@cmmd-center/forge 0.10.5 → 0.10.7

package/dist/bin.mjs

@@ -24231,6 +24231,7 @@ const UsageBucket = Struct({
 	costSource: UsageCostSource,
 	records: NonNegativeInt,
 	unpricedRecords: NonNegativeInt,
+	unreportedRecords: optional$4(NonNegativeInt),
 	sessions: NonNegativeInt,
 	runtimeId: optional$4(TrimmedNonEmptyString),
 	origin: optional$4(UsageBucketOrigin),
@@ -65120,7 +65121,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.10.5";
+var version$1 = "0.10.7";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67888,6 +67889,15 @@ function parsePersistedServerObservabilitySettings(raw) {
 * @module ServerConfig
 */
 const DEFAULT_PORT = 13773;
+/**
+* Where a managed cloud runtime keeps the user's checkouts when
+* FORGE_CLOUD_PROJECTS_ROOT is not set. CMMD seeds every sprite checkout under
+* /projects (forge-guest-layout.ts on the CMMD side) and passes that value in
+* the Service env, so this default only matters for a server started without
+* it. It used to be a path under the Fly-era mounted volume; on a sprite the
+* two repos disagreed and every local-checkout turn was refused (FOR-36484).
+*/
+const DEFAULT_CLOUD_PROJECTS_ROOT = "/projects";
 const RuntimeMode = Literals(["web", "desktop"]);
 Literals(["browser", "headless"]);
 const deriveServerPaths = fn$1(function* (baseDir, _devUrl, _mode) {
@@ -68013,7 +68023,7 @@ var ServerConfig = class ServerConfig extends Service$1()("forge/config/ServerCo
 			forgeCodexHomePath: void 0,
 			forgeClaudeConfigPath: void 0,
 			forgeApexBaseUrl: void 0,
-			cloudProjectsRoot: "/data/Projects",
+			cloudProjectsRoot: DEFAULT_CLOUD_PROJECTS_ROOT,
 			...overrides
 		};
 	}));
@@ -70017,6 +70027,14 @@ function invalidateCachedCmmdWorkIntakeForIdentity(identityKey) {
 *
 * Bespoke routes (MCP/PAT transport, hybrid fallback, multipart) stay in
 * http.ts and are NOT migrated here.
+*
+* A second, narrower entry point — `registerProxyHandler` / `ProxyHandlerRoute`
+* — covers routes whose middle (request parsing, the actual gateway call,
+* success shaping) cannot be expressed by the five `ProxyRoute` fields above,
+* while still sharing the same prologue: session auth, the CMMD-connection
+* gate, and the same `buildProxyErrorResponse` error mapping plus
+* `clearUnrecoverableCmmdAuthForSession` on an auth failure. See the type doc
+* below for the exact contract.
 */
 /** Substitutes ":paramName" tokens in a path template from a params record. */
 function substitutePath(template, params) {
@@ -70066,6 +70084,29 @@ function buildProxyErrorResponse(error) {
 	}
 	return jsonUnsafe({ error: "CMMD REST request failed." }, { status: 502 });
 }
+/**
+* Clears every unrecoverable CMMD credential tied to this session, logging a
+* warning rather than failing the request if the clear itself errors — a
+* session that already has no usable credential must still get its 401,
+* not a 500 from a failed best-effort cleanup.
+*/
+function clearCmmdAuthAfterFailure(sessionId) {
+	return clearUnrecoverableCmmdAuthForSession(sessionId).pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
+		cause: error,
+		sessionId
+	})));
+}
+/**
+* The single "no usable CMMD credential" response: clears whatever
+* unrecoverable auth state this session is holding, then returns the
+* canonical `CMMD_AUTH_REQUIRED` body. Every prologue path that decides the
+* session has no way to reach CMMD — a missing PAT, a JWT that fails to
+* resolve, a bespoke gate elsewhere in http.ts — emits this same response so
+* the Shell only ever has one `CMMD_AUTH_REQUIRED` body to branch on.
+*/
+function respondCmmdConnectionRequired(sessionId) {
+	return clearCmmdAuthAfterFailure(sessionId).pipe(as$3(buildProxyErrorResponse(new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue."))));
+}
 async function dispatchToProxy(method, jwt, cmmdPath, rawBody, orgId, searchParams) {
 	return cmmdGateway.request({
 		method,
@@ -70096,12 +70137,27 @@ function buildProxySearchParams(input) {
 	return Object.keys(result).length > 0 ? result : void 0;
 }
 const _registeredRoutes = [];
-/**
-* Generates an Effect HttpRouter layer for the given route.
-* The returned layer registers one handler at forgePath.
-*/
-function registerProxyRoute(route) {
-	_registeredRoutes.push(route);
+const _registeredLayers = [];
+/**
+* Layers produced by every registerProxyRoute call so far, in registration
+* order. Callers that want only the routes registered by their own module
+* should snapshot `.length` before their own registerProxyRoute calls run and
+* slice from that index — see command/http.ts's `cmmdProxyRouteLayers`.
+*
+* Typed via `ReturnType<typeof buildProxyRouteLayer>` (not `HttpRouter.add`
+* directly, and not `registerProxyRoute` itself — that would be circular
+* since registerProxyRoute pushes onto this same array): `buildProxyRouteLayer`
+* takes a concrete, non-generic `ProxyRoute` argument and never references
+* this array, so its return type is fully resolved independently. Referencing
+* the generic `HttpRouter.add` on its own instead collapses its unresolved E/R
+* type parameters to `unknown`, which then leaks into makeRoutesLayer's
+* requirements channel everywhere this array is spread.
+*/
+function registeredProxyRouteLayers() {
+	return Object.freeze([..._registeredLayers]);
+}
+/** Builds the Effect HttpRouter layer for one route, with no registry side effects. */
+function buildProxyRouteLayer(route) {
 	const handler = gen(function* () {
 		const req = yield* HttpServerRequest;
 		const session = yield* (yield* ServerAuth).authenticateHttpRequest(req);
@@ -70124,23 +70180,14 @@ function registerProxyRoute(route) {
 			forceRefresh
 		});
 		const jwt = yield* resolveJwt();
-		if (!jwt) {
-			yield* clearUnrecoverableCmmdAuthForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after missing JWT.", {
-				cause: error,
-				sessionId: session.sessionId
-			})));
-			return buildProxyErrorResponse(new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue."));
-		}
+		if (!jwt) return yield* respondCmmdConnectionRequired(session.sessionId);
 		let outcome = yield* promise(() => runProxy(() => dispatchToProxy(route.method, jwt, cmmdPath, rawBody, orgId, searchParams)));
 		if (!outcome.ok && outcome.error instanceof CmmdProxyAuthError) {
 			const refreshedJwt = yield* resolveJwt(true);
 			if (refreshedJwt && refreshedJwt !== jwt) outcome = yield* promise(() => runProxy(() => dispatchToProxy(route.method, refreshedJwt, cmmdPath, rawBody, orgId, searchParams)));
 		}
 		if (!outcome.ok) {
-			if (outcome.error instanceof CmmdProxyAuthError || outcome.error instanceof CmmdProxyAuthenticationRequiredError) yield* clearUnrecoverableCmmdAuthForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after REST 401.", {
-				cause: error,
-				sessionId: session.sessionId
-			})));
+			if (outcome.error instanceof CmmdProxyAuthError || outcome.error instanceof CmmdProxyAuthenticationRequiredError) yield* clearCmmdAuthAfterFailure(session.sessionId);
 			return buildProxyErrorResponse(outcome.error);
 		}
 		const payload = route.responseShape === "passthrough" ? outcome.value : unwrapEnvelope$1(outcome.value);
@@ -70150,6 +70197,59 @@ function registerProxyRoute(route) {
 	}).pipe(catchTag("AuthError", (error) => respondToAuthError(error)));
 	return add$1(route.method, route.forgePath, handler);
 }
+/**
+* Generates an Effect HttpRouter layer for the given route and records it in
+* the registry (for auditing / tests, and so command/http.ts's
+* `cmmdProxyRouteLayers` can pick it up). The returned layer registers one
+* handler at forgePath.
+*/
+function registerProxyRoute(route) {
+	_registeredRoutes.push(route);
+	const layer = buildProxyRouteLayer(route);
+	_registeredLayers.push(layer);
+	return layer;
+}
+/**
+* Builds the bare handler Effect for one handler route (no `HttpRouter.add`
+* wrapping, no registry side effects) — exposed on its own so tests can
+* exercise it the same way they exercise every other bespoke handler in
+* http.ts: providing `HttpServerRequest` / `ServerAuth` directly and running
+* the Effect, without standing up a router.
+*/
+function buildProxyHandlerEffect(route) {
+	return gen(function* () {
+		const req = yield* HttpServerRequest;
+		const session = yield* (yield* ServerAuth).authenticateHttpRequest(req);
+		if (!readCommandAccessTokenForSession(session.sessionId)) return yield* respondCmmdConnectionRequired(session.sessionId);
+		const parsed = yield* route.parse(req);
+		if (!parsed.ok) return jsonUnsafe(parsed.body, { status: parsed.status });
+		const result$4 = yield* route.run(parsed.value, { session }).pipe(result);
+		if (isFailure$1(result$4)) {
+			const error = result$4.failure;
+			if (error instanceof CmmdProxyAuthError || error instanceof CmmdProxyAuthenticationRequiredError) yield* clearCmmdAuthAfterFailure(session.sessionId);
+			return buildProxyErrorResponse(error);
+		}
+		return jsonUnsafe(result$4.success.body, { status: result$4.success.status });
+	}).pipe(catchTag("AuthError", (error) => respondToAuthError(error)));
+}
+const _registeredHandlerRoutes = [];
+/**
+* Builds the handler Effect for one route, mounts it via `HttpRouter.add` and
+* records that layer in the same registry `registerProxyRoute` uses (so
+* command/http.ts's `cmmdProxyRouteLayers` picks it up without a separate
+* mount list) — then returns the bare handler Effect rather than the layer,
+* so the caller can keep a single `__xHandlerForTests`-style export that
+* doubles as both the thing under test and the thing that gets mounted.
+*/
+function registerProxyHandler(route) {
+	_registeredHandlerRoutes.push({
+		method: route.method,
+		forgePath: route.forgePath
+	});
+	const handler = buildProxyHandlerEffect(route);
+	_registeredLayers.push(add$1(route.method, route.forgePath, handler));
+	return handler;
+}
 //#endregion
 //#region src/connect/credentialRefresh.ts
 async function refreshConnectCredential(deps) {
@@ -92262,6 +92362,172 @@ function classifyRuntimeReplicationHttpFailure(failure) {
 	};
 }
 //#endregion
+//#region src/runtimeReplication/runtimeLane.ts
+/**
+* Read a grant-lane response the way the gateway reads an owner-lane one: a
+* non-2xx becomes a `CmmdProxyRequestError` carrying the status and CMMD's
+* error code, so a caller can classify either lane's failure with one rule.
+*/
+async function parseRuntimeLaneResponse(response) {
+	const text = await response.text();
+	let body = null;
+	if (text) try {
+		body = JSON.parse(text);
+	} catch {
+		body = null;
+	}
+	if (!response.ok) {
+		const code = readRuntimeReplicationErrorCode(body);
+		throw new CmmdProxyRequestError(`CMMD runtime replication failed (${response.status})`, response.status, null, code ? { code } : null);
+	}
+	if (body === null) throw new Error("CMMD runtime replication returned an empty or invalid JSON response.");
+	return body;
+}
+/**
+* One request on whichever lane the runtime holds. The caller has already
+* built the path for `lane.kind`; this only decides the transport and the
+* credential header, and normalises failures to the gateway's error classes.
+*/
+async function requestOnRuntimeLane(lane, request, transport = {}) {
+	if (lane.kind === "owner-session") return (transport.gateway ?? cmmdGateway).request({
+		method: request.method,
+		jwt: lane.jwt,
+		path: request.path,
+		...request.body === void 0 ? {} : { body: request.body }
+	});
+	return parseRuntimeLaneResponse(await (transport.fetchImpl ?? fetch)(new URL(request.path, `${lane.controlPlaneUrl}/`), {
+		method: request.method,
+		headers: {
+			authorization: `Bearer ${lane.grantToken}`,
+			accept: "application/json",
+			...request.body === void 0 ? {} : { "content-type": "application/json" }
+		},
+		...request.body === void 0 ? {} : { body: JSON.stringify(request.body) },
+		...request.signal === void 0 ? {} : { signal: request.signal }
+	}));
+}
+function mapRuntimeReplicationClientError(error, operation) {
+	if (error instanceof CmmdProxyAuthError) return new RuntimeReplicationClientError({
+		kind: "auth",
+		code: "CMMD_AUTH_REQUIRED",
+		detail: error.message
+	});
+	if (error instanceof CmmdProxyAuthenticationRequiredError) return new RuntimeReplicationClientError({
+		kind: "auth",
+		code: "CMMD_AUTH_REQUIRED",
+		detail: error.message
+	});
+	if (error instanceof CmmdProxyPermissionError) return new RuntimeReplicationClientError({
+		kind: "permanent",
+		code: "CMMD_PERMISSION_DENIED",
+		detail: error.message
+	});
+	if (error instanceof CmmdProxyRequestError) return new RuntimeReplicationClientError(classifyRuntimeReplicationHttpFailure({
+		status: error.status,
+		body: error.body,
+		detail: error.detail ?? error.message,
+		...operation ? { operation } : {}
+	}));
+	return new RuntimeReplicationClientError({
+		kind: "retryable",
+		code: "CMMD_UNAVAILABLE",
+		detail: error instanceof Error ? error.message : String(error)
+	});
+}
+//#endregion
+//#region src/runtimeReplication/lifecycleIntentClient.ts
+/**
+* The runtime half of a lifecycle intent: a settle or un-settle a person asked
+* for while this runtime was offline, held by CMMD until the runtime lists it,
+* applies it through its own orchestration, and acknowledges it.
+*
+* Both lanes carry the same envelope (pinned equal in the contracts package),
+* so one client serves the desktop's owner-session lane and the cloud
+* runtime's grant lane; only the path family differs.
+*/
+const LIFECYCLE_INTENT_TIMEOUT = "10 seconds";
+const LifecycleIntentListEnvelope = Struct({ data: Struct({ intents: ArraySchema(Struct({
+	runtimeId: String$1,
+	threadId: String$1,
+	action: Literals(["settle", "unsettle"]),
+	requestedAt: String$1
+})) }) });
+const LifecycleIntentAcknowledgementEnvelope = Struct({ data: Struct({ acknowledged: Number$1 }) });
+const decodeListEnvelope = decodeUnknownSync(LifecycleIntentListEnvelope);
+const decodeAcknowledgementEnvelope = decodeUnknownSync(LifecycleIntentAcknowledgementEnvelope);
+function decodeLifecycleIntentListResponse(response) {
+	return decodeListEnvelope(response).data;
+}
+function decodeLifecycleIntentAcknowledgementResponse(response) {
+	return decodeAcknowledgementEnvelope(response).data;
+}
+/**
+* Ids arrive from runtime rows, not constrained to path-safe characters, so
+* they are encoded the way every other runtime-lane path builder encodes them.
+*/
+function lifecycleIntentPath(lane, operation) {
+	const base = `/api/forge/context/${lane.kind === "grant" ? "runtime-replication" : "devices"}/runtimes/${encodeURIComponent(lane.runtimeId)}/thread-lifecycle-intents`;
+	return operation === "ack" ? `${base}/ack` : base;
+}
+function timedOut(operation) {
+	return new RuntimeReplicationClientError({
+		kind: "retryable",
+		code: "CMMD_TIMEOUT",
+		detail: `CMMD lifecycle intent ${operation} timed out.`
+	});
+}
+function decodeOrFail(response, decode, label) {
+	return try_({
+		try: () => decode(response),
+		catch: (cause) => new RuntimeReplicationClientError({
+			kind: "permanent",
+			code: "CMMD_PROTOCOL_INVALID_RESPONSE",
+			detail: `CMMD returned an invalid lifecycle intent ${label}: ${cause instanceof Error ? cause.message : String(cause)}`
+		})
+	});
+}
+/**
+* Every pending intent for this runtime, or an empty list.
+*
+* 404 is an ordinary answer, not a failure: a CMMD that predates the route
+* has nothing pending for anyone, and a runtime it has not registered yet has
+* nothing pending either. Every other non-2xx is a typed error -- a signed-out
+* owner (auth) is the caller's to skip, an outage is the next tick's to retry.
+*/
+function listPendingLifecycleIntents(lane, transport) {
+	return tryPromise({
+		try: (signal) => requestOnRuntimeLane(lane, {
+			method: "GET",
+			path: lifecycleIntentPath(lane, "list"),
+			signal
+		}, transport),
+		catch: (cause) => cause instanceof CmmdProxyRequestError && cause.status === 404 ? null : mapRuntimeReplicationClientError(cause)
+	}).pipe(catch_((cause) => cause === null ? succeed(null) : fail(cause)), flatMap((response) => response === null ? succeed([]) : decodeOrFail(response, decodeLifecycleIntentListResponse, "list").pipe(map$3((list) => list.intents))), timeoutOrElse({
+		duration: LIFECYCLE_INTENT_TIMEOUT,
+		orElse: () => fail(timedOut("list"))
+	}));
+}
+/**
+* Tell CMMD which intents were applied (or deliberately skipped), by thread
+* and requested time. CMMD drops only an intent whose requested time matches,
+* so a newer request recorded while this one was being applied survives.
