@cmmd-center/forge 0.10.14 → 0.11.0

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -16520,7 +16520,7 @@ function makeNetServiceShape(createServer = Net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.10.6";
+const FORGE_RELEASE_VERSION = "0.11.0";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -50107,7 +50107,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -52550,7 +52550,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -52572,7 +52572,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -65495,7 +65495,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.14";
+var version$1 = "0.11.0";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -65968,7 +65968,7 @@ function readCmmdAvatarUrl(raw) {
 function readTrimmedString$2(value) {
 	return typeof value === "string" ? value.trim() || null : null;
 }
-function asRecord$13(value) {
+function asRecord$14(value) {
 	return value && typeof value === "object" ? value : null;
 }
 function readDirectPlanLabelFromRecord(obj) {
@@ -65980,26 +65980,26 @@ function readNestedPlanLabelFromRecord(obj) {
 function readCmmdPlanLabel(obj) {
 	const direct = readDirectPlanLabelFromRecord(obj);
 	if (direct) return direct;
-	const plan = asRecord$13(obj["plan"]);
+	const plan = asRecord$14(obj["plan"]);
 	if (plan) {
 		const label = readNestedPlanLabelFromRecord(plan);
 		if (label) return label;
 	}
-	const subscription = asRecord$13(obj["subscription"]);
+	const subscription = asRecord$14(obj["subscription"]);
 	if (subscription) {
 		const label = readNestedPlanLabelFromRecord(subscription);
 		if (label) return label;
-		const subscriptionPlan = asRecord$13(subscription["plan"]);
+		const subscriptionPlan = asRecord$14(subscription["plan"]);
 		if (subscriptionPlan) {
 			const nestedLabel = readNestedPlanLabelFromRecord(subscriptionPlan);
 			if (nestedLabel) return nestedLabel;
 		}
 	}
-	const billing = asRecord$13(obj["billing"]);
+	const billing = asRecord$14(obj["billing"]);
 	if (billing) {
 		const label = readNestedPlanLabelFromRecord(billing);
 		if (label) return label;
-		const billingPlan = asRecord$13(billing["plan"]);
+		const billingPlan = asRecord$14(billing["plan"]);
 		if (billingPlan) return readNestedPlanLabelFromRecord(billingPlan);
 	}
 	return null;
@@ -69794,22 +69794,22 @@ const EMPTY_PARSED_ERROR = {
 	message: null,
 	raw: null
 };
-function asRecord$12(value) {
+function asRecord$13(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function readTrimmedString$1(value) {
 	return (typeof value === "string" ? value.trim() : "") || null;
 }
 function readErrorEnvelope(record) {
-	return asRecord$12(record["error"]);
+	return asRecord$13(record["error"]);
 }
 function readUpstreamErrorCode(body) {
-	const record = asRecord$12(body);
+	const record = asRecord$13(body);
 	if (record === null) return null;
 	return readTrimmedString$1(record["code"]) ?? readTrimmedString$1(readErrorEnvelope(record)?.["code"]);
 }
 function readErrorMessage$2(raw) {
-	const record = asRecord$12(raw);
+	const record = asRecord$13(raw);
 	if (record === null) return null;
 	const error = record["error"];
 	const nestedMessage = readErrorEnvelope(record)?.["message"];
@@ -71891,7 +71891,7 @@ function readStringJS(length) {
 	if (units.length > 0) result += fromCharCode.apply(String, units);
 	return result;
 }
-function readString$4(source, start, length) {
+function readString$5(source, start, length) {
 	let existingSrc = src;
 	src = source;
 	position$1 = start;
@@ -73756,7 +73756,7 @@ function readStruct(src, position, srcEnd, unpackr) {
 						}
 						if (end == null) end = source.bytesEnd - refStart;
 						if (source.srcString) return source.srcString.slice(ref, end);
-						return readString$4(src, ref + refStart, end - ref);
+						return readString$5(src, ref + refStart, end - ref);
 					};
 					break;
 				case UTF8:
@@ -74232,7 +74232,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -74240,8 +74240,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -77105,7 +77105,7 @@ succeed$2(TraceDiagnostics, TraceDiagnostics.of({ read: (options) => succeed(mak
 * through the server is what lets it ask at all.
 */
 const RUNTIMES_PATH = "/api/forge/context/runtimes";
-function asRecord$11(value) {
+function asRecord$12(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 /** A trimmed string, or null. Empty and whitespace are the same as absent. */
@@ -77120,7 +77120,7 @@ function text$1(value) {
 * something that cannot work.
 */
 function toSummary(value) {
-	const row = asRecord$11(value);
+	const row = asRecord$12(value);
 	if (!row) return null;
 	const runtimeId = text$1(row["runtimeId"]);
 	const organizationId = row["organizationId"];
@@ -77144,7 +77144,7 @@ function listCloudRuntimes(input) {
 	return gen(function* () {
 		const jwt = input.jwt;
 		if (jwt === null || jwt.trim().length === 0) return yield* fail(new CloudRuntimeListError({ failure: "not_signed_in" }));
-		const runtimes = asRecord$11(asRecord$11(yield* tryPromise({
+		const runtimes = asRecord$12(asRecord$12(yield* tryPromise({
 			try: () => input.request({
 				method: "GET",
 				jwt,
@@ -91971,7 +91971,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -92650,7 +92650,7 @@ var AnalyticsService = class AnalyticsService extends Service$1()("forge/telemet
 var RuntimeReplication = class extends Service$1()("forge/runtimeReplication/Services/RuntimeReplication") {};
 //#endregion
 //#region src/runtimeDrain/forgeGitCommit.ts
-const execFileAsync$6 = promisify$1(execFile);
+const execFileAsync$7 = promisify$1(execFile);
 const FORGE_GIT_COMMIT_PATTERN = /^[0-9a-f]{7,40}$/i;
 /**
 * Resolve the commit this forge checkout actually booted from, so the
@@ -92674,7 +92674,7 @@ const FORGE_GIT_COMMIT_PATTERN = /^[0-9a-f]{7,40}$/i;
 * it yet.
 */
 let cached$1 = null;
-async function resolveForgeGitCommit(execImpl = (command, args) => execFileAsync$6(command, [...args], { timeout: 5e3 })) {
+async function resolveForgeGitCommit(execImpl = (command, args) => execFileAsync$7(command, [...args], { timeout: 5e3 })) {
 	if (cached$1 !== null) return cached$1;
 	try {
 		const { stdout } = await execImpl("git", ["rev-parse", "HEAD"]);
@@ -94606,7 +94606,7 @@ function mightCarryUsage(line, provider) {
 * a line at a time, so the usual cause is a tail the scan opened mid-write,
 * and a count that keeps growing is a file the scan can no longer read.
 */
-function parseJsonObject$1(line, diagnostics) {
+function parseJsonObject$2(line, diagnostics) {
 	let parsed;
 	try {
 		parsed = JSON.parse(line);
@@ -94636,7 +94636,7 @@ function claudeDedupeKey(messageId, requestId) {
 	return `${messageId ?? ""}:${requestId ?? ""}`;
 }
 function parseClaudeLine(line, diagnostics) {
-	const record = parseJsonObject$1(line, diagnostics);
+	const record = parseJsonObject$2(line, diagnostics);
 	if (record === null) return null;
 	if (record["type"] !== "assistant") return null;
 	const messageRecord = objectAt(record, "message");
@@ -94783,7 +94783,7 @@ function parseCodexTokenCount(record, payloadRecord, state) {
 	};
 }
 function parseCodexLine(line, state, diagnostics) {
-	const record = parseJsonObject$1(line, diagnostics);
+	const record = parseJsonObject$2(line, diagnostics);
 	if (record === null) return null;
 	const payloadRecord = objectAt(record, "payload");
 	if (payloadRecord === null) return null;
@@ -99160,7 +99160,7 @@ function buildDiscoveryResult(probes) {
 }
 //#endregion
 //#region src/sourceControl/probe.ts
-const execFileAsync$5 = promisify$1(execFile);
+const execFileAsync$6 = promisify$1(execFile);
 /**
 * How long a machine's toolchain answer stays good for.
 *
@@ -99171,7 +99171,7 @@ const execFileAsync$5 = promisify$1(execFile);
 */
 const DISCOVERY_TTL = "5 minutes";
 /** Probes time out because `gh auth status` reaches the network on a cold keyring. */
-const PROBE_TIMEOUT_MS = 5e3;
+const PROBE_TIMEOUT_MS$1 = 5e3;
 /**
 * Runs one probe. A tool that is absent, fails, or hangs is reported the same
 * way — `null`, meaning "no answer" — because the discovery result only
@@ -99183,7 +99183,7 @@ const PROBE_TIMEOUT_MS = 5e3;
 */
 const probe = (command, args) => promise(async () => {
 	try {
-		const { stdout, stderr } = await execFileAsync$5(command, [...args], { timeout: PROBE_TIMEOUT_MS });
+		const { stdout, stderr } = await execFileAsync$6(command, [...args], { timeout: PROBE_TIMEOUT_MS$1 });
 		const output = `${stdout}\n${stderr}`.trim();
 		return { output: output.length === 0 ? null : output };
 	} catch (cause) {
@@ -100501,7 +100501,7 @@ const EMPTY_PLAN_VALUES = new Set([
 	"none",
 	"null"
 ]);
-function asRecord$10(value) {
+function asRecord$11(value) {
 	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
 	return value;
 }
@@ -100518,7 +100518,7 @@ function decodeJwtClaims(token) {
 	try {
 		const decoded = Buffer.from(payload, "base64url");
 		if (decoded.byteLength > MAX_CLAIMS_BYTES) return void 0;
-		return asRecord$10(JSON.parse(decoded.toString("utf8")));
+		return asRecord$11(JSON.parse(decoded.toString("utf8")));
 	} catch {
 		return;
 	}
@@ -100540,7 +100540,7 @@ function findPlanType(claims) {
 	const direct = fromRecord(claims);
 	if (direct) return direct;
 	for (const value of Object.values(claims)) {
-		const nested = asRecord$10(value);
+		const nested = asRecord$11(value);
 		if (!nested) continue;
 		const found = fromRecord(nested);
 		if (found) return found;
@@ -100557,7 +100557,7 @@ function readCodexAuthIdentity(authJson) {
 	} catch {
 		return {};
 	}
-	const claims = decodeJwtClaims(asRecord$10(asRecord$10(parsed)?.tokens)?.id_token);
+	const claims = decodeJwtClaims(asRecord$11(asRecord$11(parsed)?.tokens)?.id_token);
 	if (!claims) return {};
 	const email = findEmail(claims);
 	const planType = findPlanType(claims);
@@ -100720,6 +100720,7 @@ const CLAUDE_IDENTITY_KEYS = new Set([
 	"provider",
 	"credentialGenerationId"
 ]);
+const CLAUDE_IDENTITY_OPTIONAL_KEYS = new Set(["providerAccountIdentity"]);
 function isRecord$13(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -100744,6 +100745,10 @@ function daysInMonth$1(year, month) {
 function hasExactKeys$2(value, keys) {
 	return Object.keys(value).every((key) => keys.has(key)) && Object.keys(value).length === keys.size;
 }
+function hasAllowedKeys(value, required, optional) {
+	const keys = Object.keys(value);
+	return keys.every((key) => required.has(key) || optional.has(key)) && [...required].every((key) => keys.includes(key));
+}
 function parseDeliveryIdentity(value, provider) {
 	if (!isRecord$13(value)) return null;
 	if (provider === "openai") return parseCodexDeliveryIdentity(value);
@@ -100758,12 +100763,25 @@ function parseCodexDeliveryIdentity(value) {
 		providerAccountIdentity: value.providerAccountIdentity
 	};
 }
+/**
+* Absent means the writer does not name the Provider Account yet, and the
+* identity keeps the shape it has always had. Present but malformed means the
+* identity is not the one CMMD signed, so it is refused the same way a
+* malformed Codex account identity is.
+*/
+function claudeAccountFields(value) {
+	if (value === void 0) return {};
+	if (typeof value !== "string" || !PROVIDER_ACCOUNT_IDENTITY$2.test(value)) return null;
+	return { providerAccountIdentity: value };
+}
 function parseClaudeDeliveryIdentity(value) {
-	if (!hasExactKeys$2(value, CLAUDE_IDENTITY_KEYS) || value.kind !== "credential_generation" || value.provider !== "claude" || typeof value.credentialGenerationId !== "string" || !UUID.test(value.credentialGenerationId)) return null;
+	const account = claudeAccountFields(value.providerAccountIdentity);
+	if (!account || !hasAllowedKeys(value, CLAUDE_IDENTITY_KEYS, CLAUDE_IDENTITY_OPTIONAL_KEYS) || value.kind !== "credential_generation" || value.provider !== "claude" || typeof value.credentialGenerationId !== "string" || !UUID.test(value.credentialGenerationId)) return null;
 	return {
 		kind: "credential_generation",
 		provider: "claude",
-		credentialGenerationId: value.credentialGenerationId
+		credentialGenerationId: value.credentialGenerationId,
+		...account
 	};
 }
 function parseProviderRuntimeDeliveryReceipt(value, expected) {
@@ -100802,10 +100820,49 @@ function readProviderDeliveryBinding(value) {
 		identity
 	};
 }
+/** The Provider Account a delivery identity names, or null when it names none. */
+function providerDeliveryAccount(identity) {
+	return identity.kind === "provider_account" ? identity.providerAccountIdentity : identity.providerAccountIdentity ?? null;
+}
+function sameDeliveredCredential(left, right) {
+	if (left.kind === "provider_account" && right.kind === "provider_account") return left.providerAccountIdentity === right.providerAccountIdentity;
+	return left.kind === "credential_generation" && right.kind === "credential_generation" && left.credentialGenerationId === right.credentialGenerationId;
+}
+/**
+* Names how one thread's delivery binding moved, which is the question the
+* delivery layer could not answer while Claude's identity carried no account.
