@cmmd-center/forge 0.10.13 → 0.10.14

package/dist/bin.cjs

@@ -2,18 +2,18 @@
 
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("./chunk-BhaIgcZK.cjs");
-const require_Schema$1 = require("./Schema-Cf_uEUQU.cjs");
-const require_Path = require("./Path-CHDjKLrB.cjs");
-const require_NodeTerminal = require("./NodeTerminal-DfKMT-mE.cjs");
-const require_NodeServices = require("./NodeServices-pfwgkiUu.cjs");
-const require_HttpServer = require("./HttpServer-B-QOc7bR.cjs");
-const require_Config = require("./Config-e5bi-5Ut.cjs");
-const require_Cache = require("./Cache-D56wNKiH.cjs");
-const require_SqlError = require("./SqlError-Du_dEWbw.cjs");
+const require_Schema$1 = require("./Schema-dLi7Qssy.cjs");
+const require_Path = require("./Path-Be7zSwar.cjs");
+const require_NodeTerminal = require("./NodeTerminal-5iWbO0B2.cjs");
+const require_NodeServices = require("./NodeServices-Cw6SxEbl.cjs");
+const require_HttpServer = require("./HttpServer-DGoLR-kU.cjs");
+const require_Config = require("./Config-CkEzdD9L.cjs");
+const require_Cache = require("./Cache-CWlxNDbC.cjs");
+const require_SqlError = require("./SqlError-Bt0Bcd5C.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
 const require_runtimeControlAuthority = require("./runtimeControlAuthority-BdIovv-r.cjs");
-const require_PTY = require("./PTY-DB-DmqyE.cjs");
+const require_PTY = require("./PTY-BxYDiW3h.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
 let node_stream = require("node:stream");
@@ -65775,7 +65775,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.13";
+var version$1 = "0.10.14";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -75409,7 +75409,7 @@ const makeNoSerialization = /* @__PURE__ */ require_Schema$1.fnUntraced(function
 	const services = yield* require_Schema$1.context();
 	const scope = require_Schema$1.get(services, require_Schema$1.Scope);
 	const trackFiber = require_Path.runIn(require_Schema$1.forkUnsafe(scope, "parallel"));
-	const concurrencySemaphore = concurrency === "unbounded" ? void 0 : yield* require_Path.make$4(concurrency);
+	const concurrencySemaphore = concurrency === "unbounded" ? void 0 : yield* require_Path.make$5(concurrency);
 	const clients = /* @__PURE__ */ new Map();
 	let isShutdown = false;
 	const shutdownLatch = require_Path.makeUnsafe$1(false);
@@ -75818,7 +75818,7 @@ const toHttpEffectWebsocket = /* @__PURE__ */ require_Schema$1.fnUntraced(functi
 });
 const makeSocketProtocol = /* @__PURE__ */ require_Schema$1.gen(function* () {
 	const serialization = yield* RpcSerialization;
-	const disconnects = yield* require_Path.make$5();
+	const disconnects = yield* require_Path.make$6();
 	let clientId = 0;
 	const clients = /* @__PURE__ */ new Map();
 	const clientIds = /* @__PURE__ */ new Set();
@@ -83008,7 +83008,7 @@ const makeServerSettings = require_Schema$1.gen(function* () {
 	const { settingsPath } = yield* ServerConfig;
 	const fs = yield* require_Path.FileSystem;
 	const pathService = yield* require_Path.Path;
-	const writeSemaphore = yield* require_Path.make$4(1);
+	const writeSemaphore = yield* require_Path.make$5(1);
 	const cacheKey = "settings";
 	const changesPubSub = yield* require_Path.unbounded$1();
 	const startedRef = yield* require_HttpServer.make$3(false);
@@ -91856,7 +91856,7 @@ const makeKeybindings = require_Schema$1.gen(function* () {
 	const { keybindingsConfigPath } = yield* ServerConfig;
 	const fs = yield* require_Path.FileSystem;
 	const path = yield* require_Path.Path;
-	const upsertSemaphore = yield* require_Path.make$4(1);
+	const upsertSemaphore = yield* require_Path.make$5(1);
 	const resolvedConfigCacheKey = "resolved";
 	const changesPubSub = yield* require_Path.unbounded$1();
 	const startedRef = yield* require_HttpServer.make$3(false);
@@ -97761,7 +97761,7 @@ const make$15 = (hooks) => require_Schema$1.gen(function* () {