+*/
+function acknowledgeLifecycleIntents(lane, intents, transport) {
+	const body = { intents };
+	return tryPromise({
+		try: (signal) => requestOnRuntimeLane(lane, {
+			method: "POST",
+			path: lifecycleIntentPath(lane, "ack"),
+			body,
+			signal
+		}, transport),
+		catch: mapRuntimeReplicationClientError
+	}).pipe(flatMap((response) => decodeOrFail(response, decodeLifecycleIntentAcknowledgementResponse, "acknowledgement")), timeoutOrElse({
+		duration: LIFECYCLE_INTENT_TIMEOUT,
+		orElse: () => fail(timedOut("ack"))
+	}));
+}
+//#endregion
 //#region src/runtimeReplication/runtimeReplicationGrantPolicy.ts
 /**
 * Chooses which CMMD grant a replication send should use: the in-memory
@@ -92357,26 +92623,11 @@ function runtimeReplicationDevicePath(input) {
 	const threadId = input.streamKey.slice(7);
 	return `${devicePath}/threads/${encodeURIComponent(threadId)}/events`;
 }
-async function parseRuntimeReplicationResponse(response) {
-	const text = await response.text();
-	let body = null;
-	if (text) try {
-		body = JSON.parse(text);
-	} catch {
-		body = null;
-	}
-	if (!response.ok) {
-		const code = readRuntimeReplicationErrorCode(body);
-		throw new CmmdProxyRequestError(`CMMD runtime replication failed (${response.status})`, response.status, null, code ? { code } : null);
-	}
-	if (body === null) throw new Error("CMMD runtime replication returned an empty or invalid JSON response.");
-	return body;
-}
 async function requestRuntimeReplicationWithGrant(input, fetchImpl = fetch) {
 	const abortController = new AbortController();
 	const timeout = setTimeout(() => abortController.abort(), RUNTIME_REPLICATION_TIMEOUT_MS);
 	try {
-		return await parseRuntimeReplicationResponse(await fetchImpl(new URL(runtimeReplicationGrantPath(input), `${input.controlPlaneUrl}/`), {
+		return await parseRuntimeLaneResponse(await fetchImpl(new URL(runtimeReplicationGrantPath(input), `${input.controlPlaneUrl}/`), {
 			method: input.operation === "inventory" ? "PUT" : "POST",
 			headers: {
 				authorization: `Bearer ${input.grantToken}`,
@@ -92389,34 +92640,6 @@ async function requestRuntimeReplicationWithGrant(input, fetchImpl = fetch) {
 		clearTimeout(timeout);
 	}
 }
-function mapRuntimeReplicationClientError(error, operation) {
-	if (error instanceof CmmdProxyAuthError) return new RuntimeReplicationClientError({
-		kind: "auth",
-		code: "CMMD_AUTH_REQUIRED",
-		detail: error.message
-	});
-	if (error instanceof CmmdProxyAuthenticationRequiredError) return new RuntimeReplicationClientError({
-		kind: "auth",
-		code: "CMMD_AUTH_REQUIRED",
-		detail: error.message
-	});
-	if (error instanceof CmmdProxyPermissionError) return new RuntimeReplicationClientError({
-		kind: "permanent",
-		code: "CMMD_PERMISSION_DENIED",
-		detail: error.message
-	});
-	if (error instanceof CmmdProxyRequestError) return new RuntimeReplicationClientError(classifyRuntimeReplicationHttpFailure({
-		status: error.status,
-		body: error.body,
-		detail: error.detail ?? error.message,
-		...operation ? { operation } : {}
-	}));
-	return new RuntimeReplicationClientError({
-		kind: "retryable",
-		code: "CMMD_UNAVAILABLE",
-		detail: error instanceof Error ? error.message : String(error)
-	});
-}
 function decodeRuntimeThreadAcknowledgementResponse(response) {
 	return decodeThreadAcknowledgement(response).data.acknowledgement;
 }
@@ -92492,9 +92715,12 @@ function replicateWithOwnerSession(sql, input) {
 		const jwt = owner.jwt;
 		const path = runtimeReplicationDevicePath(input);
 		const response = yield* tryPromise({
-			try: () => cmmdGateway.request({
+			try: () => requestOnRuntimeLane({
+				kind: "owner-session",
+				runtimeId: input.runtimeId,
+				jwt
+			}, {
 				method: input.operation === "inventory" ? "PUT" : "POST",
-				jwt,
 				path,
 				body: input.payload
 			}),
@@ -92505,11 +92731,63 @@ function replicateWithOwnerSession(sql, input) {
 		return yield* decodeAcknowledgementOrFail(response, decodeRuntimeThreadAcknowledgementResponse, "transcript");
 	});
 }
+/**
+* The lane this runtime holds right now, resolved per call because both
+* credentials rotate: the cloud grant is re-read from the control authority,
+* and the owner session is whichever sign-in is newest on this desktop.
+*/
+function resolveRuntimeLane(config, sql, input) {
+	return gen(function* () {
+		if (config.forgeCmmdRuntimeMode === true) {
+			const cloudGrant = resolveCloudRuntimeReplicationGrant(config);
+			if (!cloudGrant) return yield* new RuntimeReplicationClientError({
+				kind: "auth",
+				code: "CMMD_RUNTIME_GRANT_REQUIRED",
+				detail: "Cloud runtime replication requires a canonical runtime ID, CMMD URL, and scoped runtime grant."
+			});
+			if (input.runtimeId !== cloudGrant.runtimeId) return yield* new RuntimeReplicationClientError({
+				kind: "permanent",
+				code: "CMMD_RUNTIME_ID_MISMATCH",
+				detail: "The requested runtime does not match this cloud runtime identity."
+			});
+			return {
+				kind: "grant",
+				controlPlaneUrl: cloudGrant.controlPlaneUrl,
+				runtimeId: cloudGrant.runtimeId,
+				grantToken: cloudGrant.grantToken
+			};
+		}
+		const owner = yield* resolveCmmdOwnerSessionCredential(sql, { logPrefix: input.logPrefix });
+		if (owner.kind === "no-session") return yield* new RuntimeReplicationClientError({
+			kind: "auth",
+			code: "CMMD_AUTH_REQUIRED",
+			detail: "CMMD sign-in is required for runtime replication."
+		});
+		if (owner.kind === "no-credential") return yield* new RuntimeReplicationClientError({
+			kind: "auth",
+			code: "CMMD_AUTH_REQUIRED",
+			detail: "CMMD REST credentials are unavailable for runtime replication."
+		});
+		return {
+			kind: "owner-session",
+			runtimeId: input.runtimeId,
+			jwt: owner.jwt
+		};
+	});
+}
 const RuntimeReplicationClientLive = effect(RuntimeReplicationClient, gen(function* () {
 	const sql = yield* SqlClient;
 	const config = yield* ServerConfig;
 	const send = (input) => config.forgeCmmdRuntimeMode === true ? replicateWithRuntimeGrant(config, input) : replicateWithOwnerSession(sql, input);
-	return RuntimeReplicationClient.of({ send });
+	const lane = (runtimeId) => resolveRuntimeLane(config, sql, {
+		runtimeId,
+		logPrefix: "lifecycle-intents"
+	});
+	return RuntimeReplicationClient.of({
+		send,
+		listPendingLifecycleIntents: ({ runtimeId }) => lane(runtimeId).pipe(flatMap((l) => listPendingLifecycleIntents(l))),
+		acknowledgeLifecycleIntents: ({ runtimeId, intents }) => lane(runtimeId).pipe(flatMap((l) => acknowledgeLifecycleIntents(l, intents)))
+	});
 }));
 //#endregion
 //#region src/runtimeReplication/Services/RuntimeReplicationOutbox.ts
@@ -92827,6 +93105,14 @@ function stableReplicaDigest(...values) {
 function replicaHydrationCommandId(runtimeId, generationId, threadId) {
 	return CommandId.make("runtime-replica-hydration:" + stableReplicaDigest(runtimeId, generationId, threadId));
 }
+/**
+* One id per (runtime, thread, requested time): a restart between dispatch and
+* acknowledgement re-lists the same intent, and the engine's command receipts
+* turn the second dispatch into a no-op instead of a second settle.
+*/
+function lifecycleIntentCommandId(runtimeId, threadId, requestedAt) {
+	return CommandId.make("lifecycle-intent:" + stableReplicaDigest(runtimeId, threadId, requestedAt));
+}
 //#endregion
 //#region src/runtimeReplication/protocol.ts
 const EMPTY_RUNTIME_THREAD_HEAD_HASH = "sha256:47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU";
@@ -93776,6 +94062,21 @@ function totalTokens(totals) {
 	return totals.uncachedInputTokens + totals.cachedInputTokens + totals.cacheCreationTokens + totals.outputTokens;
 }
 /**
+* What a transcript record's own on-disk facts say it is a row of.
+*
+* Reuses exactly the facts `usageDrivers.ts`'s `isForgeAgent` reads to route a
+* record to the Forge agents lane, minus the "is this one of this
+* environment's own threads" gate: a Claude sidechain or a Codex subagent
+* rollout is a Subagent row regardless of which thread (if any) it hangs
+* under, so a subagent driven from outside Forge is still `subagent`, not a
+* plain Recorded-turn-shaped `turn`. Exported so the scan cache can recompute
+* the same value on decode instead of storing it as a redundant column.
+*/
+function transcriptRecordKind(provider, sidechain, rootSessionId) {
+	if (provider === "claude") return sidechain === true ? "subagent" : "turn";
+	return rootSessionId !== void 0 ? "subagent" : "turn";
+}
+/**
 * Cheap substring gate applied before `JSON.parse`.
 *
 * Transcripts are mostly tool output; only a minority of lines carry usage. On
@@ -93844,6 +94145,7 @@ function parseClaudeLine(line, diagnostics) {
 	const dedupeKey = claudeDedupeKey(stringAt(messageRecord, "id"), stringAt(record, "requestId"));
 	const cost = record["costUSD"];
 	const launcher = stringAt(record, "entrypoint");
+	const sidechain = record["isSidechain"] === true;
 	return {
 		provider: "claude",
 		timestampMs,
@@ -93852,8 +94154,9 @@ function parseClaudeLine(line, diagnostics) {
 		totals: claudeTokenBuckets(usageRecord) ?? EMPTY_TOTALS,
 		reportedCostUsd: typeof cost === "number" && Number.isFinite(cost) ? cost : null,
 		dedupeKey,
+		kind: transcriptRecordKind("claude", sidechain, void 0),
 		...launcher === null ? {} : { launcher },
-		...record["isSidechain"] === true ? { sidechain: true } : {}
+		...sidechain ? { sidechain: true } : {}
 	};
 }
 function initialCodexScanState() {
@@ -93970,6 +94273,7 @@ function parseCodexTokenCount(record, payloadRecord, state) {
 		totals,
 		reportedCostUsd: null,
 		dedupeKey: null,
+		kind: transcriptRecordKind("codex", void 0, state.rootSessionId),
 		...codexSessionFields(state)
 	};
 }
@@ -94238,7 +94542,8 @@ var UsageAggregator = class {
 			origin,
 			sync,
 			runtimeId,
-			driver
+			driver,
+			record.kind
 		].join("\0");
 		const existing = this.#buckets.get(key);
 		if (existing !== void 0) return existing;
@@ -94276,7 +94581,7 @@ var UsageAggregator = class {
 	finish() {
 		const buckets = [];
 		for (const [key, bucket] of this.#buckets) {
-			const [day = "", hourStart = "", provider = "", model = "", origin = "", sync = "", runtimeId = "", driver = ""] = key.split("\0");
+			const [day = "", hourStart = "", provider = "", model = "", origin = "", sync = "", runtimeId = "", driver = "", kind = ""] = key.split("\0");
 			buckets.push({
 				day,
 				...hourStart === "" ? {} : { hourStart },
@@ -94292,10 +94597,15 @@ var UsageAggregator = class {
 				origin,
 				...sync === "" ? {} : { sync },
 				...runtimeId === "" ? {} : { runtimeId },
-				...driver === "" ? {} : { driver }
+				...driver === "" ? {} : { driver },
+				kind
 			});
 		}
-		buckets.sort((a, b) => bucketSortKey(a).localeCompare(bucketSortKey(b)));
+		buckets.sort((a, b) => {
+			const left = bucketSortKey(a);
+			const right = bucketSortKey(b);
+			return left < right ? -1 : left > right ? 1 : 0;
+		});
 		return {
 			buckets,
 			duplicatesDropped: this.#duplicatesDropped,
@@ -94313,7 +94623,8 @@ function bucketSortKey(bucket) {
 		bucket.origin ?? "",
 		bucket.sync ?? "",
 		bucket.runtimeId ?? "",
-		bucket.driver ?? ""
+		bucket.driver ?? "",
+		bucket.kind ?? ""
 	].join("\0");
 }
 /**
@@ -95302,6 +95613,7 @@ function syncOf(sequence, options, threadId, events) {
 	return sequence <= cursor.acknowledgedSequence ? "acknowledged" : "pending";
 }
 function recordOf(event, provider, sync, threadId, runtimeId) {
+	const kind = event.usageKind ?? "turn";
 	return {
 		provider,
 		timestampMs: Date.parse(event.occurredAt),
@@ -95310,6 +95622,7 @@ function recordOf(event, provider, sync, threadId, runtimeId) {
 		totals: event.usage ?? EMPTY_TOTALS,
 		reportedCostUsd: null,
 		dedupeKey: `recorded:${threadId}:${event.turnId}:${event.usageKind ?? "turn"}:${event.subagentId ?? ""}:${event.model}`,
+		kind,
 		origin: "recorded",
 		...sync === void 0 ? {} : { sync },
 		...runtimeId === void 0 ? {} : { runtimeId },
@@ -96030,6 +96343,22 @@ async function readTranscriptRecords(filePath, provider) {
 //#endregion
 //#region src/usage/usageScanCache.ts
 /**
+* Durable per-file scan cache.
+*
+* Transcripts are append-only and a file that has not changed can never yield
+* different usage, so parsed records are keyed by `(size, mtime)` and reused.
+* Without this every server restart re-parses the whole window: seconds for a
+* 30-day scan, against milliseconds to reload this cache.
+*
+* Caching *per file* rather than per day is deliberate. It is timezone
+* independent, so changing the reporting zone does not invalidate anything, and
+* it keeps cross-file de-duplication exact: cached entries are de-duplicated
+* within their own file only, and the aggregator still applies the global
+* dedupe pass over the small surviving key set.
+*
+* @module usageScanCache
+*/
+/**
 * Bumped whenever cached records could differ from what a fresh parse produces.
 *
 * Version 1 was written before `parseCodexLine` suppressed the parent history a
@@ -96175,6 +96504,7 @@ function decodeRecord(row, provider, tables) {
 		},
 		reportedCostUsd: finiteNumber(reportedCostUsd),
 		dedupeKey: typeof dedupeKey === "string" ? dedupeKey : null,
+		kind: transcriptRecordKind(provider, session.sidechain, session.rootSessionId),
 		...session
 	};
 }
@@ -97138,7 +97468,7 @@ const resolveAutoBootstrapWelcomeTargets = gen(function* () {
 /**
 * Cloud-mode project recovery — runs only on cloud execution runtimes.
 * Scans `cloudProjectsRoot` (default
-* /data/Projects) for git-repo subdirectories and registers any not yet in
+* /projects) for git-repo subdirectories and registers any not yet in
 * the orchestration engine. This is the cloud-mode replacement for the
 * gated `autoBootstrapProjectFromCwd` path: managed runtimes whose volume
 * already holds cloned repos surface them in the sidebar after restart.
@@ -99142,144 +99472,6 @@ function claudeWriteToken(env = process.env) {
 	return accessor.read(env);
 }
 //#endregion
-//#region src/usage/providerRateLimits.ts
-/**
-* In-process cache of the latest Claude 5h/7d rate-limit telemetry, decoded
-* from the genuine Claude Agent SDK's own `rate_limit_event` messages
-* (see ClaudeAdapter.ts). This is intentionally NOT a CMMD call site: CMMD
-* must never replay a personal Claude OAuth token against api.anthropic.com
-* from its own backend (see CMMD's personal-claude-delivery.ts) - the only
-* legitimate source for this data is the real in-VM SDK session reporting it
-* as a side effect of a real turn.
-*
-* Snapshots are fenced by the exact non-secret credential-generation hash.
-* A Forge process can outlive an account reconnect, so a process-wide singleton
-* without that fence can leak account A's windows into account B's session.
-* The request-scoped route that reads this
-* cache (apps/server/src/command/http.ts) is what actually forwards it to
-* CMMD, using the request's own authenticated session - a background event
-* pipeline has no such session to reuse safely.
-*/
-/**
-* The SDK only ever reports ONE window per event. Only `five_hour` and
-* `seven_day` map to the two windows the Usage page shows; the
-* per-model/overage variants (seven_day_opus, overage, ...) are ignored here
-* on purpose rather than silently overwriting the plain 7-day figure.
-*/
-function mapClaudeRateLimitInfo(info) {
-	if (typeof info.utilization !== "number" || typeof info.resetsAt !== "number" || !info.status) return null;
-	const kind = info.rateLimitType === "five_hour" ? "fiveHour" : info.rateLimitType === "seven_day" ? "sevenDay" : null;
-	if (!kind) return null;
-	return {
-		kind,
-		window: {
-			usedPercent: Math.round(info.utilization * 100),
-			resetsAt: (/* @__PURE__ */ new Date(info.resetsAt * 1e3)).toISOString(),
-			status: info.status
-		}
-	};
-}
-const SEVEN_DAY_MODEL_PREFIX = "seven_day_";
-const SEVEN_DAY_OVERAGE_SUFFIX = "overage_included";
-function capitalizeModelSuffix(suffix) {
-	return suffix.length === 0 ? suffix : suffix.charAt(0).toUpperCase() + suffix.slice(1);
-}
-/**
-* Maps a per-model weekly SDKRateLimitInfo (`seven_day_<model>`, e.g.
-* `seven_day_opus`) into a `ProviderUsageModelWindow`. `seven_day_overage_included`
-* is not a per-model window (it reports overage-inclusive quota, not a
-* specific model) and stays ignored here, same as plain `overage`.
-*/
-function mapClaudeModelRateLimitInfo(info) {
-	if (typeof info.utilization !== "number" || typeof info.resetsAt !== "number" || !info.status) return null;
-	if (!info.rateLimitType?.startsWith(SEVEN_DAY_MODEL_PREFIX)) return null;
-	const suffix = info.rateLimitType.slice(10);
-	if (suffix.length === 0 || suffix === SEVEN_DAY_OVERAGE_SUFFIX) return null;
-	return {
-		model: capitalizeModelSuffix(suffix),
-		window: {
-			usedPercent: Math.round(info.utilization * 100),
-			resetsAt: (/* @__PURE__ */ new Date(info.resetsAt * 1e3)).toISOString(),
-			status: info.status
-		}
-	};
-}
-const cachedSnapshots = /* @__PURE__ */ new Map();
-let localClaudeGenerationHash = null;
-function setLocalClaudeUsageGeneration(generationId) {
-	localClaudeGenerationHash = createHash("sha256").update(generationId).digest("hex");
-}
-function currentClaudeUsageGenerationHash() {
-	const value = process.env.FORGE_PERSONAL_CLAUDE_GENERATION_HASH?.trim() ?? "";
-	return /^[a-f0-9]{64}$/.test(value) ? value : localClaudeGenerationHash;
-}
-function cacheKeyFor(generationHash, providerAccountId) {
-	return providerAccountId ? `${providerAccountId}:${generationHash}` : generationHash;
-}
-/**
-* `observedAt` here is a placeholder, not an observation — it becomes
-* meaningful only once a standard (five_hour/seven_day) window actually
-* lands via `withStandardWindow`, which recomputes it from the retained
-* windows' own observation times. A per-model-only cache (no standard window
-* yet) still carries this placeholder, so callers should treat `observedAt`
-* as trustworthy only once `fiveHour` or `sevenDay` is non-null.