+*
+* `account_switch` needs both sides to name an account, the accounts to differ,
+* the delivered credential to change with them, and the runtime, machine and
+* epoch to hold. A switch changes the account and the generation together, so
+* two accounts on one generation would be two accounts sharing a credential,
+* and a switch that also moved the epoch changed more than the identity. Both
+* are `unknown`.
+*
+* The same delivered credential is `unchanged` whether or not either side names
+* an account, so a binding recorded before CMMD named the account still resumes
+* against the credential it ran on. A changed credential where either side
+* names no account is `unknown` rather than guessed at, which keeps an
+* account-less binding compared on exactly the fields it was compared on before.
+*
+* `providerDeliveryBindingsEqual` asks only whether the answer is `unchanged`.
+* `permitsProviderAccountTransition` in `provider/providerAccountTransition.ts`
+* asks whether it is `account_switch`, and is the Codex resume gate's rule
+* today. #3055 wires the Claude resume gate onto it.
+*/
+function classifyProviderDeliveryBindingChange(prior, current) {
+	if (prior.runtimeId !== current.runtimeId || prior.machineId !== current.machineId || prior.identity.kind !== current.identity.kind || prior.identity.provider !== current.identity.provider) return "unknown";
+	const sameEpoch = prior.credentialEpoch === current.credentialEpoch;
+	const sameCredential = sameDeliveredCredential(prior.identity, current.identity);
+	const priorAccount = providerDeliveryAccount(prior.identity);
+	const currentAccount = providerDeliveryAccount(current.identity);
+	if (priorAccount !== null && currentAccount !== null && priorAccount !== currentAccount) return sameEpoch && !sameCredential ? "account_switch" : "unknown";
+	if (sameEpoch && sameCredential) return "unchanged";
+	if (priorAccount === null || currentAccount === null) return "unknown";
+	return "credential_refresh";
+}
 function providerDeliveryBindingsEqual(left, right) {
-	if (left.runtimeId !== right.runtimeId || left.machineId !== right.machineId || left.credentialEpoch !== right.credentialEpoch || left.identity.kind !== right.identity.kind || left.identity.provider !== right.identity.provider) return false;
-	if (left.identity.kind === "provider_account" && right.identity.kind === "provider_account") return left.identity.providerAccountIdentity === right.identity.providerAccountIdentity;
-	return left.identity.kind === "credential_generation" && right.identity.kind === "credential_generation" && left.identity.credentialGenerationId === right.identity.credentialGenerationId;
+	return classifyProviderDeliveryBindingChange(left, right) === "unchanged";
 }
 //#endregion
 //#region src/provider/claudeReadinessReason.ts
@@ -101084,8 +101141,128 @@ const runClaudeLogout = (runtime) => new Promise((resolve, reject) => {
 	});
 });
 //#endregion
+//#region src/usage/providerRateLimits.ts
+/**
+* `new Date(ms).toISOString()` throws past +-8.64e15 ms, so a `resetsAt` past
+* the same bound in seconds is refused rather than allowed to throw inside a
+* decoder whose whole job is to fail closed.
+*/
+const MAX_RESETS_AT_SECONDS = 864e10;
+/**
+* One reset time in unix seconds as an ISO string, or null.
+*
+* Both mappers read reset times through this, so a malformed `resetsAt`
+* yields the null that means "this observation said nothing" instead of a
+* RangeError thrown out of a decoder the ingestion layer runs on every Claude
+* rate-limit event.
+*/
+function resetsAtIso(resetsAt) {
+	if (!Number.isFinite(resetsAt) || resetsAt <= 0 || resetsAt > MAX_RESETS_AT_SECONDS) return null;
+	return (/* @__PURE__ */ new Date(resetsAt * 1e3)).toISOString();
+}
+/**
+* The SDK only ever reports ONE window per event. Only `five_hour` and
+* `seven_day` map to the two windows the Usage page shows; the
+* per-model/overage variants (seven_day_opus, overage, ...) are ignored here
+* on purpose rather than silently overwriting the plain 7-day figure.
+*/
+function mapClaudeRateLimitInfo(info) {
+	if (typeof info.utilization !== "number" || typeof info.resetsAt !== "number" || !info.status) return null;
+	const kind = info.rateLimitType === "five_hour" ? "fiveHour" : info.rateLimitType === "seven_day" ? "sevenDay" : null;
+	if (!kind) return null;
+	const resetsAt = resetsAtIso(info.resetsAt);
+	if (resetsAt === null) return null;
+	return {
+		kind,
+		window: {
+			usedPercent: Math.round(info.utilization * 100),
+			resetsAt,
+			status: info.status
+		}
+	};
+}
+/**
+* The one place a used-percent becomes a status. `unifiedWindows` carries no
+* per-window status of its own, and the `/usage` parser derives one the same
+* way, so both Claude usage sources agree on where "warning" starts.
+*/
+function usageStatus(usedPercent) {
+	if (usedPercent >= 100) return "rejected";
+	return usedPercent >= 80 ? "allowed_warning" : "allowed";
+}
+/**
+* One untyped `utilization` as a whole percent, or nothing. The [0, 100] bound
+* matches `claudeUsageCli.ts`'s own bound on the `/usage` text, which in turn
+* matches CMMD's parser.
+*/
+function readUsedPercent(utilization) {
+	if (typeof utilization !== "number" || !Number.isFinite(utilization)) return null;
+	const usedPercent = Math.round(utilization * 100);
+	return usedPercent < 0 || usedPercent > 100 ? null : usedPercent;
+}
+/**
+* Reads one `unifiedWindows` entry, or nothing. Every field is checked because
+* none of them are typed: a non-object entry, a utilization that is not a
+* finite number in [0, 1], or a reset time that is not a positive finite
+* number of seconds all mean "this observation said nothing about this
+* window".
+*/
+function readUnifiedWindow(raw) {
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const { utilization, resetsAt } = raw;
+	const usedPercent = readUsedPercent(utilization);
+	if (usedPercent === null) return null;
+	if (typeof resetsAt !== "number") return null;
+	const resetsAtIsoValue = resetsAtIso(resetsAt);
+	if (resetsAtIsoValue === null) return null;
+	return {
+		usedPercent,
+		resetsAt: resetsAtIsoValue,
+		status: usageStatus(usedPercent)
+	};
+}
+/**
+* Reads the `unifiedWindows` sub-object of `rate_limit_info` into the two
+* rolling windows. The SDK rebuilds that sub-object on every turn from the
+* `anthropic-ratelimit-unified-{5h,7d}-utilization` and `-reset` response
+* headers.
+*
+* The top-level `rateLimitType` names one window per event and carries a
+* utilization only for `five_hour` or `seven_day`. This sub-object reports
+* every window it knows on every observation, which makes it the only
+* SDK-side source that can feed the Usage card without waking a Sprite and
+* delivering a credential.
+*
+* Its `seven_day_overage_included` window is skipped. `/usage` names each model
+* row after the display name Anthropic's usage API gives that model, one row
+* per allowlisted model, and the `7d_oi` header behind this window is one
+* aggregate that carries no name. Any name given to it here would be a guess
+* that could disagree with the rows the probe writes, so model rows come from
+* the probe alone.
+*
+* It is also undocumented internal surface stripped from the SDK's exported
+* types, so this decoder fails closed everywhere. It returns null when the
+* sub-object is absent or is not a plain object, and null when neither window
+* in it survives validation. A window that fails validation is reported as
+* null, and an unrecognized key is skipped, never fatal. A caller that gets
+* null has learned nothing and must not publish, because a partial write could
+* overwrite a good `/usage` reading with a guess.
+*/
+function mapClaudeUnifiedWindows(info) {
+	const raw = info.unifiedWindows;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return null;
+	const windows = raw;
+	const fiveHour = readUnifiedWindow(windows.five_hour);
+	const sevenDay = readUnifiedWindow(windows.seven_day);
+	if (!fiveHour && !sevenDay) return null;
+	return {
+		fiveHour,
+		sevenDay
+	};
+}
+//#endregion
 //#region src/usage/claudeUsageCli.ts
-const execFileAsync$4 = promisify$1(execFile);
+const execFileAsync$5 = promisify$1(execFile);
 const USAGE_ARGS = [
 	"--safe-mode",
 	"--no-session-persistence",
@@ -101109,7 +101286,7 @@ const MONTH_BY_NAME = {
 	Dec: 11
 };
 async function runClaudeUsageCommand(binaryPath, args, claudeConfigDir) {
-	const { stdout } = await execFileAsync$4(binaryPath, [...args], {
+	const { stdout } = await execFileAsync$5(binaryPath, [...args], {
 		env: {
 			...process.env,
 			TZ: "UTC",
@@ -101184,10 +101361,6 @@ function parseResetAt(value, now) {
 	});
 	return resetAt === null || Number.isNaN(resetAt.getTime()) ? null : resetAt.toISOString();
 }
-function usageStatus(usedPercent) {
-	if (usedPercent >= 100) return "rejected";
-	return usedPercent >= 80 ? "allowed_warning" : "allowed";
-}
 function parseUsageLine(output, label, now) {
 	const escapedLabel = label.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 	const match = new RegExp(`^${escapedLabel}: (\\d+(?:\\.\\d+)?)% used(?: · resets (.+))?$`, "m").exec(output);
@@ -101256,6 +101429,29 @@ async function fetchClaudeUsageViaOfficialClient(input) {
 	};
 }
 //#endregion
+//#region src/usage/claudeUsageTelemetryRequest.ts
+/** The owner-session route for a Claude usage reading. */
+const CLAUDE_USAGE_TELEMETRY_PATH = "/api/forge/context/providers/usage/claude/telemetry";
+/**
+* Builds the body for either lane.
+*
+* `modelWindows` is sent only when the reading carries it. CMMD keeps the
+* stored model rows when the key is absent, so a reading that cannot name
+* model rows the way `/usage` does leaves the key out.
+*/
+function claudeUsageTelemetryBody(input) {
+	return {
+		providerAccountId: input.attribution.providerAccountId,
+		credentialGenerationId: input.attribution.credentialGenerationId,
+		...input.account,
+		source: input.source,
+		fiveHour: input.windows.fiveHour,
+		sevenDay: input.windows.sevenDay,
+		...input.windows.modelWindows !== void 0 ? { modelWindows: input.windows.modelWindows } : {},
+		observedAt: input.observedAt
+	};
+}
+//#endregion
 //#region src/cmmd/syncClaudeCredential.ts
 /**
 * Card 1359 (harvest path A, Claude) — publish a personal Claude subscription
@@ -101271,7 +101467,6 @@ async function fetchClaudeUsageViaOfficialClient(input) {
 const USER_CLAUDE_CREDENTIAL_PATH = "/api/forge/context/providers/claude/credential";
 const USER_CLAUDE_LINKED_ACCOUNT_PATH = "/api/forge/context/providers/claude/accounts";
 const AUTH_RUNTIME_CLAUDE_CREDENTIAL_PATH = "/api/forge/context/auth-runtime-claude-credential";
-const USER_CLAUDE_USAGE_PATH = "/api/forge/context/providers/usage/claude/telemetry";
 const AUTH_RUNTIME_CLAUDE_USAGE_PATH = "/api/forge/context/auth-runtime-claude-credential/usage";
 /** Path to the local Claude credentials.json, mirroring Claude Code's resolution. */
 function resolveLocalClaudeCredentialPath(homePath) {
@@ -101300,7 +101495,7 @@ function resolveLocalClaudeCredentialPath(homePath) {
 * it reaches — this is the first gate and the only one near the user, who is
 * standing in front of the sign-in and can simply try again.
 *
-* The floor is ONE token, not both, and that distinction is load-bearing: an
+* The floor is ONE token, not both, because an
 * expired or blank access token beside a live refresh token is the normal
 * resting state of a rotating login, which Claude Code refreshes silently on
 * use. Demanding both would reject a perfectly recoverable credential and break
@@ -101378,10 +101573,10 @@ function extractClaudeAccountMetadata(credentialJson) {
 		return {};
 	}
 }
-const execFileAsync$3 = promisify$1(execFile);
+const execFileAsync$4 = promisify$1(execFile);
 async function loadClaudeAccountMetadataFromCli(homePath) {
 	try {
-		const { stdout } = await execFileAsync$3(resolveClaudeBinaryPath("claude"), ["auth", "status"], {
+		const { stdout } = await execFileAsync$4(resolveClaudeBinaryPath("claude"), ["auth", "status"], {
 			timeout: 2e4,
 			maxBuffer: 1024 * 1024,
 			env: {
@@ -101477,18 +101672,20 @@ async function publishClaudeUsageAfterSync(input) {
 			binaryPath: resolveClaudeBinaryPath("claude"),
 			...input.homePath ? { claudeConfigDir: input.homePath } : {}
 		});
-		await publishUsageBody(input.auth.jwt, input.auth.path === AUTH_RUNTIME_CLAUDE_CREDENTIAL_PATH ? AUTH_RUNTIME_CLAUDE_USAGE_PATH : USER_CLAUDE_USAGE_PATH, {
-			providerAccountId: input.providerAccountId,
-			credentialGenerationId: input.credentialGenerationId,
-			accountEmail: input.accountEmail,
-			accountDisplayName: input.accountDisplayName,
-			planType: input.planType,
+		await publishUsageBody(input.auth.jwt, input.auth.path === AUTH_RUNTIME_CLAUDE_CREDENTIAL_PATH ? AUTH_RUNTIME_CLAUDE_USAGE_PATH : CLAUDE_USAGE_TELEMETRY_PATH, claudeUsageTelemetryBody({
+			attribution: {
+				providerAccountId: input.providerAccountId,
+				credentialGenerationId: input.credentialGenerationId
+			},
+			account: {
+				accountEmail: input.accountEmail,
+				accountDisplayName: input.accountDisplayName,
+				planType: input.planType
+			},
 			source: "active_poll",
-			fiveHour: usage.fiveHour,
-			sevenDay: usage.sevenDay,
-			modelWindows: usage.modelWindows,
+			windows: usage,
 			observedAt: (/* @__PURE__ */ new Date()).toISOString()
-		});
+		}));
 		return null;
 	} catch (cause) {
 		return { cause };
@@ -149004,11 +149201,11 @@ function readObject(value) {
 function readArray(value) {
 	return Array.isArray(value) ? value : void 0;
 }
-function readString$3(value) {
+function readString$4(value) {
 	return typeof value === "string" ? value : void 0;
 }
 function nonEmptyTrimmed$1(value) {
-	const candidate = readString$3(value)?.trim();
+	const candidate = readString$4(value)?.trim();
 	return candidate ? candidate : void 0;
 }
 function readBoolean$2(value) {
@@ -149790,7 +149987,7 @@ function issueCmmdLocalUserProviderEgressCredential(input) {
 	});
 }
 //#endregion
-//#region src/provider/codexAccountTransition.ts
+//#region src/provider/providerAccountTransition.ts
 function explicitProviderAccountTransition(fromAccountId, toAccountId) {
 	if (!fromAccountId || !toAccountId || fromAccountId === toAccountId) return void 0;
 	return {
@@ -149798,13 +149995,20 @@ function explicitProviderAccountTransition(fromAccountId, toAccountId) {
 		toAccountId
 	};
 }
-function permitsCodexAccountTransition(input) {
+/**
+* Whether a thread may move from `prior` to `current` because the person asked
+* for another Provider Account. The credential broker authorizes the selected
+* account, so only the identity may change, which is what `account_switch`
+* means.
