@cmmd-center/forge 0.12.0 → 0.13.1

package/dist/bin.cjs

@@ -16544,7 +16544,7 @@ function makeNetServiceShape(createServer = node_net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.12.0";
+const FORGE_RELEASE_VERSION = "0.13.1";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -18654,6 +18654,43 @@ const TerminalError = require_Schema$1.Union([
 	TerminalSignalError
 ]);
 //#endregion
+//#region ../../packages/contracts/src/projectScriptCommands.ts
+const ProjectScriptIcon = require_Schema$1.Literals([
+	"play",
+	"test",
+	"lint",
+	"configure",
+	"build",
+	"debug"
+]);
+const ProjectScript = require_Schema$1.Struct({
+	id: TrimmedNonEmptyString,
+	name: TrimmedNonEmptyString,
+	command: TrimmedNonEmptyString,
+	icon: ProjectScriptIcon,
+	runOnWorktreeCreate: require_Schema$1.Boolean
+});
+const ProjectScriptUpdateCommand = require_Schema$1.Struct({
+	type: require_Schema$1.Literal("project.script.update"),
+	commandId: CommandId,
+	projectId: ProjectId,
+	mutation: require_Schema$1.Union([
+		require_Schema$1.Struct({
+			kind: require_Schema$1.Literal("add"),
+			script: ProjectScript
+		}),
+		require_Schema$1.Struct({
+			kind: require_Schema$1.Literal("update"),
+			script: ProjectScript,
+			expected: ProjectScript
+		}),
+		require_Schema$1.Struct({
+			kind: require_Schema$1.Literal("remove"),
+			expected: ProjectScript
+		})
+	])
+});
+//#endregion
 //#region ../../packages/contracts/src/model.ts
 const CODEX_REASONING_EFFORT_OPTIONS = [
 	"ultra",
@@ -19313,21 +19350,6 @@ const UploadChatImageAttachment = require_Schema$1.Struct({
 });
 const ChatAttachment = require_Schema$1.Union([ChatImageAttachment]);
 const UploadChatAttachment = require_Schema$1.Union([UploadChatImageAttachment]);
-const ProjectScriptIcon = require_Schema$1.Literals([
-	"play",
-	"test",
-	"lint",
-	"configure",
-	"build",
-	"debug"
-]);
-const ProjectScript = require_Schema$1.Struct({
-	id: TrimmedNonEmptyString,
-	name: TrimmedNonEmptyString,
-	command: TrimmedNonEmptyString,
-	icon: ProjectScriptIcon,
-	runOnWorktreeCreate: require_Schema$1.Boolean
-});
 /**
 * Availability of the project's `workspaceRoot` on the server's filesystem.
 *
@@ -19958,6 +19980,7 @@ const ThreadSessionStopCommand = require_Schema$1.Struct({
 const DispatchableClientOrchestrationCommand = require_Schema$1.Union([
 	ProjectCreateCommand,
 	ProjectMetaUpdateCommand,
+	ProjectScriptUpdateCommand,
 	ProjectDeleteCommand,
 	ThreadCreateCommand,
 	ThreadDeleteCommand,
@@ -19979,6 +20002,7 @@ const DispatchableClientOrchestrationCommand = require_Schema$1.Union([
 const ClientOrchestrationCommand = require_Schema$1.Union([
 	ProjectCreateCommand,
 	ProjectMetaUpdateCommand,
+	ProjectScriptUpdateCommand,
 	ProjectDeleteCommand,
 	ThreadCreateCommand,
 	ThreadDeleteCommand,
@@ -22623,6 +22647,27 @@ const ProviderUnavailableDetail = require_Schema$1.Literals([
 	"delivery-pending",
 	"reconnect-required"
 ]);
+/**
+* Whether the provider CLI honours the credential-directory variable, as this
+* Environment's probe found. `inconclusive` is a probe that ran and could not
+* tell. It is not `unsupported`, and it is never reported as `supported`. The
+* members are CMMD's `forgeRuntimeInventoryCredentialDirectoryAnswers`.
+*/
+const ProviderCredentialDirectoryAnswer = require_Schema$1.Literals([
+	"supported",
+	"unsupported",
+	"inconclusive"
+]);
+/**
+* Which Credential Store the provider CLI uses on this Environment: its file,
+* the operating system's store, or `unknown` when it cannot be read the way
+* the CLI reads it. The members are CMMD's `forgeRuntimeInventoryCredentialStores`.
+*/
+const ProviderCredentialStore = require_Schema$1.Literals([
+	"file",
+	"os",
+	"unknown"
+]);
 const ServerProviderModel = require_Schema$1.Struct({
 	slug: TrimmedNonEmptyString,
 	name: TrimmedNonEmptyString,
@@ -22659,6 +22704,8 @@ const ServerProvider = require_Schema$1.Struct({
 	availability: require_Schema$1.optional(ProviderAvailability),
 	unavailableReason: require_Schema$1.optional(ProviderUnavailableReason),
 	unavailableDetail: require_Schema$1.optional(ProviderUnavailableDetail),
+	credentialDirectory: require_Schema$1.optional(ProviderCredentialDirectoryAnswer),
+	credentialStore: require_Schema$1.optional(ProviderCredentialStore),
 	slashCommands: require_Schema$1.ArraySchema(ServerProviderSlashCommand).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed([]))),
 	skills: require_Schema$1.ArraySchema(ServerProviderSkill).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed([])))
 });
@@ -26697,12 +26744,12 @@ function encodeCmmdRuntimeThreadWorkspaceMetadata(workspace) {
 }
 //#endregion
 //#region ../../packages/contracts/src/cmmdRuntimeToolActivity.ts
-function isRecord$22(value) {
+function isRecord$23(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function encodeCmmdRuntimeToolActivityPayload(kind, payload) {
 	return {
-		...isRecord$22(payload) ? payload : { sourcePayload: payload },
+		...isRecord$23(payload) ? payload : { sourcePayload: payload },
 		forgeToolActivity: {
 			schemaVersion: 1,
 			source: "native",
@@ -30702,13 +30749,13 @@ async function completePendingDesktopRelayIdentityRotation(input) {
 }
 //#endregion
 //#region ../../packages/relay-host/src/internal/desktopRelayJws.ts
-function isRecord$21(value) {
+function isRecord$22(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function decodeBase64UrlJson$1(value) {
 	try {
 		const decoded = JSON.parse(Buffer.from(value, "base64url").toString("utf8"));
-		return isRecord$21(decoded) ? decoded : null;
+		return isRecord$22(decoded) ? decoded : null;
 	} catch {
 		return null;
 	}
@@ -30862,11 +30909,11 @@ var DesktopRelayControlPlaneError = class extends Error {
 		this.name = "DesktopRelayControlPlaneError";
 	}
 };
-function isRecord$20(value) {
+function isRecord$21(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function parseErrorPayload(value) {
-	return isRecord$20(value) ? value : {};
+	return isRecord$21(value) ? value : {};
 }
 function messageFromErrorPayload(payload, fallback) {
 	return typeof payload.error === "string" && payload.error.trim().length > 0 ? payload.error.trim() : fallback;
@@ -30964,7 +31011,7 @@ async function postControlPlane(input) {
 		const errorPayload = parseErrorPayload(payload);
 		throw new DesktopRelayControlPlaneError(typeof errorPayload.code === "string" && errorPayload.code.trim().length > 0 ? errorPayload.code.trim() : `CMMD_HTTP_${response.status}`, messageFromErrorPayload(errorPayload, `CMMD relay request failed (${response.status}).`), response.status === 408 || response.status === 429 || response.status >= 500);
 	}
-	if (!isRecord$20(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
+	if (!isRecord$21(payload) || !("data" in payload)) throw new DesktopRelayControlPlaneError("CONTROL_PLANE_INVALID_RESPONSE", "CMMD returned an invalid Forge relay response.", false);
 	return payload.data;
 }
 function resolveRegisteredDevice(input) {
@@ -31834,6 +31881,10 @@ const relayCommandPolicyByType = {
 		requiredScope: "project.write",
 		deliveryClass: "idempotent-command"
 	},
+	"project.script.update": {
+		requiredScope: "project.write",
+		deliveryClass: "idempotent-command"
+	},
 	"project.delete": {
 		requiredScope: "project.write",
 		deliveryClass: "idempotent-command"
@@ -65813,7 +65864,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.12.0";
+var version$1 = "0.13.1";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -71377,12 +71428,12 @@ function resolveDesktopRelayControlPlaneTarget(path, configuredRuntimeId) {
 		code: "RELAY_OPERATION_DENIED"
 	};
 }
-function isRecord$19(value) {
+function isRecord$20(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function relayControlPlaneBodyMatchesRuntime(path, body, configuredRuntimeId) {
 	if (path !== "/api/forge/context/devices/register") return true;
-	if (!isRecord$19(body) || !isRecord$19(body.runtime)) return false;
+	if (!isRecord$20(body) || !isRecord$20(body.runtime)) return false;
 	return body.runtime.runtimeId === configuredRuntimeId;
