C_KvvYFp.mjs');
     if (op === "add") {
       const url = sessionArgs[2];
       if (!url || url.startsWith("--")) {
@@ -1190,7 +1255,7 @@ async function handleSessionCommand() {
       process.exit(1);
     }
     const level = parseFlagStr("--level") || "info";
-    const { sessionNotify } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { sessionNotify } = await import('./agentCommands-C_KvvYFp.mjs');
     await sessionNotify(message, level);
   } else if (sessionSubcommand === "broadcast") {
     const action = sessionArgs[1];
@@ -1199,7 +1264,7 @@ async function handleSessionCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { sessionBroadcast } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { sessionBroadcast } = await import('./agentCommands-C_KvvYFp.mjs');
     await sessionBroadcast(action, sessionArgs.slice(2).filter((a) => !a.startsWith("--")));
   } else if (sessionSubcommand === "inbox") {
     const inboxSubcmd = sessionArgs[1];
@@ -1211,24 +1276,24 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId) {
-        const { inboxSend } = await import('./agentCommands-B2Nl7Fof.mjs');
+        const { inboxSend } = await import('./agentCommands-C_KvvYFp.mjs');
         await inboxSend(sessionArgs[2], {
           body: sessionArgs[3],
           subject: parseFlagStr("--subject"),
-          urgency: parseFlagStr("--urgency"),
+          urgency: await urgencyFlag(),
           whenIdle: hasFlag("--when-idle")
         });
       } else {
         await sessionInboxSend(sessionArgs[2], sessionArgs[3], targetMachineId, {
           subject: parseFlagStr("--subject"),
-          urgency: parseFlagStr("--urgency"),
+          urgency: await urgencyFlag(),
           whenIdle: hasFlag("--when-idle"),
           json: hasFlag("--json")
         });
       }
     } else if (inboxSubcmd === "list" || inboxSubcmd === "ls") {
       if (agentSessionId && !sessionArgs[2]) {
-        const { inboxList } = await import('./agentCommands-B2Nl7Fof.mjs');
+        const { inboxList } = await import('./agentCommands-C_KvvYFp.mjs');
         await inboxList({
           unread: hasFlag("--unread"),
           limit: parseFlagInt("--limit"),
@@ -1252,7 +1317,7 @@ async function handleSessionCommand() {
         process.exit(1);
       }
       if (agentSessionId && !sessionArgs[3]) {
-        const { inboxList } = await import('./agentCommands-B2Nl7Fof.mjs');
+        const { inboxList } = await import('./agentCommands-C_KvvYFp.mjs');
         await sessionInboxRead(agentSessionId, sessionArgs[2], targetMachineId);
       } else if (sessionArgs[3]) {
         await sessionInboxRead(sessionArgs[2], sessionArgs[3], targetMachineId);
@@ -1262,13 +1327,15 @@ async function handleSessionCommand() {
         process.exit(1);
       }
     } else if (inboxSubcmd === "reply") {
-      if (agentSessionId && sessionArgs[2] && sessionArgs[3] && !sessionArgs[4]) {
-        const { inboxReply } = await import('./agentCommands-B2Nl7Fof.mjs');
-        await inboxReply(sessionArgs[2], sessionArgs[3]);
-      } else if (sessionArgs[2] && sessionArgs[3] && sessionArgs[4]) {
-        await sessionInboxReply(sessionArgs[2], sessionArgs[3], sessionArgs[4], targetMachineId);
+      const pos = replyPositionals(sessionArgs.slice(2));
+      const replyOpts = { urgency: await urgencyFlag(), whenIdle: hasFlag("--when-idle") };
+      if (agentSessionId && pos[0] && pos[1] && !pos[2]) {
+        const { inboxReply } = await import('./agentCommands-C_KvvYFp.mjs');
+        await inboxReply(pos[0], pos[1], replyOpts);
+      } else if (pos[0] && pos[1] && pos[2]) {
+        await sessionInboxReply(pos[0], pos[1], pos[2], targetMachineId, replyOpts);
       } else {
-        console.error('Usage: svamp session inbox reply <session-id> <message-id> "<body>"');
+        console.error('Usage: svamp session inbox reply <session-id> <message-id> "<body>" [--urgency urgent|normal] [--when-idle]');
         await flushStdout();
         process.exit(1);
       }
@@ -1306,7 +1373,7 @@ async function handleMachineCommand() {
     return;
   }
   if (machineSubcommand === "share") {
-    const { machineShare } = await import('./commands-D1pZq3d4.mjs');
+    const { machineShare } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     let machineId;
     const shareArgs = [];
     for (let i = 1; i < machineArgs.length; i++) {
@@ -1358,14 +1425,14 @@ async function handleMachineCommand() {
       process.exit(1);
     }
     if (all) {
-      const { fleetExec } = await import('./fleet-DM_Q7w69.mjs');
+      const { fleetExec } = await import('./fleet-Ca-UjJNL.mjs');
       await fleetExec(command, { cwd });
     } else {
-      const { machineExec } = await import('./commands-D1pZq3d4.mjs');
+      const { machineExec } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
       await machineExec(machineId, command, cwd);
     }