+*
+* Nothing in the rule is specific to a provider, but the Codex resume gate in
+* `codexAppServerManager.ts` is its only caller. The Claude half is parked
+* until #3055 wires the Claude resume gate onto it.
+*/
+function permitsProviderAccountTransition(input) {
 	const { transition, requestedAccountId, prior, current } = input;
-	if (!transition || transition.fromAccountId === transition.toAccountId || transition.toAccountId !== requestedAccountId || prior.identity.kind !== "provider_account" || current.identity.kind !== "provider_account" || prior.identity.provider !== "codex" || current.identity.provider !== "codex") return false;
-	return providerDeliveryBindingsEqual({
-		...prior,
-		identity: current.identity
-	}, current);
+	if (!transition || transition.fromAccountId === transition.toAccountId || transition.toAccountId !== requestedAccountId) return false;
+	return classifyProviderDeliveryBindingChange(prior, current) === "account_switch";
 }
 //#endregion
 //#region src/providerAuth/codexLocalAccountIdentity.ts
@@ -150304,7 +150508,7 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 				const rawPriorDeliveryBinding = input.resumeCursor.providerDeliveryBinding;
 				const priorDeliveryBinding = readProviderDeliveryBinding(rawPriorDeliveryBinding);
 				if (rawPriorDeliveryBinding !== void 0 && rawPriorDeliveryBinding !== null && !priorDeliveryBinding) throw new Error("Existing Codex history cannot resume because its persisted delivered provider account binding is unreadable.");
-				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding) && !permitsCodexAccountTransition({
+				if (priorDeliveryBinding && !providerDeliveryBindingsEqual(priorDeliveryBinding, currentDeliveryBinding) && !permitsProviderAccountTransition({
 					transition: input.accountTransition,
 					requestedAccountId: input.providerAccountId,
 					prior: priorDeliveryBinding,
@@ -189006,7 +189210,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -199206,12 +199410,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -199226,7 +199430,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -199237,14 +199441,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -199259,7 +199463,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -199274,13 +199478,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -206523,7 +206727,7 @@ function createCodexBrowserDynamicTools() {
 function readArgs$3(value) {
 	return value && typeof value === "object" ? value : {};
 }
-function readString$2(args, key) {
+function readString$3(args, key) {
 	const value = args[key];
 	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
@@ -206552,27 +206756,27 @@ function createCodexBrowserDynamicToolHandler(browserManager, options = {}) {
 		const toolScope = options.environmentId === void 0 ? {} : { environmentId: options.environmentId };
 		const handlers = makeBrowserHandlers(browserManager, ThreadId.make(input.threadId), toolScope);
 		const args = readArgs$3(input.arguments);
-		const tabId = readString$2(args, "tabId");
+		const tabId = readString$3(args, "tabId");
 		switch (input.tool) {
 			case "forge_browser_list_sessions": return toCodexDynamicToolResult$2(await handlers.listSessions());
 			case "forge_browser_name_session": {
-				const name = readString$2(args, "name");
+				const name = readString$3(args, "name");
 				if (!name) throw new Error("forge_browser_name_session requires a name.");
 				return toCodexDynamicToolResult$2(await handlers.nameSession(name));
 			}
 			case "forge_browser_set_visibility": {
-				const visibility = readString$2(args, "visibility");
+				const visibility = readString$3(args, "visibility");
 				if (visibility !== "hidden" && visibility !== "visible") throw new Error("forge_browser_set_visibility requires visibility hidden or visible.");
 				return toCodexDynamicToolResult$2(await handlers.setVisibility(visibility));
 			}
 			case "forge_browser_close_session":
 			case "forge_browser_reset_session": return toCodexDynamicToolResult$2(await handlers.closeSession());
 			case "forge_browser_navigate": {
-				const url = readString$2(args, "url");
+				const url = readString$3(args, "url");
 				if (!url) throw new Error("forge_browser_navigate requires a URL.");
 				return toCodexDynamicToolResult$2(await handlers.navigate(url, tabId));
 			}
-			case "forge_browser_new_tab": return toCodexDynamicToolResult$2(await handlers.newTab(readString$2(args, "url")));
+			case "forge_browser_new_tab": return toCodexDynamicToolResult$2(await handlers.newTab(readString$3(args, "url")));
 			case "forge_browser_close_tab":
 				if (!tabId) throw new Error("forge_browser_close_tab requires a tabId.");
 				return toCodexDynamicToolResult$2(await handlers.closeTab(tabId));
@@ -206583,33 +206787,33 @@ function createCodexBrowserDynamicToolHandler(browserManager, options = {}) {
 			case "forge_browser_go_forward": return toCodexDynamicToolResult$2(await handlers.goForward(tabId));
 			case "forge_browser_reload": return toCodexDynamicToolResult$2(await handlers.reload(tabId));
 			case "forge_browser_click": {
-				const selector = readString$2(args, "selector");
+				const selector = readString$3(args, "selector");
 				if (!selector) throw new Error("forge_browser_click requires a selector.");
 				return toCodexDynamicToolResult$2(await handlers.click(selector, tabId));
 			}
 			case "forge_browser_click_point": {
 				const x = readNumber$2(args, "x");
 				const y = readNumber$2(args, "y");
-				const button = readString$2(args, "button");
+				const button = readString$3(args, "button");
 				const clickCount = readNumber$2(args, "clickCount");
 				if (x === void 0 || y === void 0) throw new Error("forge_browser_click_point requires x and y.");
 				if (button !== void 0 && button !== "left" && button !== "middle" && button !== "right") throw new Error("forge_browser_click_point requires button left, middle, or right.");
 				return toCodexDynamicToolResult$2(await handlers.clickPoint(x, y, button, clickCount, tabId));
 			}
 			case "forge_browser_type": {
-				const selector = readString$2(args, "selector");
+				const selector = readString$3(args, "selector");
 				if (!selector) throw new Error("forge_browser_type requires a selector.");
-				const text = readString$2(args, "text");
+				const text = readString$3(args, "text");
 				if (text === void 0) throw new Error("forge_browser_type requires text.");
 				return toCodexDynamicToolResult$2(await handlers.type(selector, text, readBoolean$1(args, "append"), tabId));
 			}
 			case "forge_browser_type_text": {
-				const text = readString$2(args, "text");
+				const text = readString$3(args, "text");
 				if (text === void 0) throw new Error("forge_browser_type_text requires text.");
 				return toCodexDynamicToolResult$2(await handlers.typeText(text, readBoolean$1(args, "pressEnter"), tabId));
 			}
 			case "forge_browser_press_key": {
-				const key = readString$2(args, "key");
+				const key = readString$3(args, "key");
 				if (!key) throw new Error("forge_browser_press_key requires a key.");
 				return toCodexDynamicToolResult$2(await handlers.pressKey(key, tabId));
 			}
@@ -206923,7 +207127,7 @@ function createCodexComputerDynamicToolHandler(computerManager) {
 function readArgs$1(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
-function readString$1(args, key) {
+function readString$2(args, key) {
 	const value = args[key];
 	return typeof value === "string" ? value : void 0;
 }
@@ -206943,7 +207147,7 @@ function readStringArray(args, key) {
 	return value.filter((entry) => typeof entry === "string");
 }
 function readRequiredString(args, key, toolName) {
-	const value = readString$1(args, key)?.trim();
+	const value = readString$2(args, key)?.trim();
 	if (!value) throw new Error(`${toolName} requires ${key}.`);
 	return value;
 }
@@ -206978,7 +207182,7 @@ async function runGitHubLifecycleTool(toolName, context) {
 		action,
 		args: lifecycleArgs,
 		mode
-	}), mode === "write" ? readString$1(args, "confirmationId") : void 0);
+	}), mode === "write" ? readString$2(args, "confirmationId") : void 0);
 }
 //#endregion
 //#region src/github/GitHubCodexPullRequestTools.ts
@@ -206988,8 +207192,8 @@ async function runGitHubPullRequestTool(toolName, context) {
 		case "forge_github_create_pull_request": {
 			const cwd = readRequiredString(args, "cwd", toolName);
 			const title = readRequiredString(args, "title", toolName);
-			const body = readString$1(args, "body");
-			const headBranch = readString$1(args, "headBranch")?.trim();
+			const body = readString$2(args, "body");
+			const headBranch = readString$2(args, "headBranch")?.trim();
 			if (body === void 0) throw new Error("forge_github_create_pull_request requires body.");
 			const request = {
 				cwd,
@@ -206998,7 +207202,7 @@ async function runGitHubPullRequestTool(toolName, context) {
 				baseBranch: readRequiredString(args, "baseBranch", toolName),
 				...headBranch ? { headBranch } : {}
 			};
-			return runTool(request, () => broker.createPullRequest(auth, request), readString$1(args, "confirmationId"));
+			return runTool(request, () => broker.createPullRequest(auth, request), readString$2(args, "confirmationId"));
 		}
 		case "forge_github_get_pull_request": {
 			const cwd = readRequiredString(args, "cwd", toolName);
@@ -207020,29 +207224,29 @@ function runStatus$1({ auth, broker, runTool }) {
 	return runTool({}, () => broker.status(auth));
 }
 function runListRepositories({ args, auth, broker, runTool }) {
-	const search = readString$1(args, "search");
+	const search = readString$2(args, "search");
 	return runTool({ search: search ?? null }, () => broker.listRepositories(auth, { search }));
 }
 function runCloneRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_clone_repository";
 	const repoFullName = readRequiredString(args, "repoFullName", toolName);
 	const destination = readRequiredString(args, "destination", toolName);
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		repoFullName,
 		destination,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.cloneRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.cloneRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runCreateRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_create_repository";
 	const owner = readRequiredString(args, "owner", toolName);
 	const name = readRequiredString(args, "name", toolName);
-	const visibility = readString$1(args, "visibility");
+	const visibility = readString$2(args, "visibility");
 	if (visibility !== void 0 && visibility !== "private" && visibility !== "public") throw new Error("forge_github_create_repository visibility must be private or public.");
 	const repositoryVisibility = visibility;
-	const description = readString$1(args, "description");
+	const description = readString$2(args, "description");
 	const request = {
 		owner,
 		name,
@@ -207050,32 +207254,32 @@ function runCreateRepository({ args, auth, broker, runTool }) {
 		...repositoryVisibility ? { visibility: repositoryVisibility } : {},
 		...description !== void 0 ? { description } : {}
 	};
-	return runTool(request, () => broker.createRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.createRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runLinkProjectRepository({ args, auth, broker, runTool }) {
 	const toolName = "forge_github_link_project_repository";
 	const cwd = readRequiredString(args, "cwd", toolName);
 	const repoFullName = readRequiredString(args, "repoFullName", toolName);
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		cwd,
 		repoFullName,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.linkProjectRepository(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.linkProjectRepository(auth, request), readString$2(args, "confirmationId"));
 }
 function runPushBranch({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_push_branch");
-	const branch = readString$1(args, "branch");
+	const branch = readString$2(args, "branch");
 	const request = {
 		cwd,
 		...branch ? { branch } : {}
 	};
-	return runTool(request, () => broker.pushProjectBranch(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.pushProjectBranch(auth, request), readString$2(args, "confirmationId"));
 }
 function runRefreshCredentials({ args, auth, broker, runTool }) {
 	const request = { cwd: readRequiredString(args, "cwd", "forge_github_refresh_credentials") };
-	return runTool(request, () => broker.refreshProjectCredentials(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.refreshProjectCredentials(auth, request), readString$2(args, "confirmationId"));
 }
 const repositoryToolHandlers = {
 	forge_github_status: runStatus$1,
@@ -207113,7 +207317,7 @@ async function runGitHubWorkflowTool(toolName, context) {
 }
 function listWorkflowRuns({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_list_workflow_runs");
-	const branch = readString$1(args, "branch")?.trim();
+	const branch = readString$2(args, "branch")?.trim();
 	const limit = readNumber$1(args, "limit");
 	const request = {
 		cwd,
@@ -207132,7 +207336,7 @@ function watchWorkflowRun({ args, auth, broker, runTool }) {
 }
 function getWorkflowRunLogs({ args, auth, broker, runTool }) {
 	const { cwd, runId } = readWorkflowRunRequest(args, "forge_github_get_workflow_run_logs");
-	const jobId = readString$1(args, "jobId")?.trim();
+	const jobId = readString$2(args, "jobId")?.trim();
 	const request = {
 		cwd,
 		runId,
@@ -207142,16 +207346,16 @@ function getWorkflowRunLogs({ args, auth, broker, runTool }) {
 }
 function downloadWorkflowArtifacts({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_download_workflow_artifacts");
-	const runId = readString$1(args, "runId")?.trim();
-	const artifactName = readString$1(args, "artifactName")?.trim();
-	const destinationDir = readString$1(args, "destinationDir")?.trim();
+	const runId = readString$2(args, "runId")?.trim();
