svamp-cli 0.2.346 → 0.2.358

package/dist/{hookSettings-DYMTUgVA.mjs → hookSettings-CvvUhwCK.mjs}

@@ -1,5 +1,5 @@
 import{createRequire as _pkgrollCR}from"node:module";const require=_pkgrollCR(import.meta.url);import * as fs from 'fs';
-import { mkdirSync, chmodSync, writeFileSync, unlinkSync, existsSync, readFileSync, renameSync as renameSync$1 } from 'fs';
+import { statSync, mkdirSync, chmodSync, writeFileSync, unlinkSync, existsSync, readFileSync, renameSync as renameSync$1 } from 'fs';
 import * as path from 'path';
 import path__default, { join } from 'path';
 import { randomUUID as randomUUID$1, randomBytes as randomBytes$1, createHash as createHash$1, timingSafeEqual } from 'node:crypto';
@@ -17,15 +17,15 @@ import * as net from 'net';
 import { createServer } from 'net';
 import { homedir, platform, arch } from 'os';
 import { d as getFrpsSubdomainHost, e as getFrpsServerPort, f as getFrpsServerAddr, h as getHyphaServerUrl } from './instance-CeHz5C8v.mjs';
-import { S as ServeAuth, s as sanitizeLoginReturn, h as hasCookieToken, a as stripServeTokenParam, b as sanitizeForwardHeaders, c as stripServeAuthCookie } from './serveAuth-DbVLRCRR.mjs';
-import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, rmSync, cpSync, realpathSync, readdirSync, statSync, renameSync, appendFileSync, openSync, readSync, closeSync, fstatSync, writeSync, unlinkSync as unlinkSync$1 } from 'node:fs';
+import { S as ServeAuth, s as sanitizeLoginReturn, h as hasCookieToken, a as stripServeTokenParam, b as sanitizeForwardHeaders, c as stripServeAuthCookie } from './serveAuth-4M0vwMyj.mjs';
+import { existsSync as existsSync$1, mkdirSync as mkdirSync$1, readFileSync as readFileSync$1, writeFileSync as writeFileSync$1, chmodSync as chmodSync$1, renameSync, rmSync, cpSync, realpathSync, readdirSync, statSync as statSync$1, appendFileSync, openSync, readSync, closeSync, fstatSync, writeSync, unlinkSync as unlinkSync$1 } from 'node:fs';
 import os, { homedir as homedir$1 } from 'node:os';
 import { join as join$1, extname, resolve, sep, basename, dirname } from 'node:path';
 import { e as envFlagEnabled, a as envFlagDisabled } from './envFlag-COOuJ3AH.mjs';
-import { normalizeProxyUrl, resolveHyphaProxyUrl, applyClaudeProxyEnv } from './claudeAuth-iAerdaMr.mjs';
+import { normalizeProxyUrl, resolveHyphaProxyUrl, applyClaudeProxyEnv } from './claudeAuth-DMDvPNhO.mjs';
 import { CODEX_PROVIDER_KEY_ENV } from './codexProvider-BtxYc5Rj.mjs';
 import { spawn as spawn$1 } from 'node:child_process';
-import { b as applyInboxClear } from './friendlyName-1UZcyDhu.mjs';
+import { applyInboxClear } from './inboxGuard-CDqmIypF.mjs';
 import { w as withFileLock, s as sleepSync } from './fileLock-BMPwCrB6.mjs';
 import { EventEmitter } from 'node:events';
 import { r as renderTemplate } from './cron-hHGdb5kU.mjs';
@@ -74,6 +74,19 @@ function levelToRole(level) {
   const entry = Object.entries(ROLE_HIERARCHY).find(([, v]) => v === level);
   return entry?.[0] ?? null;
 }
+function isOwnerEquivalentStrict(context, sharing) {
+  if (!context?.user) return true;
+  if (isSameOwnerWorkspace(context)) return true;
+  if (!sharing) return false;
+  const userEmail = context.user.email;
+  if (userEmail && sharing.owner && userEmail.toLowerCase() === sharing.owner.toLowerCase()) return true;
+  return false;
+}
+function isAdminEquivalentStrict(context, sharing) {
+  if (!context?.user) return true;
+  if (isSameOwnerWorkspace(context)) return true;
+  return !!sharing && getEffectiveRole(context, sharing) === "admin";
+}
 function authorizeRequest(context, sharing, requiredRole = "view") {
   if (!context?.user) return;
