@cmmd-center/forge 0.10.4 → 0.10.6

package/dist/bin.cjs

@@ -16544,7 +16544,7 @@ function makeNetServiceShape(createServer = node_net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.10.3";
+const FORGE_RELEASE_VERSION = "0.10.4";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -18213,6 +18213,7 @@ const ExecutionEnvironmentDescriptor = require_Schema$1.Struct({
 	platform: ExecutionEnvironmentPlatform,
 	serverVersion: TrimmedNonEmptyString,
 	buildCommit: require_Schema$1.optional(TrimmedNonEmptyString),
+	deviceRuntimeId: require_Schema$1.optional(TrimmedNonEmptyString),
 	capabilities: ExecutionEnvironmentCapabilities
 });
 require_Schema$1.Literals([
@@ -22079,6 +22080,7 @@ const ClientSettingsSchema = require_Schema$1.Struct({
 	confirmThreadArchive: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(true))),
 	confirmThreadDelete: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(true))),
 	showInteractionModeToggle: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(false))),
+	composerCollapseOnBlur: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(true))),
 	diffWordWrap: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(true))),
 	previewAutoOpen: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(false))),
 	previewRememberLastUrl: require_Schema$1.Boolean.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(true))),
@@ -26338,7 +26340,7 @@ function acceptCmmdProjectPatchField(field, raw) {
 //#region ../../packages/contracts/src/cloud.ts
 /**
 * One entry returned by `GET /api/cloud/available-folders` — a candidate
-* subdirectory of the managed runtime's `cloudProjectsRoot` (typically `/data/Projects`)
+* subdirectory of the managed runtime's `cloudProjectsRoot` (typically `/projects`)
 * that the SPA can offer in the cloud-mode "Register existing folder" picker.
 */
 const CloudAvailableFolder = require_Schema$1.Struct({
@@ -65376,7 +65378,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.4";
+var version$1 = "0.10.6";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -68161,6 +68163,15 @@ function parsePersistedServerObservabilitySettings(raw) {
 * @module ServerConfig
 */
 const DEFAULT_PORT = 13773;
+/**
+* Where a managed cloud runtime keeps the user's checkouts when
+* FORGE_CLOUD_PROJECTS_ROOT is not set. CMMD seeds every sprite checkout under
+* /projects (forge-guest-layout.ts on the CMMD side) and passes that value in
+* the Service env, so this default only matters for a server started without
+* it. It used to be a path under the Fly-era mounted volume; on a sprite the
+* two repos disagreed and every local-checkout turn was refused (FOR-36484).
+*/
+const DEFAULT_CLOUD_PROJECTS_ROOT = "/projects";
 const RuntimeMode = require_Schema$1.Literals(["web", "desktop"]);
 require_Schema$1.Literals(["browser", "headless"]);
 const deriveServerPaths = require_Schema$1.fn(function* (baseDir, _devUrl, _mode) {
@@ -68286,7 +68297,7 @@ var ServerConfig = class ServerConfig extends require_Schema$1.Service()("forge/
 			forgeCodexHomePath: void 0,
 			forgeClaudeConfigPath: void 0,
 			forgeApexBaseUrl: void 0,
-			cloudProjectsRoot: "/data/Projects",
+			cloudProjectsRoot: DEFAULT_CLOUD_PROJECTS_ROOT,
 			...overrides
 		};
 	}));
@@ -97489,7 +97500,7 @@ const resolveAutoBootstrapWelcomeTargets = require_Schema$1.gen(function* () {
 /**
 * Cloud-mode project recovery — runs only on cloud execution runtimes.
 * Scans `cloudProjectsRoot` (default
-* /data/Projects) for git-repo subdirectories and registers any not yet in
+* /projects) for git-repo subdirectories and registers any not yet in
 * the orchestration engine. This is the cloud-mode replacement for the
 * gated `autoBootstrapProjectFromCwd` path: managed runtimes whose volume
 * already holds cloned repos surface them in the sidebar after restart.