+	const artifactName = readString$2(args, "artifactName")?.trim();
+	const destinationDir = readString$2(args, "destinationDir")?.trim();
 	const request = {
 		cwd,
 		...runId ? { runId } : {},
 		...artifactName ? { artifactName } : {},
 		...destinationDir ? { destinationDir } : {}
 	};
-	return runTool(request, () => broker.downloadWorkflowArtifacts(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.downloadWorkflowArtifacts(auth, request), readString$2(args, "confirmationId"));
 }
 function listWorkflows({ args, auth, broker, runTool }) {
 	const cwd = readRequiredString(args, "cwd", "forge_github_list_workflows");
@@ -207170,7 +207374,7 @@ function getWorkflow({ args, auth, broker, runTool }) {
 }
 function runWorkflow({ args, auth, broker, runTool }) {
 	const { cwd, workflow } = readWorkflowRequest(args, "forge_github_run_workflow");
-	const ref = readString$1(args, "ref")?.trim();
+	const ref = readString$2(args, "ref")?.trim();
 	const fields = readStringRecord(args, "fields");
 	const request = {
 		cwd,
@@ -207178,7 +207382,7 @@ function runWorkflow({ args, auth, broker, runTool }) {
 		...ref ? { ref } : {},
 		...fields && Object.keys(fields).length > 0 ? { fields } : {}
 	};
-	return runTool(request, () => broker.runWorkflow(auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker.runWorkflow(auth, request), readString$2(args, "confirmationId"));
 }
 function enableWorkflow(context) {
 	return runWorkflowToggle("forge_github_enable_workflow", context, "enableWorkflow");
@@ -207201,12 +207405,12 @@ function readWorkflowRequest(args, toolName) {
 async function runWorkflowRunMutation(toolName, context, brokerMethod) {
 	const { args, auth, broker, runTool } = context;
 	const request = readWorkflowRunRequest(args, toolName);
-	return runTool(request, () => broker[brokerMethod](auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker[brokerMethod](auth, request), readString$2(args, "confirmationId"));
 }
 function runWorkflowToggle(toolName, context, brokerMethod) {
 	const { args, auth, broker, runTool } = context;
 	const request = readWorkflowRequest(args, toolName);
-	return runTool(request, () => broker[brokerMethod](auth, request), readString$1(args, "confirmationId"));
+	return runTool(request, () => broker[brokerMethod](auth, request), readString$2(args, "confirmationId"));
 }
 //#endregion
 //#region src/github/GitHubCodexWorkspaceGitTools.ts
@@ -207223,7 +207427,7 @@ async function runWorkspaceGitTool(toolName, context) {
 		case "forge_git_commit": return runCommit("forge_git_commit", context);
 		case "forge_git_reset_hard": return runResetHard("forge_git_reset_hard", context);
 		case "forge_git": {
-			const operation = readString$1(args, "operation")?.trim();
+			const operation = readString$2(args, "operation")?.trim();
 			switch (operation) {
 				case "status": return runStatus(toolName, context, "status");
 				case "log": return runLog(toolName, context);
@@ -207252,7 +207456,7 @@ function runLog(toolName, { args, broker, runTool }) {
 }
 function runStash(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
-	const message = readString$1(args, "message")?.trim();
+	const message = readString$2(args, "message")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207260,12 +207464,12 @@ function runStash(toolName, { args, broker, runTool }, operation) {
 	}, () => broker.stashWorkspace({
 		cwd,
 		...message ? { message } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 function runCommit(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
 	const message = readRequiredString(args, "message", operation ? `${toolName} operation=commit` : toolName);
-	const branch = readString$1(args, "branch")?.trim();
+	const branch = readString$2(args, "branch")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207275,11 +207479,11 @@ function runCommit(toolName, { args, broker, runTool }, operation) {
 		cwd,
 		message,
 		...branch ? { branch } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 function runResetHard(toolName, { args, broker, runTool }, operation) {
 	const cwd = readRequiredString(args, "cwd", toolName);
-	const ref = readString$1(args, "ref")?.trim();
+	const ref = readString$2(args, "ref")?.trim();
 	return runTool({
 		cwd,
 		...operation ? { operation } : {},
@@ -207287,7 +207491,7 @@ function runResetHard(toolName, { args, broker, runTool }, operation) {
 	}, () => broker.resetWorkspaceHard({
 		cwd,
 		...ref ? { ref } : {}
-	}), readString$1(args, "confirmationId"));
+	}), readString$2(args, "confirmationId"));
 }
 //#endregion
 //#region src/github/GitHubCodexToolRunner.ts
@@ -207921,7 +208125,7 @@ function createCodexGitHubDynamicToolHandler(options = {}) {
 			error: "Forge could not resolve the authenticated user session for this thread. Send a new turn from the Forge UI and retry."
 		}, false);
 		const args = readArgs$1(input.arguments);
-		const dispatchOperation = input.tool === "forge_git" ? readString$1(args, "operation")?.trim() : void 0;
+		const dispatchOperation = input.tool === "forge_git" ? readString$2(args, "operation")?.trim() : void 0;
 		const operation = dispatchOperation ?? operationForTool(input.tool);
 		const requiresConfirmation = !bypassWriteConfirmation && (isGitHubWriteTool(input.tool) || dispatchOperation !== void 0 && FORGE_GIT_WRITE_OPERATIONS.has(dispatchOperation));
 		const runTool = async (request, execute, confirmationId) => {
@@ -208443,7 +208647,7 @@ function createCodexDevServerDynamicTools() {
 function readArgs(value) {
 	return value && typeof value === "object" ? value : {};
 }
-function readString(args, key) {
+function readString$1(args, key) {
 	const value = args[key];
 	return typeof value === "string" && value.trim().length > 0 ? value : void 0;
 }
@@ -208456,8 +208660,8 @@ function readBoolean(args, key) {
 	return typeof value === "boolean" ? value : void 0;
 }
 function runDevServerStart(handlers, args) {
-	const command = readString(args, "command");
-	const cwd = readString(args, "cwd");
+	const command = readString$1(args, "command");
+	const cwd = readString$1(args, "cwd");
 	const port = readNumber(args, "port");
 	const readyTimeoutMs = readNumber(args, "readyTimeoutMs");
 	const openPreview = readBoolean(args, "openPreview");
@@ -208613,7 +208817,7 @@ function readConnectorParams(tool, args) {
 	switch (tool.tool) {
 		case "forge_gmail_search": return {
 			...params,
-			query: readString$1(args, "query") ?? ""
+			query: readString$2(args, "query") ?? ""
 		};
 		case "forge_gmail_list_recent": return {
 			...params,
@@ -208625,7 +208829,7 @@ function readConnectorParams(tool, args) {
 	}
 }
 function appendString(target, args, key) {
-	const value = readString$1(args, key);
+	const value = readString$2(args, key);
 	if (value !== void 0) target[key] = value;
 }
 function appendNumber(target, args, key) {
@@ -209214,7 +209418,7 @@ const collectStreamAsString = (stream) => stream.pipe(decodeText$1(), runFold(()
 //#region src/orchestration/WorkerPlanCodexTools.ts
 const FORGE_PROPOSE_WORKER_TASKS_TOOL = "forge_propose_worker_tasks";
 const MAX_WORKER_PLAN_ITEMS = 5;
-function asRecord$9(value) {
+function asRecord$10(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
 function readTrimmedString(value) {
@@ -209230,7 +209434,7 @@ function isValidWorkerSummary(value) {
 	return value !== void 0 && value.length > 0 && value.length <= 4e3;
 }
 function decodeWorkerPlanItem(value) {
-	const item = asRecord$9(value);
+	const item = asRecord$10(value);
 	const slug = readTrimmedString(item?.slug);
 	const title = readTrimmedString(item?.title);
 	const summary = readTrimmedString(item?.summary);
@@ -209294,7 +209498,7 @@ function createWorkerPlanDynamicTools() {
 function createWorkerPlanDynamicToolHandler() {
 	return async (input) => {
 		if (input.tool !== "forge_propose_worker_tasks") throw new Error(`Unsupported worker-plan tool: ${input.tool}`);
-		if (!decodeWorkerPlanItems(asRecord$9(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
+		if (!decodeWorkerPlanItems(asRecord$10(input.arguments)?.items)) throw new Error("Worker plans require one to five unique, fully described items.");
 		return {
 			success: true,
 			contentItems: [{
@@ -210785,6 +210989,374 @@ function withoutInheritedAnthropicCredentials(env, options) {
 	return contained;
 }
 //#endregion
+//#region src/provider/personalClaudeInVm.ts
+/**
+* CMMD writes this marker when it activates a personal Claude subscription
+* inside a running sprite. Activation always happens after boot, so a
+* boot-time env var alone cannot reflect it (FOR-36249).
+*
+* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
+* Without that, the marker sits directly under FORGE_HOME, which is the same
+* guest home CMMD derives every sprite path from. A server with neither has no
+* sprite home to look in, and a desktop never has a marker, so it reads none.
+*/
+const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
+const PERSONAL_CLAUDE_GENERATION_FILE_NAME = ".forge-personal-claude-generation";
+function markerPath(env) {
+	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
+	if (env.FORGE_HOME) return join(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
+	return null;
+}
+/**
+* True when this runtime should offer the personal Claude subscription lane.
+*
+* Accepts either signal: the boot-time env var (backward compatible) or the
+* activation marker on disk. Reading the marker at call time lets the provider
+* catalog and the per-turn readiness guard self-heal once CMMD delivers,
+* without a sprite reboot. Callers still verify the credential is non-empty
+* before treating it as usable; this only decides whether the lane is active.
+*/
+function personalClaudeInVmEnabled(env = process.env) {
+	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
+	const marker = markerPath(env);
+	if (!marker) return false;
+	try {
+		return existsSync(marker);
+	} catch {
+		return false;
+	}
+}
+/** Exported at boot. This is the restart proof CMMD waits on, so it must never read the file. */
+function bootExportedPersonalClaudeGenerationHash(env = process.env) {
+	return env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
+}
+/**
+* The sha256 of the Claude credential generation this runtime holds, or "" when
+* it holds none. The readiness guard compares it with the generation CMMD
+* applied. The restart proof must not use it; it uses the boot-exported hash.
+*
+* The boot preload exports FORGE_PERSONAL_CLAUDE_GENERATION_HASH, but only when
+* the marker already exists at boot. Activation in place writes the generation
+* file and touches the marker without setting any env, so an empty variable
+* falls back to that file, hashed the way the preload hashes it. CMMD puts the
+* file beside the marker in the guest home and names no path for it. A marker
+* with no generation file is a legacy runtime, and gets no hash here either.
+*/
+function personalClaudeGenerationHash(env = process.env) {
+	const exported = bootExportedPersonalClaudeGenerationHash(env);
+	if (exported) return exported;
+	const marker = markerPath(env);
+	if (!marker) return "";
+	try {
+		if (!existsSync(marker)) return "";
+		const generation = readFileSync(join(dirname(marker), PERSONAL_CLAUDE_GENERATION_FILE_NAME), "utf8").trim();
+		return generation ? createHash("sha256").update(generation).digest("hex") : "";
+	} catch {
+		return "";
+	}
+}
+//#endregion
+//#region src/provider/claudeCredentialDirectory.ts
+/**
+* Per-account credential directories for Claude turns.
+*
+* Claude Code keeps conversation transcripts under
+* `${CLAUDE_CONFIG_DIR}/projects/<cwd-slug>/<sessionId>.jsonl` and its login
+* under `.credentials.json`. `CLAUDE_SECURESTORAGE_CONFIG_DIR` moves only the
+* credential file, so each Provider Account can hold its own login while every
+* session file stays in one place and `--resume` keeps finding its target. See
+* `docs/adr/claude-accounts-split-credentials-not-sessions.md`.
+*
+* That variable is not documented. Under
+* `docs/adr/unpublished-provider-surface-needs-a-fallback.md` the dependency is
+* only allowed because absence degrades to a named behaviour that already
+* works: one account per Environment, exactly what runs today. This module is
+* the gate that keeps the degrade honest. It sets the variable only when a
+* readable `.credentials.json` is already sitting in the resolved directory,
+* because a missing or empty directory makes the CLI report logged out and a
+* live turn would fail. Nothing writes these directories yet, so every runtime
+* today takes the skip path.
+*
+* Pure and dependency-free on purpose, for the same reason as
+* `claudeCredentialContainment.ts`: ClaudeAdapter drags in Effect platform
+* services, the browser manager and the server config, so a unit test that
+* imports it cannot run in a worktree. This rule decides which account pays for
+* a turn, so it has to stay directly testable.
+*/
+/** Repoints `.credentials.json` without moving the transcripts. */
+const CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV = "CLAUDE_SECURESTORAGE_CONFIG_DIR";
+/** The one file Claude Code writes into the credential directory. */
+const CLAUDE_CREDENTIAL_FILE_NAME = ".credentials.json";
+/**
+* Runtime env var naming the Provider Account this runtime's Claude turns
+* belong to.
+*
+* NOTHING SETS THIS. It has no writer anywhere in Forge or CMMD, so as shipped
+* the per-account lane can never turn on and every runtime keeps today's single
+* account. The writer waits on issue 3073, which decides which identity keys
+* the directory. That has to be settled first: the credential generation
+* rotates on every re-delivery, so keying on it would give a new directory
+* each time and defeat the point.
+*
+* It is also not the seam. The seam is the `credentialDirectory` parameter on
+* `ClaudeAdapter.buildClaudeQueryEnv`, which is what tests and callers drive.