 	const selfRuntimeId = resolveRuntimeReplicationRuntimeId(config);
 	const scanScope = yield* require_Schema$1.make$3("sequential");
 	yield* require_Schema$1.addFinalizer(() => require_Schema$1.close(scanScope, require_Schema$1.void_$1));
-	const scanSemaphore = yield* require_Path.make$4(1);
+	const scanSemaphore = yield* require_Path.make$5(1);
 	const inFlight = /* @__PURE__ */ new Map();
 	const ratesCachePath = path.join(config.stateDir, RATES_CACHE_FILE);
 	const scanCachePath = path.join(config.stateDir, SCAN_CACHE_FILE);
@@ -98698,7 +98698,7 @@ const makeWorkspaceBulkTransfer = (options = {}) => require_Schema$1.gen(functio
 	const workspacePaths = yield* WorkspacePaths;
 	const workspaceEntries = yield* WorkspaceEntries;
 	const fault = options.fault ?? (() => require_Schema$1.void_);
-	const transferLocks = yield* require_Schema$1.forEach(Array.from({ length: TRANSFER_LOCK_STRIPE_COUNT }), () => require_Path.make$4(1));
+	const transferLocks = yield* require_Schema$1.forEach(Array.from({ length: TRANSFER_LOCK_STRIPE_COUNT }), () => require_Path.make$5(1));
 	const withTransferLock = (transferId, effect) => transferLocks[transferLockStripe(transferId)].withPermit(effect);
 	const findTransfer = (transferId) => sql`
         SELECT transfer_id AS "transferId", workspace_root AS "workspaceRoot",
@@ -116557,8 +116557,8 @@ require_Schema$1.effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => Promise.resolve().then(() => require("./SqliteClient-D4Srj6O8.cjs")),
-	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-PZ6NN2gq.cjs"))
+	bun: () => Promise.resolve().then(() => require("./SqliteClient-B08FzZM4.cjs")),
+	node: () => Promise.resolve().then(() => require("./NodeSqliteClient-CmxPzcBf.cjs"))
 };
 const makeRuntimeSqliteLayer = require_Schema$1.fn("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -150195,6 +150195,23 @@ function issueCmmdLocalUserProviderEgressCredential(input) {
 	});
 }
 //#endregion
+//#region src/provider/codexAccountTransition.ts
+function explicitProviderAccountTransition(fromAccountId, toAccountId) {
+	if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) return void 0;
+	return {
+		fromAccountId,
+		toAccountId
+	};
+}
+function permitsCodexAccountTransition(input) {
+	const { transition, requestedAccountId, prior, current } = input;
+	if (!transition || transition.fromAccountId === transition.toAccountId || transition.toAccountId !== requestedAccountId || prior.identity.kind !== "provider_account" || current.identity.kind !== "provider_account" || prior.identity.provider !== "codex" || current.identity.provider !== "codex") return false;
+	return providerDeliveryBindingsEqual({
+		...prior,
+		identity: current.identity
+	}, current);
+}
+//#endregion
 //#region src/providerAuth/codexLocalAccountIdentity.ts
 const ACCOUNT_IDENTITY_PATH = "/api/forge/context/providers/codex/account-identity";
 const PROVIDER_ACCOUNT_IDENTITY$1 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
@@ -150692,7 +150709,12 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 				const rawPriorDeliveryBinding = input.resumeCursor.providerDeliveryBinding;
 				const priorDeliveryBinding = readProviderDeliveryBinding(rawPriorDeliveryBinding);
 				if (rawPriorDeliveryBinding !== void 0 && rawPriorDeliveryBinding !== null && !priorDeliveryBinding) throw new Error("Existing Codex history cannot resume because its persisted delivered provider account binding is unreadable.");
-				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding)) throw new Error("Existing Codex history cannot resume because the delivered provider account changed.");
+				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding) && !permitsCodexAccountTransition({
+					transition: input.accountTransition,
+					requestedAccountId: input.providerAccountId,
+					prior: priorDeliveryBinding,
+					current: currentDeliveryBinding