   if (isSameOwnerWorkspace(context)) return;
@@ -124,6 +137,18 @@ function workflowOpMinRole(op) {
   if (typeof op === "string" && WORKFLOW_READ_OPS.has(op)) return "view";
   return "admin";
 }
+function issueVerifyRefusalReason(params, isOwner) {
+  if (isOwner) return null;
+  const p = params;
+  if (!p || typeof p !== "object") return null;
+  const op = typeof p.op === "string" ? p.op : "";
+  if (op !== "add" && op !== "edit" && op !== "triage") return null;
+  const v = p.verify;
+  const structuredIsCommand = !!v && typeof v === "object" && v.type === "command";
+  const flatCommand = typeof p.verifyCmd === "string" && p.verifyCmd.length > 0;
+  if (!structuredIsCommand && !flatCommand) return null;
+  return "Access denied: only the session owner may attach a command verify-cmd. It is executed by the daemon outside the sandbox when the issue is closed. Use --verify '<criterion>' (an agent-evaluated check) or --manual instead.";
+}
 
 function toSchema(t) {
   return { name: t.name, description: t.description, parameters: t.parameters || { type: "object", properties: {} } };
@@ -279,6 +304,17 @@ const DEFAULT_PROBE_FAILURE_THRESHOLD = 3;
 const MAX_RESTART_DELAY_S = 300;
 const BACKOFF_RESET_WINDOW_MS = 6e4;
 const MAX_LOG_LINES = 300;
+function checkWorkdir(workdir, stat = statSync) {
+  if (!workdir) return null;
+  try {
+    if (!stat(workdir).isDirectory()) return `workdir is not a directory: ${workdir}`;
+    return null;
+  } catch (err) {
+    if (err?.code === "ENOENT") return `workdir does not exist: ${workdir}`;
+    if (err?.code === "EACCES") return `workdir is not accessible: ${workdir}`;
+    return null;
+  }
+}
 const CRASH_LOOP_FAILURE_THRESHOLD = 10;
 function accumulateCrashLoopFailure(prev, healthy, now) {
   if (healthy) return { consecutiveFailures: 0, failureWindowStart: void 0 };
@@ -567,8 +603,11 @@ class ProcessSupervisor {
       if (!file.endsWith(".json")) continue;
       try {
         const raw = await readFile(path__default.join(this.persistDir, file), "utf-8");
-        const spec = JSON.parse(raw);
-        const entry = this.makeEntry(spec);
+        const parsed = JSON.parse(raw);
+        const restored = parsed?.__state;
+        delete parsed.__state;
+        const spec = parsed;
+        const entry = this.makeEntry(spec, restored);
         this.entries.set(spec.id, entry);
         if (spec.keepAlive && !spec.desiredStopped) {
           await this.startEntry(
@@ -591,12 +630,49 @@ class ProcessSupervisor {
       console.log(`[SUPERVISOR] Restored ${loaded} supervised process(es)`);
     }
   }
-  async persistSpec(spec) {
+  /**
+   * #1643: the crash-loop LEDGER travels with the spec.
+   *
+   * `ProcessState` is annotated "not persisted", and `makeEntry` zeroes restartCount /
+   * consecutiveFailures / crashLoopBackOff on every restore — so a permanently-broken keepAlive
+   * spec (dead upstream, taken port, vanished workdir) got a FRESH 10-restart budget on every
+   * daemon start, forever. It burns CRASH_LOOP_FAILURE_THRESHOLD restarts and ~15 min of
+   * exponential spawn churn, parks crash-loop-backoff, and starts over on the next boot —
+   * undermining the cap that exists because of the "11,508 restarts in 4 days" incident, and
+   * worst right after a reboot when several dead specs churn at once. `svamp process list` also
+   * showed RESTARTS 0 after every restart, which hid it. The #1633 docblock states this for the
+   * missing-workdir case; it is general.
+   *
+   * Written under a `__state` key so the file stays a superset of ProcessSpec: an older daemon
+   * ignores it, and `loadAll` strips it before the object becomes `entry.spec`.