+* This variable is one bridge into that parameter, and the delivery step is
+* free to replace it with something better rather than adopt it.
+*/
+const CLAUDE_PROVIDER_ACCOUNT_IDENTITY_ENV = "FORGE_CLAUDE_PROVIDER_ACCOUNT_IDENTITY";
+/** Operator escape hatch for the directory root, mostly for local debugging. */
+const CLAUDE_CREDENTIAL_ROOT_ENV = "FORGE_CLAUDE_CREDENTIAL_ROOT";
+const CREDENTIAL_ROOT_DIRECTORY_NAME = "claude-credentials";
+const FALLBACK_ROOT_DIRECTORY_NAME = ".forge-claude-credentials";
+const DEFAULT_CLAUDE_CONFIG_DIRECTORY_NAME = ".claude";
+const MAX_ACCOUNT_IDENTITY_LENGTH = 256;
+const DIRECTORY_NAME_HASH_LENGTH = 32;
+/**
+* Directory name for an account. A hash, so no email or display name reaches a
+* filesystem path and no path-illegal character can appear in one either.
+*/
+function claudeCredentialDirectoryName(accountIdentity) {
+	return `account-${createHash("sha256").update(accountIdentity, "utf8").digest("hex").slice(0, DIRECTORY_NAME_HASH_LENGTH)}`;
+}
+/** The account this runtime's Claude turns belong to, or null on every runtime today. */
+function resolveClaudeProviderAccountIdentity(env) {
+	const identity = env[CLAUDE_PROVIDER_ACCOUNT_IDENTITY_ENV]?.trim();
+	if (!identity || identity.length > MAX_ACCOUNT_IDENTITY_LENGTH) return null;
+	return identity;
+}
+/**
+* Where per-account credential directories live. Always outside
+* `CLAUDE_CONFIG_DIR`, so one of them can never be mistaken for the main
+* credential store, and so a stray read of the config directory cannot walk
+* into another account's login.
+*/
+function claudeCredentialDirectoryRoot(env) {
+	const root = credentialRootCandidate(env);
+	if (!root || !isAbsolute(root)) return null;
+	return isInside(root, claudeConfigDirectory(env)) ? null : resolve(root);
+}
+/** Absolute credential directory for one account, or null when either half is missing. */
+function resolveClaudeCredentialDirectory(input) {
+	if (!input.accountIdentity) return null;
+	const root = claudeCredentialDirectoryRoot(input.env);
+	if (!root) return null;
+	return join(root, claudeCredentialDirectoryName(input.accountIdentity));
+}
+/**
+* Decide whether this turn may point at a per-account credential directory.
+*
+* The cheap checks run first and the capability probe runs last, so a runtime
+* with no delivered credential never spawns the CLI. Any failure is a skip, so
+* the worst outcome is today's behaviour.
+*/
+async function decideClaudeCredentialDirectory(input) {
+	if (!input.accountIdentity) return skip("no-account");
+	if (input.env["CLAUDE_SECURESTORAGE_CONFIG_DIR"]?.trim()) return skip("operator-override");
+	const directory = resolveClaudeCredentialDirectory(input);
+	if (!directory) return skip("no-root");
+	if (!(input.credentialFilePresent ?? hasReadableCredentialFile)(directory)) return skip("no-credential-file");
+	return await probeSupportSafely(input.probeSupport) === "supported" ? {
+		outcome: "set",
+		directory
+	} : skip("capability-not-supported");
+}
+/** True when `.credentials.json` is in the directory and readable right now. */
+function hasReadableCredentialFile(directory) {
+	const file = join(directory, CLAUDE_CREDENTIAL_FILE_NAME);
+	try {
+		if (!statSync(file).isFile()) return false;
+		accessSync(file, constants.R_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function skip(reason) {
+	return {
+		outcome: "skipped",
+		reason
+	};
+}
+/** `inconclusive` is treated as `unsupported`, and so is a probe that throws. */
+async function probeSupportSafely(probeSupport) {
+	try {
+		return await probeSupport();
+	} catch {
+		return "inconclusive";
+	}
+}
+function credentialRootCandidate(env) {
+	const explicit = env[CLAUDE_CREDENTIAL_ROOT_ENV]?.trim();
+	if (explicit) return explicit;
+	const forgeHome = env.FORGE_HOME?.trim();
+	if (forgeHome) return join(forgeHome, CREDENTIAL_ROOT_DIRECTORY_NAME);
+	try {
+		return join(homedir(), FALLBACK_ROOT_DIRECTORY_NAME);
+	} catch {
+		return null;
+	}
+}
+function claudeConfigDirectory(env) {
+	const configured = env.CLAUDE_CONFIG_DIR?.trim();
+	if (configured) return configured;
+	try {
+		return join(homedir(), DEFAULT_CLAUDE_CONFIG_DIRECTORY_NAME);
+	} catch {
+		return null;
+	}
+}
+function isInside(candidate, parent) {
+	if (!parent) return false;
+	const step = relative(resolve(parent), resolve(candidate));
+	return step === "" || !step.startsWith("..") && !isAbsolute(step);
+}
+//#endregion
+//#region src/provider/claudeCredentialDirectoryProbe.ts
+/**
+* Capability probe for `CLAUDE_SECURESTORAGE_CONFIG_DIR`.
+*
+* The variable is unpublished, so a runtime is asked rather than assumed to
+* honour it (`docs/adr/unpublished-provider-surface-needs-a-fallback.md`). The
+* question the probe can actually answer: point the variable at an empty
+* directory and a runtime that honours it flips from logged in to logged out.
+* A runtime with no credential at all is logged out either way and cannot
+* discriminate, which is `inconclusive`, and callers read that as unsupported.
+*
+* `claude auth status` is a pure read. It sends no prompt and leaves
+* `.credentials.json` byte-identical, so probing spends no subscription usage.
+* It prints JSON on stdout and exits 1 when logged out, so the exit code is not
+* a failure signal and the `loggedIn` field is what gets read.
+*/
+const execFileAsync$3 = promisify$1(execFile);
+const AUTH_STATUS_ARGS = ["auth", "status"];
+const VERSION_ARGS = ["--version"];
+/**
+* The probe sits in front of a turn, so a provider process that never answers
+* must not hold that turn open. `execFile` kills the child at this bound, and
+* `runBounded` gives up on it at the same bound whatever the deps do, so a
+* hung or unkillable process costs a few seconds and an `inconclusive`.
+*/
+const PROBE_TIMEOUT_MS = 5e3;
+const PROBE_DIRECTORY_PREFIX = "forge-claude-capability-";
+const VERSION_PATTERN = /\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/;
+function makeClaudeCredentialDirectoryProbe(deps) {
+	const answers = /* @__PURE__ */ new Map();
+	return { support: async () => {
+		const version = await readVersionSafely(deps);
+		if (version === null) return runProbe(deps);
+		const cached = answers.get(version);
+		if (cached) return cached;
+		const pending = runProbe(deps);
+		answers.set(version, pending);
+		return pending;
+	} };
+}
+/**
+* One probe per binary path for the life of the process. The probe spawns the
+* CLI twice, and every Claude session start would otherwise pay for it.
+*/
+const probesByBinaryPath = /* @__PURE__ */ new Map();
+function claudeCredentialDirectoryProbeFor(binaryPath) {
+	const binary = binaryPath?.trim() || "claude";
+	const existing = probesByBinaryPath.get(binary);
+	if (existing) return existing;
+	const probe = makeClaudeCredentialDirectoryProbe(claudeCredentialDirectoryProbeDeps(binary));
+	probesByBinaryPath.set(binary, probe);
+	return probe;
+}
+function claudeCredentialDirectoryProbeDeps(binaryPath) {
+	return {
+		runAuthStatus: ({ credentialDirectory }) => runClaudeCommand$1(binaryPath, AUTH_STATUS_ARGS, credentialDirectory),
+		readBinaryVersion: async () => {
+			const { stdout } = await runClaudeCommand$1(binaryPath, VERSION_ARGS, null);
+			return VERSION_PATTERN.exec(stdout)?.[0] ?? null;
+		},
+		makeProbeDirectory: () => mkdtemp(join(tmpdir(), PROBE_DIRECTORY_PREFIX)),
+		removeProbeDirectory: (directory) => rm(directory, {
+			recursive: true,
+			force: true
+		})
+	};
+}
+async function runProbe(deps) {
+	let probeDirectory = null;
+	try {
+		if (parseLoggedIn(await runBounded(deps, () => deps.runAuthStatus({ credentialDirectory: null }))) !== true) return "inconclusive";
+		probeDirectory = await deps.makeProbeDirectory();
+		const directory = probeDirectory;
+		const redirected = parseLoggedIn(await runBounded(deps, () => deps.runAuthStatus({ credentialDirectory: directory })));
+		if (redirected === false) return "supported";
+		return redirected === true ? "unsupported" : "inconclusive";
+	} catch {
+		return "inconclusive";
+	} finally {
+		if (probeDirectory !== null) await deps.removeProbeDirectory(probeDirectory).catch(() => void 0);
+	}
+}
+async function readVersionSafely(deps) {
+	try {
+		return await runBounded(deps, () => deps.readBinaryVersion());
+	} catch {
+		return null;
+	}
+}
+/**
+* Give up on a call that outlives the bound. The underlying promise is left to
+* settle on its own; the real deps hand `execFile` the same bound, so its child
+* is already being killed by the time this rejects.
+*/
+async function runBounded(deps, operation) {
+	const timeoutMs = deps.timeoutMs ?? PROBE_TIMEOUT_MS;
+	let timer;
+	try {
+		return await Promise.race([operation(), new Promise((_resolve, reject) => {
+			timer = setTimeout(() => reject(/* @__PURE__ */ new Error("claude auth status timed out")), timeoutMs);
+		})]);
+	} finally {
+		if (timer !== void 0) clearTimeout(timer);
+	}
+}
+/** The `loggedIn` field, or null when the output does not carry one. */
+function parseLoggedIn(run) {
+	const parsed = parseJsonObject$1(run.stdout);
+	return typeof parsed?.loggedIn === "boolean" ? parsed.loggedIn : null;
+}
+function parseJsonObject$1(output) {
+	const trimmed = output.trim();
+	const start = trimmed.indexOf("{");
+	const end = trimmed.lastIndexOf("}");
+	if (start === -1 || end <= start) return null;
+	try {
+		const parsed = JSON.parse(trimmed.slice(start, end + 1));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : null;
+	} catch {
+		return null;
+	}
+}
+async function runClaudeCommand$1(binaryPath, args, credentialDirectory) {
+	try {
+		const { stdout } = await execFileAsync$3(binaryPath, [...args], {
+			env: {
+				...process.env,
+				...credentialDirectory ? { [CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV]: credentialDirectory } : {}
+			},
+			maxBuffer: 1024 * 1024,
+			timeout: PROBE_TIMEOUT_MS
+		});
+		return {
+			stdout,
+			exitCode: 0
+		};
+	} catch (cause) {
+		const failure = cause;
+		if (typeof failure.stdout !== "string") throw cause;
+		return {
+			stdout: failure.stdout,
+			exitCode: typeof failure.code === "number" ? failure.code : null
+		};
+	}
+}
+//#endregion
 //#region src/provider/makeManagedServerProvider.ts
 const makeManagedServerProvider = fn$1("makeManagedServerProvider")(function* (input) {
 	const refreshSemaphore = yield* make$43(1);
@@ -210873,43 +211445,6 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
-//#region src/provider/personalClaudeInVm.ts
-/**
-* CMMD writes this marker when it activates a personal Claude subscription
-* inside a running sprite. Activation always happens after boot, so a
-* boot-time env var alone cannot reflect it (FOR-36249).
-*
-* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
-* Without that, the marker sits directly under FORGE_HOME, which is the same
-* guest home CMMD derives every sprite path from. A server with neither has no
-* sprite home to look in, and a desktop never has a marker, so it reads none.
-*/
-const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
-function markerPath(env) {
-	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
-	if (env.FORGE_HOME) return join(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
-	return null;
-}
-/**
-* True when this runtime should offer the personal Claude subscription lane.
-*
-* Accepts either signal: the boot-time env var (backward compatible) or the
-* activation marker on disk. Reading the marker at call time lets the provider
-* catalog and the per-turn readiness guard self-heal once CMMD delivers,
-* without a sprite reboot. Callers still verify the credential is non-empty
-* before treating it as usable; this only decides whether the lane is active.
-*/
-function personalClaudeInVmEnabled(env = process.env) {
-	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
-	const marker = markerPath(env);
-	if (!marker) return false;
-	try {
-		return existsSync(marker);
-	} catch {
-		return false;
-	}
-}
-//#endregion
 //#region src/provider/Layers/ClaudeProvider.ts
 function endpointProfileDisplayNames(settings) {
 	return Object.fromEntries(settings.endpointProfiles.filter((p) => p.displayName).map((p) => [p.slug, p.displayName]));
@@ -211110,25 +211645,25 @@ const AUTH_METHOD_CONTAINER_KEYS = [
 /** Lift an unknown value into `Option<string>` if it is a non-empty string. */
 const asNonEmptyString = (v) => typeof v === "string" && v.length > 0 ? some(v) : none$4();
 /** Lift an unknown value into `Option<Record>` if it is a plain object. */
-const asRecord$8 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
+const asRecord$9 = (v) => typeof v === "object" && v !== null && !globalThis.Array.isArray(v) ? some(v) : none$4();
 /**
 * Walk an unknown parsed JSON value looking for a subscription/plan
 * identifier, returning the first match as an `Option`.