 }
 /** Matches the client id `connect login` used, so CMMD accepts the refresh. */
@@ -71397,7 +71448,7 @@ function forbiddenResponse() {
 	return errorResponse(403, "RELAY_BRIDGE_FORBIDDEN", "Desktop relay bridge access denied.");
 }
 function relayProxyErrorResponse(error) {
-	if (error instanceof CmmdProxyRequestError && isRecord$19(error.body)) {
+	if (error instanceof CmmdProxyRequestError && isRecord$20(error.body)) {
 		const code = typeof error.body.code === "string" ? error.body.code : error.code;
 		const message = typeof error.body.error === "string" ? error.body.error : error.detail;
 		return errorResponse(error.status >= 500 ? 502 : error.status, code, message ?? "CMMD relay coordination failed.");
@@ -93773,7 +93824,7 @@ const REPLICA_THREAD_STATUSES = [
 ];
 //#endregion
 //#region src/runtimeReplication/replicaDecodeModel.ts
-function isRecord$18(value) {
+function isRecord$19(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonBlankString(value) {
@@ -93793,7 +93844,7 @@ function nullableInteger(value) {
 	return value === null || typeof value === "number" && Number.isSafeInteger(value);
 }
 function unwrapEnvelope(payload, expectedDomain) {
-	if (!isRecord$18(payload) || !isRecord$18(payload.meta) || !isRecord$18(payload.data)) return null;
+	if (!isRecord$19(payload) || !isRecord$19(payload.meta) || !isRecord$19(payload.data)) return null;
 	const { domain, timestamp, version } = payload.meta;
 	if (!isNonBlankString(domain) || expectedDomain !== void 0 && domain !== expectedDomain || version !== "1.0" || !isIsoDateTime(timestamp)) return null;
 	return payload.data;
@@ -93806,12 +93857,12 @@ function hasValidRuntimeIdentity(value) {
 	].includes(String(value.runtimeKind)) && typeof value.displayName === "string" && typeof value.status === "string";
 }
 function decodeRuntime$1(value) {
-	if (!isRecord$18(value) || !hasValidRuntimeIdentity(value)) return null;
-	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$18(value.metadata))) return null;
+	if (!isRecord$19(value) || !hasValidRuntimeIdentity(value)) return null;
+	if (!nullableString(value.endpointUrl) || value.endpointUrl !== null && !URL.canParse(value.endpointUrl) || !nullableInteger(value.deviceId) || !nullableString(value.workspaceRoot) || !nullableString(value.githubRepoFullName) || !(value.lastSeenAt === null || isIsoDateTime(value.lastSeenAt)) || !(value.metadata === null || isRecord$19(value.metadata))) return null;
 	return value;
 }
 function decodeProject(value) {
-	if (!isRecord$18(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
+	if (!isRecord$19(value) || !isNonBlankString(value.projectId) || typeof value.title !== "string" || !nullableString(value.githubRepoFullName) || !nullableString(value.branch)) return null;
 	return {
 		projectId: value.projectId,
 		title: value.title,
@@ -93820,11 +93871,11 @@ function decodeProject(value) {
 	};
 }
 function decodeThread$1(value) {
-	if (!isRecord$18(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt))) return null;
+	if (!isRecord$19(value) || !isNonBlankString(value.threadId) || typeof value.title !== "string" || !isReplicaThreadStatus(value.status) || !nullableString(value.model) || !nullableString(value.branch) || !(value.lastActivityAt === null || isIsoDateTime(value.lastActivityAt))) return null;
 	return value;
 }
 function decodeSummary(value) {
-	if (!isRecord$18(value) || !nullableString(value.conversationId)) return null;
+	if (!isRecord$19(value) || !nullableString(value.conversationId)) return null;
 	const project = decodeProject(value.project);
 	const thread = decodeThread$1(value.thread);
 	return project === null || thread === null ? null : {
@@ -93935,7 +93986,7 @@ function isNonNegativeInt(value) {
 /** `usage` is null for an Unreported turn, otherwise exactly the five buckets. */
 function isValidTurnUsageTokens(value) {
 	if (value === null) return true;
-	if (!isRecord$18(value)) return false;
+	if (!isRecord$19(value)) return false;
 	return turnUsageTokenKeys.every((key) => isNonNegativeInt(value[key])) && Object.keys(value).every((key) => turnUsageTokenKeys.includes(key));
 }
 /** The row itself: no text, no status, and the turn it belongs to. */
@@ -93944,7 +93995,7 @@ function hasValidTurnUsageEnvelope(value) {
 }
 /** What the row records: who ran it, what it spent, and what it says of itself. */
 function hasValidTurnUsageRecord(payload) {
-	return isRecord$18(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
+	return isRecord$19(payload) && isNonBlankString(payload.provider) && isNonBlankString(payload.model) && "usage" in payload && isValidTurnUsageTokens(payload.usage) && hasValidTurnUsageAttribution(payload);
 }
 /** A turn_usage row: no text, no status, and its record in `payload`. */
 function hasValidTurnUsagePayload(value) {
@@ -93981,7 +94032,7 @@ function hasValidEventPayload(value) {
 	return isNonBlankString(value.text) && value.status === null;
 }
 function decodeEvent$1(value) {
-	if (!isRecord$18(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
+	if (!isRecord$19(value) || !hasValidEventFields(value) || !hasValidEventPayload(value)) return null;
 	return value;
 }
 function decodeEvents(data) {
@@ -94002,11 +94053,11 @@ function decodeReplicaThreadDetail(payload) {
 	const thread = decodeThread$1(data.thread);
 	const reachability = decodeReachability(data.reachability);
 	const events = decodeEvents(data);
-	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$18(data.execution) || typeof data.execution.available !== "boolean" || ![
+	if (runtime === null || project === null || thread === null || reachability === null || events === null || !isRecord$19(data.execution) || typeof data.execution.available !== "boolean" || ![
 		null,
 		"runtime_offline",
 		"runtime_unavailable"
-	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$18(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
+	].includes(data.execution.reason) || (data.execution.available ? data.execution.reason !== null : data.execution.reason === null) || !isRecord$19(data.replication) || data.replication.protocolVersion !== 2 || !isNonBlankString(data.replication.generationId) || !Number.isSafeInteger(data.replication.acknowledgedSequence) || Number(data.replication.acknowledgedSequence) < 0 || !isNonBlankString(data.replication.headHash)) return null;
 	return {
 		conversationId: data.conversationId,
 		runtime,
@@ -94927,7 +94978,7 @@ function resolveRuntimeReplicationRuntimeId(config) {
 }
 //#endregion
 //#region src/usage/providerTokenBuckets.ts
-function isRecord$17(value) {
+function isRecord$18(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function count(record, ...keys) {
@@ -94948,7 +94999,7 @@ function reportedOrNull(tokens) {
 * the app server sends camelCase.
 */
 function codexTokenBuckets(value) {
-	if (!isRecord$17(value)) return null;
+	if (!isRecord$18(value)) return null;
 	const inputTokens = count(value, "input_tokens", "inputTokens");
 	const cachedInputTokens = count(value, "cached_input_tokens", "cachedInputTokens");
 	const cacheCreationTokens = count(value, "cache_write_input_tokens", "cacheWriteInputTokens");
@@ -94967,7 +95018,7 @@ function codexTokenBuckets(value) {
 * tokens into output and does not break them out, so reasoning stays zero.
 */
 function claudeTokenBuckets(value) {
-	if (!isRecord$17(value)) return null;
+	if (!isRecord$18(value)) return null;
 	return reportedOrNull({
 		uncachedInputTokens: count(value, "input_tokens", "inputTokens"),
 		cachedInputTokens: count(value, "cache_read_input_tokens", "cacheReadInputTokens"),
@@ -95861,6 +95912,20 @@ function publishedAvailability(provider) {
 		...detail === void 0 ? {} : { unavailableDetail: detail }
 	};
 }
+/**
+* What the Claude CLI said about its credentials, beside the version it said
+* it for. CMMD keeps each Claude version's answers, so these go on the Claude
+* entry only. Each is copied only when the snapshot has an answer: absent means
+* the runtime has not answered yet, and inventing a value would hide that.