-*/
-function emptyCachedSnapshot(observedAt) {
-	return {
-		fiveHour: null,
-		sevenDay: null,
-		modelWindowsByModel: {},
-		observedAt,
-		fiveHourObservedAt: null,
-		sevenDayObservedAt: null
-	};
-}
-/** Oldest observation among the retained standard windows, so one fresh event cannot mask stale data. */
-function oldestObservedAt(fiveHourObservedAt, sevenDayObservedAt) {
-	return [fiveHourObservedAt, sevenDayObservedAt].filter((value) => value !== null).toSorted()[0];
-}
-function withStandardWindow(previous, mapped, observedAt) {
-	const isFiveHour = mapped.kind === "fiveHour";
-	const fiveHourObservedAt = isFiveHour ? observedAt : previous.fiveHourObservedAt;
-	const sevenDayObservedAt = isFiveHour ? previous.sevenDayObservedAt : observedAt;
-	return {
-		...previous,
-		fiveHour: isFiveHour ? mapped.window : previous.fiveHour,
-		sevenDay: isFiveHour ? previous.sevenDay : mapped.window,
-		fiveHourObservedAt,
-		sevenDayObservedAt,
-		observedAt: oldestObservedAt(fiveHourObservedAt, sevenDayObservedAt)
-	};
-}
-function withModelWindow(previous, mapped) {
-	return {
-		...previous,
-		modelWindowsByModel: {
-			...previous.modelWindowsByModel,
-			[mapped.model]: mapped.window
-		}
-	};
-}
-/**
-* Merges a single-window update into the cached snapshot without clobbering
-* the other windows. A per-model weekly report (`seven_day_<model>`) merges
-* into `modelWindowsByModel` keyed by model, leaving every other model and
-* the plain five_hour/seven_day windows untouched.
-*/
-function recordClaudeRateLimitTelemetry(info, generationHash = currentClaudeUsageGenerationHash(), providerAccountId) {
-	if (generationHash === null) return;
-	const cacheKey = cacheKeyFor(generationHash, providerAccountId);
-	const observedAt = (/* @__PURE__ */ new Date()).toISOString();
-	const previous = cachedSnapshots.get(cacheKey) ?? emptyCachedSnapshot(observedAt);
-	const standard = mapClaudeRateLimitInfo(info);
-	if (standard) {
-		cachedSnapshots.set(cacheKey, withStandardWindow(previous, standard, observedAt));
-		return;
-	}
-	const model = mapClaudeModelRateLimitInfo(info);
-	if (model) cachedSnapshots.set(cacheKey, withModelWindow(previous, model));
-}
-//#endregion
 //#region src/providerAuth/ClaudeDeviceAuth.ts
 const AUTHORIZE_URL_PATTERN = /https:\/\/[^\s]*\/oauth\/authorize\?[^\s]+/u;
 const ANSI_ESCAPE_PATTERN$1 = new RegExp(String.raw`\x1B\[[0-?]*[ -/]*[@-~]`, "gu");
@@ -99794,7 +99986,6 @@ async function finalizeClaudeCredentialSync(input) {
 	const providerAccountId = extractClaudeProviderAccountId(input.response);
 	const credentialGenerationId = extractClaudeCredentialGenerationId(input.response);
 	if (providerAccountId === null || credentialGenerationId === null) return null;
-	if (input.auth.path === USER_CLAUDE_CREDENTIAL_PATH) setLocalClaudeUsageGeneration(credentialGenerationId);
 	return publishClaudeUsageAfterSync({
 		auth: input.auth,
 		providerAccountId,
@@ -146884,137 +147075,6 @@ const LocalAutomationRepositoryLive = effect(LocalAutomationRepository, gen(func
 */
 var CodexAdapter = class extends Service$1()("forge/provider/Services/CodexAdapter") {};
 //#endregion
-//#region ../../packages/shared/src/model.ts
-/** Check whether a capabilities object includes a given effort value. */
-function hasEffortLevel(caps, value) {
-	return caps.reasoningEffortLevels.some((l) => l.value === value);
-}
-/** Return the default effort value for a capabilities object, or null if none. */
-function getDefaultEffort(caps) {
-	return caps.reasoningEffortLevels.find((l) => l.isDefault)?.value ?? null;
-}
-/**
-* Resolve a raw effort option against capabilities.
-*
-* Returns the effective effort value — the explicit value if supported and not
-* prompt-injected, otherwise the model's default. Returns `undefined` only
-* when the model has no effort levels at all.
-*
-* Prompt-injected efforts (e.g. "ultrathink") are excluded because they are
-* applied via prompt text, not the effort API parameter.
-*/
-function resolveEffort(caps, raw) {
-	const defaultValue = getDefaultEffort(caps);
-	const trimmed = typeof raw === "string" ? raw.trim() : null;
-	if (trimmed && !caps.promptInjectedEffortLevels.includes(trimmed) && hasEffortLevel(caps, trimmed)) return trimmed;
-	return defaultValue ?? void 0;
-}
-/** Check whether a capabilities object includes a given context window value. */
-function hasContextWindowOption(caps, value) {
-	return caps.contextWindowOptions.some((o) => o.value === value);
-}
-/** Return the default context window value, or `null` if none is defined. */
-function getDefaultContextWindow(caps) {
-	return caps.contextWindowOptions.find((o) => o.isDefault)?.value ?? null;
-}
-/**
-* Resolve a raw `contextWindow` option against capabilities.
-*
-* Returns the effective context window value — the explicit value if supported,
-* otherwise the model's default. Returns `undefined` only when the model has
-* no context window options at all.
-*
-* Unlike effort levels (where the API has matching defaults), the context
-* window requires an explicit API suffix (e.g. `[1m]`), so we always preserve
-* the resolved value to avoid ambiguity between "user chose the default" and
-* "not specified".
-*/
-function resolveContextWindow(caps, raw) {
-	const defaultValue = getDefaultContextWindow(caps);
-	if (!raw) return defaultValue ?? void 0;
-	return hasContextWindowOption(caps, raw) ? raw : defaultValue ?? void 0;
-}
-function normalizeCodexModelOptionsWithCapabilities(caps, modelOptions) {
-	const reasoningEffort = resolveEffort(caps, modelOptions?.reasoningEffort);
-	const fastMode = caps.supportsFastMode ? modelOptions?.fastMode : void 0;
-	const nextOptions = {
-		...reasoningEffort ? { reasoningEffort } : {},
-		...fastMode !== void 0 ? { fastMode } : {}
-	};
-	return Object.keys(nextOptions).length > 0 ? nextOptions : void 0;
-}
-function normalizeClaudeModelOptionsWithCapabilities(caps, modelOptions) {
-	const effort = resolveEffort(caps, modelOptions?.effort);
-	const thinking = caps.supportsThinkingToggle ? modelOptions?.thinking : void 0;
-	const fastMode = caps.supportsFastMode ? modelOptions?.fastMode : void 0;
-	const contextWindow = resolveContextWindow(caps, modelOptions?.contextWindow);
-	const nextOptions = {
-		...thinking !== void 0 ? { thinking } : {},
-		...effort ? { effort } : {},
-		...fastMode !== void 0 ? { fastMode } : {},
-		...contextWindow !== void 0 ? { contextWindow } : {}
-	};
-	return Object.keys(nextOptions).length > 0 ? nextOptions : void 0;
-}
-function normalizeModelSlug(model, provider = "codex") {
-	if (typeof model !== "string") return null;
-	const trimmed = model.trim();
-	if (!trimmed) return null;
-	const aliases = MODEL_SLUG_ALIASES_BY_PROVIDER[provider];
-	const aliased = Object.prototype.hasOwnProperty.call(aliases, trimmed) ? aliases[trimmed] : void 0;
-	return typeof aliased === "string" ? aliased : trimmed;
-}
-/** Trim a string, returning null for empty/missing values. */
-function trimOrNull(value) {
-	if (typeof value !== "string") return null;
-	return value.trim() || null;
-}
-/**
-* Resolve the actual API model identifier from a model selection.
-*
-* Provider-aware: each provider can map `contextWindow` (or other options)
-* to whatever the API requires — a model-id suffix, a separate parameter, etc.
-* The canonical slug stored in the selection stays unchanged so the
-* capabilities system keeps working.
-*
-* Expects `contextWindow` to already be resolved (via `resolveContextWindow`)
-* to the effective value, not stripped to `undefined` for defaults.
-*/
-function resolveApiModelId(modelSelection) {
-	switch (modelSelection.provider) {
-		case "claudeAgent": switch (modelSelection.options?.contextWindow) {
-			case "1m": return `${modelSelection.model}[1m]`;
-			default: return modelSelection.model;
-		}
-		default: return modelSelection.model;
-	}
-}
-function applyClaudePromptEffortPrefix(text, effort) {
-	const trimmed = text.trim();
-	if (!trimmed) return trimmed;
-	if (effort !== "ultrathink") return trimmed;
-	if (trimmed.startsWith("Ultrathink:")) return trimmed;
-	return `Ultrathink:\n${trimmed}`;
-}
-function getRawProviderOptionSelectionValue(selections, id) {
-	return selections?.find((candidate) => candidate.id === id)?.value;
-}
-function getProviderOptionSelectionValue(selections, id) {
-	return getRawProviderOptionSelectionValue(selections, id);
-}
-function getProviderOptionStringSelectionValue(selections, id) {
-	const value = getProviderOptionSelectionValue(selections, id);
-	return typeof value === "string" ? value : void 0;
-}
-function flatProviderOptions(selection) {
-	if (!selection) return void 0;
-	if (selection.provider !== "cursor" && selection.provider !== "opencode") return void 0;
-	return selection.options;
-}
-function getModelSelectionStringOptionValue(selection, id) {
-	return getProviderOptionStringSelectionValue(flatProviderOptions(selection), id);
-}
-//#endregion
 //#region src/provider/codexCliVersion.ts
 const CODEX_VERSION_PATTERN = /\bv?(\d+\.\d+(?:\.\d+)?(?:-[0-9A-Za-z.-]+)?)\b/;
 const MINIMUM_CODEX_CLI_VERSION = "0.37.0";
@@ -147669,6 +147729,213 @@ async function probeCodexDiscovery(input) {
 	});
 }
 //#endregion
+//#region ../../packages/shared/src/model.ts
+/** Check whether a capabilities object includes a given effort value. */
+function hasEffortLevel(caps, value) {
+	return caps.reasoningEffortLevels.some((l) => l.value === value);
+}
+/** Return the default effort value for a capabilities object, or null if none. */
+function getDefaultEffort(caps) {
+	return caps.reasoningEffortLevels.find((l) => l.isDefault)?.value ?? null;
+}
+/**
+* Resolve a raw effort option against capabilities.
+*
+* Returns the effective effort value — the explicit value if supported and not
+* prompt-injected, otherwise the model's default. Returns `undefined` only
+* when the model has no effort levels at all.
+*
+* Prompt-injected efforts (e.g. "ultrathink") are excluded because they are
+* applied via prompt text, not the effort API parameter.
+*/
+function resolveEffort(caps, raw) {
+	const defaultValue = getDefaultEffort(caps);
+	const trimmed = typeof raw === "string" ? raw.trim() : null;
+	if (trimmed && !caps.promptInjectedEffortLevels.includes(trimmed) && hasEffortLevel(caps, trimmed)) return trimmed;
+	return defaultValue ?? void 0;
+}
+/** Check whether a capabilities object includes a given context window value. */
+function hasContextWindowOption(caps, value) {
+	return caps.contextWindowOptions.some((o) => o.value === value);
+}
+/** Return the default context window value, or `null` if none is defined. */
+function getDefaultContextWindow(caps) {
+	return caps.contextWindowOptions.find((o) => o.isDefault)?.value ?? null;
+}
+/**
+* Resolve a raw `contextWindow` option against capabilities.
+*
+* Returns the effective context window value — the explicit value if supported,
+* otherwise the model's default. Returns `undefined` only when the model has
+* no context window options at all.
+*
+* Unlike effort levels (where the API has matching defaults), the context
+* window requires an explicit API suffix (e.g. `[1m]`), so we always preserve
+* the resolved value to avoid ambiguity between "user chose the default" and
+* "not specified".
+*/
+function resolveContextWindow(caps, raw) {
+	const defaultValue = getDefaultContextWindow(caps);
+	if (!raw) return defaultValue ?? void 0;
+	return hasContextWindowOption(caps, raw) ? raw : defaultValue ?? void 0;
+}
+function normalizeCodexModelOptionsWithCapabilities(caps, modelOptions) {
+	const reasoningEffort = resolveEffort(caps, modelOptions?.reasoningEffort);
+	const fastMode = caps.supportsFastMode ? modelOptions?.fastMode : void 0;
+	const nextOptions = {
+		...reasoningEffort ? { reasoningEffort } : {},
+		...fastMode !== void 0 ? { fastMode } : {}
+	};
+	return Object.keys(nextOptions).length > 0 ? nextOptions : void 0;
+}
+function normalizeClaudeModelOptionsWithCapabilities(caps, modelOptions) {
+	const effort = resolveEffort(caps, modelOptions?.effort);
+	const thinking = caps.supportsThinkingToggle ? modelOptions?.thinking : void 0;
+	const fastMode = caps.supportsFastMode ? modelOptions?.fastMode : void 0;
+	const contextWindow = resolveContextWindow(caps, modelOptions?.contextWindow);
+	const nextOptions = {
+		...thinking !== void 0 ? { thinking } : {},
+		...effort ? { effort } : {},
+		...fastMode !== void 0 ? { fastMode } : {},
+		...contextWindow !== void 0 ? { contextWindow } : {}
+	};
+	return Object.keys(nextOptions).length > 0 ? nextOptions : void 0;
+}
+function normalizeModelSlug(model, provider = "codex") {
+	if (typeof model !== "string") return null;
+	const trimmed = model.trim();
+	if (!trimmed) return null;
+	const aliases = MODEL_SLUG_ALIASES_BY_PROVIDER[provider];
+	const aliased = Object.prototype.hasOwnProperty.call(aliases, trimmed) ? aliases[trimmed] : void 0;
+	return typeof aliased === "string" ? aliased : trimmed;
+}
+/** Trim a string, returning null for empty/missing values. */
+function trimOrNull(value) {
+	if (typeof value !== "string") return null;
+	return value.trim() || null;
+}
+/**
+* Resolve the actual API model identifier from a model selection.
+*
+* Provider-aware: each provider can map `contextWindow` (or other options)
+* to whatever the API requires — a model-id suffix, a separate parameter, etc.
+* The canonical slug stored in the selection stays unchanged so the
+* capabilities system keeps working.
+*
+* Expects `contextWindow` to already be resolved (via `resolveContextWindow`)
+* to the effective value, not stripped to `undefined` for defaults.
+*/
+function resolveApiModelId(modelSelection) {
+	switch (modelSelection.provider) {
+		case "claudeAgent": switch (modelSelection.options?.contextWindow) {
+			case "1m": return `${modelSelection.model}[1m]`;
+			default: return modelSelection.model;
+		}
+		default: return modelSelection.model;
+	}
+}
+function applyClaudePromptEffortPrefix(text, effort) {
+	const trimmed = text.trim();
+	if (!trimmed) return trimmed;
+	if (effort !== "ultrathink") return trimmed;
+	if (trimmed.startsWith("Ultrathink:")) return trimmed;
+	return `Ultrathink:\n${trimmed}`;
+}
+function getRawProviderOptionSelectionValue(selections, id) {
+	return selections?.find((candidate) => candidate.id === id)?.value;
+}
+function getProviderOptionSelectionValue(selections, id) {
+	return getRawProviderOptionSelectionValue(selections, id);
+}
+function getProviderOptionStringSelectionValue(selections, id) {
+	const value = getProviderOptionSelectionValue(selections, id);
+	return typeof value === "string" ? value : void 0;
+}
+function flatProviderOptions(selection) {
+	if (!selection) return void 0;
+	if (selection.provider !== "cursor" && selection.provider !== "opencode") return void 0;
+	return selection.options;
+}
+function getModelSelectionStringOptionValue(selection, id) {
+	return getProviderOptionStringSelectionValue(flatProviderOptions(selection), id);
+}
+function acceptableModelSlug(value) {
+	const trimmed = value?.trim();
+	if (!trimmed || trimmed.length > 120) return;
+	return trimmed;
+}
+/**
+* Order the credential's model scope: selected model first, then the catalog,
+* deduplicated and capped.
+*
+* Returns `undefined` when there is no catalog to widen to, which is the signal
+* to send the old single-model body. A slug CMMD would refuse is dropped rather
+* than sent, because one bad entry 400s the whole mint and takes the session
+* with it.
+*/
+function providerEgressModelScope(model, models) {
+	const catalog = (models ?? []).map(acceptableModelSlug).filter((slug) => slug !== void 0);
+	if (catalog.length === 0) return;
+	const selected = acceptableModelSlug(model);
+	const ordered = new Set(selected ? [selected] : []);
+	for (const slug of catalog) {
+		if (ordered.size >= 32) break;
+		ordered.add(slug);
+	}
+	return [...ordered];
+}
+//#endregion
+//#region src/provider/codexCredentialModelScope.ts
+/**
+* Which Codex models one workspace egress credential has to cover.
+*
+* FOR-36501: the credential was scoped to the model the user picked, and the
+* Codex app-server holds one credential for the whole process. A turn on
+* gpt-6-astra that called `spawn_agent` with gpt-5.6-terra therefore lost the
+* child to a 401 before it spent a token. The subagent model is the model's own
+* choice in the tool arguments, so Forge cannot predict it and has to scope the
+* credential to the catalog a spawn can pick from.
+*
+* The catalog is the built-in Codex list, which is what the picker offers. It
+* includes the Spark model even though only a Pro account may call it: the
+* account snapshot is not resolved at issue time in workspace mode, and CMMD
+* still decides per call which models the account may use, so a slug in the
+* scope is permission to ask, never permission to spend.
+*/
+/**
+* Normalize a Codex model slug to the one the app-server and the mint route use.
+*
+* Lives here rather than in codexAppServerManager.ts so the catalog builder can
+* use it without importing the manager back. The manager re-exports it, which is
+* where every existing caller still reads it from.
+*/
+function normalizeCodexModelSlug(model, preferredId) {
+	const normalized = normalizeModelSlug(model);
+	if (!normalized) return;
+	if (preferredId?.endsWith("-codex") && preferredId !== normalized) return preferredId;
+	return normalized;
+}
+/** The model a proxy token is minted for when the thread names none. */
+function resolveCodexProviderProxyTokenModel(model) {
+	const displaySlug = model?.trim().toLowerCase().replace(/\s+/g, "-");
+	return normalizeCodexModelSlug(displaySlug) ?? "gpt-6-astra";
+}
+/** Every built-in Codex slug a `spawn_agent` call can name. */
+function codexCredentialModelCatalog() {
+	return CODEX_BUILT_IN_MODELS.map((model) => normalizeCodexModelSlug(model.slug) ?? model.slug);
+}
+/**
+* The `models` list to mint a Codex session credential with.
+*
+* `undefined` means the catalog is unknown, and the caller then sends `model`
+* alone, exactly as before this card. That is the only safe answer: an empty
+* list would narrow the credential rather than widen it.