   } else if (machineSubcommand === "info") {
-    const { machineInfo } = await import('./commands-D1pZq3d4.mjs');
+    const { machineInfo } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     let machineId;
     for (let i = 1; i < machineArgs.length; i++) {
       if ((machineArgs[i] === "--machine" || machineArgs[i] === "-m") && i + 1 < machineArgs.length) {
@@ -1397,10 +1464,10 @@ async function handleMachineCommand() {
       await flushStdout();
       process.exit(1);
     }
-    const { machineNotify } = await import('./agentCommands-B2Nl7Fof.mjs');
+    const { machineNotify } = await import('./agentCommands-C_KvvYFp.mjs');
     await machineNotify(message, level);
   } else if (machineSubcommand === "ls") {
-    const { machineLs } = await import('./commands-D1pZq3d4.mjs');
+    const { machineLs } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     let machineId;
     let showHidden = false;
     let path;
@@ -1486,29 +1553,29 @@ Examples:
   };
   const hasFlag = (name) => fleetArgs.includes(`--${name}`);
   if (sub === "status") {
-    const { fleetStatus } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetStatus } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetStatus();
   } else if (sub === "upgrade-claude") {
-    const { fleetUpgradeClaude } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetUpgradeClaude } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetUpgradeClaude({ version: flag("version", "-v") });
   } else if (sub === "upgrade-codex") {
-    const { fleetUpgradeCodex } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetUpgradeCodex } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetUpgradeCodex({ version: flag("version", "-v") });
   } else if (sub === "upgrade-kimi") {
-    const { fleetUpgradeKimi } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetUpgradeKimi } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetUpgradeKimi({ version: flag("version", "-v") });
   } else if (sub === "upgrade-nono") {
-    const { fleetUpgradeNono } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetUpgradeNono } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetUpgradeNono({ version: flag("version", "-v") });
   } else if (sub === "upgrade-svamp") {
-    const { fleetUpgradeSvamp } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetUpgradeSvamp } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetUpgradeSvamp({ version: flag("version", "-v"), excludeSelf: hasFlag("exclude-self"), force: hasFlag("force") });
   } else if (sub === "daemon-restart") {
-    const { fleetDaemonRestart } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetDaemonRestart } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetDaemonRestart({ graceful: !hasFlag("cleanup"), force: hasFlag("force") });
   } else if (sub === "push-skill") {
     const name = fleetArgs[1];
-    const { fleetPushSkill } = await import('./fleet-DM_Q7w69.mjs');
+    const { fleetPushSkill } = await import('./fleet-Ca-UjJNL.mjs');
     await fleetPushSkill(name);
   } else {
     console.error(`Unknown fleet subcommand: ${sub}`);
@@ -2003,7 +2070,7 @@ Commands:
   svamp workflow --help              Automation workflows (schedule / event / idle triggers)
   svamp process --help               Process supervisor (apply, list, start, stop, logs)
   svamp machine --help               Machine sharing & security contexts
-  svamp fleet --help                 Fan-out commands across all your machines (status, upgrade-claude, upgrade-codex, upgrade-kimi, upgrade-svamp, daemon-restart, push-skill)
+  svamp fleet --help                 Fan-out commands across all your machines (status, upgrade-claude, upgrade-codex, upgrade-kimi, upgrade-nono, upgrade-svamp, daemon-restart, push-skill)
   svamp skills --help                Skills marketplace (find, install, publish)
   svamp service --help               Service exposure (HTTP services from sandboxes)
   svamp outpost --help               Connect a remote machine (FDE outpost): up, exec, list, install
@@ -2048,6 +2115,11 @@ Usage:
   svamp daemon auth set <URL> <KEY>   Use a custom Anthropic gateway (base URL must not end in /v1)
   svamp daemon codex-auth --help      Configure how Codex authenticates (status/set/use-openai/use-chatgpt/clear)
   svamp daemon kimi-auth --help       Configure how Kimi Code authenticates (status/use-moonshot/use-coding/set/clear)
+  svamp daemon install-nono           Install/reconcile THIS machine onto the pinned, checksum-verified
+                                      nono \u2014 the sandbox boundary. installNono() otherwise runs only
+                                      when the binary is ABSENT, so an existing machine never picks up
+                                      a new pin. Roll deliberately; 'svamp fleet upgrade-nono' fans
+                                      this out (no -v \u2014 it always installs the pin, #1376).