+*/
+function claudeCredentialAnswersToPublish(provider) {
+	if (provider.provider !== "claudeAgent") return {};
+	const { credentialDirectory, credentialStore } = provider;
+	return {
+		...credentialDirectory === void 0 ? {} : { credentialDirectory },
+		...credentialStore === void 0 ? {} : { credentialStore }
+	};
+}
 function serializeProvider(provider) {
 	const models = [];
 	for (const model of provider.models) {
@@ -95873,7 +95938,8 @@ function serializeProvider(provider) {
 		models,
 		...publishedAvailability(provider),
 		version: cappedText(provider.version, VERSION_MAX_LENGTH),
-		binaryPath: cappedText(provider.auth.provenance?.binaryPath, BINARY_PATH_MAX_LENGTH)
+		binaryPath: cappedText(provider.auth.provenance?.binaryPath, BINARY_PATH_MAX_LENGTH),
+		...claudeCredentialAnswersToPublish(provider)
 	};
 }
 function serializeProviderCatalog(providers) {
@@ -95894,7 +95960,7 @@ const replicaTurnStatuses = new Set([
 	"cancelled",
 	"interrupted"
 ]);
-function isRecord$16(value) {
+function isRecord$17(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function replicaSourceSequence(value) {
@@ -95907,7 +95973,7 @@ function replicaSourceTurn(sourceTurnId) {
 	return typeof sourceTurnId === "string" && sourceTurnId.length > 0 ? { turnId: sourceTurnId } : {};
 }
 function replicaActivitySource(activity) {
-	if (!activity.kind.startsWith("replica.") || !isRecord$16(activity.payload)) return null;
+	if (!activity.kind.startsWith("replica.") || !isRecord$17(activity.payload)) return null;
 	const sourceSequence = replicaSourceSequence(activity.sequence);
 	const eventId = replicaSourceEventId(activity.payload.sourceEventId);
 	if (sourceSequence === null || eventId === null) return null;
@@ -95920,7 +95986,7 @@ function replicaActivitySource(activity) {
 }
 function replicaSummaryEvent(activity, source) {
 	if (activity.kind !== "replica.activity_summary" && activity.kind !== "replica.error_summary") return null;
-	const sourceText = isRecord$16(activity.payload) ? activity.payload.text : null;
+	const sourceText = isRecord$17(activity.payload) ? activity.payload.text : null;
 	return {
 		sourceSequence: source.sourceSequence,
 		event: {
@@ -95933,7 +95999,7 @@ function replicaSummaryEvent(activity, source) {
 	};
 }
 function replicaTurnEvent(activity, source) {
-	const status = isRecord$16(activity.payload) ? activity.payload.status : null;
+	const status = isRecord$17(activity.payload) ? activity.payload.status : null;
 	if (activity.kind !== "replica.turn_status" || !replicaTurnStatuses.has(status)) return null;
 	return {
 		sourceSequence: source.sourceSequence,
@@ -95947,7 +96013,7 @@ function replicaTurnEvent(activity, source) {
 	};
 }
 function replicaToolCallEvent(activity, source) {
-	if (activity.kind !== "replica.tool_call" || !isRecord$16(activity.payload)) return null;
+	if (activity.kind !== "replica.tool_call" || !isRecord$17(activity.payload)) return null;
 	const sourceText = activity.payload.text;
 	const status = activity.payload.status;
 	if (typeof sourceText !== "string" || typeof status !== "string") return null;
@@ -95965,9 +96031,9 @@ function replicaToolCallEvent(activity, source) {
 	};
 }
 function replicaTurnUsageEvent(activity, source) {
-	if (activity.kind !== "replica.turn_usage" || !isRecord$16(activity.payload)) return null;
+	if (activity.kind !== "replica.turn_usage" || !isRecord$17(activity.payload)) return null;
 	const usage = activity.payload.payload;
-	if (!("turnId" in source.turn) || !isRecord$16(usage)) return null;
+	if (!("turnId" in source.turn) || !isRecord$17(usage)) return null;
 	const provider = usage.provider;
 	const model = usage.model;
 	if (typeof provider !== "string" || typeof model !== "string" || !("usage" in usage)) return null;
@@ -96019,6 +96085,10 @@ function threadStatus(thread) {
 	if (thread.latestTurn) return "running";
 	return "active";
 }
+function threadProviderAccountId(thread) {
+	const selection = thread.modelSelection;
+	return selection && "providerAccountId" in selection ? selection.providerAccountId ?? null : null;
+}
 function serializeRuntimeInventory(snapshot, providerInventory) {
 	const activeProjects = snapshot.projects.filter((project) => project.availability !== "missing");
 	const projectIds = new Set(activeProjects.map((project) => project.id));
@@ -96049,6 +96119,7 @@ function serializeRuntimeInventory(snapshot, providerInventory) {
 			status: threadStatus(thread),
 			model: thread.modelSelection?.model ?? null,
 			provider: thread.modelSelection?.provider ?? null,
+			providerAccountId: threadProviderAccountId(thread),
 			branch: thread.branch,
 			lastActivityAt: thread.latestUserMessageAt ?? thread.updatedAt,
 			kind: thread.kind,
@@ -96775,9 +96846,9 @@ function isUsageSessionLookupRuntimeNotFound(error) {
 async function isRuntimeNotFoundResponse(response) {
 	if (response.status !== 404) return false;
 	const body = await response.json().catch(() => null);
-	return isRecord$15(body) && body["code"] === "RUNTIME_NOT_FOUND";
+	return isRecord$16(body) && body["code"] === "RUNTIME_NOT_FOUND";
 }
-function isRecord$15(value) {
+function isRecord$16(value) {
 	return typeof value === "object" && value !== null;
 }
 /**
@@ -96789,11 +96860,11 @@ function isRecord$15(value) {
 * no count on the page saying so.
 */
 function decodeHeldSessions(body) {
-	const held = isRecord$15(body) && isRecord$15(body["data"]) ? body["data"]["held"] : void 0;
+	const held = isRecord$16(body) && isRecord$16(body["data"]) ? body["data"]["held"] : void 0;
 	if (!Array.isArray(held)) throw new Error("The usage session lookup returned an invalid body.");
 	return held.map((row) => {
-		const providerSessionId = isRecord$15(row) ? row["providerSessionId"] : void 0;
-		const runtimeId = isRecord$15(row) ? row["runtimeId"] : void 0;
+		const providerSessionId = isRecord$16(row) ? row["providerSessionId"] : void 0;
+		const runtimeId = isRecord$16(row) ? row["runtimeId"] : void 0;
 		if (typeof providerSessionId !== "string" || typeof runtimeId !== "string") throw new Error("The usage session lookup returned an invalid held row.");
 		return {
 			providerSessionId,
@@ -99286,7 +99357,7 @@ var BrowserManager = class extends require_Schema$1.Service()("forge/browser/Ser
 const DEFAULT_PORT_MIN = 5200;
 const DEFAULT_PORT_MAX = 5999;
 var ThreadDevRuntime = class extends require_Schema$1.Service()("forge/threadDevRuntime/ThreadDevRuntime") {};
-function nowIso$4() {
+function nowIso$5() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
 function previewUrlForPort(port) {
@@ -99313,7 +99384,7 @@ const ThreadDevRuntimeLive = require_Schema$1.effect(ThreadDevRuntime, require_S
 				allocatedPort: port,
 				status: "allocated",
 				previewUrl: previewUrlForPort(port),
-				updatedAt: nowIso$4()
+				updatedAt: nowIso$5()
 			};
 			yield* require_HttpServer.update(byThreadId, (current) => {
 				const next = new Map(current);
@@ -99335,7 +99406,7 @@ const ThreadDevRuntimeLive = require_Schema$1.effect(ThreadDevRuntime, require_S
 				next.set(input.threadId, {
 					...existing,
 					status: "released",
-					updatedAt: nowIso$4()
+					updatedAt: nowIso$5()
 				});
 				return next;
 			});
@@ -99361,7 +99432,7 @@ const ThreadDevRuntimeLive = require_Schema$1.effect(ThreadDevRuntime, require_S
 				...patch.terminalId !== void 0 ? { terminalId: patch.terminalId } : {},
 				...patch.previewUrl !== void 0 ? { previewUrl: patch.previewUrl } : {},
 				...patch.tunnelId !== void 0 ? { tunnelId: patch.tunnelId } : {},
-				updatedAt: nowIso$4()
+				updatedAt: nowIso$5()
 			};
 			yield* require_HttpServer.update(byThreadId, (current) => {
 				const next = new Map(current);
@@ -99589,7 +99660,7 @@ function emptyConfig(source, path) {
 		issues: []
 	};
 }
-function isRecord$14(value) {
+function isRecord$15(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function stringArray(value) {
@@ -99617,7 +99688,7 @@ function terminalsFromValue(value) {
 			name: `Terminal ${index + 1}`,
 			command: terminal.trim()
 		}];
-		if (!isRecord$14(terminal)) return [];
+		if (!isRecord$15(terminal)) return [];
 		const command = typeof terminal.command === "string" ? terminal.command.trim() : "";
 		if (!command) return [];
 		return [{
@@ -99656,7 +99727,7 @@ function readConfigFile(source, path) {
 			}]
 		};
 	}
-	if (!isRecord$14(parsed)) return {
+	if (!isRecord$15(parsed)) return {
 		...emptyConfig(source, path),
 		issues: [{
 			severity: "blocked",
@@ -100799,7 +100870,7 @@ const CLAUDE_IDENTITY_KEYS = new Set([
 	"credentialGenerationId"
 ]);
 const CLAUDE_IDENTITY_OPTIONAL_KEYS = new Set(["providerAccountIdentity"]);
-function isRecord$13(value) {
+function isRecord$14(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isStrictRfc3339DateTime(value) {
@@ -100828,7 +100899,7 @@ function hasAllowedKeys(value, required, optional) {
 	return keys.every((key) => required.has(key) || optional.has(key)) && [...required].every((key) => keys.includes(key));
 }
 function parseDeliveryIdentity(value, provider) {
-	if (!isRecord$13(value)) return null;
+	if (!isRecord$14(value)) return null;
 	if (provider === "openai") return parseCodexDeliveryIdentity(value);