@@ -149778,13 +149789,40 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 		if (!providerConversationId) return;
 		return context.collabReceiverTurns.get(providerConversationId);
 	}
+	/**
+	* The child threads one thread item says the turn spawned.
+	*
+	* Two item shapes name a child, and which one arrives depends on the Codex
+	* build. `CollabAgentToolCallThreadItem` lists `receiverThreadIds`, which
+	* "in case of spawn operation ... corresponds to the newly spawned agent".
+	* `SubAgentActivityThreadItem` names a single `agentThreadId` and is what a
+	* `spawn_agent` call reports on codex-cli 0.152/0.153: measured on the
+	* packaged desktop on 2026-09-06, the spawn arrived as `SubAgentActivity`
+	* (`kind: started`) and the only collab tool call that followed was the
+	* `wait`, whose `receiverThreadIds` was empty. Reading only the collab item
+	* left the child unmapped, so its spend was published as a second turn row
+	* under the child's own turn id instead of a subagent row under the parent's.
+	*
+	* `SubAgentActivityThreadItem` has no `model` field, so a `completed` report
+	* for a child a collab call already named must not blank the model out; the
+	* caller's `model ?? known` merge is what keeps it.
+	*/
+	readSpawnedThreadIds(item, itemType) {
+		if (itemType === "subAgentActivity") {
+			const agentThreadId = this.readString(item, "agentThreadId");
+			return agentThreadId ? [agentThreadId] : [];
+		}
+		if (itemType !== "collabAgentToolCall") return [];
+		return this.readArray(item, "receiverThreadIds")?.map((value) => typeof value === "string" ? value : null).filter((value) => value !== null) ?? [];
+	}
 	rememberCollabReceiverTurns(context, params, parentTurnId) {
 		if (!parentTurnId) return;
 		const payload = this.readObject(params);
 		const item = this.readObject(payload, "item") ?? payload;
-		if ((this.readString(item, "type") ?? this.readString(item, "kind")) !== "collabAgentToolCall") return;
+		const itemType = this.readString(item, "type") ?? this.readString(item, "kind");
+		const receiverThreadIds = this.readSpawnedThreadIds(item, itemType);
+		if (receiverThreadIds.length === 0) return;
 		const model = this.readString(item, "model");
-		const receiverThreadIds = this.readArray(item, "receiverThreadIds")?.map((value) => typeof value === "string" ? value : null).filter((value) => value !== null) ?? [];
 		for (const receiverThreadId of receiverThreadIds) {
 			const known = context.collabReceiverTurns.get(receiverThreadId)?.model;
 			const resolved = model ?? known;
@@ -149800,8 +149838,8 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 	* Codex reports a child thread's tokens on the parent's own connection:
 	* `ThreadTokenUsageUpdatedNotification` requires `threadId` and `turnId` and
 	* names the child thread for a child, and `Thread.parentThreadId` is "only
-	* set if this thread is a subagent" (codex 0.144.6 app-server protocol
-	* schema). Every other child notification is suppressed so it cannot replace
+	* set if this thread is a subagent" (still true of the codex-cli 0.153
+	* app-server protocol schema). Every other child notification is suppressed so it cannot replace
 	* the parent turn; this one is not, because the tokens belong on the ledger.
 	* The method is Forge's own rather than the protocol's, because the payload
 	* carries what the Usage row needs rather than what the notification held.
@@ -207597,11 +207635,14 @@ function mapCodexThreadTokenUsageEvent(event, canonicalThreadId, payload) {
 *
 * The source is the live app-server protocol, not a rollout read: Codex sends
 * `thread/tokenUsage/updated` for a child thread on the parent's own
-* connection (0.144.6 schema: `ThreadTokenUsageUpdatedNotification` requires
-* `threadId` and `turnId`, `Thread.parentThreadId` is set only for a subagent,
-* and `CollabAgentToolCallThreadItem` names `receiverThreadIds` and the
-* spawned agent's `model`), and `codexAppServerManager` already tracked those
-* child threads to route their notifications onto the parent turn.