 
 Claude auth flags (take effect on next start/restart):
   svamp daemon start --use-hypha-proxy <URL>   (or --hypha-proxy-url URL)
@@ -2073,7 +2145,7 @@ async function applyClaudeAuthFlags(argv) {
       "--use-hypha-proxy, --use-claude-login, and --anthropic-base-url/--anthropic-api-key are mutually exclusive"
     );
   }
-  const mod = await import('./claudeAuth-iAerdaMr.mjs');
+  const mod = await import('./claudeAuth-DMDvPNhO.mjs');
   if (hasHypha) {
     let url;
     const hyphaIdx = argv.indexOf("--use-hypha-proxy");
@@ -2127,7 +2199,7 @@ async function applyDaemonShareFlag(argv) {
     }
   }
   if (collected.length === 0) return;
-  const { updateEnvFile } = await import('./claudeAuth-iAerdaMr.mjs');
+  const { updateEnvFile } = await import('./claudeAuth-DMDvPNhO.mjs');
   const seen = /* @__PURE__ */ new Set();
   const deduped = collected.filter((e) => {
     const k = e.toLowerCase();
@@ -2160,7 +2232,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const message = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAskCli } = await import('./commands-D1pZq3d4.mjs');
+    const { wiseAskCli } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await wiseAskCli(machineId, message, sessionId, { json });
     return;
   }
@@ -2172,7 +2244,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { runWiseVoiceCli } = await import('./headlessCli-C8HzQvis.mjs');
+    const { runWiseVoiceCli } = await import('./headlessCli-BpTXz6FD.mjs');
     await runWiseVoiceCli({ voice: valueOf(["--voice"]), wakeKeywordPath: valueOf(["--wake"]), model: valueOf(["--model"]) });
     return;
   }
@@ -2190,7 +2262,7 @@ async function handleWiseAgentCommand(rest) {
     const mode = valueOf(["--mode"]);
     const mission = valueOf(["--mission"]);
     const url = rest.slice(1).find((a) => /^https?:\/\//.test(a)) || "";
-    const { wiseJoinMeetingCli } = await import('./commands-D1pZq3d4.mjs');
+    const { wiseJoinMeetingCli } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await wiseJoinMeetingCli(machineId, url, sessionId, { json, mode, mission });
     return;
   }
@@ -2202,7 +2274,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseLeaveMeetingCli } = await import('./commands-D1pZq3d4.mjs');
+    const { wiseLeaveMeetingCli } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await wiseLeaveMeetingCli(valueOf(["--machine", "-m"]), valueOf(["--session", "-s"]), { json: rest.includes("--json") });
     return;
   }
@@ -2226,7 +2298,7 @@ async function handleWiseAgentCommand(rest) {
       }
     });
     const text = rest.slice(1).map((a, idx) => ({ a, idx: idx + 1 })).filter(({ a, idx }) => !a.startsWith("-") && !consumed.has(String(idx))).map(({ a }) => a).join(" ");
-    const { wiseAnnounceCli } = await import('./commands-D1pZq3d4.mjs');
+    const { wiseAnnounceCli } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await wiseAnnounceCli(machineId, text, sessionId, { json });
     return;
   }
@@ -2238,7 +2310,7 @@ async function handleWiseAgentCommand(rest) {
       }
       return void 0;
     };
-    const { wiseMeetingsCli } = await import('./commands-D1pZq3d4.mjs');
+    const { wiseMeetingsCli } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     await wiseMeetingsCli(valueOf(["--machine", "-m"]), { json: rest.includes("--json") });
     return;
   }
@@ -2299,7 +2371,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
     return;
   }
   if (action) {
-    const { updateEnvFile } = await import('./claudeAuth-iAerdaMr.mjs');
+    const { updateEnvFile } = await import('./claudeAuth-DMDvPNhO.mjs');
     const updates = mod.buildWiseAgentEnvUpdates(action);
     updateEnvFile(updates);
     for (const [k, v] of Object.entries(updates)) {
@@ -2313,7 +2385,7 @@ If none is set, hitting a WISE Agent channel returns a clear "not configured" er
 }
 async function handleDaemonAuthCommand(argv) {
   const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
-  const mod = await import('./claudeAuth-iAerdaMr.mjs');
+  const mod = await import('./claudeAuth-DMDvPNhO.mjs');
   if (sub === "--help" || sub === "-h" || sub === "help") {