+				})) throw new Error("Existing Codex history cannot resume because the delivered provider account changed.");
 			}
 			const initialResumeCursor = initialCodexResumeCursor({
 				resumeCursor: input.resumeCursor,
@@ -210841,6 +210863,7 @@ const makeCodexAdapter = require_Schema$1.fn("makeCodexAdapter")(function* (opti
 			...browserToolEnvironmentId !== void 0 ? { environmentId: browserToolEnvironmentId } : {}
 		};
 		const managerInput = {
+			...input.accountTransition ? { accountTransition: input.accountTransition } : {},
 			threadId: input.threadId,
 			provider: "codex",
 			...input.cwd !== void 0 ? { cwd: input.cwd } : {},
@@ -211171,7 +211194,7 @@ function withoutInheritedAnthropicCredentials(env, options) {
 //#endregion
 //#region src/provider/makeManagedServerProvider.ts
 const makeManagedServerProvider = require_Schema$1.fn("makeManagedServerProvider")(function* (input) {
-	const refreshSemaphore = yield* require_Path.make$4(1);
+	const refreshSemaphore = yield* require_Path.make$5(1);
 	const changesPubSub = yield* require_Schema$1.acquireRelease(require_Path.unbounded$1(), require_Path.shutdown$1);
 	const initialSettings = yield* input.getSettings;
 	const initialSnapshot = input.initialSnapshot(initialSettings);
@@ -220911,7 +220934,7 @@ function makeCursorAdapter(cursorSettings, options) {
 		const getThreadSemaphore = (threadId) => modifyEffect(threadLocksRef, (current) => {
 			const existing = require_Schema$1.fromNullishOr(current.get(threadId));
 			return require_Schema$1.match$2(existing, {
-				onNone: () => require_Path.make$4(1).pipe(require_Schema$1.map((semaphore) => {
+				onNone: () => require_Path.make$5(1).pipe(require_Schema$1.map((semaphore) => {
 					const next = new Map(current);
 					next.set(threadId, semaphore);
 					return [semaphore, next];
@@ -229321,6 +229344,8 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 	const canonicalEventLogger = options?.canonicalEventLogger ?? (options?.canonicalEventLogPath !== void 0 ? yield* makeEventNdjsonLogger(options.canonicalEventLogPath, { stream: "canonical" }) : void 0);
 	const registry = yield* ProviderAdapterRegistry;
 	const directory = yield* ProviderSessionDirectory;
+	const sessionLocks = yield* require_Path.make$3({ lookup: (_threadId) => require_Path.make$5(1) });
+	const withSessionLock = (threadId, effect) => require_Path.get$1(sessionLocks, threadId).pipe(require_Schema$1.flatMap((lock) => lock.withPermit(effect)), require_Schema$1.scoped);
 	const runtimeEventPubSub = yield* require_Path.unbounded$1();
 	const assertProviderExecutable = options?.assertProviderExecutable ?? (() => require_Schema$1.succeed(null));
 	const assertCurrentProviderDelivery = require_Schema$1.fn("assertCurrentProviderDelivery")(function* (input) {
@@ -229495,18 +229520,19 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 				"provider.runtime_mode": input.runtimeMode
 			});
 			const persistedBinding = require_Schema$1.getOrUndefined$1(yield* directory.getBinding(threadId));
-			yield* assertProviderAccountBoundary({
+			const adapter = yield* registry.getByProvider(effectiveProvider);
+			const priorAccountId = readPersistedProviderAccountId(persistedBinding?.runtimePayload);
+			const requestedAccountId = readProviderAccountIdFromModelSelection(input.modelSelection);
+			if (effectiveProvider !== "codex" || persistedBinding?.provider !== effectiveProvider || (yield* adapter.hasSession(threadId))) yield* assertProviderAccountBoundary({
 				operation: "ProviderService.startSession",
 				threadId,
-				persistedAccountId: readPersistedProviderAccountId(persistedBinding?.runtimePayload),
-				requestedAccountId: readProviderAccountIdFromModelSelection(input.modelSelection)
+				persistedAccountId: priorAccountId,
+				requestedAccountId
 			});
-			const effectiveResumeCursor = input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0);