+   */
+  async persistSpec(spec, state, failureWindowStart) {
     const filePath = path__default.join(this.persistDir, `${spec.id}.json`);
+    if (!state) {
+      const live = this.entries.get(spec.id);
+      if (live) {
+        state = live.state;
+        failureWindowStart = live.failureWindowStart;
+      }
+    }
     const tmpPath = `${filePath}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`;
-    await writeFile(tmpPath, JSON.stringify(spec, null, 2), "utf-8");
+    const payload = { ...spec };
+    if (state) {
+      payload.__state = {
+        restartCount: state.restartCount,
+        userRestartCount: state.userRestartCount,
+        consecutiveFailures: state.consecutiveFailures,
+        crashLoopBackOff: state.crashLoopBackOff,
+        failureWindowStart
+      };
+    }
+    await writeFile(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
     await rename(tmpPath, filePath);
   }
+  /** #1643: rewrite this spec's file including its live crash-loop ledger. Best-effort. */
+  persistLedger(entry) {
+    void this.persistSpec(entry.spec, entry.state, entry.failureWindowStart).catch((err) => console.error(`[SUPERVISOR] Failed to persist crash-loop ledger for ${entry.spec.name}: ${err?.message || err}`));
+  }
   async deleteSpec(id) {
     try {
       await unlink(path__default.join(this.persistDir, `${id}.json`));
@@ -604,17 +680,22 @@ class ProcessSupervisor {
     }
   }
   // ── Internal helpers ──────────────────────────────────────────────────────
-  makeEntry(spec) {
+  makeEntry(spec, restored) {
     return {
       spec,
       state: {
         id: spec.id,
         status: "pending",
-        restartCount: 0,
-        userRestartCount: 0,
+        // #1643: a restored ledger carries the crash-loop budget ACROSS the restart. Without
+        // it, `maxRestarts` and CRASH_LOOP_FAILURE_THRESHOLD were per-boot rather than
+        // lifetime caps, which is not what either of them claims to be.
+        restartCount: restored?.restartCount ?? 0,
+        userRestartCount: restored?.userRestartCount ?? 0,
         consecutiveProbeFailures: 0,
-        consecutiveFailures: 0
+        consecutiveFailures: restored?.consecutiveFailures ?? 0,
+        crashLoopBackOff: restored?.crashLoopBackOff
       },
+      failureWindowStart: restored?.failureWindowStart,
       logBuffer: [],
       stopping: false
     };
@@ -654,6 +735,16 @@ class ProcessSupervisor {
     const { spec, state } = entry;
     if (entry.deleted) return;
     state.consecutiveProbeFailures = 0;
+    const workdirProblem = checkWorkdir(spec.workdir);
+    if (workdirProblem) {
+      state.status = "failed";
+      state.stoppedAt = Date.now();
+      entry.logBuffer.push(`[supervisor] ${workdirProblem}`);
+      console.error(
+        `[SUPERVISOR] Not starting '${spec.name}': ${workdirProblem} (permanent \u2014 not retrying; fix the path or run 'svamp process restart ${spec.name}')`
+      );
+      return;
+    }
     try {
       const env = { ...process.env, ...spec.env ?? {} };
       const child = spawn(spec.command, spec.args, {
@@ -735,6 +826,7 @@ class ProcessSupervisor {
       );
       return;
     }
+    this.persistLedger(entry);
     if (spec.maxRestarts > 0 && state.restartCount >= spec.maxRestarts) {
       console.warn(`[SUPERVISOR] Process '${spec.name}' reached max restarts (${spec.maxRestarts}), not restarting`);
       state.status = "failed";
@@ -758,6 +850,7 @@ class ProcessSupervisor {
       if (entry.child) return;
       state.restartCount++;
       state.status = "starting";
+      this.persistLedger(entry);
       this.spawnProcess(entry);
     }, delayMs);
   }
@@ -2068,9 +2161,10 @@ function serveStaticMount(req, res, opts) {
     return;
   }
   if (st.isDirectory()) {
-    const reqPath = (req.url || "/").split("?")[0];
-    if (!reqPath.endsWith("/")) {
-      res.writeHead(302, { ...CORS, Location: reqPath + "/" });
+    const normalizedPath = (relPath || "/").split("?")[0];
+    const redirectTo = ("/" + normalizedPath.replace(/^\/+/, "")).replace(/\/+$/, "") + "/";
+    if (!normalizedPath.endsWith("/")) {
+      res.writeHead(302, { ...CORS, Location: mountUrlPrefix ? mountUrlPrefix.replace(/\/$/, "") + redirectTo : redirectTo });
       res.end();
       return;
     }
@@ -2251,7 +2345,13 @@ function resolveMountOwnerEmail(suppliedOwnerEmail, callerEmail, machineOwnerEma
 function sanitizeMountForRole(mount, isAdmin) {
   if (isAdmin) return mount;
   const { linkToken: _lt, directory: _dir, process: proc, url, ...rest } = mount;
-  const safeProcess = proc ? { ...proc, env: proc.env ? Object.fromEntries(Object.keys(proc.env).map((k) => [k, "***"])) : proc.env } : proc;
+  const safeProcess = proc ? (() => {
+    const { env, workdir: _wd, command: _cmd, args: _args, ...procRest } = proc;
+    return {
+      ...procRest,
+      env: env ? Object.fromEntries(Object.keys(env).map((k) => [k, "***"])) : env
+    };
+  })() : proc;
   const safeUrl = mount.access === "link" ? void 0 : url;
   return { ...rest, process: safeProcess, ...safeUrl !== void 0 ? { url: safeUrl } : {} };