 */
 function findSubscriptionType(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findSubscriptionType));
-	return asRecord$8(value).pipe(flatMap$2((record) => {
+	return asRecord$9(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(SUBSCRIPTION_TYPE_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findSubscriptionType))));
+		return firstSomeOf(SUBSCRIPTION_CONTAINER_KEYS.map((key) => asRecord$9(record[key]).pipe(flatMap$2(findSubscriptionType))));
 	}));
 }
 function findAuthMethod(value) {
 	if (globalThis.Array.isArray(value)) return firstSomeOf(value.map(findAuthMethod));
-	return asRecord$8(value).pipe(flatMap$2((record) => {
+	return asRecord$9(value).pipe(flatMap$2((record) => {
 		const direct = firstSomeOf(AUTH_METHOD_KEYS.map((key) => asNonEmptyString(record[key])));
 		if (isSome(direct)) return direct;
-		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$8(record[key]).pipe(flatMap$2(findAuthMethod))));
+		return firstSomeOf(AUTH_METHOD_CONTAINER_KEYS.map((key) => asRecord$9(record[key]).pipe(flatMap$2(findAuthMethod))));
 	}));
 }
 /**
@@ -212328,10 +212863,27 @@ function claudeForgeAttributionPrompt() {
 	const attribution = resolveAgentAttribution();
 	return `When creating git commits, do NOT add any "Claude" or "Anthropic" co-author trailers. Use exactly:\n  ${attribution.coauthorTrailer}\n\nWhen creating GitHub pull request descriptions, do NOT add any "🤖 Generated with [Claude Code]" footer. Use exactly:\n  ${attribution.prFooter}`;
 }
-function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential) {
+/**
+* `credentialDirectory` points this turn at one Provider Account's own
+* `.credentials.json` without moving the transcripts, which is what lets an
+* account switch keep `--resume` working
+* (`docs/adr/claude-accounts-split-credentials-not-sessions.md`). It is null on
+* every runtime today: `decideClaudeCredentialDirectory` only hands back a
+* directory that already holds a readable credential file, and nothing writes
+* one yet, so the environment stays byte-for-byte what it was.
+*
+* It applies to the personal-subscription branch below and to nothing else. On
+* the profile / proxy branch the credential file is not what authenticates the
+* turn, an API key is, so pointing the variable there would add a second source
+* of truth that a later reader has to rule out.
+*/
+function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential, credentialDirectory) {
 	const baseEnv = scrubForgeProviderChildEnvSecrets(baseProcessEnv);
 	const effectiveBaseUrl = resolveClaudeQueryBaseUrl(endpointProfile, claudeSettings, providerProxyCredential);
-	if (!effectiveBaseUrl) return withoutInheritedAnthropicCredentials(baseEnv, { stripEndpointOverride: baseProcessEnv.FORGE_PERSONAL_CLAUDE_IN_VM === "true" });
+	if (!effectiveBaseUrl) return {
+		...withoutInheritedAnthropicCredentials(baseEnv, { stripEndpointOverride: personalClaudeInVmEnabled(baseProcessEnv) }),
+		...credentialDirectory ? { [CLAUDE_SECURESTORAGE_CONFIG_DIR_ENV]: credentialDirectory } : {}
+	};
 	const effectiveApiKey = resolveClaudeQueryApiKey(endpointProfile, claudeSettings, providerProxyCredential?.token ?? null);
 	return {
 		...baseEnv,
@@ -212374,7 +212926,7 @@ function userInputQuestionsFromToolInput(toolInput) {
 	return (Array.isArray(toolInput.questions) ? toolInput.questions : []).map((question, idx) => userInputQuestionFromUnknown(question, idx));
 }
 function userInputQuestionFromUnknown(question, idx) {
-	const value = asRecord$7(question) ?? {};
+	const value = asRecord$8(question) ?? {};
 	return {
 		id: typeof value.header === "string" ? value.header : `q-${idx}`,
 		header: typeof value.header === "string" ? value.header : `Question ${idx + 1}`,
@@ -212384,13 +212936,13 @@ function userInputQuestionFromUnknown(question, idx) {
 	};
 }
 function userInputOptionFromUnknown(option) {
-	const value = asRecord$7(option) ?? {};
+	const value = asRecord$8(option) ?? {};
 	return {
 		label: typeof value.label === "string" ? value.label : "",
 		description: typeof value.description === "string" ? value.description : ""
 	};
 }
-function asRecord$7(value) {
+function asRecord$8(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function permissionResultFromDecision(decision, toolInput, suggestions) {
@@ -213294,7 +213846,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 	const updateResumeCursor = fn$1("updateResumeCursor")(function* (context) {
 		const threadId = context.session.threadId;
 		if (!threadId) return;
-		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$7(context.session.resumeCursor)?.providerDeliveryBinding);
+		const providerDeliveryBinding = readProviderDeliveryBinding(asRecord$8(context.session.resumeCursor)?.providerDeliveryBinding);
 		const resumeCursor = {
 			threadId,
 			...context.resumeSessionId ? { resume: context.resumeSessionId } : {},
@@ -214599,6 +215151,11 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		})));
 		const claudeSettings = serverSettings.providers.claudeAgent;
 		const claudeBinaryPath = claudeSettings.binaryPath;
+		const claudeCredentialDirectory = yield* tryPromise(() => decideClaudeCredentialDirectory({
+			env: process.env,
+			accountIdentity: resolveClaudeProviderAccountIdentity(process.env),
+			probeSupport: () => claudeCredentialDirectoryProbeFor(claudeBinaryPath).support()
+		})).pipe(map$3((decision) => decision.outcome === "set" ? decision.directory : null), orElseSucceed(() => null));
 		const modelConfig = resolveClaudeSessionModelConfig(input.modelSelection, claudeSettings.endpointProfiles);
 		const providerProxyCredential = yield* issueClaudeProviderProxyCredential(modelConfig.endpointProfile, modelConfig.modelSlug ?? modelConfig.effectiveApiModelId ?? "unknown", threadId);
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
@@ -214623,7 +215180,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			existingResumeSessionId,
 			newSessionId,
 			canUseTool,
-			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential),
+			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential, claudeCredentialDirectory),
 			browserManager,
 			threadId,
 			browserToolEnvironmentId,
@@ -218369,7 +218926,7 @@ function makeAcpContentDeltaEvent(input) {
 }
 //#endregion
 //#region ../../packages/shared/src/toolActivity.ts
-function asRecord$6(value) {
+function asRecord$7(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 function asTrimmedString(value) {
@@ -218395,10 +218952,10 @@ function extractCommandFromTitle$1(title) {
 	return /`([^`]+)`/u.exec(title)?.[1]?.trim() || void 0;
 }
 function extractToolCommand(data, title) {
-	const item = asRecord$6(data?.item);
-	const itemInput = asRecord$6(item?.input);
-	const itemResult = asRecord$6(item?.result);
-	const rawInput = asRecord$6(data?.rawInput);
+	const item = asRecord$7(data?.item);
+	const itemInput = asRecord$7(item?.input);
+	const itemResult = asRecord$7(item?.result);
+	const rawInput = asRecord$7(data?.rawInput);
 	const direct = [
 		normalizeCommandValue$1(item?.command),
 		normalizeCommandValue$1(itemInput?.command),
@@ -218426,7 +218983,7 @@ function collectPaths(value, paths, seen, depth) {
 		}
 		return;
 	}
-	const record = asRecord$6(value);
+	const record = asRecord$7(value);
 	if (!record) return;
 	for (const key of [
 		"path",
@@ -218485,7 +219042,7 @@ function deriveToolActivityPresentation(input) {
 	const title = asTrimmedString(input.title);
 	const detail = stripTrailingExitCode(asTrimmedString(input.detail));
 	const fallbackSummary = asTrimmedString(input.fallbackSummary) ?? "Tool";
-	const data = asRecord$6(input.data);
+	const data = asRecord$7(input.data);
 	const command = extractToolCommand(data, title);
 	const primaryPath = extractPrimaryPath(data);
 	const action = classifyToolAction({
@@ -218509,7 +219066,7 @@ function deriveToolActivityPresentation(input) {
 		...primaryPath ? { detail: primaryPath } : {}
 	};
 	if (action === "search") {
-		const query = asTrimmedString(asRecord$6(data?.rawInput)?.query) ?? asTrimmedString(asRecord$6(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$6(data?.rawInput)?.searchTerm);
+		const query = asTrimmedString(asRecord$7(data?.rawInput)?.query) ?? asTrimmedString(asRecord$7(data?.rawInput)?.pattern) ?? asTrimmedString(asRecord$7(data?.rawInput)?.searchTerm);
 		return {
 			summary: "Searched files",
 			...query ? { detail: query } : {}
@@ -229697,7 +230254,7 @@ function claudeReadinessGuardEffect(config, dependencies, resolved, input) {
 	});
 }
 function requiresNativeClaudeReadiness(config, provider) {
-	return provider === "claudeAgent" && config.forgeCmmdRuntimeMode === true && process.env.FORGE_PERSONAL_CLAUDE_IN_VM === "true";
+	return provider === "claudeAgent" && config.forgeCmmdRuntimeMode === true && personalClaudeInVmEnabled();
 }
 function resolveGuardAuthority(config, readSessionId, input) {
 	const runtimeId = config.forgeCmmdRuntimeId?.trim();
@@ -229709,7 +230266,7 @@ function resolveGuardAuthority(config, readSessionId, input) {
 		runtimeId,
 		machineId,
 		credentialEpoch,
-		localGenerationHash: process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "",
+		localGenerationHash: personalClaudeGenerationHash(),
 		sessionId
 	};
 }
@@ -265212,7 +265769,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -265343,14 +265900,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -265358,7 +265915,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -285311,7 +285868,7 @@ function makeApprovedWorkerPlanEventState() {
 function promptKey(masterThreadId, promptId) {
 	return `${masterThreadId}\n${promptId}`;
 }
-function asRecord$5(value) {
+function asRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value) ? value : null;
 }
 function exactMaterializedTaskIds(value, expectedCount) {
@@ -285321,7 +285878,7 @@ function exactMaterializedTaskIds(value, expectedCount) {
 }
 function readyBatchFromActivity(state, event) {
 	if (event.payload.activity.kind !== "plan.task-creation.batch-succeeded") return null;
-	const payload = asRecord$5(event.payload.activity.payload);
+	const payload = asRecord$6(event.payload.activity.payload);
 	const promptId = payload?.["promptId"];
 	if (typeof promptId !== "string") return null;
 	const key = promptKey(event.payload.threadId, promptId);
@@ -286497,7 +287054,7 @@ function runtimeGrantNeedsRefresh(token, identity, nowSeconds = Math.floor(Date.
 	return claims.expiresAtSeconds - nowSeconds <= RUNTIME_GRANT_REFRESH_SKEW_SECONDS;
 }
 /** Narrow an unknown to a plain object, or null. */
-function asRecord$4(value) {
+function asRecord$5(value) {
 	return value !== null && typeof value === "object" ? value : null;
 }
 /** The raw (untrimmed) string when it is present and not blank, else null. */
@@ -286509,7 +287066,7 @@ function asTimestamp(value) {
 	return typeof value === "string" && Number.isFinite(Date.parse(value)) ? value : null;
 }
 function parseRuntimeGrantRefreshResponse(runtimeId, value) {
-	const data = asRecord$4(asRecord$4(value)?.data);
+	const data = asRecord$5(asRecord$5(value)?.data);
 	if (!data || data.runtimeId !== runtimeId) return null;
 	const grantToken = asNonBlankString(data.grantToken);
 	const expiresAt = asTimestamp(data.expiresAt);
@@ -286570,7 +287127,6 @@ async function refreshRuntimeProvisioningGrant(input) {
 async function maybeRefreshRuntimeProvisioningGrant(input) {
 	const current = runtimeGrantToken();
 	if (!current) return "skipped";
-	if (!runtimeGrantNeedsRefresh(current, input)) return "skipped";
 	const exactIdentity = exactRuntimeControlIdentity(input);
 	const currentClaims = currentGrantClaimsForRefresh({
 		currentGrant: current,
@@ -286579,6 +287135,11 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	});
 	if (!currentClaims) throw invalidRefreshResponse("Current runtime provisioning grant is unverifiable.");
 	const currentAuthorityClass = currentGrantAuthorityClass(currentClaims, exactIdentity);
+	const controlAuthorityMissing = currentAuthorityClass === "exact" && exactIdentity !== null && readRuntimeControlAuthority({
+		runtimeId: input.runtimeId,
+		...exactIdentity
+	}) === null;
+	if (!runtimeGrantNeedsRefresh(current, input) && !controlAuthorityMissing) return "skipped";
 	const refreshed = await refreshRuntimeProvisioningGrant({
 		runtimeId: input.runtimeId,
 		currentGrant: current,
@@ -286865,25 +287426,124 @@ const makeRuntimeDrainReporter = gen(function* () {
 var RuntimeDrainReporter = class extends Service$1()("forge/runtimeDrain/RuntimeDrainReporter") {};
 const RuntimeDrainReporterLive = effect(RuntimeDrainReporter, makeRuntimeDrainReporter);
 //#endregion
-//#region src/usage/providerRateLimits.ts
-/**
-* The SDK only ever reports ONE window per event. Only `five_hour` and
-* `seven_day` map to the two windows the Usage page shows; the
-* per-model/overage variants (seven_day_opus, overage, ...) are ignored here
-* on purpose rather than silently overwriting the plain 7-day figure.
-*/
-function mapClaudeRateLimitInfo(info) {
-	if (typeof info.utilization !== "number" || typeof info.resetsAt !== "number" || !info.status) return null;
-	const kind = info.rateLimitType === "five_hour" ? "fiveHour" : info.rateLimitType === "seven_day" ? "sevenDay" : null;
-	if (!kind) return null;
-	return {
-		kind,
-		window: {
-			usedPercent: Math.round(info.utilization * 100),
-			resetsAt: (/* @__PURE__ */ new Date(info.resetsAt * 1e3)).toISOString(),
-			status: info.status
-		}
-	};
+//#region src/usage/Services/ClaudeUsageTelemetry.ts
+/**
+* Claude usage the SDK reports on every turn, published as passive telemetry.
+*
+* Every Claude turn carries a `rate_limit_event` whose `unifiedWindows`
+* sub-object holds the two rolling windows the Usage card renders. Reading it
+* costs nothing: no `claude` process, no credential delivery, no woken sprite.