 	if (provider === "anthropic") return parseClaudeDeliveryIdentity(value);
 	return null;
@@ -100863,7 +100934,7 @@ function parseClaudeDeliveryIdentity(value) {
 	};
 }
 function parseProviderRuntimeDeliveryReceipt(value, expected) {
-	if (!isRecord$13(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
+	if (!isRecord$14(value) || !hasExactKeys$2(value, RECEIPT_KEYS)) return null;
 	const identity = parseDeliveryIdentity(value.identity, expected.provider);
 	if (!identity || typeof value.receiptId !== "string" || value.receiptId.length === 0 || value.receiptId.length > 256 || value.runtimeId !== expected.runtimeId || value.machineId !== expected.machineId || value.credentialEpoch !== expected.credentialEpoch || !Number.isInteger(value.credentialEpoch) || value.credentialEpoch < 0 || !isStrictRfc3339DateTime(value.issuedAt) || value.expiresAt !== expected.expiresAt || value.expiresAt !== null && !isStrictRfc3339DateTime(value.expiresAt)) return null;
 	return {
@@ -100885,8 +100956,8 @@ function providerDeliveryBindingFromReceipt(receipt) {
 	};
 }
 function readProviderDeliveryBinding(value) {
-	if (!isRecord$13(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
-	const identityProvider = isRecord$13(value.identity) ? value.identity.provider : void 0;
+	if (!isRecord$14(value) || !hasExactKeys$2(value, BINDING_KEYS)) return null;
+	const identityProvider = isRecord$14(value.identity) ? value.identity.provider : void 0;
 	const tokenProvider = identityProvider === "codex" ? "openai" : identityProvider === "claude" ? "anthropic" : null;
 	if (!tokenProvider) return null;
 	const identity = parseDeliveryIdentity(value.identity, tokenProvider);
@@ -148170,12 +148241,12 @@ function decodeProviderKind(providerName, operation) {
 		detail: `Unknown persisted provider '${providerName}'.`
 	}));
 }
-function isRecord$12(value) {
+function isRecord$13(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function mergeRuntimePayload(existing, next) {
 	if (next === void 0) return existing ?? null;
-	if (isRecord$12(existing) && isRecord$12(next)) return {
+	if (isRecord$13(existing) && isRecord$13(next)) return {
 		...existing,
 		...next
 	};
@@ -150147,7 +150218,7 @@ const PAGINATION_KEYS = new Set([
 	"total",
 	"hasMore"
 ]);
-function isRecord$11(value) {
+function isRecord$12(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasOnlyKeys(value, allowed) {
@@ -150160,17 +150231,17 @@ function isRfc3339(value) {
 	return typeof value === "string" && RFC3339.test(value) && Number.isFinite(Date.parse(value));
 }
 function isEnvelopeMeta(value) {
-	if (!isRecord$11(value) || !hasExactKeys$1(value, META_KEYS)) return false;
+	if (!isRecord$12(value) || !hasExactKeys$1(value, META_KEYS)) return false;
 	return typeof value.domain === "string" && value.domain.length > 0 && isRfc3339(value.timestamp) && typeof value.version === "string" && value.version.length > 0;
 }
 function isPagination(value) {
-	if (!isRecord$11(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
+	if (!isRecord$12(value) || !hasExactKeys$1(value, PAGINATION_KEYS)) return false;
 	return Number.isInteger(value.page) && value.page >= 0 && Number.isInteger(value.limit) && value.limit >= 0 && Number.isInteger(value.total) && value.total >= 0 && typeof value.hasMore === "boolean";
 }
 function readLocalProviderAccountId(authJson) {
 	try {
 		const value = JSON.parse(authJson);
-		if (!isRecord$11(value) || value.auth_mode !== "chatgpt" || !isRecord$11(value.tokens)) return null;
+		if (!isRecord$12(value) || value.auth_mode !== "chatgpt" || !isRecord$12(value.tokens)) return null;
 		const providerAccountId = value.tokens.account_id;
 		if (typeof providerAccountId !== "string") return null;
 		const normalized = providerAccountId.trim();
@@ -150183,13 +150254,13 @@ function resolveLocalAuthJsonPath(homePath) {
 	return (0, node_path.join)(homePath?.trim() || process.env.CODEX_HOME?.trim() || (0, node_path.join)((0, node_os.homedir)(), ".codex"), "auth.json");
 }
 function parseCodexAccountIdentityEnvelope(value) {
-	if (!isRecord$11(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
+	if (!isRecord$12(value) || !hasOnlyKeys(value, ENVELOPE_KEYS)) return null;
 	if (!("data" in value) || !("meta" in value) || !isEnvelopeMeta(value.meta)) return null;
 	if (value.pagination !== void 0 && !isPagination(value.pagination)) return null;
 	return readCodexAccountIdentity(value.data);
 }
 function readCodexAccountIdentity(value) {
-	if (!isRecord$11(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
+	if (!isRecord$12(value) || !hasExactKeys$1(value, IDENTITY_KEYS)) return null;
 	if (value.kind !== "provider_account" || value.provider !== "codex" || typeof value.providerAccountIdentity !== "string" || !PROVIDER_ACCOUNT_IDENTITY$1.test(value.providerAccountIdentity)) return null;
 	return {
 		kind: "provider_account",
@@ -210973,6 +211044,11 @@ const PUBLIC_PROVIDER_LEAK_PATTERNS = [
 	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
 ];
 const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+function isProviderRateOrQuotaError(message) {
+	if (!message) return false;
+	const normalized = message.toLowerCase();
+	return /\b(rate[\s-]?limit|too\s+many\s+requests|usage[ _-]limit|usage_limit_reached|quota|insufficient_quota)\b/.test(normalized) || /\b429\b/.test(normalized);
+}
 /**
 * Infer a SAFE, clearer failure category from a (possibly leaky) provider error.
 *
@@ -210988,7 +211064,7 @@ function categorizePublicProviderError(message) {
 	if (/\bforge_runtime_stopped\b/.test(m) || /\bthis turn was interrupted because the environment was stopped\b/.test(m)) return "This turn was interrupted because the environment was stopped. Start the environment and retry.";
 	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
 	if (/\bmodel\b[\s\S]*\b(not\s+(found|available|supported)|does\s+not\s+exist|unsupported|invalid|unknown)\b/.test(m) || /\b(unsupported|unknown|invalid)\b[\s\S]*\bmodel\b/.test(m) || /\b(model_not_found|invalid_model|model_not_supported)\b/.test(m)) return "The selected model isn't available right now. Pick a different model and retry.";
-	if (/\b(rate[\s-]?limit|too\s+many\s+requests|quota|insufficient_quota)\b/.test(m) || /\b429\b/.test(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
+	if (isProviderRateOrQuotaError(m)) return "The AI service is rate-limited or out of quota. Wait a moment and retry.";
 	if (/\b(unauthorized|forbidden|authentication\s+(failed|error|required)|invalid\s+api\s+key|expired\s+(token|credential))\b/.test(m) || /\b40[13]\b/.test(m)) return "Workspace AI authentication failed. Reconnect the workspace and retry.";
 	if (/\b(timed?\s*out|timeout|overloaded|service\s+unavailable)\b/.test(m) || /\b50[234]\b/.test(m)) return "The AI service is temporarily overloaded. Retry in a moment.";
 	return null;
@@ -211369,10 +211445,16 @@ function claudeSubscriptionChildEnv(processEnv, credentialDirectory) {
 * environment with `claudeSubscriptionChildEnv`, the same builder as the turn's
 * personal-subscription branch.
 *
-* `claude auth status` is a pure read. It sends no prompt and leaves
-* `.credentials.json` byte-identical, so probing spends no subscription usage.
+* `claude auth status` sends no prompt and leaves `.credentials.json`
+* byte-identical, so probing spends no subscription usage. For Team and
+* Enterprise accounts the CLI's `auth` preAction schedules a remote-settings
+* fetch it never awaits, and the command exits before that fetch runs (see the
+* 2026-09-10 amendment to `docs/adr/cmmd-is-the-only-claude-credential-renewer.md`).
 * It prints JSON on stdout and exits 1 when logged out, so the exit code is not
 * a failure signal and the `loggedIn` field is what gets read.
+*
+* Each answer a probe reaches is also kept in `claudeCredentialDirectoryAnswers`
+* so the provider check can publish it without probing.
 */
 const execFileAsync$3 = (0, node_util.promisify)(node_child_process.execFile);
 const AUTH_STATUS_ARGS = ["auth", "status"];
@@ -211389,8 +211471,7 @@ const PROBE_DIRECTORY_PREFIX = "forge-claude-capability-";
 const VERSION_PATTERN = /\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/;
 function makeClaudeCredentialDirectoryProbe(deps) {
 	const answers = /* @__PURE__ */ new Map();
-	const answer = async () => {
-		const version = await readVersionSafely(deps);
+	const answerFor = (version) => {
 		if (version === null) return runProbe(deps);
 		const cached = answers.get(version);
 		if (cached) return cached;
@@ -211401,10 +211482,47 @@ function makeClaudeCredentialDirectoryProbe(deps) {
 		};
 		pending.then((result) => {
 			if (result === "inconclusive") forget();
-		}, forget);
+			deps.onAnswer?.(version, result);
+		}, () => {
+			forget();
+			deps.onAnswer?.(version, "inconclusive");
+		});
 		return pending;
 	};
-	return { support: require_Schema$1.tryPromise(answer).pipe(require_Schema$1.orElseSucceed(() => "inconclusive")) };
+	return { support: inconclusiveOnFailure(async () => answerFor(await readVersionSafely(deps))) };
+}
+/**
+* The one place a probe failure is handled. A missing binary, a timeout or a
+* directory that cannot be made all mean the probe could not tell.