 }
@@ -3410,6 +3510,13 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
               res.end("Write access denied: public mounts are read-only.");
               return;
             }
+            const writeBadSeg = hiddenSegmentOf(basePath);
+            if (writeBadSeg) {
+              this.log(`Write DENY '${mountName}': blocked dotfile segment '${writeBadSeg}' (${basePath})`);
+              res.writeHead(403, { "Content-Type": "text/plain" });
+              res.end("Forbidden: hidden/dot-prefixed paths are not writable.");
+              return;
+            }
             const filePath = resolveContained();
             if (!filePath) {
               this.log(`Write DENY '${mountName}': path escapes mount root (${basePath})`);
@@ -3419,13 +3526,17 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
             }
             if (req.method === "PUT") {
               fs.mkdirSync(path.dirname(filePath), { recursive: true });
-              const ws = fs.createWriteStream(filePath);
+              const tmpPath = path.join(
+                path.dirname(filePath),
+                `.svamp-put-${process.pid}-${crypto.randomBytes(6).toString("hex")}.part`
+              );
+              const ws = fs.createWriteStream(tmpPath);
               let done = false;
               const cleanupPartial = () => {
                 if (done) return;
                 done = true;
                 ws.destroy();
-                fs.unlink(filePath, () => {
+                fs.unlink(tmpPath, () => {
                 });
               };
               req.on("aborted", cleanupPartial);
@@ -3434,13 +3545,25 @@ a{color:#0969da;text-decoration:none;font-weight:500}a:hover{text-decoration:und
               });
               req.pipe(ws);
               ws.on("finish", () => {
+                if (done) return;
                 done = true;
+                try {
+                  fs.renameSync(tmpPath, filePath);
+                } catch (err) {
+                  fs.unlink(tmpPath, () => {
+                  });
+                  res.writeHead(500);
+                  res.end(err?.message || "rename failed");
+                  return;
+                }
                 res.writeHead(201);
                 res.end();
               });
               ws.on("error", (err) => {
                 if (done) return;
                 done = true;
+                fs.unlink(tmpPath, () => {
+                });
                 res.writeHead(500);
                 res.end(err.message);
               });
@@ -3823,9 +3946,13 @@ function loadAccounts(svampHome) {
   if (!existsSync$1(file)) return [];
   try {
     const parsed = JSON.parse(readFileSync$1(file, "utf-8"));
-    if (!parsed || !Array.isArray(parsed.accounts)) return [];
+    if (!parsed || !Array.isArray(parsed.accounts)) {
+      console.warn(`[accounts] ${file} is present but malformed \u2014 treating as empty. Configured backend accounts will appear to have vanished; restore from a backup rather than re-adding blindly. (#1629)`);
+      return [];
+    }
     return parsed.accounts;
-  } catch {
+  } catch (err) {
+    console.warn(`[accounts] failed to read ${file}: ${err?.message || err}. Treating as empty \u2014 every configured backend account will appear to have vanished. (#1629)`);
     return [];
   }
 }
@@ -3834,7 +3961,13 @@ function saveAccounts(accounts, svampHome) {
   const dir = join$1(file, "..");
   if (!existsSync$1(dir)) mkdirSync$1(dir, { recursive: true });
   const payload = { version: 1, accounts };
-  writeFileSync$1(file, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  const tmp = `${file}.tmp-${process.pid}`;
+  writeFileSync$1(tmp, JSON.stringify(payload, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync$1(tmp, 384);
+  } catch {
+  }
+  renameSync(tmp, file);
   try {
     chmodSync$1(file, 384);
   } catch {
@@ -4520,7 +4653,7 @@ function validateUpload(input) {
     if (existsSync$1(destDir)) {
       const count = readdirSync(destDir).filter((f) => {
         try {
-          return statSync(join$1(destDir, f)).isFile();
+          return statSync$1(join$1(destDir, f)).isFile();
         } catch {
           return false;
         }
@@ -4733,7 +4866,7 @@ class ChannelStore {
   list() {
     let st;
     try {
-      const s = statSync(this.dir);
+      const s = statSync$1(this.dir);
       st = { mtimeMs: s.mtimeMs, size: s.size };
     } catch {
       _channelListCache.delete(this.dir);
@@ -5202,7 +5335,7 @@ class ChannelOutbox {
   /** Current on-disk (mtimeMs, size), or (0, -1) if the file does not exist. */
   _stat() {
     try {
-      const st = statSync(this.file);
+      const st = statSync$1(this.file);
       return { mtimeMs: st.mtimeMs, size: st.size };
     } catch {
       return { mtimeMs: 0, size: -1 };
@@ -5442,6 +5575,9 @@ const SESSION_METHOD_MIN_ROLE = {
   channelReply: "admin",
   updateAgentState: "admin",
   switchMode: "admin",
+  // #1628: rotating the outpost token DESTROYS a live capability and mints a new one — admin,
+  // like outpostConnectInfo which hands the same capability out.