+* connection (`ThreadTokenUsageUpdatedNotification` requires `threadId` and
+* `turnId`, and `Thread.parentThreadId` is set only for a subagent), and
+* `codexAppServerManager` already tracked those child threads to route their
+* notifications onto the parent turn. It learns a child from whichever item
+* the running Codex build uses to announce a spawn: the
+* `receiverThreadIds` of a `CollabAgentToolCallThreadItem`, which also names
+* the spawned agent's `model`, or the `agentThreadId` of a
+* `SubAgentActivityThreadItem`, which names no model.
 *
 * The row carries no context-meter snapshot and no `turnUsage`: the parent's
 * own row is never re-summed with its children. It carries the call's delta
@@ -208488,7 +208529,8 @@ const CODE_BY_UPSTREAM_REASON$1 = {
 	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
 	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
 	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED"
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
 };
 const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
 /**
@@ -208551,10 +208593,17 @@ function claudeNativeCredentialUnusableMessage() {
 * CMMD writes this marker when it activates a personal Claude subscription
 * inside a running sprite. Activation always happens after boot, so a
 * boot-time env var alone cannot reflect it (FOR-36249).
+*
+* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
+* Without that, the marker sits directly under FORGE_HOME, which is the same
+* guest home CMMD derives every sprite path from. A server with neither has no
+* sprite home to look in, and a desktop never has a marker, so it reads none.
 */
-const PERSONAL_CLAUDE_IN_VM_MARKER_PATH = "/data/.forge-personal-claude-in-vm";
+const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
 function markerPath(env) {
-	return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH || PERSONAL_CLAUDE_IN_VM_MARKER_PATH;
+	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
+	if (env.FORGE_HOME) return (0, node_path.join)(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
+	return null;
 }
 /**
 * True when this runtime should offer the personal Claude subscription lane.
@@ -208567,8 +208616,10 @@ function markerPath(env) {
 */
 function personalClaudeInVmEnabled(env = process.env) {
 	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
+	const marker = markerPath(env);
+	if (!marker) return false;
 	try {
-		return (0, node_fs.existsSync)(markerPath(env));
+		return (0, node_fs.existsSync)(marker);
 	} catch {
 		return false;
 	}
@@ -227179,7 +227230,8 @@ const CLAUDE_READINESS_COPY = {
 	failed: "Claude native runtime setup could not be applied. Reconnect Claude in Settings.",
 	invalid: "Claude native runtime readiness is no longer valid. Reconnect Claude in Settings.",
 	unavailable: "Claude native runtime readiness could not be verified.",
-	generationMismatch: "Claude native runtime generation does not match CMMD readiness."
+	generationMismatch: "Claude native runtime generation does not match CMMD readiness.",
+	environmentUnavailable: "This Environment is not running, so Claude cannot run on it. Restart the Environment, then try again."
 };
 var ClaudeRuntimeReadinessError = class extends Error {
 	constructor(safeIssue, retryable = false, retryProfile = "default") {
@@ -227249,6 +227301,7 @@ async function withReadinessRetry(attempt) {
 */
 function readinessReasonIssue(readiness) {
 	const code = claudeReadinessReasonCode(readiness.reason);
+	if (code === "RUNTIME_UNAVAILABLE") return CLAUDE_READINESS_COPY.environmentUnavailable;
 	if (code === "CREDENTIAL_RECONNECT_REQUIRED") return CLAUDE_READINESS_COPY.invalid;
 	if (code === "CREDENTIAL_GENERATION_NOT_APPLIED") return CLAUDE_READINESS_COPY.applying;
 	if (code !== "CREDENTIAL_EXPIRED_REFRESHING") return null;
@@ -227259,6 +227312,10 @@ function readinessReasonIssue(readiness) {
 function isCredentialRefreshInFlight(readiness) {
 	return claudeReadinessReasonCode(readiness.reason) === "CREDENTIAL_EXPIRED_REFRESHING";