     console.log(`
 svamp daemon auth \u2014 Configure how Claude subprocesses authenticate
@@ -2390,7 +2462,7 @@ one step: --use-hypha-proxy / --use-claude-login / --anthropic-base-url URL --an
 }
 async function handleDaemonCodexAuthCommand(argv) {
   const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
-  const { updateEnvFile } = await import('./claudeAuth-iAerdaMr.mjs');
+  const { updateEnvFile } = await import('./claudeAuth-DMDvPNhO.mjs');
   const { resolveCodexProvider } = await import('./codexProvider-BtxYc5Rj.mjs');
   const redact = (k) => k && k.length > 10 ? `${k.slice(0, 6)}\u2026${k.slice(-4)}` : k ? "***" : "(unset)";
   if (sub === "--help" || sub === "-h" || sub === "help") {
@@ -2479,7 +2551,7 @@ The generic LLM_API_BASE / LLM_API_KEY / LLM_MODEL env vars are also honored if
 }
 async function handleDaemonKimiAuthCommand(argv) {
   const sub = wantsHelp(argv) ? "--help" : (argv[0] || "status").toLowerCase();
-  const { updateEnvFile } = await import('./claudeAuth-iAerdaMr.mjs');
+  const { updateEnvFile } = await import('./claudeAuth-DMDvPNhO.mjs');
   const { resolveKimiProvider, buildKimiCatalogAddArgs, DEFAULT_KIMI_PROVIDER } = await import('./kimiProvider-DbxODebR.mjs');
   const redact = (k) => k && k.length > 10 ? `${k.slice(0, 6)}\u2026${k.slice(-4)}` : k ? "***" : "(unset)";
   const PRESETS = {
@@ -2646,9 +2718,13 @@ COMMANDS:
                                           the message lands in the peer's inbox and is processed on
                                           their next idle turn (no interrupt). Loop safeguard: a send
                                           issued from a turn that was itself triggered by an inbox
-                                          message is always forced non-urgent (no recursive wake
-                                          cascades); the daemon's per-sender rate limit + circuit
-                                          breaker further bound any storm.
+                                          message DEFAULTS to non-urgent (no recursive wake cascades)
+                                          and says so on stderr; pass --urgency urgent to override.
+                                          This safeguard covers "send" and "inbox send" only \u2014
+                                          "inbox reply" deliberately defaults urgent (it wakes a party
+                                          that is waiting) and is bounded by the hop cap instead.
+                                          The daemon's per-sender rate limit + circuit breaker
+                                          further bound any storm.
                                             --when-idle         defer: handle on the recipient's
                                                                 next idle turn (opposite of the
                                                                 urgent default)
@@ -2710,7 +2786,9 @@ COMMANDS:
     inbox send <id> "<body>" [opts]       Send a message to session inbox
     inbox list <id> [--unread] [--json]   List inbox messages
     inbox read <id> <msg-id>              Read and mark a message
-    inbox reply <id> <msg-id> "<body>"    Reply to sender's session
+    inbox reply <id> <msg-id> "<body>"    Reply to sender's session (urgent by default \u2014
+        [--urgency urgent|normal]         it wakes a party that is waiting; --when-idle or
+        [--when-idle]                     --urgency normal defers to their next idle turn)
     inbox clear <id> [--all]              Clear read (or all) messages
 
 SPAWN OPTIONS:
@@ -2762,7 +2840,7 @@ ISOLATION & SHARING OPTIONS (for spawn):
 MESSAGES OPTIONS:
   --last N       Show last N messages only
   --after N      Start after sequence number N (for pagination)
-  --limit N      Max messages to fetch (default: 1000)
+  --limit N      Max messages to fetch (default: 50, capped at 500 by the daemon)
   --json         Output as JSON array of {id, seq, role, text, createdAt}
   --raw          With --json: include full raw objects (tool_use, tool_result, thinking)