+*/
+function buildCodexCredentialModelScope(input) {
+	const catalog = (input.catalogModels ?? codexCredentialModelCatalog()).map((slug) => normalizeCodexModelSlug(slug) ?? slug).filter((slug) => slug.trim().length > 0);
+	return providerEgressModelScope(input.selectedModel, catalog);
+}
+//#endregion
 //#region src/egress/providerDeliveryReceipt.ts
 const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -147920,6 +148187,21 @@ function runtimeProviderEgressBaseUrl(provider, controlPlaneUrl) {
 		anthropic: "/api/provider-egress/anthropic"
 	}[provider]}`;
 }
+/**
+* The model fields of a mint body.
+*
+* `model` stays the single selected model, which is what CMMD runs its
+* post-mint constraint check on. `models` appears only when the caller knows a
+* catalog, so a caller that does not know one sends exactly the body it sent
+* before FOR-36501.
+*/
+function providerEgressModelBodyFields(input) {
+	const scope = providerEgressModelScope(input.model, input.models);
+	return {
+		...input.model ? { model: input.model } : {},
+		...scope ? { models: scope } : {}
+	};
+}
 const issueProviderEgressToken = (input) => issueProviderEgressCredential(input).pipe(map$3((credential) => credential.token));
 const issueProviderEgressCredential = (input) => tryPromise({
 	try: async () => {
@@ -147943,7 +148225,7 @@ async function issueCmmdRuntimeProviderEgressCredential(input) {
 		token: runtimeGrantToken,
 		body: JSON.stringify({
 			provider: input.provider,
-			...input.model ? { model: input.model } : {},
+			...providerEgressModelBodyFields(input),
 			...input.provider === "openai" && input.providerAccountId ? { provider_account_id: input.providerAccountId } : {}
 		})
 	});
@@ -148059,7 +148341,7 @@ function issueCmmdLocalUserProviderEgressCredential(input) {
 						},
 						body: JSON.stringify({
 							provider: input.provider,
-							...input.model ? { model: input.model } : {},
+							...providerEgressModelBodyFields(input),
 							...input.provider === "openai" && input.providerAccountId ? { provider_account_id: input.providerAccountId } : {},
 							client: "local-desktop",
 							sessionId,
@@ -148442,16 +148724,6 @@ function mapCodexRuntimeMode(runtimeMode) {
 async function killChildTree(child) {
 	await killCodexChildProcess(child);
 }
-function normalizeCodexModelSlug(model, preferredId) {
-	const normalized = normalizeModelSlug(model);
-	if (!normalized) return;
-	if (preferredId?.endsWith("-codex") && preferredId !== normalized) return preferredId;
-	return normalized;
-}
-function resolveCodexProviderProxyTokenModel(model) {
-	const displaySlug = model?.trim().toLowerCase().replace(/\s+/g, "-");
-	return normalizeCodexModelSlug(displaySlug) ?? "gpt-6-astra";
-}
 function buildCodexCollaborationMode(input) {
 	if (input.interactionMode === void 0) return;
 	const model = normalizeCodexModelSlug(input.model) ?? "gpt-6-astra";
@@ -149002,9 +149274,11 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 		const proxyConfig = getOpenAiProviderEgressProxyConfig({ allowLocalUser: true });
 		if (proxyConfig.mode === "disabled") return null;
 		if (proxyConfig.mode === "misconfigured") throw new ProviderEgressTokenError({ message: proxyConfig.message });
+		const models = buildCodexCredentialModelScope({ selectedModel: input.model });
 		return await runPromise(issueProviderEgressCredential({
 			provider: "openai",
 			model: input.model,
+			...models ? { models } : {},
 			threadId: input.threadId,
 			...input.providerAccountId ? { providerAccountId: input.providerAccountId } : {}
 		}));
@@ -149397,13 +149671,40 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 		if (!providerConversationId) return;
 		return context.collabReceiverTurns.get(providerConversationId);
 	}
+	/**
+	* The child threads one thread item says the turn spawned.
+	*
+	* Two item shapes name a child, and which one arrives depends on the Codex
+	* build. `CollabAgentToolCallThreadItem` lists `receiverThreadIds`, which
+	* "in case of spawn operation ... corresponds to the newly spawned agent".
+	* `SubAgentActivityThreadItem` names a single `agentThreadId` and is what a
+	* `spawn_agent` call reports on codex-cli 0.152/0.153: measured on the
+	* packaged desktop on 2026-09-06, the spawn arrived as `SubAgentActivity`
+	* (`kind: started`) and the only collab tool call that followed was the
+	* `wait`, whose `receiverThreadIds` was empty. Reading only the collab item
+	* left the child unmapped, so its spend was published as a second turn row
+	* under the child's own turn id instead of a subagent row under the parent's.
+	*
+	* `SubAgentActivityThreadItem` has no `model` field, so a `completed` report
+	* for a child a collab call already named must not blank the model out; the
+	* caller's `model ?? known` merge is what keeps it.
+	*/
+	readSpawnedThreadIds(item, itemType) {
+		if (itemType === "subAgentActivity") {
+			const agentThreadId = this.readString(item, "agentThreadId");
+			return agentThreadId ? [agentThreadId] : [];
+		}
+		if (itemType !== "collabAgentToolCall") return [];
+		return this.readArray(item, "receiverThreadIds")?.map((value) => typeof value === "string" ? value : null).filter((value) => value !== null) ?? [];
+	}
 	rememberCollabReceiverTurns(context, params, parentTurnId) {
 		if (!parentTurnId) return;
 		const payload = this.readObject(params);
 		const item = this.readObject(payload, "item") ?? payload;
-		if ((this.readString(item, "type") ?? this.readString(item, "kind")) !== "collabAgentToolCall") return;
+		const itemType = this.readString(item, "type") ?? this.readString(item, "kind");
+		const receiverThreadIds = this.readSpawnedThreadIds(item, itemType);
+		if (receiverThreadIds.length === 0) return;
 		const model = this.readString(item, "model");
-		const receiverThreadIds = this.readArray(item, "receiverThreadIds")?.map((value) => typeof value === "string" ? value : null).filter((value) => value !== null) ?? [];
 		for (const receiverThreadId of receiverThreadIds) {
 			const known = context.collabReceiverTurns.get(receiverThreadId)?.model;
 			const resolved = model ?? known;
@@ -149419,8 +149720,8 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 	* Codex reports a child thread's tokens on the parent's own connection:
 	* `ThreadTokenUsageUpdatedNotification` requires `threadId` and `turnId` and
 	* names the child thread for a child, and `Thread.parentThreadId` is "only
-	* set if this thread is a subagent" (codex 0.144.6 app-server protocol
-	* schema). Every other child notification is suppressed so it cannot replace
+	* set if this thread is a subagent" (still true of the codex-cli 0.153
+	* app-server protocol schema). Every other child notification is suppressed so it cannot replace
 	* the parent turn; this one is not, because the tokens belong on the ledger.
 	* The method is Forge's own rather than the protocol's, because the payload
 	* carries what the Usage row needs rather than what the notification held.
@@ -207164,36 +207465,23 @@ function mapCodexThreadNameUpdatedEvent(event, canonicalThreadId, payload) {
 		}
 	}];
 }
-/** One provider call's spend, from Codex's `last_token_usage`. */
-function codexTurnUsageDelta(value) {
-	const usage = asObject$2(value);
-	return codexUsageBuckets(usage?.last_token_usage ?? usage?.last, "call-delta");
-}
 /**
-* One Codex token report in Forge's disjoint buckets. Codex reports
-* `input_tokens` inclusive of the cached and cache-write portions, so the
-* uncached bucket is the remainder; reasoning is reported inside output and is
-* surfaced separately without being added again. Mirrors `parseCodexLine` in
+* One provider call's spend, from Codex's `last_token_usage`. Reads the
+* buckets via `codexTokenBuckets`, the shared home of the Claude/Codex
+* disjointness rule (providerTokenBuckets.ts): Codex reports `input_tokens`
+* inclusive of the cached and cache-write portions, so the uncached bucket is
+* the remainder, and reasoning is reported inside output and surfaced
+* separately without being added again. Mirrors `parseCodexLine` in
 * usage/usageTranscripts.ts so a Recorded turn and a scanned transcript agree
 * on the same numbers.
 */
-function codexUsageBuckets(value, scope) {
-	const lastUsage = asObject$2(value);
-	if (!lastUsage) return void 0;
-	const int = (key, alt) => Math.max(0, Math.trunc(asNumber(lastUsage[key]) ?? asNumber(lastUsage[alt]) ?? 0));
-	const inputTokens = int("input_tokens", "inputTokens");
-	const cachedInputTokens = int("cached_input_tokens", "cachedInputTokens");
-	const cacheCreationTokens = int("cache_write_input_tokens", "cacheWriteInputTokens");
-	const outputTokens = int("output_tokens", "outputTokens");
-	if (inputTokens + cachedInputTokens + cacheCreationTokens + outputTokens === 0) return void 0;
-	return {
-		scope,
-		uncachedInputTokens: Math.max(0, inputTokens - cachedInputTokens - cacheCreationTokens),
-		cachedInputTokens,
-		cacheCreationTokens,
-		outputTokens,
-		reasoningTokens: Math.min(outputTokens, int("reasoning_output_tokens", "reasoningOutputTokens"))
-	};
+function codexTurnUsageDelta(value) {
+	const usage = asObject$2(value);
+	const buckets = codexTokenBuckets(usage?.last_token_usage ?? usage?.last);
+	return buckets ? {
+		scope: "call-delta",
+		...buckets
+	} : void 0;
 }
 function mapCodexThreadTokenUsageEvent(event, canonicalThreadId, payload) {
 	const tokenUsage = asObject$2(payload?.tokenUsage);
@@ -207216,11 +207504,14 @@ function mapCodexThreadTokenUsageEvent(event, canonicalThreadId, payload) {
 *
 * The source is the live app-server protocol, not a rollout read: Codex sends
 * `thread/tokenUsage/updated` for a child thread on the parent's own
-* connection (0.144.6 schema: `ThreadTokenUsageUpdatedNotification` requires
-* `threadId` and `turnId`, `Thread.parentThreadId` is set only for a subagent,
-* and `CollabAgentToolCallThreadItem` names `receiverThreadIds` and the
-* spawned agent's `model`), and `codexAppServerManager` already tracked those
-* child threads to route their notifications onto the parent turn.
+* connection (`ThreadTokenUsageUpdatedNotification` requires `threadId` and
+* `turnId`, and `Thread.parentThreadId` is set only for a subagent), and
+* `codexAppServerManager` already tracked those child threads to route their
+* notifications onto the parent turn. It learns a child from whichever item
+* the running Codex build uses to announce a spawn: the
+* `receiverThreadIds` of a `CollabAgentToolCallThreadItem`, which also names
+* the spawned agent's `model`, or the `agentThreadId` of a
+* `SubAgentActivityThreadItem`, which names no model.
 *
 * The row carries no context-meter snapshot and no `turnUsage`: the parent's
 * own row is never re-summed with its children. It carries the call's delta
@@ -207882,6 +208173,7 @@ const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check th
 function categorizePublicProviderError(message) {
 	if (!message) return null;
 	const m = message.toLowerCase();
+	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
 	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
 	if (/\b(rate[\s-]?limit|too\s+many\s+requests|quota|insufficient_quota)\b/.test(m) || /\b429\b/.test(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
 	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
@@ -208102,7 +208394,8 @@ const CODE_BY_UPSTREAM_REASON$1 = {
 	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
 	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
 	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED"
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
 };
 const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
 /**
@@ -208165,10 +208458,17 @@ function claudeNativeCredentialUnusableMessage() {
 * CMMD writes this marker when it activates a personal Claude subscription
 * inside a running sprite. Activation always happens after boot, so a
 * boot-time env var alone cannot reflect it (FOR-36249).
+*
+* CMMD names the file in the Service env (FORGE_PERSONAL_CLAUDE_MARKER_PATH).
+* Without that, the marker sits directly under FORGE_HOME, which is the same
+* guest home CMMD derives every sprite path from. A server with neither has no
+* sprite home to look in, and a desktop never has a marker, so it reads none.
 */
-const PERSONAL_CLAUDE_IN_VM_MARKER_PATH = "/data/.forge-personal-claude-in-vm";
+const PERSONAL_CLAUDE_IN_VM_MARKER_NAME = ".forge-personal-claude-in-vm";
 function markerPath(env) {
-	return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH || PERSONAL_CLAUDE_IN_VM_MARKER_PATH;
+	if (env.FORGE_PERSONAL_CLAUDE_MARKER_PATH) return env.FORGE_PERSONAL_CLAUDE_MARKER_PATH;
+	if (env.FORGE_HOME) return join(env.FORGE_HOME, PERSONAL_CLAUDE_IN_VM_MARKER_NAME);
+	return null;
 }
 /**
 * True when this runtime should offer the personal Claude subscription lane.
@@ -208181,8 +208481,10 @@ function markerPath(env) {
 */
 function personalClaudeInVmEnabled(env = process.env) {
 	if (env.FORGE_PERSONAL_CLAUDE_IN_VM === "true") return true;
+	const marker = markerPath(env);
+	if (!marker) return false;
 	try {
-		return existsSync(markerPath(env));
+		return existsSync(marker);
 	} catch {
 		return false;
 	}
@@ -209720,9 +210022,6 @@ function buildClaudeSessionContext(input) {
 		query: input.queryRuntime,
 		streamFiber: void 0,
 		startedAt: input.startedAt,
-		recordsPersonalUsageTelemetry: input.recordsPersonalUsageTelemetry,
-		personalUsageGenerationHash: input.personalUsageGenerationHash,
-		personalUsageProviderAccountId: input.personalUsageProviderAccountId,
 		basePermissionMode: input.permissionMode,
 		resumeSessionId: input.sessionId,
 		pendingApprovals: input.pendingApprovals,
@@ -210080,26 +210379,18 @@ function finiteNumberFieldOrZero(usage, key) {
 }
 /**
 * The whole turn's spend from the SDK result message, cache split intact.
-* Claude reports `input_tokens` exclusive of the cached and cache-creation
-* portions, so the buckets are already disjoint. Claude does not report
-* reasoning separately.
+* Reads the buckets via `claudeTokenBuckets`, the shared home of the
+* Claude/Codex disjointness rule (providerTokenBuckets.ts): Claude reports
+* `input_tokens` exclusive of the cached and cache-creation portions, so the
+* buckets are already disjoint, and Claude does not report reasoning
+* separately.
 */
 function claudeTurnUsageTotal(value) {
-	const usage = asClaudeUsageRecord(value);
-	if (!usage) return void 0;
-	const uncachedInputTokens = finiteNumberFieldOrZero(usage, "input_tokens");
-	const cachedInputTokens = finiteNumberFieldOrZero(usage, "cache_read_input_tokens");
-	const cacheCreationTokens = finiteNumberFieldOrZero(usage, "cache_creation_input_tokens");
-	const outputTokens = finiteNumberFieldOrZero(usage, "output_tokens");
-	if (uncachedInputTokens + cachedInputTokens + cacheCreationTokens + outputTokens <= 0) return;
-	return {
+	const buckets = claudeTokenBuckets(value);
+	return buckets ? {
 		scope: "turn-total",
-		uncachedInputTokens: Math.trunc(uncachedInputTokens),
-		cachedInputTokens: Math.trunc(cachedInputTokens),
-		cacheCreationTokens: Math.trunc(cacheCreationTokens),
-		outputTokens: Math.trunc(outputTokens),
-		reasoningTokens: 0
-	};
+		...buckets
+	} : void 0;
 }
 const EMPTY_MODEL_USAGE_BUCKETS = {
 	uncachedInputTokens: 0,
@@ -210112,20 +210403,14 @@ function bucketsTotal(buckets) {
 	return buckets.uncachedInputTokens + buckets.cachedInputTokens + buckets.cacheCreationTokens + buckets.outputTokens;
 }
 /**
-* One `ModelUsage` entry as buckets. `ModelUsage` names its fields in
-* camelCase, unlike `result.usage`, so this cannot share `claudeTurnUsageTotal`.
-* Claude reports `inputTokens` exclusive of the cached and cache-creation
-* portions, so the buckets are already disjoint, and it reports no reasoning.
+* One `ModelUsage` entry as buckets, via `claudeTokenBuckets`. `ModelUsage`
+* names its fields in camelCase, unlike `result.usage`, but `claudeTokenBuckets`
+* already reads both spellings. Claude reports `inputTokens` exclusive of the
+* cached and cache-creation portions, so the buckets are already disjoint, and
+* it reports no reasoning.
 */
 function claudeModelUsageBuckets(usage) {
-	const record = usage;
-	return {
-		uncachedInputTokens: Math.trunc(finiteNumberFieldOrZero(record, "inputTokens")),
-		cachedInputTokens: Math.trunc(finiteNumberFieldOrZero(record, "cacheReadInputTokens")),
-		cacheCreationTokens: Math.trunc(finiteNumberFieldOrZero(record, "cacheCreationInputTokens")),
-		outputTokens: Math.trunc(finiteNumberFieldOrZero(record, "outputTokens")),
-		reasoningTokens: 0
-	};
+	return claudeTokenBuckets(usage) ?? EMPTY_MODEL_USAGE_BUCKETS;
 }
 /**
 * What each model spent during THIS turn, from the SDK's per-model totals.
@@ -211468,7 +211753,6 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			return;
 		}
 		if (message.type === "rate_limit_event") {
-			if (context.recordsPersonalUsageTelemetry) recordClaudeRateLimitTelemetry(message.rate_limit_info, context.personalUsageGenerationHash, context.personalUsageProviderAccountId);
 			yield* offerRuntimeEvent({
 				...base,
 				type: "account.rate-limits.updated",
@@ -211966,10 +212250,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			inFlightTools,
 			resumeSessionAt: resumeState?.resumeSessionAt,
 			effectiveApiModelId: modelConfig.effectiveApiModelId,
-			effectiveEffort: modelConfig.effectiveEffort,
-			recordsPersonalUsageTelemetry: sessionProvider === PROVIDER$11 && modelConfig.endpointProfile === void 0 && providerProxyCredential === null && !claudeSettings.anthropicBaseUrl && !claudeSettings.anthropicApiKey,
-			personalUsageGenerationHash: currentClaudeUsageGenerationHash(),
-			personalUsageProviderAccountId: modelConfig.modelSelection?.provider === "claudeAgent" ? modelConfig.modelSelection.providerAccountId : void 0
+			effectiveEffort: modelConfig.effectiveEffort
 		});
 		yield* set$2(contextRef, context$4);
 		sessions.set(threadId, context$4);
@@ -226762,7 +227043,8 @@ const CLAUDE_READINESS_COPY = {
 	failed: "Claude native runtime setup could not be applied. Reconnect Claude in Settings.",
 	invalid: "Claude native runtime readiness is no longer valid. Reconnect Claude in Settings.",
 	unavailable: "Claude native runtime readiness could not be verified.",
-	generationMismatch: "Claude native runtime generation does not match CMMD readiness."