+*
+* This module is the whole publish lane behind one call. `observe` takes what
+* an observation knows and returns void. Whether the floor admits it, which
+* credential generation it ran on, whether the value is new, and whether CMMD
+* accepted it are all decided here, so the ingestion layer stays a decoder and
+* a hand-off. Nothing decided here can fail a turn, and no admitted
+* observation outlives `CLAUDE_USAGE_TELEMETRY_PUBLISH_TIMEOUT_MS`.
+*
+* The `/usage` probe in `syncClaudeCredential.ts` is a separate lane that
+* publishes `source: "active_poll"`. This one publishes
+* `source: "passive_sdk_telemetry"`, and both lanes build their body with
+* `claudeUsageTelemetryBody`.
+*
+* @module ClaudeUsageTelemetry
+*/
+var ClaudeUsageTelemetry = class extends Service$1()("forge/usage/Services/ClaudeUsageTelemetry") {};
+/**
+* The longest one admitted observation may take, from the credential
+* generation lookup through the CMMD credential and the POST, before it is
+* abandoned and counted as failed. Ingestion does not wait on it, so this
+* bounds how long a slow lookup or a slow CMMD keeps a fiber alive, not how
+* long a turn waits. Together with the floor it caps how many observations for
+* one account can be in flight at once.
+*/
+const CLAUDE_USAGE_TELEMETRY_PUBLISH_TIMEOUT_MS = 1e4;
+/** How many accounts, and how many pairs, the observer remembers before evicting the oldest. */
+const MAX_TRACKED_KEYS = 32;
+/**
+* Why one publish did not land. Every reason is the same to `observe`, which
+* logs it and moves on, so the type exists to name the lane rather than to be
+* matched on.
+*/
+var ClaudeUsageTelemetryPublishError = class extends TaggedError("ClaudeUsageTelemetryPublishError") {};
+function pairKey(attribution) {
+	return `${attribution.providerAccountId}\u0000${attribution.credentialGenerationId}`;
+}
+function windowFingerprint(value) {
+	return value === null ? "-" : `${value.usedPercent}|${value.resetsAt}|${value.status}`;
+}
+/**
+* A value fingerprint built field by field rather than by `JSON.stringify` on
+* the whole object, so the comparison does not depend on key insertion order
+* and cannot silently start ignoring a field a future mapper adds without a
+* matching change here.
+*/
+function windowsFingerprint(windows) {
+	return `${windowFingerprint(windows.fiveHour)}/${windowFingerprint(windows.sevenDay)}`;
+}
+/**
+* Stores `value` as the newest entry for `key` and evicts the oldest entry past
+* the cap. Map iteration is insertion-ordered, so the first key is the one
+* touched longest ago. An idle account or a rotated credential generation
+* rarely comes back, so evicting it costs at most one early lookup or one
+* redundant publish.
+*/
+function remember(map, key, value) {
+	map.delete(key);
+	map.set(key, value);
+	if (map.size > MAX_TRACKED_KEYS) {
+		const oldest = map.keys().next();
+		if (!oldest.done) map.delete(oldest.value);
+	}
+}
+/**
+* Builds the observer over injected dependencies. The HTTP call and the clock
+* both arrive from outside, so a test drives the whole policy without a network
+* or a timer.
+*/
+function makeClaudeUsageTelemetry(dependencies) {
+	const now = dependencies.now ?? (() => Date.now());
+	/** When each account last had an observation admitted, whatever came of it. */
+	const admittedAt = /* @__PURE__ */ new Map();
+	/** The fingerprint of the last value CMMD accepted, per pair. */
+	const publishedFingerprints = /* @__PURE__ */ new Map();
+	const publishIfNew = (windows, providerAccountId, lookupCredentialGenerationId, at) => gen(function* () {
+		const credentialGenerationId = yield* lookupCredentialGenerationId;
+		if (!credentialGenerationId) return;
+		const attribution = {
+			providerAccountId,
+			credentialGenerationId
+		};
+		const key = pairKey(attribution);
+		const fingerprint = windowsFingerprint(windows);
+		if (publishedFingerprints.get(key) === fingerprint) return;
+		yield* dependencies.publish(claudeUsageTelemetryBody({
+			attribution,
+			source: "passive_sdk_telemetry",
+			windows,
+			observedAt: new Date(at).toISOString()
+		}));
+		remember(publishedFingerprints, key, fingerprint);
+	});
+	/**
+	* The floor is read and claimed inside the returned effect, never while
+	* building it, and before anything suspends. Two turns on one account can be
+	* in flight at once, and the floor only holds them apart if the second one
+	* reads what the first one wrote.
+	*/
+	const observe = (observation) => suspend$1(() => {
+		const { windows, providerAccountId } = observation;
+		if (!windows || !providerAccountId) return void_$1;
+		const at = now();
+		const lastAdmittedAt = admittedAt.get(providerAccountId);
+		if (lastAdmittedAt !== void 0 && at - lastAdmittedAt < 5e3) return void_$1;
+		remember(admittedAt, providerAccountId, at);
+		return publishIfNew(windows, providerAccountId, observation.credentialGenerationId, at).pipe(timeout$1(CLAUDE_USAGE_TELEMETRY_PUBLISH_TIMEOUT_MS), catchCause((cause) => logWarning$1("claude usage passive telemetry publish failed", {
+			providerAccountId,
+			cause
+		})), asVoid);
+	});
+	return { observe };
 }
 //#endregion
 //#region src/orchestration/Layers/ProviderRuntimeIngestion.ts
@@ -286898,20 +287558,37 @@ const BUFFERED_PROPOSED_PLAN_BY_ID_TTL = minutes(120);
 const MAX_BUFFERED_ASSISTANT_CHARS = 24e3;
 const PROVIDER_INGESTION_CONCURRENCY = 8;
 const STRICT_PROVIDER_LIFECYCLE_GUARD = process.env.FORGE_STRICT_PROVIDER_LIFECYCLE_GUARD !== "0";
-function decodeClaudeRateLimitWindows(raw) {
+/**
+* The SDK's own `rate_limit_info` off one ClaudeAdapter rate-limit event, or
+* nothing. Both readers below start here: the banner takes the single window
+* `rateLimitType` names, and passive usage telemetry takes the `unifiedWindows`
+* sub-object riding along on the same object.
+*/
+function readClaudeRateLimitInfo(raw) {
 	const rateLimitInfo = raw.rate_limit_info;
-	if (rateLimitInfo === null || typeof rateLimitInfo !== "object") return [];
+	if (rateLimitInfo === null || typeof rateLimitInfo !== "object") return null;
+	return rateLimitInfo;
+}
+function decodeClaudeRateLimitWindows(raw) {
+	const rateLimitInfo = readClaudeRateLimitInfo(raw);
+	if (!rateLimitInfo) return [];
 	const mapped = mapClaudeRateLimitInfo(rateLimitInfo);
 	return mapped ? [{
 		window: mapped.kind === "fiveHour" ? "five_hour" : "seven_day",
 		...mapped.window
 	}] : [];
 }
+/** The raw telemetry object ClaudeAdapter/CodexAdapter wrap as `payload.rateLimits`. */
+function readRateLimitPayload(event) {
+	if (event.type !== "account.rate-limits.updated") return null;
+	const raw = event.payload.rateLimits;
+	return raw !== null && typeof raw === "object" ? raw : null;
+}
 /**
 * Codex's app-server protocol shape isn't type-published anywhere this
-* codebase has access to, so it's read defensively - an unrecognized shape
-* is skipped rather than thrown, since this is a best-effort in-chat notice,
-* never load-bearing for the turn itself.
+* codebase has access to, so it's read defensively. An unrecognized shape
+* is skipped rather than thrown, since this is a best-effort in-chat notice
+* that the turn itself never depends on.
 */
 /**
 * Decodes ONE window of the codex app-server `account/rateLimits/updated`
@@ -287224,6 +287901,9 @@ function shouldApplyProviderTurnCompleted(activeTurnId, eventTurnId) {
 }
 const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$1("make")(function* () {
 	const orchestrationEngine = yield* OrchestrationEngineService;
+	const claudeUsageTelemetry = yield* ClaudeUsageTelemetry;
+	const claudeUsageScope = yield* make$37("parallel");
+	yield* addFinalizer$2(() => close(claudeUsageScope, void_$3));
 	const providerService = yield* ProviderService;
 	const projectionTurnRepository = yield* ProjectionTurnRepository;
 	const serverSettingsService = yield* ServerSettingsService;
@@ -287631,18 +288311,53 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	* SDKRateLimitInfo, reused from apps/server/src/usage/providerRateLimits.ts
 	* (same decoder the Usage page cache uses). Codex's app-server protocol
 	* shape isn't type-published anywhere this codebase has access to, so it's
-	* read defensively - an unrecognized shape means no window update, not a
-	* thrown error, since this is a best-effort in-chat notice, never load-
-	* bearing for the turn itself.
+	* read defensively. An unrecognized shape means no window update, not a
+	* thrown error, since this is a best-effort in-chat notice that the turn
+	* itself never depends on.
 	*/
 	function decodeRateLimitWindows(event) {
-		if (event.type !== "account.rate-limits.updated") return [];
-		const raw = event.payload.rateLimits;
-		if (raw === null || typeof raw !== "object") return [];
+		const raw = readRateLimitPayload(event);
+		if (!raw) return [];
 		if (event.provider === "claudeAgent") return decodeClaudeRateLimitWindows(raw);
 		if (event.provider === "codex") return decodeCodexRateLimitWindows(raw);
 		return [];
 	}
+	/**
+	* The credential generation a Claude thread's live session runs on, or null.
+	*
+	* It is the delivery identity the readiness guard verified before the
+	* session started, which ProviderService writes into the provider resume
+	* cursor and `listSessions` hands back on the live session. Claude's
+	* delivery identity is `{kind: "credential_generation"}` and carries NO
+	* account field, so it cannot stand in for the account the thread's model
+	* selection names, and neither id is derivable from the other. The usage
+	* observer drops an observation missing either one, because publishing under
+	* a guessed id would write one account's usage onto another account's card.
+	*/
+	const claudeCredentialGenerationId = fn$1("claudeCredentialGenerationId")(function* (threadId) {
+		const cursor = (yield* providerService.listSessions()).find((entry) => entry.threadId === threadId && entry.provider === "claudeAgent")?.resumeCursor;
+		const binding = cursor !== null && typeof cursor === "object" ? readProviderDeliveryBinding(cursor.providerDeliveryBinding) : null;
+		return binding?.identity.kind === "credential_generation" ? binding.identity.credentialGenerationId : null;
+	});
+	/**
+	* Publishes the unified windows the same event already carried for the
+	* banner. Passive: no probe, no credential delivery, no woken sprite. The SDK
+	* reports these figures on every turn whether anything reads them or not.
+	* The observer owns the floor, the credential generation lookup, dedupe, the
+	* timeout and the HTTP call, and never fails.
+	*/
+	const observeClaudeUsage = fn$1("observeClaudeUsage")(function* (event, thread) {
+		if (event.provider !== "claudeAgent") return;
+		const raw = readRateLimitPayload(event);
+		const rateLimitInfo = raw ? readClaudeRateLimitInfo(raw) : null;
+		const windows = rateLimitInfo ? mapClaudeUnifiedWindows(rateLimitInfo) : null;
+		if (!windows) return;
+		yield* claudeUsageTelemetry.observe({
+			windows,
+			providerAccountId: readProviderAccountId(thread.modelSelection) ?? null,
+			credentialGenerationId: claudeCredentialGenerationId(thread.id)
+		});
+	});
 	const handleRateLimitEvent = fn$1("handleRateLimitEvent")(function* (event, thread) {
 		const provider = event.provider === "claudeAgent" ? "claude" : event.provider === "codex" ? "codex" : null;
 		if (!provider) return;
@@ -287658,6 +288373,10 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 			resetsAt: win.resetsAt,
 			createdAt: event.createdAt
 		}), { discard: true });
+		yield* observeClaudeUsage(event, thread).pipe(catchCause((cause) => hasInterruptsOnly(cause) ? void_$1 : logWarning$1("claude usage observation failed", {
+			eventId: event.eventId,
+			cause
+		})), forkIn(claudeUsageScope));
 	});
 	const processRuntimeEvent = fn$1("processRuntimeEvent")(function* (event) {
 		const thread = (yield* orchestrationEngine.getReadModel()).threads.find((entry) => entry.id === event.threadId);
@@ -287772,6 +288491,44 @@ const ProviderRuntimeIngestionLive = effect(ProviderRuntimeIngestionService, fn$
 	};
 })()).pipe(provide$1(ProjectionTurnRepositoryLive));
 //#endregion
+//#region src/usage/Layers/ClaudeUsageTelemetry.ts
+/**
+* The real publish behind `ClaudeUsageTelemetry`: the owner's CMMD credential
+* and one POST to `CLAUDE_USAGE_TELEMETRY_PATH`.
+*
+* The call always goes out on the owner session credential, never on a
+* runtime grant.
+*
+* A machine with nobody signed in, or one whose CMMD credential cannot be
+* minted, fails the publish rather than reporting success. The observer only
+* remembers a value it managed to send, so a quiet success here would suppress
+* the publish for as long as that reading stayed the same, which on a stable
+* account is hours.
+*
+* @module ClaudeUsageTelemetryLive
+*/
+const LOG_PREFIX = "claude-usage-passive-telemetry";
+const ClaudeUsageTelemetryLive = effect(ClaudeUsageTelemetry, gen(function* () {
+	const sql = yield* SqlClient;
+	const publish = (body) => gen(function* () {
+		const credential = yield* resolveCmmdOwnerSessionCredential(sql, { logPrefix: LOG_PREFIX });
+		if (credential.kind !== "credential") return yield* new ClaudeUsageTelemetryPublishError({ reason: credential.kind });
+		yield* tryPromise({
+			try: () => cmmdGateway.request({
+				method: "POST",
+				jwt: credential.jwt,
+				path: CLAUDE_USAGE_TELEMETRY_PATH,
+				body
+			}),
+			catch: (cause) => new ClaudeUsageTelemetryPublishError({
+				reason: "request-failed",
+				cause
+			})
+		});
+	});
+	return makeClaudeUsageTelemetry({ publish });
+}));
+//#endregion
 //#region ../../packages/shared/src/DrainableWorker.ts
 /**
 * Create a drainable worker that processes items from an unbounded queue.