 }
+/** True when CMMD says the runtime itself cannot take a delivery (CMMD-36473). */
+function isRuntimeUnavailable(readiness) {
+	return claudeReadinessReasonCode(readiness.reason) === "RUNTIME_UNAVAILABLE";
+}
 function readinessFailureIssue(readiness) {
 	const reasonIssue = readinessReasonIssue(readiness);
 	if (reasonIssue !== null) return reasonIssue;
@@ -227298,11 +227355,12 @@ function verifiedClaudeDeliveryBinding(readiness, authority) {
 function appliedClaudeGeneration(readiness) {
 	if (readiness.connected !== true || readiness.deliveryStatus !== "applied" || readiness.nativeExecutable !== true || typeof readiness.generationId !== "string" || readiness.generationId.trim().length === 0) {
 		const refreshing = isCredentialRefreshInFlight(readiness);
-		throw new ClaudeRuntimeReadinessError(readinessFailureIssue(readiness), refreshing || [
+		const retryable = !isRuntimeUnavailable(readiness) && (refreshing || [
 			"pending",
 			"claimed",
 			"activating"
-		].includes(readiness.deliveryStatus), refreshing ? "credentialRefresh" : "default");
+		].includes(readiness.deliveryStatus));
+		throw new ClaudeRuntimeReadinessError(readinessFailureIssue(readiness), retryable, refreshing ? "credentialRefresh" : "default");
 	}
 	return readiness.generationId;
 }
@@ -228460,15 +228518,15 @@ const collectOutput = require_Schema$1.fn("collectOutput")(function* (input, str
 /**
 * Adds a `safe.directory` exception to a git child environment.
 *
-* Forge runs git against workspaces on a mounted volume (`/data/Projects/...` on
-* Fly). A volume mount replaces the build-time ownership of its mountpoint, so a
+* Forge runs git against workspaces on a mounted volume (`<cloudProjectsRoot>/...`
+* on Fly). A volume mount replaces the build-time ownership of its mountpoint, so a
 * repository there can be owned by a uid other than the server's, and git then
 * refuses EVERY command against it with "detected dubious ownership" — the
 * FORGE-2T failure in `CheckpointStore.captureCheckpoint`.
 *
 * The exception has to be `*`, verified against git 2.43:
 * - git compares `safe.directory` entries literally, so a prefix such as
-*   `/data/Projects/*` does not match the repository at all.
+*   `/projects/*` does not match the repository at all.
 * - the value must name the DISCOVERED REPOSITORY ROOT, which is an ancestor of
 *   `cwd` whenever a command runs from a subdirectory. Resolving that root means
 *   asking git, which is the command being refused.
@@ -291410,7 +291468,7 @@ const ServerLoggerLive = require_Schema$1.gen(function* () {
 * Observed live on a Forge Cloud sprite (2026-07-25): the browser opens
 * `wss://<sprite>.sprites.app/ws?routeKey=…&runtimeTicket=<JWT>`, and the HTTP
 * instrumentation records `url.full` / `url.query` verbatim. The ticket then
-* lands in `/data/userdata/logs/server.trace.ndjson` at mode 644 — readable by
+* lands in `<FORGE_HOME>/userdata/logs/server.trace.ndjson` at mode 644 — readable by
 * the same user the agent runs as — and the URL also crosses fly.io's edge,
 * where infrastructure we do not control may log it.
 *
@@ -291707,7 +291765,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "986939d02dd54d5adfd34ed23f2d67fece201f9a";
+	return "5f0060a9696edd41f61f06cbf24450a5994fed33";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -291796,6 +291854,25 @@ function runtimeTopology(serverConfig) {
 	if (serverConfig.mode === "desktop") return "desktop-local";
 	return "local-web";
 }
+/**
+* The CMMD device runtime id to publish on this server's descriptor.
+*
+* A client cannot work this out for itself. Its only other source is page
+* storage, which holds this machine's id when the page runs inside the desktop
+* shell and a freshly minted browser id otherwise, so opening the same local
+* server at `127.0.0.1` in Safari made the desktop look like a remote runtime
+* (FOR-36439). The server was told the id at boot, so the server says it.