+	generationMismatch: "Claude native runtime generation does not match CMMD readiness.",
+	environmentUnavailable: "This Environment is not running, so Claude cannot run on it. Restart the Environment, then try again."
 };
 var ClaudeRuntimeReadinessError = class extends Error {
 	constructor(safeIssue, retryable = false, retryProfile = "default") {
@@ -226832,6 +227114,7 @@ async function withReadinessRetry(attempt) {
 */
 function readinessReasonIssue(readiness) {
 	const code = claudeReadinessReasonCode(readiness.reason);
+	if (code === "RUNTIME_UNAVAILABLE") return CLAUDE_READINESS_COPY.environmentUnavailable;
 	if (code === "CREDENTIAL_RECONNECT_REQUIRED") return CLAUDE_READINESS_COPY.invalid;
 	if (code === "CREDENTIAL_GENERATION_NOT_APPLIED") return CLAUDE_READINESS_COPY.applying;
 	if (code !== "CREDENTIAL_EXPIRED_REFRESHING") return null;
@@ -226842,6 +227125,10 @@ function readinessReasonIssue(readiness) {
 function isCredentialRefreshInFlight(readiness) {
 	return claudeReadinessReasonCode(readiness.reason) === "CREDENTIAL_EXPIRED_REFRESHING";
 }
+/** True when CMMD says the runtime itself cannot take a delivery (CMMD-36473). */
+function isRuntimeUnavailable(readiness) {
+	return claudeReadinessReasonCode(readiness.reason) === "RUNTIME_UNAVAILABLE";
+}
 function readinessFailureIssue(readiness) {
 	const reasonIssue = readinessReasonIssue(readiness);
 	if (reasonIssue !== null) return reasonIssue;
@@ -226881,11 +227168,12 @@ function verifiedClaudeDeliveryBinding(readiness, authority) {
 function appliedClaudeGeneration(readiness) {
 	if (readiness.connected !== true || readiness.deliveryStatus !== "applied" || readiness.nativeExecutable !== true || typeof readiness.generationId !== "string" || readiness.generationId.trim().length === 0) {
 		const refreshing = isCredentialRefreshInFlight(readiness);
-		throw new ClaudeRuntimeReadinessError(readinessFailureIssue(readiness), refreshing || [
+		const retryable = !isRuntimeUnavailable(readiness) && (refreshing || [
 			"pending",
 			"claimed",
 			"activating"
-		].includes(readiness.deliveryStatus), refreshing ? "credentialRefresh" : "default");
+		].includes(readiness.deliveryStatus));
+		throw new ClaudeRuntimeReadinessError(readinessFailureIssue(readiness), retryable, refreshing ? "credentialRefresh" : "default");
 	}
 	return readiness.generationId;
 }
@@ -228039,15 +228327,15 @@ const collectOutput = fn$1("collectOutput")(function* (input, stream, maxOutputB
 /**
 * Adds a `safe.directory` exception to a git child environment.
 *
-* Forge runs git against workspaces on a mounted volume (`/data/Projects/...` on
-* Fly). A volume mount replaces the build-time ownership of its mountpoint, so a
+* Forge runs git against workspaces on a mounted volume (`<cloudProjectsRoot>/...`
+* on Fly). A volume mount replaces the build-time ownership of its mountpoint, so a
 * repository there can be owned by a uid other than the server's, and git then
 * refuses EVERY command against it with "detected dubious ownership" — the
 * FORGE-2T failure in `CheckpointStore.captureCheckpoint`.
 *
 * The exception has to be `*`, verified against git 2.43:
 * - git compares `safe.directory` entries literally, so a prefix such as
-*   `/data/Projects/*` does not match the repository at all.
+*   `/projects/*` does not match the repository at all.
 * - the value must name the DISCOVERED REPOSITORY ROOT, which is an ancestor of
 *   `cwd` whenever a command runs from a subdirectory. Resolving that root means
 *   asking git, which is the command being refused.
@@ -284169,6 +284457,27 @@ const makeRuntimeDrainReporter = gen(function* () {
 var RuntimeDrainReporter = class extends Service$1()("forge/runtimeDrain/RuntimeDrainReporter") {};
 const RuntimeDrainReporterLive = effect(RuntimeDrainReporter, makeRuntimeDrainReporter);
 //#endregion
+//#region src/usage/providerRateLimits.ts
+/**
+* The SDK only ever reports ONE window per event. Only `five_hour` and
+* `seven_day` map to the two windows the Usage page shows; the
+* per-model/overage variants (seven_day_opus, overage, ...) are ignored here
+* on purpose rather than silently overwriting the plain 7-day figure.
+*/
+function mapClaudeRateLimitInfo(info) {
+	if (typeof info.utilization !== "number" || typeof info.resetsAt !== "number" || !info.status) return null;
+	const kind = info.rateLimitType === "five_hour" ? "fiveHour" : info.rateLimitType === "seven_day" ? "sevenDay" : null;
+	if (!kind) return null;
+	return {
+		kind,
+		window: {
+			usedPercent: Math.round(info.utilization * 100),
+			resetsAt: (/* @__PURE__ */ new Date(info.resetsAt * 1e3)).toISOString(),
+			status: info.status
+		}
+	};
+}
+//#endregion
 //#region src/orchestration/Layers/ProviderRuntimeIngestion.ts
 const providerTurnKey = (threadId, turnId) => `${threadId}:${turnId}`;
 const providerCommandId = (event, tag) => CommandId.make(`provider:${event.eventId}:${tag}:${crypto.randomUUID()}`);
@@ -290891,7 +291200,7 @@ const ServerLoggerLive = gen(function* () {
 * Observed live on a Forge Cloud sprite (2026-07-25): the browser opens
 * `wss://<sprite>.sprites.app/ws?routeKey=…&runtimeTicket=<JWT>`, and the HTTP
 * instrumentation records `url.full` / `url.query` verbatim. The ticket then
-* lands in `/data/userdata/logs/server.trace.ndjson` at mode 644 — readable by
+* lands in `<FORGE_HOME>/userdata/logs/server.trace.ndjson` at mode 644 — readable by
 * the same user the agent runs as — and the URL also crosses fly.io's edge,
 * where infrastructure we do not control may log it.
 *
@@ -291183,7 +291492,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "3a8f4c1280c7611f1850f146a6792e13b754bb4b";
+	return "9e352ae66ea610fd1916726270fce8a1ab138a3b";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -299172,16 +299481,6 @@ function describeDispatchCause(cause) {
 	if (deepest === void 0 || deepest.length <= DISPATCH_CAUSE_DETAIL_LIMIT) return deepest;
 	return `${deepest.slice(0, DISPATCH_CAUSE_DETAIL_LIMIT)}...`;
 }
-/**
-* Where automation-created projects live when the caller does not say.
-*
-* This is the documented default of the `cloudProjectsRoot` setting
-* (FORGE_CLOUD_PROJECTS_ROOT, see cli.ts) and exists only for direct callers
-* such as tests. Every HTTP route passes the CONFIGURED value instead: reading
-* the default here is what made a runtime configured with any other root create
-* its automation projects in a directory nothing else read.
-*/
-const DEFAULT_CLOUD_PROJECTS_ROOT = "/data/Projects";
 const respondToOrchestrationHttpError = (error) => gen(function* () {
 	if (error._tag === "OrchestrationGetSnapshotError") {
 		yield* logError("orchestration http route failed", {
@@ -300376,6 +300675,7 @@ function resolveWsUrl(baseUrl) {
 const callCmmdTool = legacyCmmdToolBridge.callTool;
 const extractMcpToolText = legacyCmmdToolBridge.extractText;
 const isCmmdMcpAuthError = legacyCmmdToolBridge.isAuthError;
+const __cmmdProxyRouteLayersStartIndex = registeredProxyRouteLayers().length;
 /**
 * CMMD-side path for the PROJECT-keyed Forge Cloud catalog. Shared by the list
 * proxy, the SSE poll-and-emit proxy, and the register/unregister proxies so the
@@ -300385,8 +300685,9 @@ const CMMD_CLOUD_PROJECTS_PATH = "/api/forge/context/cloud-projects";
 const CMMD_RUNTIMES_PATH = "/api/forge/context/runtimes";
 /**
 * Authenticate the browser session and resolve the CMMD JWT to forward
-* upstream. Returns null when no token could be resolved, which every caller
-* turns into a CMMD_AUTH_REQUIRED response.
+* upstream. `jwt` is null when none could be resolved, which every caller
+* turns into `respondCmmdConnectionRequired(session.sessionId)` — the same
+* unified `CMMD_AUTH_REQUIRED` body and auth-clear the registry uses.
 *
 * Shared so the auth preamble is written once rather than once per proxy route.
 */
@@ -300394,11 +300695,14 @@ function makeCmmdProxyAccessTokenEffect(logPrefix) {
 	return gen(function* () {
 		const request = yield* HttpServerRequest;
 		const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-		return yield* resolveCmmdJwtForSession({
-			sessionId: session.sessionId,
-			subject: session.subject,
-			logPrefix
-		});
+		return {
+			session,
+			jwt: yield* resolveCmmdJwtForSession({
+				sessionId: session.sessionId,
+				subject: session.subject,
+				logPrefix
+			})
+		};
 	});
 }
 var WorkIntakeSnapshotReadError = class extends TaggedErrorClass()("WorkIntakeSnapshotReadError", {
@@ -300478,32 +300782,19 @@ const cmmdProfileRouteLayer = add$1("GET", "/api/cmmd/profile", gen(function* ()
 * `resolution`/`sinceTime`/`untilTime` when the page is drawing hours, which is
 * what lets CMMD cut hour buckets rather than only days.
 */
-const cmmdUsageSummaryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/usage/summary",
 	method: "GET",
 	cmmdPath: "/api/forge/context/usage/summary",
 	orgIdSource: "none"
 });
-/**
-* The workspace's CMMD plan: entitlements, the current period, and how much of
-* each metered allowance is left. This is subscription consumption, which is a
-* different question from the API-equivalent estimate the usage summary above
-* computes from transcripts.
-*
-* `orgIdSource` is `query` (FOR-36406): a plan belongs to an organization, and
-* without one CMMD answers for the user's default organization, which is their
-* personal space rather than the workspace their Environment runs in. The web
-* passes the Environment's organization as `?orgId=` and the registry turns it
-* into `X-Organization-ID`; without it CMMD still answers, for the default.
-*/
-const cmmdBillingRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/billing",
 	method: "GET",
 	cmmdPath: "/api/forge/context/billing",
 	orgIdSource: "query"
 });
-/** Per-day consumption across that period, so the remaining figure gets a shape. */
-const cmmdBillingSeriesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/billing/series",
 	method: "GET",
 	cmmdPath: "/api/forge/context/billing/series",
@@ -300541,6 +300832,15 @@ function runCmmdRestProxy(session, proxy, dependencies = {}) {
 	});
 }
 /**
+* Adapts `runCmmdRestProxy`'s `{ ok, value | error }` outcome into a
+* `ProxyHandlerRoute.run` result: the shared shape every converted handler's
+* `run` uses so it stays the three or so lines of the actual gateway call
+* plus response shaping, with resolve-and-retry left to `runCmmdRestProxy`.
+*/
+function runCmmdRestProxyAsHandlerResult(session, proxy, shape) {
+	return runCmmdRestProxy(session, proxy).pipe(flatMap((outcome) => outcome.ok ? succeed(shape(outcome.value)) : fail(outcome.error)));
+}
+/**
 * Forge-context REST responses wrap their payload in `{ data, meta, pagination? }`
 * (see CMMD `sendForgeEnvelope`). Unwrap to the bare payload so handler response
 * shapes match what the web client expected from the prior MCP text path.
@@ -300704,22 +301004,34 @@ function buildCreateBrainDocumentInput(payload) {
 		...payload.tags && payload.tags.length > 0 ? { tags: payload.tags } : {}
 	};
 }
-const cmmdCreateBrainDocRouteLayer = add$1("POST", "/api/cmmd/brain-docs", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	if (!readCommandAccessTokenForSession(session.sessionId)) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const payload = parseBrainDocPayload(yield* request.json);
-	if (!payload) return jsonUnsafe({ error: "Invalid request: title (1-500 chars) and content (1-100k chars) are required." }, { status: 400 });
-	const restOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.createBrainDocument({
+function parseCreateBrainDocRequest(request) {
+	return request.json.pipe(orElseSucceed(() => null), map$3((rawBody) => {
+		const payload = parseBrainDocPayload(rawBody);
+		return payload ? {
+			ok: true,
+			value: payload
+		} : {
+			ok: false,
+			status: 400,
+			body: { error: "Invalid request: title (1-500 chars) and content (1-100k chars) are required." }
+		};
+	}));
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/brain-docs",
+	method: "POST",
+	parse: parseCreateBrainDocRequest,
+	run: (payload, { session }) => runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.createBrainDocument({
 		jwt,
 		document: buildCreateBrainDocumentInput(payload)
-	}));
-	if (restOutcome.ok) return jsonUnsafe({
-		success: true,
-		doc: unwrapForgeEnvelope(restOutcome.value)
-	}, { status: 201 });
-	return buildProxyErrorResponse(restOutcome.error);
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	}), (value) => ({
+		status: 201,
+		body: {
+			success: true,
+			doc: unwrapForgeEnvelope(value)
+		}
+	}))
+});
 function normalizeOptionalNullableString(value, options) {
 	if (value === void 0) return void 0;
 	if (value === null) return null;
@@ -300773,46 +301085,77 @@ function buildUpdateTaskToolInput(payload) {
 		...payload.labels !== void 0 ? { tags: payload.labels } : {}
 	};
 }
-const updateCmmdTaskHandler = gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	if (!readCommandAccessTokenForSession(session.sessionId)) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const payload = parseUpdateTaskPayload(yield* request.json);
-	if (!payload) return jsonUnsafe({ error: "Invalid request: taskId is required and at least one update field must be provided." }, { status: 400 });
+function parseUpdateCmmdTaskRequest(request) {
+	return request.json.pipe(orElseSucceed(() => null), map$3((rawBody) => {
+		const payload = parseUpdateTaskPayload(rawBody);
+		return payload ? {
+			ok: true,
+			value: payload
+		} : {
+			ok: false,
+			status: 400,
+			body: { error: "Invalid request: taskId is required and at least one update field must be provided." }
+		};
+	}));
+}
+function runUpdateCmmdTask(payload, { session }) {
 	const { taskId, ...patch } = buildUpdateTaskToolInput(payload);
-	const restOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.updateTask({
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.updateTask({
 		jwt,
 		taskId: String(taskId),
 		patch
-	}));
-	if (restOutcome.ok) {
+	}), (value) => {
 		invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-		return jsonUnsafe({
-			success: true,
-			details: unwrapForgeEnvelope(restOutcome.value)
-		}, { status: 200 });
-	}
-	return buildProxyErrorResponse(restOutcome.error);
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error)));
-const cmmdUpdateTaskRouteLayer = add$1("POST", "/api/cmmd/tasks/update", updateCmmdTaskHandler);
-const commandUpdateTaskRouteLayer = add$1("POST", "/api/command/tasks/update", updateCmmdTaskHandler);
-const cmmdAddTaskCommentRouteLayer = add$1("POST", "/api/cmmd/tasks/comment", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const payload = parseTaskCommentPayload(yield* request.json);
-	if (!payload) return jsonUnsafe({ error: "taskId and content (max 2000 chars) are required." }, { status: 400 });
-	if (!readCommandAccessTokenForSession(session.sessionId)) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const restOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.addTaskComment({
+		return {
+			status: 200,
+			body: {
+				success: true,
+				details: unwrapForgeEnvelope(value)
+			}
+		};
+	});
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/tasks/update",
+	method: "POST",
+	parse: parseUpdateCmmdTaskRequest,
+	run: runUpdateCmmdTask
+});
+registerProxyHandler({
+	forgePath: "/api/command/tasks/update",
+	method: "POST",
+	parse: parseUpdateCmmdTaskRequest,
+	run: runUpdateCmmdTask
+});
+function parseAddCmmdTaskCommentRequest(request) {
+	return request.json.pipe(orElseSucceed(() => null), map$3((rawBody) => {
+		const payload = parseTaskCommentPayload(rawBody);
+		return payload ? {
+			ok: true,
+			value: payload
+		} : {
+			ok: false,
+			status: 400,
+			body: { error: "taskId and content (max 2000 chars) are required." }
+		};
+	}));
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/tasks/comment",
+	method: "POST",
+	parse: parseAddCmmdTaskCommentRequest,
+	run: (payload, { session }) => runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.addTaskComment({
 		jwt,
 		taskId: payload.taskId,
 		content: payload.content
-	}));
-	if (restOutcome.ok) return jsonUnsafe({
-		success: true,
-		details: unwrapForgeEnvelope(restOutcome.value)
-	}, { status: 201 });
-	return buildProxyErrorResponse(restOutcome.error);
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	}), (value) => ({
+		status: 201,
+		body: {
+			success: true,
+			details: unwrapForgeEnvelope(value)
+		}
+	}))
+});
 function parseTaskCommentPayload(body) {
 	if (typeof body !== "object" || body === null) return null;
 	const b = body;
@@ -300841,23 +301184,38 @@ function normalizeTaskSearchParams(url) {
 		limit: Math.min(Number(url.searchParams.get("limit") ?? "20"), 50)
 	};
 }
-const cmmdSearchTasksRouteLayer = add$1("GET", "/api/cmmd/tasks/search", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const accessToken = readCommandAccessTokenForSession((yield* (yield* ServerAuth).authenticateHttpRequest(request)).sessionId);
-	if (!accessToken) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const search = normalizeTaskSearchParams(new URL(request.url, "http://localhost"));
-	if (!search) return jsonUnsafe({
-		tasks: [],
-		total: 0
-	}, { status: 200 });
-	return jsonUnsafe(parseJsonObjectText(extractMcpToolText(yield* promise(() => callCmmdTool(accessToken, "search_tasks", {
+function parseSearchCmmdTasksRequest(request) {
+	return sync$1(() => ({
+		ok: true,
+		value: normalizeTaskSearchParams(new URL(request.url, "http://localhost"))
+	}));
+}
+function runSearchCmmdTasks(search, { session }) {
+	if (!search) return succeed({
+		status: 200,
+		body: {
+			tasks: [],
+			total: 0
+		}
+	});
+	const accessToken = readCommandAccessTokenForSession(session.sessionId) ?? "";
+	return promise(() => callCmmdTool(accessToken, "search_tasks", {
 		query: search.query,
 		limit: search.limit
-	})))) ?? {
-		tasks: [],
-		total: 0
-	}, { status: 200 });
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	})).pipe(map$3((result) => ({
+		status: 200,
+		body: parseJsonObjectText(extractMcpToolText(result)) ?? {
+			tasks: [],
+			total: 0
+		}
+	})));
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/tasks/search",
+	method: "GET",
+	parse: parseSearchCmmdTasksRequest,
+	run: runSearchCmmdTasks
+});
 function parseJsonObjectText(text) {
 	if (!text) return null;
 	try {
@@ -300871,23 +301229,47 @@ function parsePositiveIntegerId(value) {
 	const numericId = Number(value);
 	return Number.isInteger(numericId) && numericId > 0 ? numericId : null;
 }
-const cmmdGetTaskRouteLayer = add$1("GET", "/api/cmmd/tasks/:id", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	if (!readCommandAccessTokenForSession(session.sessionId)) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const taskId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 1);
-	if (!taskId) return jsonUnsafe({ error: "Task ID is required." }, { status: 400 });
-	const numericId = parsePositiveIntegerId(taskId);
-	if (!numericId) return jsonUnsafe({ error: "Invalid task ID." }, { status: 400 });
-	const restOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.getTask({
+function parseGetCmmdTaskRequest(request) {
+	return sync$1(() => {
+		const taskId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 1);
+		if (!taskId) return {
+			ok: false,
+			status: 400,
+			body: { error: "Task ID is required." }
+		};
+		const numericId = parsePositiveIntegerId(taskId);
+		if (!numericId) return {
+			ok: false,
+			status: 400,
+			body: { error: "Invalid task ID." }
+		};
+		return {
+			ok: true,
+			value: numericId
+		};
+	});
+}
+function runGetCmmdTask(numericId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.getTask({
 		jwt,
 		taskId: String(numericId)
-	}));
-	if (!restOutcome.ok) return buildProxyErrorResponse(restOutcome.error);
-	const task = unwrapForgeEnvelope(restOutcome.value);
-	if (task === null || task === void 0) return jsonUnsafe({ error: "Task not found." }, { status: 404 });
-	return jsonUnsafe(task, { status: 200 });
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	}), (value) => {
+		const task = unwrapForgeEnvelope(value);
+		return task === null || task === void 0 ? {
+			status: 404,
+			body: { error: "Task not found." }
+		} : {
+			status: 200,
+			body: task
+		};
+	});
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/tasks/:id",
+	method: "GET",
+	parse: parseGetCmmdTaskRequest,
+	run: runGetCmmdTask
+});
 function extractIdFromPath(pathname, fromEnd) {
 	const parts = pathname.split("/").filter(Boolean);
 	return parts[parts.length - fromEnd];
@@ -300899,22 +301281,37 @@ function decodePathSegment(segment) {
 		return null;
 	}
 }
-const cmmdGetTaskCommentsRouteLayer = add$1("GET", "/api/cmmd/tasks/:id/comments", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const taskId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
-	if (!taskId) return jsonUnsafe({ error: "Task ID is required." }, { status: 400 });
-	if (!readCommandAccessTokenForSession(session.sessionId)) return jsonUnsafe({ error: "CMMD account not connected. Log in via the connections panel." }, { status: 401 });
-	const restOutcome = yield* runCmmdRestProxy(session, (jwt) => cmmdGateway.listTaskComments({
+function parseGetCmmdTaskCommentsRequest(request) {
+	return sync$1(() => {
+		const taskId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
+		return taskId ? {
+			ok: true,
+			value: taskId
+		} : {
+			ok: false,
+			status: 400,
+			body: { error: "Task ID is required." }
+		};
+	});
+}
+function runGetCmmdTaskComments(taskId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.listTaskComments({
 		jwt,
 		taskId
-	}));
-	if (restOutcome.ok) {
-		const data = unwrapForgeEnvelope(restOutcome.value);
-		return jsonUnsafe({ comments: Array.isArray(data) ? data : [] }, { status: 200 });
-	}
-	return buildProxyErrorResponse(restOutcome.error);
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	}), (value) => {
+		const data = unwrapForgeEnvelope(value);
+		return {
+			status: 200,
+			body: { comments: Array.isArray(data) ? data : [] }
+		};
+	});
+}
+registerProxyHandler({
+	forgePath: "/api/cmmd/tasks/:id/comments",
+	method: "GET",
+	parse: parseGetCmmdTaskCommentsRequest,
+	run: runGetCmmdTaskComments
+});
 function normalizeCommentList(value) {
 	if (Array.isArray(value)) return value;
 	if (!value || typeof value !== "object") return [];
@@ -301020,55 +301417,54 @@ const cmmdUpdateProjectRouteLayer = add$1("PATCH", "/api/cmmd/projects/:id", gen
 		project: outcome.value
 	}, { status: 200 });
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
-const cmmdGetProjectRepositoryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/repository",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/repository",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-/** Canonical repository identity; unlike the singular route above, this is not execution-link state. */
-const cmmdListProjectRepositoriesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/repositories",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/repositories",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetOrgMembersRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/organizations/:id/members",
 	method: "GET",
 	cmmdPath: "/api/organizations/:id/members",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdSimHostsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/sim-host/hosts",
 	method: "GET",
 	cmmdPath: "/api/forge/context/sim-host/hosts",
 	responseShape: "unwrapData"
 });
-const cmmdSimLeaseReadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/sim-host/leases",
 	method: "GET",
 	cmmdPath: "/api/forge/context/sim-host/leases",
 	responseShape: "unwrapData"
 });
-const cmmdSimLeaseClaimRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/sim-host/leases",
 	method: "POST",
 	cmmdPath: "/api/forge/context/sim-host/leases",
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdSimLeaseReleaseRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/sim-host/leases/:leaseId/release",
 	method: "POST",
 	cmmdPath: "/api/forge/context/sim-host/leases/:leaseId/release",
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdSimLeaseRenewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/sim-host/leases/:leaseId/renew",
 	method: "POST",
 	cmmdPath: "/api/forge/context/sim-host/leases/:leaseId/renew",
@@ -301092,7 +301488,7 @@ function getMultipartContentType(headers) {
 	const contentType = headers["content-type"] ?? "";
 	return contentType.includes("multipart/form-data") ? contentType : null;
 }
-const cmmdGetTaskAttachmentsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:id/attachments",
 	method: "GET",
 	cmmdPath: "/api/forge/context/tasks/:id/attachments",
@@ -301127,150 +301523,150 @@ const cmmdUpdateTaskCommentRouteLayer = add$1("PATCH", "/api/cmmd/tasks/:taskId/
 		...outcome.value
 	}, { status: 200 });
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
-const cmmdDeleteTaskCommentRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/comments/:commentId",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/tasks/:taskId/comments/:commentId",
 	orgIdSource: "none",
 	requestBody: "json"
 });
-const cmmdListProjectAgentMembersRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateProjectAgentMemberRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetProjectAgentMemberRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/:memberId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/:memberId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdRenameProjectAgentMemberRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/:memberId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/:memberId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdRetireProjectAgentMemberRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/:memberId/retire",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/:memberId/retire",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListProjectAgentMemberInstancesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/:memberId/instances",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/:memberId/instances",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdPreviewProjectAgentMemberConsolidationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/consolidation/preview",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/consolidation/preview",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdApplyProjectAgentMemberConsolidationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/agent-members/consolidation/apply",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/agent-members/consolidation/apply",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdPutProjectTaskAssignmentRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/tasks/:taskId/assignment",