+  outpostRotateToken: "admin",
   restartClaude: "admin",
   archiveSession: "admin",
   readFile: "admin",
@@ -5977,6 +6113,15 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         const callerEmail = context?.user?.email;
         const machineOwner = currentMetadata.sharing?.owner;
         const isSharedUser = callerEmail && machineOwner && callerEmail.toLowerCase() !== machineOwner.toLowerCase();
+        if (options.sharing?.allowedUsers?.length) {
+          options = {
+            ...options,
+            sharing: {
+              ...options.sharing,
+              allowedUsers: options.sharing.allowedUsers.map((u) => normalizeAllowedUser(u, "spawn"))
+            }
+          };
+        }
         if (isSharedUser) {
           const sharing = {
             enabled: true,
@@ -6014,7 +6159,11 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         } else if (options.sharing?.enabled && !options.sharing.owner && callerEmail) {
           options = {
             ...options,
-            sharing: { ...options.sharing, owner: callerEmail }
+            sharing: {
+              ...options.sharing,
+              owner: callerEmail,
+              ...options.sharing.allowedUsers ? { allowedUsers: options.sharing.allowedUsers.map((u) => normalizeAllowedUser(u, "spawn-explicit")) } : {}
+            }
           };
         }
         if (currentMetadata.securityContextConfig && callerEmail) {
@@ -6356,12 +6505,12 @@ async function registerMachineService(server, machineId, metadata, daemonState,
         return { success: true };
       },
       // Shell access
-      bash: async (command, cwd, context) => {
+      bash: async (command, cwd, timeoutMs, context) => {
         authorizeRequest(context, currentMetadata.sharing, "admin");
         const { exec } = await import('child_process');
         const { homedir } = await import('os');
         return new Promise((resolve) => {
-          exec(command, { cwd: cwd || homedir(), timeout: 3e4, maxBuffer: EXEC_MAX_BUFFER }, (err, stdout, stderr) => {
+          exec(command, { cwd: cwd || homedir(), timeout: timeoutMs ?? 3e4, maxBuffer: EXEC_MAX_BUFFER }, (err, stdout, stderr) => {
             if (err) resolve(execFailureOutcome(err, stdout, stderr));
             else resolve(execSuccessOutcome(stdout, stderr));
           });
@@ -7477,7 +7626,7 @@ QUESTION: ${params.question || "Summarize this concisely."}` }
       return { ok: false, call_id: callId, status: "busy", error: "channel is busy (too many concurrent requests) \u2014 retry shortly" };
     }
     const rendered = renderMessage(c, { sender: r.sender, body: { message: kwargs.message }, callId });
-    const { queryCore } = await import('./commands-D1pZq3d4.mjs');
+    const { queryCore } = await import('./commands-CcdoQIkb.mjs').then(function (n) { return n.d; });
     const timeout = c.reply?.timeout_sec || 120;
     let result;
     let thrownSessionId;
@@ -7746,7 +7895,7 @@ ${d?.error || "not found"}`;
 const CHUNK_BYTES$1 = 1024 * 1024;
 const LF = 10;
 function countFileLines(path) {
-  const size = statSync(path).size;
+  const size = statSync$1(path).size;
   if (size === 0) return 0;
   const fd = openSync(path, "r");
   try {
@@ -7864,6 +8013,14 @@ function loadInbox(projectDir, sessionId) {
     return [];
   }
 }
+const reportedInboxWriteErrnos = /* @__PURE__ */ new Set();
+function reportInboxWriteFailure(projectDir, sessionId, err) {
+  const code = String(err?.code || err?.name || "UNKNOWN");
+  if (reportedInboxWriteErrnos.has(code)) return;
+  reportedInboxWriteErrnos.add(code);
+  const hint = code === "ENOSPC" ? ' \u2014 THE DISK IS FULL. Pending inter-agent messages will be LOST on the next daemon restart and `inbox reply` will answer "not found"; session transcripts are likely failing too.' : code === "EROFS" ? " \u2014 the filesystem is read-only." : code === "EACCES" || code === "EPERM" ? " \u2014 permission denied on the session .svamp directory." : code === "ENOTDIR" ? " \u2014 a path component of .svamp/<sessionId>/ is a FILE, not a directory." : "";