-			const adapter = yield* registry.getByProvider(effectiveProvider);
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: "ProviderService.startSession",
 				provider: effectiveProvider,
-				resumeCursor: effectiveResumeCursor,
+				resumeCursor: input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0),
 				currentBinding: yield* assertProviderExecutable({
 					threadId,
 					provider: effectiveProvider,
@@ -229515,6 +229541,7 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 			});
 			const session = yield* adapter.startSession({
 				...input,
+				accountTransition: explicitProviderAccountTransition(priorAccountId, requestedAccountId),
 				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {}
 			});
 			if (session.provider !== adapter.provider) return yield* toValidationError("ProviderService.startSession", `Adapter/provider mismatch: requested '${adapter.provider}', received '${session.provider}'.`);
@@ -229816,15 +229843,15 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 	});
 	yield* require_Schema$1.addFinalizer(() => require_Schema$1.catch_(runStopAll(), (cause) => require_Schema$1.logWarning("failed to stop provider service", { cause })));
 	return {
-		startSession,
-		sendTurn,
-		interruptTurn,
-		respondToRequest,
-		respondToUserInput,
-		stopSession,
+		startSession: (threadId, input) => withSessionLock(threadId, startSession(threadId, input)),
+		sendTurn: (input) => withSessionLock(input?.threadId, sendTurn(input)),
+		interruptTurn: (input) => withSessionLock(input?.threadId, interruptTurn(input)),
+		respondToRequest: (input) => withSessionLock(input?.threadId, respondToRequest(input)),
+		respondToUserInput: (input) => withSessionLock(input?.threadId, respondToUserInput(input)),
+		stopSession: (input) => withSessionLock(input?.threadId, stopSession(input)),
 		listSessions,
 		getCapabilities,
-		rollbackConversation,
+		rollbackConversation: (input) => withSessionLock(input?.threadId, rollbackConversation(input)),
 		get streamEvents() {
 			return require_Path.fromPubSub(runtimeEventPubSub);
 		}
@@ -231071,7 +231098,7 @@ const createTrace2Monitor = require_Schema$1.fn("createTrace2Monitor")(function*
 			});
 		}
 	});
-	const readTraceDelta = (yield* require_Path.make$4(1)).withPermit(fs.readFileString(traceFilePath).pipe(require_Schema$1.flatMap((contents) => require_Schema$1.uninterruptible(require_HttpServer.modify(traceTailState, ({ processedChars, remainder }) => {
+	const readTraceDelta = (yield* require_Path.make$5(1)).withPermit(fs.readFileString(traceFilePath).pipe(require_Schema$1.flatMap((contents) => require_Schema$1.uninterruptible(require_HttpServer.modify(traceTailState, ({ processedChars, remainder }) => {
 		if (contents.length <= processedChars) return [[], {
 			processedChars,
 			remainder
@@ -234690,7 +234717,7 @@ const makeTerminalManagerWithOptions = require_Schema$1.fn("makeTerminalManagerW
 	const getThreadSemaphore = (threadId) => modifyEffect(threadLocksRef, (current) => {
 		const existing = require_Schema$1.fromNullishOr(current.get(threadId));
 		return require_Schema$1.match$2(existing, {
-			onNone: () => require_Path.make$4(1).pipe(require_Schema$1.map((semaphore) => {
+			onNone: () => require_Path.make$5(1).pipe(require_Schema$1.map((semaphore) => {
 				const next = new Map(current);
 				next.set(threadId, semaphore);
 				return [semaphore, next];
@@ -285848,7 +285875,7 @@ const make$10 = require_Schema$1.gen(function* () {
 	const runtimeContext = yield* require_Schema$1.context();
 	const runPromise = require_Schema$1.runPromiseWith(runtimeContext);
 	const eventState = makeApprovedWorkerPlanEventState();
-	const reconcileSemaphore = yield* require_Path.make$4(1);
+	const reconcileSemaphore = yield* require_Path.make$5(1);
 	const dispatch = (command) => runPromise(orchestration.dispatch(command).pipe(require_Schema$1.asVoid));