 	method: "PUT",
 	cmmdPath: "/api/forge/context/projects/:projectId/tasks/:taskId/assignment",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListTasksRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks",
 	method: "GET",
 	cmmdPath: "/api/forge/context/tasks"
 });
-const cmmdCreateTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks",
 	method: "POST",
 	cmmdPath: "/api/forge/context/tasks"
 });
-const cmmdArchiveTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:id/archive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/tasks/:id/archive",
 	orgIdSource: "none"
 });
-const cmmdUnarchiveTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:id/unarchive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/tasks/:id/unarchive",
 	orgIdSource: "none"
 });
-const cmmdListSavedViewsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/saved-views",
 	method: "GET",
 	cmmdPath: "/api/forge/context/saved-views",
 	orgIdSource: "none"
 });
-const cmmdCreateSavedViewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/saved-views",
 	method: "POST",
 	cmmdPath: "/api/forge/context/saved-views",
 	orgIdSource: "none",
 	successStatus: 201
 });
-const cmmdImportSavedViewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/saved-views/import",
 	method: "POST",
 	cmmdPath: "/api/forge/context/saved-views/import",
 	orgIdSource: "none"
 });
-const cmmdUpdateSavedViewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/saved-views/:viewId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/saved-views/:viewId",
 	orgIdSource: "none"
 });
-const cmmdDeleteSavedViewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/saved-views/:viewId",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/saved-views/:viewId",
 	orgIdSource: "none",
 	forwardSearchParams: true
 });
-const cmmdListProjectsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects",
 	responseShape: "passthrough"
 });
-const cmmdGetProjectRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id",
 	orgIdSource: "none",
 	responseShape: "passthrough"
 });
-const cmmdCreateProjectRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects",
 	method: "POST",
 	cmmdPath: "/api/projects",
 	responseShape: "passthrough"
 });
-const cmmdDeleteProjectRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/projects/:id",
@@ -301278,78 +301674,78 @@ const cmmdDeleteProjectRouteLayer = registerProxyRoute({
 	fixedSearchParams: { soft: "false" },
 	workIntakeInvalidation: "always"
 });
-const cmmdMoveProjectRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/move",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/move",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetProjectMembersRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/members",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/team"
 });
-const cmmdGetProjectMilestonesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/milestones",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/milestones"
 });
-const cmmdCreateProjectMilestoneRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/milestones",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/milestones",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateProjectMilestoneRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/milestones/:milestoneId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:id/milestones/:milestoneId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDeleteProjectMilestoneRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/milestones/:milestoneId",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/projects/:id/milestones/:milestoneId",
 	orgIdSource: "none"
 });
-const cmmdGetProjectUpdatesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/updates",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/updates",
 	orgIdSource: "none",
 	responseShape: "passthrough"
 });
-const cmmdCreateProjectUpdateRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/updates",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/updates",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateProjectUpdateRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/updates/:updateId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:id/updates/:updateId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDeleteProjectUpdateRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/updates/:updateId",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/projects/:id/updates/:updateId",
 	orgIdSource: "none"
 });
-const cmmdImproveProjectContentRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/content/readability",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/content/readability",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts",
@@ -301357,7 +301753,7 @@ const cmmdCreateProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 201
 });
-const cmmdGetProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts/:draftId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts/:draftId",
@@ -301365,7 +301761,7 @@ const cmmdGetProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdUpdateProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts/:draftId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts/:draftId",
@@ -301373,7 +301769,7 @@ const cmmdUpdateProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdPreviewProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts/:draftId/preview",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts/:draftId/preview",
@@ -301381,7 +301777,7 @@ const cmmdPreviewProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdCommitProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts/:draftId/commit",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts/:draftId/commit",
@@ -301389,7 +301785,7 @@ const cmmdCommitProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdDiscardProjectTaskDraftRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/task-drafts/:draftId/discard",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/task-drafts/:draftId/discard",
@@ -301397,352 +301793,352 @@ const cmmdDiscardProjectTaskDraftRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdGetProjectLeadPlanRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/plan",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/plan",
 	orgIdSource: "none"
 });
-const cmmdActivateProjectLeadAuthorityRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/authority/activate",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/authority/activate",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetProjectLeadReadinessRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/readiness",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/readiness",
 	orgIdSource: "none"
 });
-const cmmdGetProjectLeadCapabilitiesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/capabilities",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/capabilities",
 	orgIdSource: "none"
 });
-const cmmdGetProjectLeadSummaryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/summary",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/summary",
 	orgIdSource: "none"
 });
-const cmmdGetProjectLeadDetailRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/detail",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/detail",
 	orgIdSource: "none"
 });
-const cmmdGetProjectLeadBriefingRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/briefing",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/briefing",
 	orgIdSource: "none"
 });
-const cmmdListProjectLeadEventsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/events",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/events",
 	orgIdSource: "none"
 });
-const cmmdExplainProjectLeadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/explain",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/explain",
 	orgIdSource: "none"
 });
-const cmmdPauseProjectLeadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/pause",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/pause",
 	orgIdSource: "none"
 });
-const cmmdResumeProjectLeadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/resume",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/resume",
 	orgIdSource: "none"
 });
-const cmmdReserveProjectLeadTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/tasks/:taskId/reservations",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/tasks/:taskId/reservations",
 	orgIdSource: "none"
 });
-const cmmdReleaseProjectLeadReservationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/reservations/:reservationId/release",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/reservations/:reservationId/release",
 	orgIdSource: "none"
 });
-const cmmdReconcileProjectLeadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/reconcile",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/reconcile",
 	orgIdSource: "none"
 });
-const cmmdResolveProjectLeadAttentionRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/attention/:attentionId/resolve",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/attention/:attentionId/resolve",
 	orgIdSource: "none"
 });
-const cmmdClaimProjectLeadControllerRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/controller/claim",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/controller/claim",
 	orgIdSource: "none"
 });
-const cmmdRenewProjectLeadControllerClaimRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/controller/claim/renew",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/controller/claim/renew",
 	orgIdSource: "none"
 });
-const cmmdYieldProjectLeadControllerClaimRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/controller/claim/yield",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/controller/claim/yield",
 	orgIdSource: "none"
 });
-const cmmdAcknowledgeProjectLeadControllerEventRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/controller/events/:eventId/acknowledge",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/controller/events/:eventId/acknowledge",
 	orgIdSource: "none"
 });
-const cmmdRecordProjectLeadControllerDecisionRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/project-lead/controller/decisions",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/project-lead/controller/decisions",
 	orgIdSource: "none"
 });
-const cmmdListForgeAutomationPresetsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/presets",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/presets",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListUserForgeAutomationRulesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/user/rules",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/user/rules",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateUserForgeAutomationRuleRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/user/rules",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/user/rules",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateUserForgeAutomationRuleRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/user/rules/:ruleId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/automations/user/rules/:ruleId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListUserForgeAutomationRunsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/user/rules/:ruleId/runs",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/user/rules/:ruleId/runs",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdStartUserForgeAutomationRunRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/user/rules/:ruleId/runs",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/user/rules/:ruleId/runs",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListForgeAutomationRulesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/projects/:projectId/rules",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/projects/:projectId/rules",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdCreateForgeAutomationRuleRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/projects/:projectId/rules",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/projects/:projectId/rules",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateForgeAutomationRuleRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/projects/:projectId/rules/:ruleId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/automations/projects/:projectId/rules/:ruleId",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdListForgeAutomationRunsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/projects/:projectId/runs",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/projects/:projectId/runs",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdStartForgeAutomationRunRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/projects/:projectId/tasks/:taskId/runs",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/projects/:projectId/tasks/:taskId/runs",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdGetForgeAutomationRunRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/runs/:runId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/automations/runs/:runId",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdRetryForgeAutomationRunRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/runs/:runId/retry",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/runs/:runId/retry",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdCancelForgeAutomationRunRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/runs/:runId/cancel",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/runs/:runId/cancel",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdApproveForgeAutomationEscalationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/runs/:runId/escalations/approve",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/runs/:runId/escalations/approve",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdRejectForgeAutomationEscalationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/automations/runs/:runId/escalations/reject",
 	method: "POST",
 	cmmdPath: "/api/forge/context/automations/runs/:runId/escalations/reject",
 	orgIdSource: "query",
 	responseShape: "unwrapData"
 });
-const cmmdListProjectBoardRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/board",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetProjectTaskWorkflowRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/task-workflow",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/task-workflow",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateProjectTaskWorkflowRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/task-workflow",
 	method: "PUT",
 	cmmdPath: "/api/forge/context/projects/:id/task-workflow",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateProjectBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/board",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateProjectBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board/:taskId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:id/board/:taskId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateProjectBoardTaskStatusRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board/:taskId/status",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:id/board/:taskId/status",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListTaskExecutionOptionsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board/:taskId/execution-options",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/board/:taskId/execution-options",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateTaskWorkSessionRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board/:taskId/work-sessions",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/board/:taskId/work-sessions",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListProjectWorkSessionsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/work-sessions",
 	method: "GET",
 	cmmdPath: "/api/forge/context/projects/:id/work-sessions",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetWorkSessionRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-sessions/:workSessionId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/work-sessions/:workSessionId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateWorkSessionRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-sessions/:workSessionId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/work-sessions/:workSessionId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdAttachWorkSessionThreadRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-sessions/:workSessionId/threads",
 	method: "POST",
 	cmmdPath: "/api/forge/context/work-sessions/:workSessionId/threads",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListTaskConversationsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/conversations",
 	method: "GET",
 	cmmdPath: "/api/forge/context/tasks/:taskId/conversations",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdLinkTaskConversationRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/conversations",
 	method: "POST",
 	cmmdPath: "/api/forge/context/tasks/:taskId/conversations",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetTaskHistoryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/history",
 	method: "GET",
 	cmmdPath: "/api/forge/context/tasks/:taskId/history",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpsertTaskPullRequestRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/pull-requests",
 	method: "PUT",
 	cmmdPath: "/api/forge/context/tasks/:taskId/pull-requests",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdPullRequestRouteLayers = [
+for (const path of [
 	"list",
 	"list-stats",
 	"detail",
@@ -301760,70 +302156,70 @@ const cmmdPullRequestRouteLayers = [
 	"thread/resolution",
 	"reviewers",
 	"reaction"
-].map((path) => registerProxyRoute({
+]) registerProxyRoute({
 	forgePath: `/api/cmmd/pull-requests/${path}`,
 	method: "POST",
 	cmmdPath: `/api/forge/context/pull-requests/${path}`,
 	orgIdSource: "none",
 	responseShape: "unwrapData"
-}));
-const cmmdGetTaskConversationRouteLayer = registerProxyRoute({
+});
+registerProxyRoute({
 	forgePath: "/api/cmmd/tasks/:taskId/conversations/:conversationId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/tasks/:taskId/conversations/:conversationId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdSpawnForgeThreadFromBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:id/board/:taskId/spawn-forge-thread",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:id/board/:taskId/spawn-forge-thread",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListCenterBoardRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board",
 	method: "GET",
 	cmmdPath: "/api/forge/context/work-items/board",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateCenterBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board",
 	method: "POST",
 	cmmdPath: "/api/forge/context/work-items/board",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateFeedbackRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/feedback",
 	method: "POST",
 	cmmdPath: "/api/forge/context/feedback",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateCenterBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board/:taskId",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/work-items/board/:taskId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdMoveCenterBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board/:taskId/move",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/work-items/board/:taskId/move",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdMoveProjectBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/board/:taskId/move",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/projects/:projectId/board/:taskId/move",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdArchiveProjectBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/board/:taskId/archive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/board/:taskId/archive",
@@ -301831,7 +302227,7 @@ const cmmdArchiveProjectBoardTaskRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdUnarchiveProjectBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/projects/:projectId/board/:taskId/unarchive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/projects/:projectId/board/:taskId/unarchive",
@@ -301839,7 +302235,7 @@ const cmmdUnarchiveProjectBoardTaskRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdArchiveCenterBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board/:taskId/archive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/work-items/board/:taskId/archive",
@@ -301847,7 +302243,7 @@ const cmmdArchiveCenterBoardTaskRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdUnarchiveCenterBoardTaskRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/work-items/board/:taskId/unarchive",
 	method: "POST",
 	cmmdPath: "/api/forge/context/work-items/board/:taskId/unarchive",
@@ -301855,109 +302251,109 @@ const cmmdUnarchiveCenterBoardTaskRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdListCampaignsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/campaigns",
 	method: "GET",
 	cmmdPath: "/api/forge/context/campaigns",
 	orgIdSource: "none",
 	responseShape: "passthrough"
 });
-const cmmdGetCampaignRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/campaigns/:id",
 	method: "GET",
 	cmmdPath: "/api/forge/context/campaigns/:id",
 	orgIdSource: "none",
 	responseShape: "passthrough"
 });
-const cmmdCreateCampaignRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/campaigns",
 	method: "POST",
 	cmmdPath: "/api/projects/campaigns",
 	responseShape: "passthrough"
 });
-const cmmdUpdateCampaignRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/campaigns/:id",
 	method: "PUT",
 	cmmdPath: "/api/projects/campaigns/:id",
 	responseShape: "passthrough"
 });
-const cmmdDeleteCampaignRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/campaigns/:id",
 	method: "DELETE",
 	cmmdPath: "/api/projects/campaigns/:id",
 	orgIdSource: "none"
 });
-const cmmdBootstrapRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
 	cmmdPath: "/api/forge/context/bootstrap",
 	orgIdSource: "none",
 	responseShape: "passthrough"
 });
-const cmmdGetAccountPreferencesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",
 	method: "GET",
 	cmmdPath: "/api/forge/context/account/preferences",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdUpdateAccountPreferencesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",
 	method: "PATCH",
 	cmmdPath: "/api/forge/context/account/preferences",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetOrgProviderPolicyRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/org/provider-policy",
 	method: "GET",
 	cmmdPath: "/api/forge/context/org/provider-policy",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListChatsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/chats",
 	method: "GET",
 	cmmdPath: "/api/forge/context/chats",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetChatRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/chats/:threadId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/chats/:threadId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListDevicesRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices",
 	method: "GET",
 	cmmdPath: "/api/forge/context/devices",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdRegisterDeviceRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/register",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/register",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdHeartbeatRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/heartbeat",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/heartbeat",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGrantRuntimeAccessRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/access-grants",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/access-grants",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdRevokeRuntimeAccessRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/access-grants/:grantId/revoke",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/access-grants/:grantId/revoke",
@@ -301965,46 +302361,60 @@ const cmmdRevokeRuntimeAccessRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdCreateRelayControlRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/relay-routes",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/relay-routes",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdCreateRelayActionGrantRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/relay-action-grants",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/relay-action-grants",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdReplaceRuntimeInventoryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/inventory",
 	method: "PUT",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/inventory",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdListRuntimeInventoryRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/runtime-inventory",
 	method: "GET",
 	cmmdPath: "/api/forge/context/runtime-inventory",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
+registerProxyRoute({
+	forgePath: "/api/cmmd/threads/:runtimeId/:threadId/lifecycle-intent",
+	method: "PUT",
+	cmmdPath: "/api/forge/context/threads/:runtimeId/:threadId/lifecycle-intent",
+	orgIdSource: "none",
+	requestBody: "json",
+	responseShape: "unwrapData"
+});
+registerProxyRoute({
+	forgePath: "/api/cmmd/threads/:runtimeId/:threadId/lifecycle-intent",
+	method: "DELETE",
+	cmmdPath: "/api/forge/context/threads/:runtimeId/:threadId/lifecycle-intent",
+	orgIdSource: "none"
+});
 /**
 * Owner-scoped, bounded control-plane observation. This is intentionally
 * separate from the runtime inventory publisher and never wakes a runtime.