+*/
+function inconclusiveOnFailure(run) {
+	return require_Schema$1.tryPromise(run).pipe(require_Schema$1.orElseSucceed(() => "inconclusive"));
+}
+const keyOf = (binaryPath, version) => JSON.stringify([binaryPath, version]);
+function makeClaudeCredentialDirectoryAnswers() {
+	const answers = /* @__PURE__ */ new Map();
+	const listeners = /* @__PURE__ */ new Set();
+	return {
+		record: (binaryPath, version, answer) => {
+			const key = keyOf(binaryPath, version);
+			if (answers.get(key) === answer) return;
+			answers.set(key, answer);
+			for (const listener of listeners) listener();
+		},
+		answerFor: (binaryPath, version) => answers.get(keyOf(binaryPath, version)),
+		subscribe: (listener) => {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		}
+	};
+}
+/** Every answer a turn-time probe in this process has reached. */
+const claudeCredentialDirectoryAnswers = makeClaudeCredentialDirectoryAnswers();
+/** The version in `claude --version` output, the key a probe answer is kept under. */
+function claudeVersionFromOutput(stdout) {
+	return VERSION_PATTERN.exec(stdout)?.[0] ?? null;
 }
 /**
 * One probe per binary path for the life of the process. A conclusive answer is
@@ -211429,7 +211547,12 @@ function claudeCredentialDirectoryProbeFor(binaryPath) {
 	if (!binaryPath) return INCONCLUSIVE_PROBE;
 	const existing = probesByBinaryPath.get(binaryPath);
 	if (existing) return existing;
-	const probe = makeClaudeCredentialDirectoryProbe(claudeCredentialDirectoryProbeDeps(binaryPath));
+	const probe = makeClaudeCredentialDirectoryProbe({
+		...claudeCredentialDirectoryProbeDeps(binaryPath),
+		onAnswer: (version, answer) => {
+			claudeCredentialDirectoryAnswers.record(binaryPath, version, answer);
+		}
+	});
 	probesByBinaryPath.set(binaryPath, probe);
 	return probe;
 }
@@ -211440,7 +211563,7 @@ function claudeCredentialDirectoryProbeDeps(binaryPath, options = {}) {
 		runAuthStatus: ({ credentialDirectory }) => run(AUTH_STATUS_ARGS, credentialDirectory),
 		readBinaryVersion: async () => {
 			const { stdout } = await run(VERSION_ARGS, null);
-			return VERSION_PATTERN.exec(stdout)?.[0] ?? null;
+			return claudeVersionFromOutput(stdout);
 		},
 		makeProbeDirectory: () => (0, node_fs_promises.mkdtemp)((0, node_path.join)((0, node_os.tmpdir)(), PROBE_DIRECTORY_PREFIX)),
 		removeProbeDirectory: (directory) => (0, node_fs_promises.rm)(directory, {
@@ -211609,6 +211732,171 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
+//#region src/provider/claudeCredentialStore.ts
+/**
+* Which Credential Store the Claude CLI uses on this machine, read the way the
+* CLI reads it.
+*
+* The CLI has two stores, `.credentials.json` in the credential directory and
+* the operating system's own, and no platform check picks between them. It
+* takes the OS store when `CLAUDE_CODE_FORCE_WINDOWS_CREDMAN` is `1`, and
+* otherwise when the remote flag it caches in its config file,
+* `cachedGrowthBookFeatures.tengu_windows_credman`, is `true`. That file is a
+* legacy `.config.json` in the config directory when one exists, and
+* `.claude.json` otherwise. Read from Claude Code 2.1.265 in #3086.
+*
+* The CLI takes the file when it cannot find, read or parse the config, and so
+* does this. A config that parses to JSON `null` reads `file` as well: the CLI
+* reads a property off the parsed value, which throws on `null`, and it falls
+* back to the file store on that throw. Any other config that parses but
+* carries no boolean flag also means the file to the CLI, but it is the shape a
+* moved key leaves, so this reads `unknown` rather than guess.
+*
+* Linux with no session bus has no secret service, so the OS store fails its
+* own check and the CLI falls back to the file whatever the flag says. Every
+* Sprite is that case, and it reads `file` without opening the config. Linux
+* with a session bus is `unknown` when the OS store is selected, because only
+* the secret service knows whether it would answer.
+* See `docs/adr/delivery-clears-the-os-credential-store-first.md`.
+*
+* Two things in 2.1.265 this does not follow. The CLI puts its OAuth name
+* suffix, `F$()` in that bundle, into the config name. The suffix is empty in a
+* production build and `-custom-oauth` with `CLAUDE_CODE_CUSTOM_OAUTH_URL` set,
+* so the config is then `.claude-custom-oauth.json` instead of `.claude.json`.
+* And `primeWindowsCredManBackendEnabled` can set the choice before the file is
+* read, but only with a v5 storage backend, and `tryCreateV5Backend` returns
+* nothing in that build, so it never does.
+*/
+const CLAUDE_FORCE_OS_CREDENTIAL_STORE_ENV = "CLAUDE_CODE_FORCE_WINDOWS_CREDMAN";
+const CACHED_FEATURES_KEY = "cachedGrowthBookFeatures";
+const OS_STORE_FLAG_KEY = "tengu_windows_credman";
+function readClaudeCredentialStore(input) {
+	if (input.platform === "linux" && !hasSessionBus(input)) return "file";
+	const selectsOsStore = cliSelectsOsStore(input);
+	if (selectsOsStore === null) return "unknown";
+	if (!selectsOsStore) return "file";
+	return input.platform === "darwin" || input.platform === "win32" ? "os" : "unknown";
+}
+/** The same read against this machine's home directory and disk. */
+const readClaudeCredentialStoreFromDisk = (context) => {
+	let homeDirectory;
+	try {
+		homeDirectory = (0, node_os.homedir)();
+	} catch {
+		homeDirectory = null;
+	}
+	return readClaudeCredentialStore({
+		...context,
+		homeDirectory: homeDirectory ?? "",
+		fileExists: homeDirectory === null ? () => false : node_fs.existsSync,
+		readFile: (path) => {
+			if (homeDirectory === null) throw new Error("no home directory");
+			return (0, node_fs.readFileSync)(path, "utf8");
+		}
+	});
+};
+/** True, false, or null when a parsed config does not say. */
+function cliSelectsOsStore(input) {
+	if (input.env[CLAUDE_FORCE_OS_CREDENTIAL_STORE_ENV] === "1") return true;
+	const config = readConfig(input);
+	if (config === null) return false;
+	const features = isRecord$11(config.parsed) ? config.parsed[CACHED_FEATURES_KEY] : void 0;
+	const flag = isRecord$11(features) ? features[OS_STORE_FLAG_KEY] : void 0;
+	return typeof flag === "boolean" ? flag : null;
+}
+/**
+* The parsed config, or null wherever the CLI's own read throws and it falls
+* back to the file store: a file that is missing, unreadable or not JSON, and a
+* config that parses to JSON `null`, because the CLI reads a property off it.
+*/
+function readConfig(input) {
+	try {
+		const parsed = JSON.parse(input.readFile(cachedFlagFile(input)));
+		return parsed === null ? null : { parsed };
+	} catch {
+		return null;
+	}
+}
+function cachedFlagFile(input) {
+	const configured = input.configDirectory?.trim();
+	const legacy = (0, node_path.join)(configured || (0, node_path.join)(input.homeDirectory, ".claude"), ".config.json");
+	if (input.fileExists(legacy)) return legacy;
+	return (0, node_path.join)(configured || input.homeDirectory, ".claude.json");
+}
+/** libsecret reaches the secret service over the session bus, so no bus means no OS store. */
+function hasSessionBus(input) {
+	if (input.env.DBUS_SESSION_BUS_ADDRESS?.trim()) return true;
+	const runtimeDirectory = input.env.XDG_RUNTIME_DIR?.trim();
+	return runtimeDirectory ? input.fileExists((0, node_path.join)(runtimeDirectory, "bus")) : false;
+}
+function isRecord$11(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/provider/claudeCredentialAnswers.ts
+/**
+* The live resolver. The credential-directory answer is whatever the turn-time
+* probe last reached for this binary path and version, so the published answer
+* and the one that gated a turn are the same. Until a turn has probed, or with
+* no version to look it up by, the field stays absent.