+  console.error(`[inbox] persist failed for session ${sessionId} in ${projectDir} (${code})${hint} Further ${code} failures will not be repeated. (#1714)`);
+}
 function saveInbox(projectDir, sessionId, inbox) {
   try {
     const p = inboxFilePath(projectDir, sessionId);
@@ -7871,7 +8028,8 @@ function saveInbox(projectDir, sessionId, inbox) {
     const tmp = `${p}.tmp-${process.pid}-${randomBytes$1(4).toString("hex")}`;
     writeFileSync$1(tmp, JSON.stringify(inbox));
     renameSync(tmp, p);
-  } catch {
+  } catch (err) {
+    reportInboxWriteFailure(projectDir, sessionId, err);
   }
 }
 function isPending(m) {
@@ -7984,6 +8142,17 @@ function ensureOutpostToken(projectDir, session) {
   }
   return rec;
 }
+function rotateOutpostToken(projectDir, session) {
+  const rec = { version: 1, session, token: genToken(), createdAt: Date.now() };
+  const file = tokenPath(projectDir, session);
+  mkdirSync$1(dirname(file), { recursive: true });
+  writeFileSync$1(file, JSON.stringify(rec, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  try {
+    chmodSync$1(file, 384);
+  } catch {
+  }
+  return rec;
+}
 function outpostTokenMatches(rec, presented) {
   if (!rec || typeof presented !== "string" || presented.length !== rec.token.length) return false;
   let diff = 0;
@@ -8151,25 +8320,34 @@ async function _mintPairingCodeLocked(opts, resolver, ttlMs) {
     stage: true,
     _rkwargs: true
   });
-  const putUrl = await am.put_file({ artifact_id: artifactId, file_path: "pair.json", download_weight: 0, _rkwargs: true });
-  if (!putUrl || typeof putUrl !== "string") throw new Error(`put_file returned invalid URL: ${putUrl}`);
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 3e4);
-  try {
-    const resp = await fetch(putUrl, {
-      method: "PUT",
-      body: pairJson,
-      headers: { "Content-Type": "application/json" },
-      signal: controller.signal
-    });
-    if (!resp.ok) throw new Error(`pair.json upload failed: ${resp.status} ${resp.statusText}`);
-  } finally {
-    clearTimeout(timer);
-  }
-  await am.commit({ artifact_id: artifactId, _rkwargs: true });
   const all = loadPairings(opts.svampHome);
   all.push({ session, code, artifactId, expiresAt, createdAt: now });
   savePairings(all, opts.svampHome);
+  try {
+    const putUrl = await am.put_file({ artifact_id: artifactId, file_path: "pair.json", download_weight: 0, _rkwargs: true });
+    if (!putUrl || typeof putUrl !== "string") throw new Error(`put_file returned invalid URL: ${putUrl}`);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 3e4);
+    try {
+      const resp = await fetch(putUrl, {
+        method: "PUT",
+        body: pairJson,
+        headers: { "Content-Type": "application/json" },
+        signal: controller.signal
+      });
+      if (!resp.ok) throw new Error(`pair.json upload failed: ${resp.status} ${resp.statusText}`);
+    } finally {
+      clearTimeout(timer);
+    }
+    await am.commit({ artifact_id: artifactId, _rkwargs: true });
+  } catch (err) {
+    try {
+      await deletePairingArtifact(am, artifactId, log);
+      savePairings(loadPairings(opts.svampHome).filter((p) => p.artifactId !== artifactId), opts.svampHome);
+    } catch {
+    }
+    throw err;
+  }
   log?.(`[OUTPOST PAIRING] minted ${code} for ${session} (expires in ${Math.round(ttlMs / 6e4)}m)`);
   return { code, resolver, expiresAt };
 }
@@ -8395,6 +8573,24 @@ function channelPublicView(c) {
 function isStructuredMessage(msg) {
   return !!(msg.from || msg.fromSession || msg.subject || msg.replyTo || msg.threadId || msg.channel);
 }
+function reportInboxEviction(result, sessionId) {
+  for (const m of result.droppedUndelivered) {
+    console.warn(
+      `[HYPHA SESSION ${sessionId}] inbox at cap: DROPPED AN UNDELIVERED message ${m.messageId || "<no id>"} from ${m.from || "<unknown>"} (urgency=${m.urgency || "normal"}). Every resident message was undelivered, so there was no delivered one to evict instead. The sender was told it was sent; it is now gone (#0328).`
+    );
+  }
+}
+function evictInboxOverflow(inbox, max) {
+  const dropped = [];
+  const droppedUndelivered = [];