 	const readMasterContext = async (prompt) => {
 		const thread = require_Schema$1.getOrNull(await runPromise(readDurableWorkerDetail(projectionSnapshotQuery, ThreadId.make(prompt.masterThreadId))));
@@ -287244,7 +287271,7 @@ const makeRuntimeDrainReporter = require_Schema$1.gen(function* () {
 	const providerService = yield* ProviderService;
 	const serverConfig = yield* ServerConfig;
 	const spriteTaskHoldReactor = yield* SpriteTaskHoldReactor;
-	const reportSemaphore = yield* require_Path.make$4(1);
+	const reportSemaphore = yield* require_Path.make$5(1);
 	let heartbeatSilent = false;
 	const postHeartbeat = (config, snapshot) => require_Schema$1.promise(async () => {
 		const forgeGitCommit = await resolveForgeGitCommit();
@@ -294041,7 +294068,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "75c8e9532c9e35e71d4da1d8d45474fa2855ff1d";
+	return "fe3ee5efe095539824d092372a8dde00f1e2f98c";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -311106,7 +311133,7 @@ const makePipelineRunCoordinator = require_Schema$1.gen(function* () {
 			preparation: preparedHandoff.providerAuthorityPreparation
 		});
 		const acceptingHeartbeatRef = yield* require_HttpServer.make$3(true);
-		const heartbeatPublicationSemaphore = yield* require_Path.make$4(1);
+		const heartbeatPublicationSemaphore = yield* require_Path.make$5(1);
 		if ((yield* store.getByRunId(input.runId)) !== null) return yield* coordinatorError("registerHandoff", "PIPELINE_HANDOFF_ALREADY_BOUND", "The CMMD run already has a Forge task thread and must use the authority rebind contract.");
 		const snapshot = preparedHandoff.snapshot;
 		const readModel = yield* orchestration.getReadModel();
@@ -314992,7 +315019,7 @@ function makeProjectLeadSchedulerLive(options = {}) {
 	return require_Schema$1.effect(ProjectLeadScheduler, require_Schema$1.gen(function* () {
 		const client = yield* ProjectLeadControllerClient;
 		const dispatcher = yield* ProjectLeadReservationDispatcher;
-		const semaphore = yield* require_Path.make$4(1);
+		const semaphore = yield* require_Path.make$5(1);
 		const leaseSeconds = options.leaseSeconds ?? DEFAULT_LEASE_SECONDS;
 		const batchSize = options.batchSize ?? DEFAULT_BATCH_SIZE;
 		const projectLimit = options.projectLimit ?? DEFAULT_PROJECT_LIMIT;
@@ -317011,13 +317038,13 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", require_
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-B4Ra6mph.cjs")))).layer;
-	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-wATyTf3M.cjs")))).layer;
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunPTY-86ttlTi6.cjs")))).layer;
+	else return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodePTY-Cps0jsDA.cjs")))).layer;
 }));
 const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-CjwNydcy.cjs")))).layer(bunHttpServerOptions(config));
-	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-Cy1XvkSE.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
+	if (typeof Bun !== "undefined") return (yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunHttpServer-BhE7Szci.cjs")))).layer(bunHttpServerOptions(config));
+	const [NodeHttpServer, NodeHttp] = yield* require_Schema$1.all([require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeHttpServer-BPjxt_DT.cjs"))), require_Schema$1.promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -317025,10 +317052,10 @@ const HttpServerLive = require_Schema$1.unwrap(require_Schema$1.gen(function* ()
 }));
 const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-CUeOgVUt.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./BunServices-BwE9KexF.cjs")));
 		return layer;
 	} else {
-		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-BqfcuvmN.cjs")));
+		const { layer } = yield* require_Schema$1.promise(() => Promise.resolve().then(() => require("./NodeServices-Ddr-tYRu.cjs")));
 		return layer;
 	}
 }));