+*/
+function makeClaudeCredentialAnswersResolver(options) {
+	const readCredentialStore = options.readCredentialStore ?? readClaudeCredentialStoreFromDisk;
+	return (input) => require_Schema$1.gen(function* () {
+		const platform = yield* HostProcessPlatform;
+		const credentialStore = yield* require_Schema$1.sync(() => readCredentialStore({
+			env: options.env ?? process.env,
+			platform,
+			configDirectory: input.configDirectory
+		}));
+		const credentialDirectory = input.version === null ? void 0 : options.credentialDirectoryAnswers.answerFor(input.binaryPath, input.version);
+		return credentialDirectory === void 0 ? { credentialStore } : {
+			credentialStore,
+			credentialDirectory
+		};
+	});
+}
+//#endregion
+//#region src/runtimeDrain/supervisedRepeat.ts
+/**
+* Runs `work` on a fixed schedule, forever, and RESTARTS the schedule itself
+* if it ever dies for any reason other than this scope closing.
+*
+* `Effect.repeat(work, Schedule.spaced(interval)).pipe(Effect.forkScoped)`
+* alone has no restart path. `work` catching its own errors only protects
+* the TICK: an interrupt that lands while `Effect.repeat` is asleep between
+* ticks — which, at any non-trivial interval, is nearly this loop's entire
+* life — happens outside anything `work` wraps, and kills that one fiber
+* outright with nothing logged, because nothing was running to log from.
+* The process this runs in can otherwise be perfectly healthy while the
+* schedule is silently, permanently dead.
+*
+* This runs the schedule on its own child fiber, raced against an explicit
+* shutdown signal fired by a finalizer registered in this scope. Only that
+* signal stops the loop for good; any other death of the schedule fiber —
+* whatever causes it, defect or interrupt — logs and restarts it. `work`
+* itself must still handle its own EXPECTED failures (this only supervises
+* the schedule, and treats every death of it as unexpected).
+*/
+function runSupervisedRepeat(input) {
+	return require_Schema$1.gen(function* () {
+		const shutdownSignal = yield* require_Schema$1.make$4();
+		yield* require_Schema$1.addFinalizer(() => require_Schema$1.succeed$2(shutdownSignal, void 0));
+		let firstAttempt = true;
+		while (true) {
+			if (!firstAttempt) yield* require_Schema$1.sleep(input.interval);
+			firstAttempt = false;
+			const scheduleFiber = yield* require_Schema$1.forkChild(require_Schema$1.repeat(input.work, require_Schema$1.spaced(input.interval)));
+			const outcome = yield* require_Schema$1.race(require_Path.await_(scheduleFiber), require_Schema$1._await(shutdownSignal).pipe(require_Schema$1.as("shutdown")));
+			if (outcome === "shutdown") {
+				yield* require_Path.interrupt(scheduleFiber);
+				return;
+			}
+			yield* require_Schema$1.logError(`${input.label} died unexpectedly — restarting`, { cause: require_Schema$1.isFailure(outcome) ? require_Schema$1.pretty(outcome.cause) : "unknown exit" });
+		}
+	});
+}
+//#endregion
 //#region src/provider/Layers/ClaudeProvider.ts
 function endpointProfileDisplayNames(settings) {
 	return Object.fromEntries(settings.endpointProfiles.filter((p) => p.displayName).map((p) => [p.slug, p.displayName]));
@@ -212110,7 +212398,21 @@ const nativeClaudeProviderStatus = require_Schema$1.fn("nativeClaudeProviderStat
 		}
 	});
 });
-const checkClaudeProviderStatus = require_Schema$1.fn("checkClaudeProviderStatus")(function* (resolveSubscriptionType, resolveSlashCommands, resolveModels) {
+/**
+* Adds what the CLI said about its credentials. Every check where
+* `claude --version` ran and exited 0 reaches here, including one whose
+* version did not parse; that one has no key to look a probe answer up by, so
+* only the store is added.
+*/
+function withClaudeCredentialAnswers(provider, resolve, input) {
+	if (!resolve) return require_Schema$1.succeed(provider);
+	return resolve(input).pipe(require_Schema$1.map((answers) => ({
+		...provider,
+		...answers
+	})));
+}
+const checkClaudeProviderStatus = require_Schema$1.fn("checkClaudeProviderStatus")(function* (resolvers = {}) {
+	const { resolveSubscriptionType, resolveSlashCommands, resolveModels, resolveCredentialAnswers } = resolvers;
 	const config = require_Schema$1.getOrElse(yield* require_Schema$1.serviceOption(ServerConfig), () => ({
 		...DEFAULT_PROVIDER_AUTH_CONFIG,
 		forgeClaudeConfigPath: void 0
@@ -212182,19 +212484,24 @@ const checkClaudeProviderStatus = require_Schema$1.fn("checkClaudeProviderStatus
 		});
 	}
 	const executableFallbackModels = modelsForClaudeCliVersion(fallbackModels, parsedVersion);
-	if (personalClaudeInVmEnabled()) return yield* nativeClaudeProviderStatus({
+	const credentialAnswersInput = {
+		binaryPath: claudeSettings.binaryPath,
+		version: claudeVersionFromOutput(version.stdout),
+		configDirectory: effectiveConfigPath
+	};
+	if (personalClaudeInVmEnabled()) return yield* withClaudeCredentialAnswers(yield* nativeClaudeProviderStatus({
 		enabled: claudeSettings.enabled,
 		checkedAt,
 		version: parsedVersion,
 		configPath: effectiveConfigPath,
 		models: executableFallbackModels,
 		provenance
-	});
+	}), resolveCredentialAnswers, credentialAnswersInput);
 	const capabilitiesProbeInput = claudeCapabilitiesProbeInput(claudeSettings.binaryPath, effectiveConfigPath);
 	const discovery = yield* resolveClaudeDiscovery(capabilitiesProbeInput, resolveSlashCommands, resolveModels);
 	const models = modelsForClaudeCliVersion(providerModelsFromSettings(resolveClaudeProviderModels(discovery.models), PROVIDER$12, claudeSettings.customModels, DEFAULT_CLAUDE_MODEL_CAPABILITIES, endpointProfileDisplayNames(claudeSettings)), parsedVersion);
 	const authProbe = yield* runClaudeCommand(["auth", "status"]).pipe(require_Schema$1.timeoutOption(DEFAULT_TIMEOUT_MS$3), require_Schema$1.result);
-	return buildClaudeProviderFromAuthProbe({
+	return yield* withClaudeCredentialAnswers(buildClaudeProviderFromAuthProbe({
 		authProbe,
 		authMetadata: yield* resolveClaudeAuthMetadata(authProbe, capabilitiesProbeInput, resolveSubscriptionType),
 		checkedAt,
@@ -212203,7 +212510,7 @@ const checkClaudeProviderStatus = require_Schema$1.fn("checkClaudeProviderStatus
 		slashCommands: discovery.slashCommands,
 		parsedVersion,
 		provenance
-	});
+	}), resolveCredentialAnswers, credentialAnswersInput);
 });
 const makePendingClaudeProvider = (claudeSettings) => {
 	const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -212235,30 +212542,76 @@ const makePendingClaudeProvider = (claudeSettings) => {
 		}
 	});
 };
-const ClaudeProviderLive = require_Schema$1.effect(ClaudeProvider, require_Schema$1.gen(function* () {
-	const serverSettings = yield* ServerSettingsService;
-	const spawner = yield* require_NodeTerminal.ChildProcessSpawner;
-	const subscriptionProbeCache = yield* require_Cache.make({
-		capacity: 4,
-		timeToLive: require_Schema$1.minutes(5),
-		lookup: (key) => {
-			const [binaryPath, configPath] = JSON.parse(key);
-			return probeClaudeCapabilities({
-				binaryPath,
-				...configPath ? { configPath } : {}
-			});
-		}
-	});
-	const getDiscovery = (input) => require_Cache.get(subscriptionProbeCache, JSON.stringify([input.binaryPath, input.configPath]));
-	const checkProvider = checkClaudeProviderStatus((input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.subscriptionType)), (input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.slashCommands)), (input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.models))).pipe(require_Schema$1.provideService(ServerSettingsService, serverSettings), require_Schema$1.provideService(require_NodeTerminal.ChildProcessSpawner, spawner));
-	return yield* makeManagedServerProvider({
-		getSettings: serverSettings.getSettings.pipe(require_Schema$1.map((settings) => settings.providers.claudeAgent), require_Schema$1.orDie),
-		streamSettings: serverSettings.streamChanges.pipe(require_Path.map((settings) => settings.providers.claudeAgent)),
-		haveSettingsChanged: (previous, next) => !require_Schema$1.equals(previous, next),
-		initialSnapshot: makePendingClaudeProvider,
-		checkProvider
-	});
-}));
+/**
+* A refresh can wait behind a check that already holds the provider's refresh
+* permit before running its own, so it gets two check budgets.
+*/
+const CREDENTIAL_ANSWER_REFRESH_TIMEOUT_MS = 2 * (CLAUDE_VERSION_PROBE_TIMEOUT_MS + CAPABILITIES_PROBE_TIMEOUT_MS$1 + DEFAULT_TIMEOUT_MS$3);
+/** The gap after each answer refresh, and the pause before a restart. */
+const CREDENTIAL_ANSWER_REFRESH_SPACING = require_Schema$1.seconds(1);
+/**
+* Reruns the check when a probe reaches a new or changed answer, so the
+* inventory carries it without waiting for the next scheduled check. Answers
+* that arrive during a refresh collapse into one more refresh.