+  while (inbox.length > max) {
+    const idx = inbox.findIndex((m) => m.handled);
+    const victim = inbox.splice(idx < 0 ? 0 : idx, 1)[0];
+    dropped.push(victim);
+    if (!victim.handled) droppedUndelivered.push(victim);
+  }
+  return { dropped, droppedUndelivered };
+}
 function escapeXml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
@@ -8430,10 +8626,10 @@ function formatInboxMessageXml(msg) {
   }
   if (msg.to) attrs.push(`to="${escapeXml(msg.to)}"`);
   if (msg.subject) attrs.push(`subject="${escapeXml(msg.subject)}"`);
-  if (msg.urgency) attrs.push(`urgency="${msg.urgency}"`);
+  if (msg.urgency) attrs.push(`urgency="${escapeXml(String(msg.urgency))}"`);
   if (msg.replyTo) attrs.push(`reply-to="${escapeXml(msg.replyTo)}"`);
   if (msg.threadId) attrs.push(`thread-id="${escapeXml(msg.threadId)}"`);
-  attrs.push(`timestamp="${msg.timestamp}"`);
+  attrs.push(`timestamp="${escapeXml(String(msg.timestamp))}"`);
   return `<svamp-message ${attrs.join(" ")}>
 ${msg.body}
 </svamp-message>`;
@@ -8544,7 +8740,7 @@ function countMessagesOnDisk(messagesDir, fallbackInMemory) {
   const filePath = join$1(messagesDir, "messages.jsonl");
   if (!existsSync$1(filePath)) return fallbackInMemory;
   try {
-    const st = statSync(filePath);
+    const st = statSync$1(filePath);
     const cached = messageCountCache.get(filePath);
     if (cached && cached.size === st.size && cached.mtimeMs === st.mtimeMs) return cached.count;
     let count;
@@ -8803,7 +8999,8 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     } else if (role === "session") {
       wrappedContent = { role: "session", content: { type: "session", data: content } };
     } else {
-      const text = typeof content === "string" ? content : content?.text || content?.content || JSON.stringify(content);
+      const rawText = typeof content === "string" ? content : content?.text ?? content?.content ?? content;
+      const text = typeof rawText === "string" ? rawText : rawText && typeof rawText === "object" && typeof rawText.text === "string" ? rawText.text : JSON.stringify(content);
       wrappedContent = { role: "user", content: { type: "text", text } };
     }
     const msg = {
@@ -8853,7 +9050,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       subject: `Remote outpost connected: ${who}`
     };
     inbox.push(msg);
-    while (inbox.length > INBOX_MAX) inbox.shift();
+    reportInboxEviction(evictInboxOverflow(inbox, INBOX_MAX), sessionId);
     syncInboxToMetadata();
     callbacks.onInboxMessage?.(msg);
     notifyListeners({ type: "inbox-update", sessionId, message: msg });
@@ -9099,7 +9296,21 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       }
     }
     const isBtwEcho = !!(parsed && parsed.meta && parsed.meta.btw) || !!(meta && meta.btw);
-    const coerceUserContent = (c) => typeof c === "string" ? { type: "text", text: c } : c;
+    const coerceUserText = (t, depth = 0) => {
+      if (typeof t === "string") return t;
+      if (t && typeof t === "object" && depth < 4) {
+        if (typeof t.text === "string") return t.text;
+        if (t.text && typeof t.text === "object") return coerceUserText(t.text, depth + 1);
+      }
+      return typeof t === "undefined" ? "" : JSON.stringify(t);
+    };
+    const coerceUserContent = (c) => {
+      if (typeof c === "string") return { type: "text", text: c };
+      if (c && typeof c === "object" && c.type === "text") {
+        return { ...c, text: coerceUserText(c.text) };
+      }
+      return c;
+    };
     const wrappedContent = parsed && parsed.role === "user" ? { role: "user", content: coerceUserContent(parsed.content) } : { role: "user", content: { type: "text", text: typeof parsed === "string" ? parsed : JSON.stringify(parsed) } };
     if (isBtwEcho) wrappedContent.meta = { btw: true };
     const msg = {
@@ -9276,6 +9487,32 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // `svamp outpost up`, so the install command never drifts. NO channel is created — the remote
     // dials the machine's public `:outpost` gateway and this session's token authenticates it.