 */
-const cmmdGetRuntimeDiagnosticsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/runtime-diagnostics/v2/runtimes/:runtimeId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/runtime-diagnostics/v2/runtimes/:runtimeId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdProvisionAuthRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/auth-runtime",
 	method: "POST",
 	cmmdPath: "/api/forge/context/auth-runtime",
@@ -302012,21 +302422,21 @@ const cmmdProvisionAuthRuntimeRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdGetAuthRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/auth-runtime",
 	method: "GET",
 	cmmdPath: "/api/forge/context/auth-runtime",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDestroyAuthRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/auth-runtime",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/auth-runtime",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdConnectAuthRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/auth-runtime/connect",
 	method: "POST",
 	cmmdPath: "/api/forge/context/auth-runtime/connect",
@@ -302034,14 +302444,14 @@ const cmmdConnectAuthRuntimeRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdGetProviderAccountsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/accounts",
 	method: "GET",
 	cmmdPath: "/api/forge/context/providers/accounts",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDeleteProviderAccountRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/accounts/:id",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/providers/accounts/:id",
@@ -302049,23 +302459,29 @@ const cmmdDeleteProviderAccountRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-const cmmdSetProviderAccountDefaultRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/accounts/default",
 	method: "PUT",
 	cmmdPath: "/api/forge/context/providers/accounts/default",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetProviderUsageRouteLayer = add$1("GET", "/api/cmmd/providers/usage", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const outcome = yield* runCmmdRestProxy(yield* (yield* ServerAuth).authenticateHttpRequest(request), (jwt) => cmmdGateway.request({
+registerProxyHandler({
+	forgePath: "/api/cmmd/providers/usage",
+	method: "GET",
+	parse: () => succeed({
+		ok: true,
+		value: void 0
+	}),
+	run: (_parsed, { session }) => runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.request({
 		method: "GET",
 		jwt,
 		path: "/api/forge/context/providers/usage"
-	}));
-	if (!outcome.ok) return buildProxyErrorResponse(outcome.error);
-	return jsonUnsafe(unwrapForgeEnvelope(outcome.value), { status: 200 });
-}).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+	}), (value) => ({
+		status: 200,
+		body: unwrapForgeEnvelope(value)
+	}))
+});
 function parseProviderUsageRefreshInput(rawBody) {
 	if (rawBody === null || typeof rawBody !== "object") return null;
 	const body = rawBody;
@@ -302147,56 +302563,56 @@ function makeRefreshProviderUsageHandler(dependencies = {}) {
 	}).pipe(catchTag("AuthError", (error) => respondToAuthError(error)));
 }
 const cmmdRefreshProviderUsageRouteLayer = add$1("POST", "/api/cmmd/providers/usage/refresh", makeRefreshProviderUsageHandler());
-const cmmdGetUserCodexCredentialRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/codex/credential",
 	method: "GET",
 	cmmdPath: "/api/forge/context/providers/codex/credential",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDeleteUserCodexCredentialRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/codex/credential",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/providers/codex/credential",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetUserClaudeCredentialRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/claude/credential",
 	method: "GET",
 	cmmdPath: "/api/forge/context/providers/claude/credential",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdDeleteUserClaudeCredentialRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/claude/credential",
 	method: "DELETE",
 	cmmdPath: "/api/forge/context/providers/claude/credential",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetClaudeRuntimeReadinessRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/providers/claude/runtime-readiness/:runtimeId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/providers/claude/runtime-readiness/:runtimeId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdAppendRuntimeThreadEventsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/runtimes/:runtimeId/threads/:threadId/events",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/runtimes/:runtimeId/threads/:threadId/events",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdGetRuntimeThreadReplicaRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/threads/:runtimeId/:threadId",
 	method: "GET",
 	cmmdPath: "/api/forge/context/threads/:runtimeId/:threadId",
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdRenameDeviceRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/:deviceId/rename",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/:deviceId/rename",
@@ -302212,7 +302628,7 @@ const cmmdRenameDeviceRouteLayer = registerProxyRoute({
 * the status and the code reach the browser unchanged, which is what lets the
 * rename field say something specific instead of "something went wrong".
 */
-const cmmdRenameForgeRuntimeRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-runtimes/:runtimeId/rename",
 	method: "POST",
 	cmmdPath: "/api/forge/context/runtimes/:runtimeId/rename",
@@ -302220,7 +302636,7 @@ const cmmdRenameForgeRuntimeRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData",
 	successStatus: 200
 });
-const cmmdRevokeDeviceRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/devices/:deviceId/revoke",
 	method: "POST",
 	cmmdPath: "/api/forge/context/devices/:deviceId/revoke",
@@ -302229,24 +302645,21 @@ const cmmdRevokeDeviceRouteLayer = registerProxyRoute({
 	requestBody: "none",
 	successStatus: 200
 });
-const cmmdListConnectorsRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/connectors",
 	method: "GET",
 	cmmdPath: "/api/forge/context/connectors",
 	orgIdSource: "none"
 });
-const cmmdInstallConnectorRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/connectors/:connectorId/install",
 	method: "POST",
 	cmmdPath: "/api/forge/context/connectors/:connectorId/install",
 	orgIdSource: "none"
 });
 const cmmdForgeCloudProjectsListRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects", gen(function* () {
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const upstreamUrl = `${resolveCommandAppUrl()}${CMMD_CLOUD_PROJECTS_PATH}`;
 	const upstreamOrError = yield* fetchCmmdUpstreamWithRetry(() => fetch(upstreamUrl, { headers: {
 		Authorization: `Bearer ${accessToken}`,
@@ -302257,10 +302670,7 @@ const cmmdForgeCloudProjectsListRouteLayer = add$1("GET", "/api/cmmd/forge-cloud
 		code: "CMMD_UNAVAILABLE"
 	}, { status: 503 });
 	const upstream = upstreamOrError.res;
-	if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication expired. Sign in again to continue."
-	});
+	if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 		ok: true,
 		text
@@ -302282,35 +302692,35 @@ const cmmdForgeCloudProjectsListRouteLayer = add$1("GET", "/api/cmmd/forge-cloud
 		headers: { "content-type": "application/json" }
 	});
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
-const cmmdForgeCloudProjectRegisterRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-projects",
 	method: "POST",
 	cmmdPath: CMMD_CLOUD_PROJECTS_PATH,
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdForgeCloudProjectUnregisterRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-projects/:projectId",
 	method: "DELETE",
 	cmmdPath: `${CMMD_CLOUD_PROJECTS_PATH}/:projectId`,
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdForgeCloudProjectLifecyclePreflightRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-projects/:projectId/lifecycle-preflight",
 	method: "GET",
 	cmmdPath: `${CMMD_CLOUD_PROJECTS_PATH}/:projectId/lifecycle-preflight`,
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdForgeCloudProjectRemovalPreviewRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-projects/:projectId/removal-preview",
 	method: "GET",
 	cmmdPath: `${CMMD_CLOUD_PROJECTS_PATH}/:projectId/removal-preview`,
 	orgIdSource: "none",
 	responseShape: "unwrapData"
 });
-const cmmdForgeCloudProjectRemovalRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-projects/:projectId/removal",
 	method: "POST",
 	cmmdPath: `${CMMD_CLOUD_PROJECTS_PATH}/:projectId/removal`,
@@ -302319,7 +302729,7 @@ const cmmdForgeCloudProjectRemovalRouteLayer = registerProxyRoute({
 	successStatus: 202,
 	workIntakeInvalidation: "completedPermanentRemoval"
 });
-const cmmdForgeCloudProjectRemovalReceiptRouteLayer = registerProxyRoute({
+registerProxyRoute({
 	forgePath: "/api/cmmd/forge-cloud-project-removals/:operationId",
 	method: "GET",
 	cmmdPath: `${CMMD_CLOUD_PROJECTS_PATH}/removals/:operationId`,
@@ -302383,11 +302793,8 @@ function makeFetchCloudProjectsFrameEffect(upstreamUrl, accessToken) {
 	})).pipe(catch_(() => succeed(null)));
 }
 const cmmdForgeCloudProjectsEventsRouteLayer = add$1("GET", "/api/cmmd/forge-cloud-projects/events", gen(function* () {
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects/events");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-cloud-projects/events");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const fetchCloudProjectsFrame = makeFetchCloudProjectsFrameEffect(`${resolveCommandAppUrl()}${CMMD_CLOUD_PROJECTS_PATH}`, accessToken);
 	const dataStream = concat$2(fromEffect(fetchCloudProjectsFrame), tick(FORGE_RUNTIMES_POLL_INTERVAL).pipe(mapEffect$1(() => fetchCloudProjectsFrame))).pipe(filter$2((frame) => frame !== null));
 	const keepaliveStream = tick(FORGE_RUNTIMES_KEEPALIVE_INTERVAL).pipe(map$7(() => FORGE_RUNTIMES_KEEPALIVE_FRAME));
@@ -302459,11 +302866,8 @@ function fetchCmmdUpstreamWithRetry(send, policy = "idempotent") {
 }
 const cmmdForgeRuntimesEnsureRouteLayer = add$1("POST", "/api/cmmd/forge-runtimes/ensure", gen(function* () {
 	const request = yield* HttpServerRequest;
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/ensure");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/ensure");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const scopedBody = splitCmmdRuntimeOrganizationScope(yield* request.json.pipe(catch_(() => succeed({}))));
 	if (!scopedBody) return jsonUnsafe({ error: "A valid organizationId is required when organization scope is provided." }, { status: 400 });
 	const upstreamUrl = `${resolveCommandAppUrl()}/api/forge/context/runtimes/ensure`;
@@ -302482,10 +302886,7 @@ const cmmdForgeRuntimesEnsureRouteLayer = add$1("POST", "/api/cmmd/forge-runtime
 		code: "CMMD_UNAVAILABLE"
 	}, { status: 503 });
 	const upstream = upstreamOrError.res;
-	if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication expired. Sign in again to continue."
-	});
+	if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 		ok: true,
 		text
@@ -302509,11 +302910,8 @@ const cmmdForgeRuntimesEnsureRouteLayer = add$1("POST", "/api/cmmd/forge-runtime
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const cmmdForgeRuntimesConnectRouteLayer = add$1("POST", "/api/cmmd/forge-runtimes/:runtimeId/connect", gen(function* () {
 	const request = yield* HttpServerRequest;
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/connect");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/connect");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const runtimeId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
 	if (!runtimeId) return jsonUnsafe({ error: "Runtime ID is required." }, { status: 400 });
 	const scopedBody = splitCmmdRuntimeOrganizationScope(yield* request.json.pipe(catch_(() => succeed({}))));
@@ -302534,10 +302932,7 @@ const cmmdForgeRuntimesConnectRouteLayer = add$1("POST", "/api/cmmd/forge-runtim
 		code: "CMMD_UNAVAILABLE"
 	}, { status: 503 });
 	const upstream = upstreamOrError.res;
-	if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication expired. Sign in again to continue."
-	});
+	if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 		ok: true,
 		text
@@ -302561,11 +302956,8 @@ const cmmdForgeRuntimesConnectRouteLayer = add$1("POST", "/api/cmmd/forge-runtim
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
 const cmmdForgeRuntimesStatusRouteLayer = add$1("GET", "/api/cmmd/forge-runtimes/:runtimeId/status", gen(function* () {
 	const request = yield* HttpServerRequest;
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/status");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/status");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const runtimeId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
 	if (!runtimeId) return jsonUnsafe({ error: "Runtime ID is required." }, { status: 400 });
 	const upstreamUrl = `${resolveCommandAppUrl()}/api/forge/context/runtimes/${encodeURIComponent(runtimeId)}/status`;
@@ -302581,10 +302973,7 @@ const cmmdForgeRuntimesStatusRouteLayer = add$1("GET", "/api/cmmd/forge-runtimes
 		code: "CMMD_UNAVAILABLE"
 	}, { status: 503 });
 	const upstream = upstreamOrError.res;
-	if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication expired. Sign in again to continue."
-	});
+	if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 		ok: true,
 		text
@@ -302615,10 +303004,7 @@ function makeCmmdForgeRuntimesLifecycleHandler(action) {
 			subject: session.subject,
 			logPrefix: `forge-runtimes/${action}`
 		});
-		if (!accessToken) return buildCmmdAuthErrorResponse({
-			code: "CMMD_AUTH_REQUIRED",
-			message: "CMMD authentication is required. Sign in again to continue."
-		});
+		if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 		const runtimeId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
 		if (!runtimeId) return jsonUnsafe({ error: "Runtime ID is required." }, { status: 400 });
 		const scopedBody = splitCmmdRuntimeOrganizationScope(yield* request.json.pipe(catch_(() => succeed({}))));
@@ -302639,10 +303025,7 @@ function makeCmmdForgeRuntimesLifecycleHandler(action) {
 			code: "CMMD_UNAVAILABLE"
 		}, { status: 503 });
 		const upstream = upstreamOrError.res;
-		if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-			code: "CMMD_AUTH_REQUIRED",
-			message: "CMMD authentication expired. Sign in again to continue."
-		});
+		if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 		const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 			ok: true,
 			text
@@ -302675,11 +303058,8 @@ const cmmdForgeRuntimesRecycleRouteLayer = add$1("POST", "/api/cmmd/forge-runtim
 const cmmdForgeRuntimesUpdateCommitRouteLayer = add$1("POST", "/api/cmmd/forge-runtimes/:runtimeId/update-commit", __cmmdForgeRuntimesUpdateCommitHandlerForTests);
 const cmmdForgeRuntimesDestroyRouteLayer = add$1("POST", "/api/cmmd/forge-runtimes/:runtimeId/destroy", gen(function* () {
 	const request = yield* HttpServerRequest;
-	const accessToken = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/destroy");
-	if (!accessToken) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication is required. Sign in again to continue."
-	});
+	const { session, jwt: accessToken } = yield* makeCmmdProxyAccessTokenEffect("forge-runtimes/destroy");
+	if (!accessToken) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const runtimeId = extractIdFromPath(new URL(request.url, "http://localhost").pathname, 2);
 	if (!runtimeId) return jsonUnsafe({ error: "Runtime ID is required." }, { status: 400 });
 	const scopedBody = splitCmmdRuntimeOrganizationScope(yield* request.json.pipe(catch_(() => succeed({}))));
@@ -302700,10 +303080,7 @@ const cmmdForgeRuntimesDestroyRouteLayer = add$1("POST", "/api/cmmd/forge-runtim
 		code: "CMMD_UNAVAILABLE"
 	}, { status: 503 });
 	const upstream = upstreamOrError.res;
-	if (upstream.status === 401 || upstream.status === 403) return buildCmmdAuthErrorResponse({
-		code: "CMMD_AUTH_REQUIRED",
-		message: "CMMD authentication expired. Sign in again to continue."