@@ -293520,7 +294277,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "fe3ee5efe095539824d092372a8dde00f1e2f98c";
+	return "8cafbb87b6204b98e93c1c69253c1c590af5f8a1";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -302551,7 +303308,7 @@ const LocalAutomationSchedulerLive = effectDiscard(gen(function* () {
 }));
 //#endregion
 //#region src/command/providerUsageEnvironment.ts
-function asRecord$3(value) {
+function asRecord$4(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
 function positiveInteger(value) {
@@ -302571,7 +303328,7 @@ function readRuntimeId(row) {
 	return typeof runtimeId === "string" && runtimeId.trim() !== "" ? runtimeId : null;
 }
 function readCandidate(runtime, ownerUserId) {
-	const row = asRecord$3(runtime);
+	const row = asRecord$4(runtime);
 	if (row === null || !isOwnedRuntime(row, ownerUserId) || row["desiredState"] !== "running") return null;
 	const organizationId = positiveInteger(row["organizationId"]);
 	const environmentId = readEnvironmentId(row["environmentId"]);
@@ -302606,15 +303363,17 @@ function deduplicateCandidates(candidates) {
 * organization from browser input.
 */
 function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
-	const runtimes = asRecord$3(asRecord$3(rawCatalog)?.["data"])?.["runtimes"];
+	const runtimes = asRecord$4(asRecord$4(rawCatalog)?.["data"])?.["runtimes"];
 	if (!Array.isArray(runtimes)) return { kind: "unavailable" };
 	const candidates = deduplicateCandidates(runtimes.map((runtime) => readCandidate(runtime, ownerUserId)).filter((candidate) => candidate !== null));
 	const bestRank = Math.min(...candidates.map((candidate) => statusRank(candidate.status)));
 	const bestCandidates = candidates.filter((candidate) => statusRank(candidate.status) === bestRank);
 	if (bestCandidates.length !== 1) return { kind: "unavailable" };
+	const selected = bestCandidates[0];
 	return {
 		kind: "ready",
-		organizationId: bestCandidates[0].organizationId
+		organizationId: selected.organizationId,
+		runtimeId: selected.runtimeId
 	};
 }
 //#endregion
@@ -302635,13 +303394,22 @@ function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
 const FAILURE_TEXT = {
 	CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE: "Refresh needs your Environment running.",
 	CLAUDE_USAGE_CREDENTIAL_NOT_READY: "The Claude credential is not applied to your Environment yet.",
+	CLAUDE_USAGE_CREDENTIAL_APPLY_FAILED: "Your Environment rejected the delivered Claude credential.",
+	CLAUDE_USAGE_CREDENTIAL_REFRESHING: "The delivered Claude credential expired. CMMD is sending a replacement.",
 	CLAUDE_USAGE_REFRESH_IN_PROGRESS: "A refresh for this account is already running.",
 	CLAUDE_USAGE_PROBE_FAILED: "Your Environment could not read Claude usage.",
 	CLAUDE_USAGE_RECONNECT_REQUIRED: "Reconnect this Claude account to refresh usage.",
 	CLAUDE_USAGE_ACCOUNT_NOT_FOUND: "This Claude account is no longer connected.",
 	CLAUDE_USAGE_REFRESH_UNAVAILABLE: "Claude usage refresh is unavailable."
 };
-/** Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`. */
+/**
+* Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`.
+*
+* Three reasons land on `CLAUDE_USAGE_CREDENTIAL_NOT_READY` because the refresh
+* response cannot tell them apart. `claudeUsageCredentialReadiness.ts` splits
+* them afterwards by reading the runtime's readiness, which is the only place
+* that knows whether a delivery is on its way or has already failed.
+*/
 const CODE_BY_UPSTREAM_REASON = {
 	runtime_not_active: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
 	claude_native_delivery_disabled: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
@@ -302654,7 +303422,12 @@ const CODE_BY_UPSTREAM_REASON = {
 	usage_receipt_invalid: "CLAUDE_USAGE_PROBE_FAILED",
 	usage_output_invalid: "CLAUDE_USAGE_PROBE_FAILED"
 };
-function failure(code, status) {
+/**
+* The one place a failure body is built, so every sentence a browser reads is
+* written in `FAILURE_TEXT` above. `claudeUsageCredentialReadiness.ts` calls it
+* to reach the two codes no upstream reason maps to.
+*/
+function describeClaudeUsageRefreshFailureCode(code, status) {
 	return {
 		status,
 		body: {
@@ -302663,6 +303436,9 @@ function failure(code, status) {
 		}
 	};
 }
+function failure(code, status) {
+	return describeClaudeUsageRefreshFailureCode(code, status);
+}
 /**
 * CMMD sends the reason as `{ "error": "<reason>" }`. Anything else, including
 * a longer sentence that happens to start with an allowlisted word, is treated
@@ -302683,6 +303459,77 @@ function describeClaudeUsageRefreshFailure(error) {
 	return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", error.status === 503 ? 503 : 502);
 }
 //#endregion
+//#region src/command/claudeUsageCredentialReadiness.ts
+/**
+* Which "credential not ready" a Claude usage refresh actually hit.
+*
+* CMMD answers a blocked refresh with one reason for three different worlds:
+* a delivery still travelling, a delivery CMMD cannot produce, and a delivery
+* the Environment already ran and rejected. `claudeUsageRefreshFailure.ts` has
+* to collapse all three into `CLAUDE_USAGE_CREDENTIAL_NOT_READY`, because the
+* refresh response carries nothing that separates them. The card then says
+* "not applied yet", which asks the user to wait even when waiting can never
+* work: on 2026-09-08 CMMD's reconciler failed native credential validation on
+* runtime 523cd771 forty-three times in seventy-two minutes, and the card said
+* "yet" through all of it.
+*
+* The runtime readiness read is the one source that separates the worlds, so
+* the handler makes that read only for the collapsed code and hands the answer
+* here. Every sentence is written in `claudeUsageRefreshFailure.ts`; nothing
+* from CMMD's `lastErrorCode` or `lastErrorMessage` is repeated to a browser.
+*/
+const CMMD_READINESS_PATH_PREFIX = "/api/forge/context/providers/claude/runtime-readiness/";
+/** Typed as the gateway's absolute-path shape so the call site needs no cast. */
+function claudeUsageReadinessPath(runtimeId) {
+	return `${CMMD_READINESS_PATH_PREFIX}${encodeURIComponent(runtimeId)}`;
+}
+/**
+* Whether a readiness read would tell the caller anything it does not know.
+*
+* Only the collapsed code is ambiguous. Every other failure already names its
+* own cause, so asking CMMD again would cost a round trip on the error path
+* and could only produce a less specific answer.
+*/
+function claudeUsageFailureWantsReadiness(failure) {
+	return failure.body.code === "CLAUDE_USAGE_CREDENTIAL_NOT_READY";
+}
+function asRecord$3(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function readString(value) {
+	return typeof value === "string" && value !== "" ? value : null;
+}
+/**
+* Refines the collapsed credential failure using the runtime's readiness.
+*
+* The ranking is by what the user can act on, not by which field looks most
+* severe:
+*
+* 1. A reason of `credential_reconnect_required` or `credential_not_connected`
+*    means CMMD holds no usable grant. That is upstream of delivery, so it wins
+*    even when the delivery it caused also failed. No re-delivery helps; only a
+*    reconnect does.
+* 2. `deliveryStatus: "failed"` means CMMD had a credential, sent it, and the
+*    Environment rejected it. Waiting cannot fix that, which is exactly what
+*    the collapsed sentence tells the user to do.
+* 3. `credential_expired_refreshing` means a replacement is already in flight,
+*    so the honest instruction is to retry shortly.
+*
+* Anything else, including a readiness read that failed or answered a shape
+* this module does not recognise, keeps the collapsed failure. A refinement
+* that guessed would be worse than the vague sentence it replaced.
+*/
+function refineClaudeUsageRefreshFailure(failure, rawReadiness) {
+	if (!claudeUsageFailureWantsReadiness(failure)) return failure;
+	const readiness = asRecord$3(asRecord$3(rawReadiness)?.["data"]);
+	if (readiness === null) return failure;
+	const reasonCode = claudeReadinessReasonCode(readString(readiness["reason"]));
+	if (reasonCode === "CREDENTIAL_RECONNECT_REQUIRED") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_RECONNECT_REQUIRED", 409);
+	if (readiness["deliveryStatus"] === "failed") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_CREDENTIAL_APPLY_FAILED", 503);
+	if (reasonCode === "CREDENTIAL_EXPIRED_REFRESHING") return describeClaudeUsageRefreshFailureCode("CLAUDE_USAGE_CREDENTIAL_REFRESHING", 503);
+	return failure;
+}
+//#endregion
 //#region src/command/wsToken.ts
 /**
 * Build the WS token response given an optional PAT and the configured CMMD
@@ -304547,6 +305394,25 @@ function buildClaudeUsageRefreshErrorResponse(error) {
 	const failure = describeClaudeUsageRefreshFailure(error);
 	return jsonUnsafe(failure.body, { status: failure.status });
 }
+/**
+* Answers a refresh CMMD refused, asking the selected runtime what state its
+* Claude credential is in when the refusal alone cannot say. Only the collapsed
+* credential code costs the extra read, and a readiness read that itself fails
+* leaves the original answer untouched.
+*/
+function answerBlockedClaudeUsageRefresh(input) {
+	return gen(function* () {
+		const failure = describeClaudeUsageRefreshFailure(input.error);
+		if (!claudeUsageFailureWantsReadiness(failure)) return jsonUnsafe(failure.body, { status: failure.status });
+		const readinessOutcome = yield* runCmmdRestProxy(input.session, (jwt) => cmmdGateway.request({
+			method: "GET",
+			jwt,
+			path: claudeUsageReadinessPath(input.runtimeId)
+		}), { jwt: input.requestJwt });
+		const refined = refineClaudeUsageRefreshFailure(failure, readinessOutcome.ok ? readinessOutcome.value : null);
+		return jsonUnsafe(refined.body, { status: refined.status });
+	});
+}
 function makeRefreshProviderUsageHandler(dependencies = {}) {
 	return gen(function* () {
 		const request = yield* HttpServerRequest;
@@ -304583,7 +305449,12 @@ function makeRefreshProviderUsageHandler(dependencies = {}) {
 				body: { providerAccountId: input.providerAccountId },
 				orgId: String(target.organizationId)
 			}), { jwt: requestJwt });
-			if (!refreshOutcome.ok) return buildClaudeUsageRefreshErrorResponse(refreshOutcome.error);
+			if (!refreshOutcome.ok) return yield* answerBlockedClaudeUsageRefresh({
+				session,
+				requestJwt,
+				runtimeId: target.runtimeId,
+				error: refreshOutcome.error
+			});
 			const snapshotOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.request({
 				method: "GET",
 				jwt,
@@ -304682,6 +305553,22 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
+registerProxyRoute({
+	forgePath: "/api/cmmd/forge-runtimes/:runtimeId/execution-intents",
+	method: "POST",
+	cmmdPath: "/api/forge/context/runtimes/:runtimeId/execution-intents",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 200
+});
+registerProxyRoute({
+	forgePath: "/api/cmmd/forge-runtimes/:runtimeId/execution-intents/:intentId/dispatched",
+	method: "POST",
+	cmmdPath: "/api/forge/context/runtimes/:runtimeId/execution-intents/:intentId/dispatched",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 200
+});
 registerProxyRoute({
 	forgePath: "/api/cmmd/devices/:deviceId/revoke",
 	method: "POST",
@@ -315874,7 +316761,7 @@ function claimClaudeReadinessJti(input) {
 	return "claimed";
 }
 const readUsableClaudeGenerationHash = (config) => {
-	const configuredGenerationHash = process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
+	const configuredGenerationHash = bootExportedPersonalClaudeGenerationHash();
 	if (!/^[a-f0-9]{64}$/.test(configuredGenerationHash)) return succeed(null);
 	return tryPromise(() => readFile$1(resolveLocalClaudeCredentialPath(config.forgeClaudeConfigPath), "utf8")).pipe(map$3((credentialJson) => isClaudeSubscriptionCredential(credentialJson) ? configuredGenerationHash : null), orElseSucceed(() => null));
 };
@@ -316389,7 +317276,7 @@ const PlatformServicesLive = unwrap(gen(function* () {
 }));
 const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(provideMerge(RuntimeReplicationClientLive), provideMerge(RuntimeReplicationOutboxLive), provideMerge(ActiveHourMeterLive.pipe(provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(provideMerge(RuntimeDrainStateLive));
-const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive));
+const RuntimeAwareProviderReactorsLive = mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(provide$1(RuntimeDrainLayerLive), provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(provideMerge(PipelineRunClientLive));
 const AgentProtocolReactorLayerLive = AgentProtocolReactorLive.pipe(provideMerge(PipelineRunStoreLive));
 const PipelineRunCoordinatorLayerLive = PipelineRunCoordinatorLive.pipe(provideMerge(PipelineProviderAuthorityInstallerLive), provideMerge(PipelineChangeInspectorLive), provideMerge(PipelineContextArtifactStoreLive), provideMerge(PipelineModelPolicyLive), provideMerge(PipelineRunClientLive), provideMerge(PipelineRunStoreLive), provideMerge(PipelineRunWorkspaceAllocatorLive), provideMerge(PipelineStagePolicyLive), provideMerge(PipelineWorkerCoordinatorLayerLive));
@@ -317378,7 +318265,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},