+*
+* The cloud shell is excluded on purpose. It is a control plane, not an
+* execution runtime, and its own provider list is empty; publishing a runtime
+* id there would let the SPA resolve some target as "the server I am talking
+* to" and read models off a surface that runs nothing. Everything else with no
+* registration (dev checkouts, plain `forge serve`) already answers undefined.
+*/
+function resolveDescriptorDeviceRuntimeId(config) {
+	if (config.forgeCloudShellMode === true) return void 0;
+	return resolveRuntimeReplicationRuntimeId(config);
+}
 function executionEnvironmentCapabilities(serverConfig) {
 	const isCloudShell = serverConfig.forgeCloudShellMode === true;
 	const isRuntime = serverConfig.forgeCmmdRuntimeMode === true && !isCloudShell;
@@ -291870,6 +291947,7 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 		env: process.env,
 		readGitCommit: resolveForgeGitCommit
 	}));
+	const deviceRuntimeId = resolveDescriptorDeviceRuntimeId(serverConfig);
 	const buildDescriptor = require_Schema$1.gen(function* () {
 		const displayNameOverride = yield* require_HttpServer.get$1(displayNameOverrideRef);
 		const os = platformOs();
@@ -291882,6 +291960,7 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 			},
 			serverVersion: version$1,
 			...buildCommit !== void 0 ? { buildCommit } : {},
+			...deviceRuntimeId !== void 0 ? { deviceRuntimeId } : {},
 			capabilities: {
 				...executionEnvironmentCapabilities(serverConfig),
 				posthogPublicKey: posthog.posthogPublicKey,
@@ -299738,16 +299817,6 @@ function describeDispatchCause(cause) {
 	if (deepest === void 0 || deepest.length <= DISPATCH_CAUSE_DETAIL_LIMIT) return deepest;
 	return `${deepest.slice(0, DISPATCH_CAUSE_DETAIL_LIMIT)}...`;
 }
-/**
-* Where automation-created projects live when the caller does not say.
-*
-* This is the documented default of the `cloudProjectsRoot` setting
-* (FORGE_CLOUD_PROJECTS_ROOT, see cli.ts) and exists only for direct callers
-* such as tests. Every HTTP route passes the CONFIGURED value instead: reading
-* the default here is what made a runtime configured with any other root create
-* its automation projects in a directory nothing else read.
-*/
-const DEFAULT_CLOUD_PROJECTS_ROOT = "/data/Projects";
 const respondToOrchestrationHttpError = (error) => require_Schema$1.gen(function* () {
 	if (error._tag === "OrchestrationGetSnapshotError") {
 		yield* require_Schema$1.logError("orchestration http route failed", {
@@ -314725,7 +314794,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => require_Schema$1.ge
 		forgeCodexHomePath: env.forgeCodexHomePath,
 		forgeClaudeConfigPath: env.forgeClaudeConfigPath,
 		forgeApexBaseUrl: env.forgeApexBaseUrl,
-		cloudProjectsRoot: env.cloudProjectsRoot ?? "/data/Projects"
+		cloudProjectsRoot: env.cloudProjectsRoot ?? "/projects"
 	};
 	if (config.forgeCloudShellMode === true && (!config.forgeCloudOwnerAssertionPublicKey?.trim() || !config.forgeCloudOwnerAssertionKeyId?.trim())) return yield* require_Schema$1.die(/* @__PURE__ */ new Error("FORGE_CMMD_CLOUD_OWNER_ASSERTION_PUBLIC_KEY and FORGE_CMMD_CLOUD_OWNER_ASSERTION_KEY_ID are required in cloud-shell mode; runtime ticket keys are not accepted for Cloud owner assertions."));
 	if (config.forgeCloudShellMode === true && !isEd25519PublicKey(config.forgeCloudOwnerAssertionPublicKey ?? "")) return yield* require_Schema$1.die(/* @__PURE__ */ new Error("FORGE_CMMD_CLOUD_OWNER_ASSERTION_PUBLIC_KEY must be a valid Ed25519 public key in cloud-shell mode."));