     // Admin-gated: the returned token is a capability to run commands on whatever machine connects.
+    // #1628: REVOKE this session's outpost token by minting a fresh one, then return the new
+    // install info. The durable token is a capability ("whoever holds it can run commands on
+    // connected outposts") that never expired and had no rotate path — and the documented
+    // workflow PRINTS it in an install one-liner meant to be pasted into someone else's
+    // terminal, so it routinely lands in shell history, chat and screen shares. Every prior
+    // outpost fix (#0757, #0778, #1035, #1374) closed a LEAK; none gave the operator a way to
+    // invalidate a token that had already leaked.
+    //
+    // Admin-gated like outpostConnectInfo — this both destroys a capability and mints a new one.
+    // Live pairing codes for the session are burned in the same act: leaving a code that
+    // resolves to the OLD token would defeat the rotation.
+    outpostRotateToken: async (params, context) => {
+      authorizeRequest(context, metadata.sharing, "admin");
+      if (!outpostServiceId) return { error: "the outpost service is not available on this machine" };
+      try {
+        rotateOutpostToken(outpostProjectDir(), sessionId);
+        try {
+          const am = await server.getService("public/artifact-manager");
+          if (am) await burnSessionPairings(am, sessionId, void 0, (m) => console.log(m));
+        } catch {
+        }
+      } catch (err) {
+        return { error: `could not rotate the outpost token: ${err?.message || err}` };
+      }
+      return await rpcHandlers.outpostConnectInfo(params, context);
+    },
     outpostConnectInfo: async (params, context) => {
       authorizeRequest(context, metadata.sharing, "admin");
       if (!outpostServiceId) return { error: "the outpost service is not available on this machine" };
@@ -9694,7 +9931,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       authorizeRequest(context, metadata.sharing, "interact");
       let forwarded = params;
       if (params && (params.mode !== void 0 || params.allowTools !== void 0)) {
-        if (!roleAtLeast(getEffectiveRole(context, metadata.sharing), "admin")) {
+        if (!isAdminEquivalentStrict(context, metadata.sharing)) {
           const { mode: _droppedMode, allowTools: _droppedTools, ...rest } = params;
           forwarded = rest;
           console.warn(
@@ -9812,6 +10049,8 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
     // workflow writes 'admin' (direct server-side command exec). See issueOpMinRole above.
     issue: async (params, context) => {
       authorizeRequest(context, metadata.sharing, issueOpMinRole(params?.op));
+      const refusal = issueVerifyRefusalReason(params, isOwnerEquivalentStrict(context, metadata.sharing));
+      if (refusal) throw new Error(refusal);
       if (!callbacks.onIssue) throw new Error("issue not supported");
       return await callbacks.onIssue(params);
     },
@@ -9928,7 +10167,7 @@ function createSessionStore(server, sessionId, initialMetadata, initialAgentStat
       const trusted = !context?.user || isSameOwnerWorkspace(context) || !!metadata.sharing && getEffectiveRole(context, metadata.sharing) === "admin";
       const msg = sanitizeInboundInboxMessage(message, { trusted, callerEmail: context?.user?.email });
       inbox.push(msg);
-      while (inbox.length > INBOX_MAX) inbox.shift();
+      reportInboxEviction(evictInboxOverflow(inbox, INBOX_MAX), sessionId);
       syncInboxToMetadata();
       callbacks.onInboxMessage?.(msg);
       notifyListeners({ type: "inbox-update", sessionId, message: msg });