+*
+* A refresh that fails, dies or outlives its timeout is logged, and the loop
+* goes back to waiting for the next answer. The timeout interrupts the check,
+* which hands back the refresh permit. `runSupervisedRepeat` restarts the loop
+* after any interrupt that does not come from the scope closing; closing the
+* scope stops it and drops the subscription.
+*/
+const refreshOnNewCredentialDirectoryAnswer = require_Schema$1.fn("refreshOnNewCredentialDirectoryAnswer")(function* (credentialDirectoryAnswers, refresh) {
+	const changed = yield* require_Path.sliding(1);
+	yield* require_Schema$1.acquireRelease(require_Schema$1.sync(() => credentialDirectoryAnswers.subscribe(() => {
+		require_Path.offerUnsafe(changed, void 0);
+	})), (unsubscribe) => require_Schema$1.sync(unsubscribe));
+	const refreshOnce = refresh.pipe(require_Schema$1.timeout(CREDENTIAL_ANSWER_REFRESH_TIMEOUT_MS), require_Schema$1.asVoid, require_Schema$1.catchCause((cause) => require_Schema$1.hasInterruptsOnly(cause) ? require_Schema$1.interrupt : require_Schema$1.logWarning("Claude refresh for a new credential-directory answer failed", { cause: require_Schema$1.pretty(cause) })));
+	yield* require_Schema$1.forkScoped(runSupervisedRepeat({
+		label: "Claude credential-directory answer refresh",
+		work: require_Path.take(changed).pipe(require_Schema$1.andThen(refreshOnce)),
+		interval: CREDENTIAL_ANSWER_REFRESH_SPACING
+	}));
+});
+/** The Claude provider. Tests hand in their own answers and store read. */
+function makeClaudeProviderLive(options = {}) {
+	const credentialDirectoryAnswers = options.credentialDirectoryAnswers ?? claudeCredentialDirectoryAnswers;
+	const resolveCredentialAnswers = makeClaudeCredentialAnswersResolver({
+		...options,
+		credentialDirectoryAnswers
+	});
+	return require_Schema$1.effect(ClaudeProvider, require_Schema$1.gen(function* () {
+		const serverSettings = yield* ServerSettingsService;
+		const spawner = yield* require_NodeTerminal.ChildProcessSpawner;
+		const subscriptionProbeCache = yield* require_Cache.make({
+			capacity: 4,
+			timeToLive: require_Schema$1.minutes(5),
+			lookup: (key) => {
+				const [binaryPath, configPath] = JSON.parse(key);
+				return probeClaudeCapabilities({
+					binaryPath,
+					...configPath ? { configPath } : {}
+				});
+			}
+		});
+		const getDiscovery = (input) => require_Cache.get(subscriptionProbeCache, JSON.stringify([input.binaryPath, input.configPath]));
+		const checkProvider = checkClaudeProviderStatus({
+			resolveSubscriptionType: (input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.subscriptionType)),
+			resolveSlashCommands: (input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.slashCommands)),
+			resolveModels: (input) => getDiscovery(input).pipe(require_Schema$1.map((probe) => probe?.models)),
+			resolveCredentialAnswers
+		}).pipe(require_Schema$1.provideService(ServerSettingsService, serverSettings), require_Schema$1.provideService(require_NodeTerminal.ChildProcessSpawner, spawner));
+		const provider = yield* makeManagedServerProvider({
+			getSettings: serverSettings.getSettings.pipe(require_Schema$1.map((settings) => settings.providers.claudeAgent), require_Schema$1.orDie),
+			streamSettings: serverSettings.streamChanges.pipe(require_Path.map((settings) => settings.providers.claudeAgent)),
+			haveSettingsChanged: (previous, next) => !require_Schema$1.equals(previous, next),
+			initialSnapshot: makePendingClaudeProvider,
+			checkProvider
+		});
+		yield* refreshOnNewCredentialDirectoryAnswer(credentialDirectoryAnswers, provider.refresh);
+		return provider;
+	}));
+}
+const ClaudeProviderLive = makeClaudeProviderLive();
 //#endregion
 //#region src/provider/Services/ClaudeAdapter.ts
 /**
@@ -228638,7 +228991,7 @@ const OpenCodeRuntimeLive = require_Schema$1.effect(OpenCodeRuntime, makeOpenCod
 //#endregion
 //#region src/provider/Layers/OpenCodeAdapter.ts
 const PROVIDER$5 = "opencode";
-const nowIso$3 = require_Schema$1.map(require_Schema$1.now, require_Schema$1.formatIso);
+const nowIso$4 = require_Schema$1.map(require_Schema$1.now, require_Schema$1.formatIso);
 /**
 * Map a tagged OpenCodeRuntimeError produced by {@link runOpenCodeSdk} into
 * the adapter-boundary `ProviderAdapterRequestError`. SDK-method-level call
@@ -228665,7 +229018,7 @@ const toProcessError = (threadId, cause) => new ProviderAdapterProcessError({
 });
 const buildEventBase = (input) => require_Schema$1.gen(function* () {
 	const uuid = yield* nextUUIDv4;
-	const createdAt = input.createdAt ?? (yield* nowIso$3);
+	const createdAt = input.createdAt ?? (yield* nowIso$4);
 	return {
 		eventId: EventId.make(uuid),
 		provider: PROVIDER$5,
@@ -228824,7 +229177,7 @@ function sessionErrorMessage(error) {
 }
 function updateProviderSession(context, patch, options) {
 	return require_Schema$1.gen(function* () {
-		const updatedAt = yield* nowIso$3;
+		const updatedAt = yield* nowIso$4;
 		const nextSession = {
 			...context.session,
 			...patch,
@@ -228946,7 +229299,7 @@ function makeOpenCodeAdapter(openCodeSettings, options) {
 			if (("properties" in event ? event.properties.sessionID : void 0) !== context.openCodeSessionId) return;
 			const turnId = context.activeTurnId;
 			yield* writeNativeEventBestEffort(context.session.threadId, {
-				observedAt: yield* nowIso$3,
+				observedAt: yield* nowIso$4,
 				event: {
 					provider: PROVIDER$5,
 					threadId: context.session.threadId,
@@ -229262,7 +229615,7 @@ function makeOpenCodeAdapter(openCodeSettings, options) {
 				yield* require_Schema$1.close(started.sessionScope, require_Schema$1.void_$1).pipe(require_Schema$1.ignore);
 				return raceWinner.session;
 			}
-			const createdAt = yield* nowIso$3;
+			const createdAt = yield* nowIso$4;
 			const session = {
 				provider: PROVIDER$5,
 				status: "ready",
@@ -236061,7 +236414,7 @@ function filterEvents(events, options) {
 	});
 	return options.limit === void 0 ? filtered : filtered.slice(-options.limit);
 }
-function nowIso$2() {
+function nowIso$3() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
 //#endregion
@@ -236076,7 +236429,7 @@ var BrowserActionEventRecorder = class {
 			type: "browser.action",
 			action,
 			...this.sessionFields(),
-			timestamp: nowIso$2()
+			timestamp: nowIso$3()
 		});
 	}
 	async result(action) {
@@ -236085,7 +236438,7 @@ var BrowserActionEventRecorder = class {
 			action,
 			ok: true,
 			...this.sessionFields(),
-			timestamp: nowIso$2()
+			timestamp: nowIso$3()
 		});
 	}
 	async error(action, error) {
@@ -236094,7 +236447,7 @@ var BrowserActionEventRecorder = class {
 			action,
 			error: error instanceof Error ? error.message : String(error),
 			...this.sessionFields(),
-			timestamp: nowIso$2()
+			timestamp: nowIso$3()
 		});
 	}
 	sessionFields() {
@@ -236615,7 +236968,7 @@ var AgentBrowser = class {
 		await this.options.events?.record({
 			type: "browser.safety.confirmation.requested",
 			...request,
-			createdAt: nowIso$2()
+			createdAt: nowIso$3()
 		});
 		const result = await this.resolveConfirmation(request);
 		const approved = typeof result === "boolean" ? result : result.approved;
@@ -236623,7 +236976,7 @@ var AgentBrowser = class {
 			type: "browser.safety.confirmation.resolved",
 			approved,
 			requestId: request.requestId,
-			resolvedAt: nowIso$2(),
+			resolvedAt: nowIso$3(),
 			...this.events.sessionFields()
 		});
 		if (!approved) throw new BrowserSafetyError(decision.reason ?? "Browser action was not confirmed.", action, {
@@ -281978,7 +282331,7 @@ const DEFAULT_AGENT_BROWSER_BRIDGE_CLOSE_TIMEOUT_MS = 3e4;
 const DEFAULT_AGENT_BROWSER_PLAYWRIGHT_BACKEND_CLOSE_TIMEOUT_MS = 1e4;
 const REMOTE_WEBRTC_UNAVAILABLE_DETAIL = "Remote WebRTC browser display is not available: the current Agent Browser runtime exposes tab control but does not provide a media transport.";
 const REMOTE_WEBRTC_RELAY_REQUIRED_DETAIL = "Remote WebRTC browser display requires a TURN relay in cloud mode. Configure FORGE_BROWSER_WEBRTC_ICE_SERVERS with authenticated turn: or turns: URLs.";
-function nowIso$1() {
+function nowIso$2() {
 	return (/* @__PURE__ */ new Date()).toISOString();
 }
 function positiveTimeoutMs(value) {
@@ -282078,12 +282431,12 @@ function snapshotAfterTimedOutControl(snapshot, command) {
 		case "setViewport": return {
 			...snapshot,
 			viewport: command.viewport,
-			updatedAt: nowIso$1()
+			updatedAt: nowIso$2()
 		};
 		case "resetViewport": return {
 			...snapshot,
 			viewport: DEFAULT_AGENT_BROWSER_VIEWPORT,
-			updatedAt: nowIso$1()
+			updatedAt: nowIso$2()
 		};
 		default: return snapshot;
 	}
@@ -282529,7 +282882,7 @@ function toStreamEvent(input) {
 		userId: BrowserUserId.make(input.userId),
 		agentId: input.agentId,
 		...input.controlState ? { sessionEpoch: input.controlState.sessionEpoch } : {},
-		createdAt: nowIso$1()
+		createdAt: nowIso$2()
 	};
 	switch (input.event.type) {
 		case "session.started": return {
@@ -282830,7 +283183,7 @@ function createAgentBrowserHostBridgeManager(bridge, options) {
 			environmentId: event.input.environmentId ?? DEFAULT_BROWSER_ENVIRONMENT_ID,
 			userId: event.input.userId ?? "local-user",
 			agentId: null,
-			createdAt: nowIso$1(),
+			createdAt: nowIso$2(),
 			type: "display.iceCandidate",
 			payload: {
 				sessionId: event.input.sessionId,
@@ -287499,46 +287852,6 @@ const makeRuntimeDrainState = require_Schema$1.gen(function* () {
 var RuntimeDrainState = class extends require_Schema$1.Service()("forge/runtimeDrain/RuntimeDrainState") {};
 const RuntimeDrainStateLive = require_Schema$1.effect(RuntimeDrainState, makeRuntimeDrainState);
 //#endregion
-//#region src/runtimeDrain/supervisedRepeat.ts
-/**
-* Runs `work` on a fixed schedule, forever, and RESTARTS the schedule itself
-* if it ever dies for any reason other than this scope closing.