-	});
+	if (upstream.status === 401 || upstream.status === 403) return yield* respondCmmdConnectionRequired(session.sessionId);
 	const bodyOrError = yield* tryPromise(() => upstream.text()).pipe(map$3((text) => ({
 		ok: true,
 		text
@@ -302725,6 +303102,7 @@ const cmmdForgeRuntimesDestroyRouteLayer = add$1("POST", "/api/cmmd/forge-runtim
 		headers: { "content-type": "application/json" }
 	});
 }).pipe(catchTag("AuthError", (error) => respondToAuthError(error))));
+const cmmdProxyRouteLayers = registeredProxyRouteLayers().slice(__cmmdProxyRouteLayersStartIndex);
 //#endregion
 //#region src/cmmdData/projectTeamProxyRoutes.ts
 const cmmdListWorkspaceMembersRouteLayer = registerProxyRoute({
@@ -303967,6 +304345,103 @@ function recordRuntimeReplicationOutboxDiagnostics(diagnostics, now = Date.now()
 	]).pipe(asVoid);
 }
 //#endregion
+//#region src/runtimeReplication/pendingLifecycleIntents.ts
+/**
+* The newest moment a person or a turn touched this thread, mirroring the
+* client's `threadLastActivityAt` over the full thread rather than its shell:
+* the shell's `latestUserMessageAt` is projected from exactly these messages.
+*/
+function readModelThreadLastActivityAt(thread) {
+	const candidates = [
+		...thread.messages.filter((message) => message.role === "user").map((m) => m.createdAt),
+		thread.latestTurn?.requestedAt,
+		thread.latestTurn?.startedAt,
+		thread.latestTurn?.completedAt
+	];
+	let latest = null;
+	let latestTimestamp = Number.NEGATIVE_INFINITY;
+	for (const candidate of candidates) {
+		if (candidate === null || candidate === void 0) continue;
+		const timestamp = Date.parse(candidate);
+		if (timestamp > latestTimestamp) {
+			latest = candidate;
+			latestTimestamp = timestamp;
+		}
+	}
+	return latest;
+}
+function intentIsSpent(thread, intent) {
+	const lastActivityAt = readModelThreadLastActivityAt(thread);
+	if (lastActivityAt === null) return false;
+	const activity = Date.parse(lastActivityAt);
+	const requested = Date.parse(intent.requestedAt);
+	return Number.isFinite(activity) && Number.isFinite(requested) && activity > requested;
+}
+function commandFor(runtimeId, intent) {
+	const commandId = lifecycleIntentCommandId(runtimeId, intent.threadId, intent.requestedAt);
+	const threadId = ThreadId.make(intent.threadId);
+	return intent.action === "settle" ? {
+		type: "thread.settle",
+		commandId,
+		threadId,
+		settledOverride: "settled"
+	} : {
+		type: "thread.unsettle",
+		commandId,
+		threadId
+	};
+}
+const applyOne = fn$1("applyLifecycleIntent")(function* (runtimeId, intent, dependencies) {
+	const base = {
+		runtimeId,
+		threadId: intent.threadId,
+		action: intent.action,
+		requestedAt: intent.requestedAt
+	};
+	const report = (outcome, detail) => dependencies.log({
+		...base,
+		outcome,
+		...detail === void 0 ? {} : { detail }
+	}).pipe(as$3(outcome));
+	const thread = (yield* dependencies.getReadModel()).threads.find((candidate) => candidate.id === intent.threadId);
+	if (thread === void 0) return yield* report("missing-thread");
+	if (intentIsSpent(thread, intent)) return yield* report("spent");
+	return yield* dependencies.dispatch(commandFor(runtimeId, intent)).pipe(flatMap(() => report("applied")), catch_((error) => error._tag === "OrchestrationCommandInvariantError" || error._tag === "OrchestrationCommandPreviouslyRejectedError" ? report("refused", error.detail) : report("failed", error.message)));
+});
+/**
+* One tick: list, apply each, acknowledge everything that got an answer.
+*
+* A signed-out owner is not an error to retry into the log every five
+* minutes; it is a state the desktop leaves when someone signs in, so it is
+* logged once at info and the tick ends. Any other listing or acknowledgement
+* failure is returned typed, and the intents stay pending on CMMD.
+*/
+function applyPendingLifecycleIntents(input, dependencies) {
+	return gen(function* () {
+		const intents = yield* dependencies.listPending();
+		if (intents.length === 0) return;
+		const answered = [];
+		for (const intent of intents) if ((yield* applyOne(input.runtimeId, intent, dependencies)) !== "failed") answered.push({
+			threadId: intent.threadId,
+			requestedAt: intent.requestedAt
+		});
+		if (answered.length === 0) return;
+		yield* dependencies.acknowledge(answered);
+	}).pipe(catch_((error) => error.kind === "auth" ? logInfo("Lifecycle intents skipped: CMMD sign-in is required.", {
+		runtimeId: input.runtimeId,
+		code: error.code
+	}) : fail(error)));
+}
+/**
+* One structured line per intent, so a row that "came back" after a wake can
+* be explained from the log: applied, refused by the decider, or spent by
+* newer activity.
+*/
+function logLifecycleIntentOutcome(outcome) {
+	const message = `Lifecycle intent ${outcome.outcome}.`;
+	return outcome.outcome === "refused" || outcome.outcome === "failed" ? logWarning$1(message, outcome) : logInfo(message, outcome);
+}
+//#endregion
 //#region src/runtimeReplication/processOutboxItem.ts
 function publicationMetricAttributes(item, outcome, failure) {
 	return {
@@ -304163,6 +304638,31 @@ const RuntimeReplicationLive = effect(RuntimeReplication, gen(function* () {
 		}).pipe(asVoid, catchCause((cause) => logError("Runtime replication reconciliation failed.", { cause })));
 		const heartbeat = enqueueAll.pipe(repeat(spaced("5 minutes")), forkScoped);
 		/**
+		* Settle and un-settle requests a person recorded in CMMD while this
+		* runtime was offline. The first tick runs at once, which is the
+		* startup case (this phase starts after the orchestration reactors);
+		* every heartbeat after that picks up requests made while awake. The
+		* tick handles its own expected failures; the supervisor restarts the
+		* schedule if it ever dies between ticks.
+		*/
+		const lifecycleIntents = runSupervisedRepeat({
+			label: "Lifecycle intent applier",
+			work: applyPendingLifecycleIntents({ runtimeId }, {
+				listPending: () => client.listPendingLifecycleIntents({ runtimeId }),
+				acknowledge: (intents) => client.acknowledgeLifecycleIntents({
+					runtimeId,
+					intents
+				}),
+				dispatch: engine.dispatch,
+				getReadModel: engine.getReadModel,
+				log: logLifecycleIntentOutcome
+			}).pipe(catchCause((cause) => logError("Lifecycle intent tick failed.", {
+				cause,
+				runtimeId
+			}))),
+			interval: "5 minutes"
+		}).pipe(forkScoped);
+		/**
 		* Closes and reports whatever Active Hour interval is currently open,
 		* every 5 minutes -- the same cadence as the inventory heartbeat, not
 		* because the two are related, but because it is a reasonable default
@@ -304181,6 +304681,7 @@ const RuntimeReplicationLive = effect(RuntimeReplication, gen(function* () {
 			reactor,
 			providerRegistry.streamChanges.pipe(debounce$1("250 millis"), mapEffect$1(() => enqueueAll, { concurrency: 1 }), runDrain, forkScoped),
 			heartbeat,
+			lifecycleIntents,
 			activeHourFlush,
 			gen(function* () {
 				yield* outbox.recover();
@@ -313581,7 +314082,7 @@ const MiscRuntimeLayerLive = mergeAll(AnalyticsServiceLayerLive, OpenLive, Serve
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(provideMerge(CheckpointingLayerLive), provideMerge(GitLayerLive), provideMerge(OrchestrationLayerLive), provideMerge(ProviderLayerLive), provideMerge(TerminalLayerLive), provideMerge(AgentBrowserManagerLive), provideMerge(mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(provide$1(ThreadDevRuntimeLive)))), provideMerge(PersistenceLayerLive), provideMerge(KeybindingsLive), provideMerge(ProviderRegistryLive), provideMerge(mergeAll(ServerSettingsLive, UsageServiceLive.pipe(provide$1(ServerSettingsLive), provide$1(UsageSessionLookupLive), provide$1(UsageRecordedSourceLive.pipe(provide$1(OrchestrationLayerLive), provide$1(RuntimeReplicationOutboxLive), provide$1(ProviderSessionRuntimeRepositoryLive), provide$1(TextGenerationSessionRepositoryLive)))))), provideMerge(WorkspaceLayerLive), provideMerge(WorkspaceReadinessStateLive), provideMerge(ProjectFaviconResolverLive), provideMerge(RepositoryIdentityResolverLive), provideMerge(ServerEnvironmentLive), provideMerge(AuthLayerLive), provideMerge(ServerSecretStoreLayerLive), provideMerge(mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(provide$1(PersistenceLayerLive)))), provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(provideMerge(RuntimeDependenciesWithoutPullRequestsLive), provideMerge(cmmdProjectIdentityResolverLive.pipe(provide$1(RuntimeDependenciesWithoutPullRequestsLive))), provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, cmmdCreateBrainDocRouteLayer, cmmdUpdateTaskRouteLayer, cmmdUpsertTaskPullRequestRouteLayer, ...cmmdPullRequestRouteLayers, cmmdAddTaskCommentRouteLayer, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdSearchTasksRouteLayer, cmmdGetTaskCommentsRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdGetOrgMembersRouteLayer, cmmdSimHostsRouteLayer, cmmdSimLeaseReadRouteLayer, cmmdSimLeaseClaimRouteLayer, cmmdSimLeaseReleaseRouteLayer, cmmdSimLeaseRenewRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdGetTaskAttachmentsRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdDeleteTaskCommentRouteLayer, cmmdGetProjectRepositoryRouteLayer, cmmdListProjectRepositoriesRouteLayer, cmmdArchiveTaskRouteLayer, cmmdUnarchiveTaskRouteLayer, cmmdListTasksRouteLayer, cmmdCreateTaskRouteLayer, cmmdListCampaignsRouteLayer, cmmdGetCampaignRouteLayer, cmmdCreateCampaignRouteLayer, cmmdUpdateCampaignRouteLayer, cmmdDeleteCampaignRouteLayer, cmmdListSavedViewsRouteLayer, cmmdCreateSavedViewRouteLayer, cmmdImportSavedViewRouteLayer, cmmdUpdateSavedViewRouteLayer, cmmdDeleteSavedViewRouteLayer, cmmdListProjectsRouteLayer, cmmdGetProjectRouteLayer, cmmdCreateProjectRouteLayer, cmmdDeleteProjectRouteLayer, cmmdMoveProjectRouteLayer, cmmdGetProjectMembersRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdGetProjectMilestonesRouteLayer, cmmdCreateProjectMilestoneRouteLayer, cmmdUpdateProjectMilestoneRouteLayer, cmmdDeleteProjectMilestoneRouteLayer, cmmdGetProjectUpdatesRouteLayer, cmmdCreateProjectUpdateRouteLayer, cmmdUpdateProjectUpdateRouteLayer, cmmdDeleteProjectUpdateRouteLayer, cmmdImproveProjectContentRouteLayer, cmmdCreateProjectTaskDraftRouteLayer, cmmdGetProjectTaskDraftRouteLayer, cmmdUpdateProjectTaskDraftRouteLayer, cmmdPreviewProjectTaskDraftRouteLayer, cmmdCommitProjectTaskDraftRouteLayer, cmmdDiscardProjectTaskDraftRouteLayer, cmmdGetProjectLeadPlanRouteLayer, cmmdActivateProjectLeadAuthorityRouteLayer, cmmdGetProjectLeadReadinessRouteLayer, cmmdGetProjectLeadCapabilitiesRouteLayer, cmmdGetProjectLeadSummaryRouteLayer, cmmdGetProjectLeadDetailRouteLayer, cmmdGetProjectLeadBriefingRouteLayer, cmmdListProjectLeadEventsRouteLayer, cmmdExplainProjectLeadRouteLayer, cmmdPauseProjectLeadRouteLayer, cmmdResumeProjectLeadRouteLayer, cmmdReserveProjectLeadTaskRouteLayer, cmmdReleaseProjectLeadReservationRouteLayer, cmmdReconcileProjectLeadRouteLayer, cmmdResolveProjectLeadAttentionRouteLayer, cmmdClaimProjectLeadControllerRouteLayer, cmmdRenewProjectLeadControllerClaimRouteLayer, cmmdYieldProjectLeadControllerClaimRouteLayer, cmmdAcknowledgeProjectLeadControllerEventRouteLayer, cmmdRecordProjectLeadControllerDecisionRouteLayer, cmmdListForgeAutomationPresetsRouteLayer, cmmdListUserForgeAutomationRulesRouteLayer, cmmdCreateUserForgeAutomationRuleRouteLayer, cmmdUpdateUserForgeAutomationRuleRouteLayer, cmmdListUserForgeAutomationRunsRouteLayer, cmmdStartUserForgeAutomationRunRouteLayer, cmmdListForgeAutomationRulesRouteLayer, cmmdCreateForgeAutomationRuleRouteLayer, cmmdUpdateForgeAutomationRuleRouteLayer, cmmdListForgeAutomationRunsRouteLayer, cmmdStartForgeAutomationRunRouteLayer, cmmdGetForgeAutomationRunRouteLayer, cmmdRetryForgeAutomationRunRouteLayer, cmmdCancelForgeAutomationRunRouteLayer, cmmdApproveForgeAutomationEscalationRouteLayer, cmmdRejectForgeAutomationEscalationRouteLayer, cmmdListProjectAgentMembersRouteLayer, cmmdCreateProjectAgentMemberRouteLayer, cmmdGetProjectAgentMemberRouteLayer, cmmdRenameProjectAgentMemberRouteLayer, cmmdRetireProjectAgentMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, cmmdListProjectAgentMemberInstancesRouteLayer, cmmdPreviewProjectAgentMemberConsolidationRouteLayer, cmmdApplyProjectAgentMemberConsolidationRouteLayer, cmmdPutProjectTaskAssignmentRouteLayer, cmmdListProjectBoardRouteLayer, cmmdGetProjectTaskWorkflowRouteLayer, cmmdUpdateProjectTaskWorkflowRouteLayer, cmmdCreateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskRouteLayer, cmmdUpdateProjectBoardTaskStatusRouteLayer, cmmdListTaskExecutionOptionsRouteLayer, cmmdCreateTaskWorkSessionRouteLayer, cmmdListProjectWorkSessionsRouteLayer, cmmdGetWorkSessionRouteLayer, cmmdUpdateWorkSessionRouteLayer, cmmdAttachWorkSessionThreadRouteLayer, cmmdListTaskConversationsRouteLayer, cmmdLinkTaskConversationRouteLayer, cmmdGetTaskHistoryRouteLayer, cmmdGetTaskConversationRouteLayer, cmmdSpawnForgeThreadFromBoardTaskRouteLayer, cmmdListCenterBoardRouteLayer, cmmdCreateCenterBoardTaskRouteLayer, cmmdCreateFeedbackRouteLayer, cmmdUpdateCenterBoardTaskRouteLayer, cmmdMoveCenterBoardTaskRouteLayer, cmmdMoveProjectBoardTaskRouteLayer, cmmdArchiveProjectBoardTaskRouteLayer, cmmdUnarchiveProjectBoardTaskRouteLayer, cmmdArchiveCenterBoardTaskRouteLayer, cmmdUnarchiveCenterBoardTaskRouteLayer, cmmdBootstrapRouteLayer, cmmdGetAccountPreferencesRouteLayer, cmmdUpdateAccountPreferencesRouteLayer, cmmdGetOrgProviderPolicyRouteLayer, cmmdListChatsRouteLayer, cmmdGetChatRouteLayer, cmmdListDevicesRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRegisterDeviceRouteLayer, cmmdHeartbeatRuntimeRouteLayer, cmmdGrantRuntimeAccessRouteLayer, cmmdRevokeRuntimeAccessRouteLayer, cmmdCreateRelayControlRouteLayer, cmmdCreateRelayActionGrantRouteLayer, cmmdReplaceRuntimeInventoryRouteLayer, cmmdListRuntimeInventoryRouteLayer, cmmdGetRuntimeDiagnosticsRouteLayer, cmmdProvisionAuthRuntimeRouteLayer, cmmdGetAuthRuntimeRouteLayer, cmmdDestroyAuthRuntimeRouteLayer, cmmdConnectAuthRuntimeRouteLayer, cmmdGetProviderAccountsRouteLayer, cmmdDeleteProviderAccountRouteLayer, cmmdSetProviderAccountDefaultRouteLayer, cmmdGetProviderUsageRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdGetUserCodexCredentialRouteLayer, cmmdDeleteUserCodexCredentialRouteLayer, cmmdGetUserClaudeCredentialRouteLayer, cmmdDeleteUserClaudeCredentialRouteLayer, cmmdGetClaudeRuntimeReadinessRouteLayer, cmmdAppendRuntimeThreadEventsRouteLayer, cmmdGetRuntimeThreadReplicaRouteLayer, cmmdRenameDeviceRouteLayer, cmmdRevokeDeviceRouteLayer, cmmdInstallConnectorRouteLayer, cmmdListConnectorsRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeCloudProjectRegisterRouteLayer, cmmdForgeCloudProjectUnregisterRouteLayer, cmmdForgeCloudProjectLifecyclePreflightRouteLayer, cmmdForgeCloudProjectRemovalRouteLayer, cmmdForgeCloudProjectRemovalPreviewRouteLayer, cmmdForgeCloudProjectRemovalReceiptRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, cmmdRenameForgeRuntimeRouteLayer, cmmdGetTaskRouteLayer, commandUpdateTaskRouteLayer, mobileProviderCatalogRouteLayer, cmmdUsageSummaryRouteLayer, cmmdBillingRouteLayer, cmmdBillingSeriesRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
+const makeRoutesLayer = mergeAll(authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(provide$1(browserApiCorsLayer));
 const runServer = launch$1(unwrap(gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });
@@ -314093,7 +314594,7 @@ const resolveServerConfig = (flags, cliLogLevel, options) => gen(function* () {
 		forgeCodexHomePath: env.forgeCodexHomePath,
 		forgeClaudeConfigPath: env.forgeClaudeConfigPath,
 		forgeApexBaseUrl: env.forgeApexBaseUrl,
-		cloudProjectsRoot: env.cloudProjectsRoot ?? "/data/Projects"
+		cloudProjectsRoot: env.cloudProjectsRoot ?? "/projects"
 	};
 	if (config.forgeCloudShellMode === true && (!config.forgeCloudOwnerAssertionPublicKey?.trim() || !config.forgeCloudOwnerAssertionKeyId?.trim())) return yield* die$1(/* @__PURE__ */ new Error("FORGE_CMMD_CLOUD_OWNER_ASSERTION_PUBLIC_KEY and FORGE_CMMD_CLOUD_OWNER_ASSERTION_KEY_ID are required in cloud-shell mode; runtime ticket keys are not accepted for Cloud owner assertions."));
 	if (config.forgeCloudShellMode === true && !isEd25519PublicKey(config.forgeCloudOwnerAssertionPublicKey ?? "")) return yield* die$1(/* @__PURE__ */ new Error("FORGE_CMMD_CLOUD_OWNER_ASSERTION_PUBLIC_KEY must be a valid Ed25519 public key in cloud-shell mode."));