-*
-* `Effect.repeat(work, Schedule.spaced(interval)).pipe(Effect.forkScoped)`
-* alone has no restart path. `work` catching its own errors only protects
-* the TICK: an interrupt that lands while `Effect.repeat` is asleep between
-* ticks — which, at any non-trivial interval, is nearly this loop's entire
-* life — happens outside anything `work` wraps, and kills that one fiber
-* outright with nothing logged, because nothing was running to log from.
-* The process this runs in can otherwise be perfectly healthy while the
-* schedule is silently, permanently dead.
-*
-* This runs the schedule on its own child fiber, raced against an explicit
-* shutdown signal fired by a finalizer registered in this scope. Only that
-* signal stops the loop for good; any other death of the schedule fiber —
-* whatever causes it, defect or interrupt — logs and restarts it. `work`
-* itself must still handle its own EXPECTED failures (this only supervises
-* the schedule, and treats every death of it as unexpected).
-*/
-function runSupervisedRepeat(input) {
-	return require_Schema$1.gen(function* () {
-		const shutdownSignal = yield* require_Schema$1.make$4();
-		yield* require_Schema$1.addFinalizer(() => require_Schema$1.succeed$2(shutdownSignal, void 0));
-		let firstAttempt = true;
-		while (true) {
-			if (!firstAttempt) yield* require_Schema$1.sleep(input.interval);
-			firstAttempt = false;
-			const scheduleFiber = yield* require_Schema$1.forkChild(require_Schema$1.repeat(input.work, require_Schema$1.spaced(input.interval)));
-			const outcome = yield* require_Schema$1.race(require_Path.await_(scheduleFiber), require_Schema$1._await(shutdownSignal).pipe(require_Schema$1.as("shutdown")));
-			if (outcome === "shutdown") {
-				yield* require_Path.interrupt(scheduleFiber);
-				return;
-			}
-			yield* require_Schema$1.logError(`${input.label} died unexpectedly — restarting`, { cause: require_Schema$1.isFailure(outcome) ? require_Schema$1.pretty(outcome.cause) : "unknown exit" });
-		}
-	});
-}
-//#endregion
 //#region src/runtimeDrain/RuntimeDrainReporter.ts
 const HEARTBEAT_INTERVAL = require_Schema$1.seconds(30);
 const HEARTBEAT_TICK_TIMEOUT = require_Schema$1.seconds(60);
@@ -294961,7 +295274,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "7695a8221bc664caedd33aa411ac7bcdbb0a3594";
+	return "9243995fc67ca68aa610fabccbf48bba35a5ffd1";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -298042,6 +298355,52 @@ function toProjectorDecodeError(eventType) {
 	});
 }
 //#endregion
+//#region src/orchestration/deciderEventBase.ts
+const nowIso$1 = () => (/* @__PURE__ */ new Date()).toISOString();
+const defaultMetadata = {
+	eventId: crypto.randomUUID(),
+	aggregateKind: "thread",
+	aggregateId: "",
+	occurredAt: nowIso$1(),
+	commandId: null,
+	causationEventId: null,
+	correlationId: null,
+	metadata: {}
+};
+function withEventBase(input) {
+	return {
+		...defaultMetadata,
+		eventId: crypto.randomUUID(),
+		aggregateKind: input.aggregateKind,
+		aggregateId: input.aggregateId,
+		occurredAt: input.occurredAt,
+		commandId: input.commandId,
+		correlationId: input.commandId,
+		metadata: input.metadata ?? {}
+	};
+}
+//#endregion
+//#region src/orchestration/projectScriptMutation.ts
+function unchanged(a, b) {
+	return a !== void 0 && a.id === b.id && a.name === b.name && a.command === b.command && a.icon === b.icon && a.runOnWorktreeCreate === b.runOnWorktreeCreate;
+}
+const applyProjectScriptMutation = require_Schema$1.fn("applyProjectScriptMutation")(function* (scripts, command) {
+	const mutation = command.mutation;
+	const id = mutation.kind === "add" ? mutation.script.id : mutation.expected.id;
+	const existing = scripts.find((script) => script.id === id);
+	if (mutation.kind === "add" ? existing !== void 0 : !unchanged(existing, mutation.expected)) return yield* new OrchestrationCommandInvariantError({
+		commandType: command.type,
+		detail: "This action changed in another window. Reopen it and try again."
+	});
+	if (mutation.kind === "add") return [...scripts, mutation.script];
+	if (mutation.kind === "remove") return scripts.filter((script) => script.id !== id);
+	if (mutation.script.id !== id) return yield* new OrchestrationCommandInvariantError({
+		commandType: command.type,
+		detail: "An action's ID cannot change during an update."
+	});
+	return scripts.map((script) => script.id === id ? mutation.script : script);
+});
+//#endregion
 //#region src/orchestration/turnAccountSelection.ts
 /** A per-turn account choice remains local to the thread and cannot change its provider. */
 function turnAccountSelection(current, requested) {
@@ -298098,28 +298457,6 @@ function requireThreadAbsent(input) {
 //#endregion
 //#region src/orchestration/decider.ts
 const nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
-const defaultMetadata = {
-	eventId: crypto.randomUUID(),
-	aggregateKind: "thread",
-	aggregateId: "",
-	occurredAt: nowIso(),
-	commandId: null,
-	causationEventId: null,
-	correlationId: null,
-	metadata: {}
-};
-function withEventBase(input) {
-	return {
-		...defaultMetadata,
-		eventId: crypto.randomUUID(),
-		aggregateKind: input.aggregateKind,
-		aggregateId: input.aggregateId,
-		occurredAt: input.occurredAt,
-		commandId: input.commandId,
-		correlationId: input.commandId,
-		metadata: input.metadata ?? {}
-	};
-}
 function requireOrdinaryMessageId(commandType, messageId) {
 	return isReservedReplicaSourceMessageId(messageId) ? require_Schema$1.fail(new OrchestrationCommandInvariantError({
 		commandType,
@@ -298172,6 +298509,22 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 					updatedAt: command.createdAt
 				}
 			};
+		case "project.script.update": {
+			const scripts = yield* applyProjectScriptMutation((yield* requireProject({
+				readModel,
+				command,
+				projectId: command.projectId
+			})).scripts, command);
+			return yield* decideOrchestrationCommand({
+				readModel,
+				command: {
+					type: "project.meta.update",
+					commandId: command.commandId,
+					projectId: command.projectId,
+					scripts
+				}
+			});
+		}
 		case "project.meta.update": {
 			yield* requireProject({
 				readModel,
@@ -299458,6 +299811,7 @@ function commandToAggregateRef(command) {
 	switch (command.type) {
 		case "project.create":
 		case "project.meta.update":
+		case "project.script.update":
 		case "project.delete": return {
 			aggregateKind: "project",
 			aggregateId: command.projectId