@cmmd-center/forge 0.13.104 → 0.13.105

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17794,6 +17794,7 @@ const OrchestrationThread = Struct({
 	status: ThreadStatus.pipe(withDecodingDefault(succeed("idle"))),
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
+	workSessionBoundAt: optionalKey(NullOr(String$1)),
 	pendingAutoCreatePrompt: optional$4(NullOr(AutoCreateTaskPrompt)).pipe(withDecodingDefault(succeed(null))),
 	goal: NullOr(TrimmedNonEmptyString).pipe(withDecodingDefault(succeed(null))),
 	titleRegeneration: NullOr(ThreadTitleRegeneration).pipe(withDecodingDefault(succeed(null))),
@@ -18375,6 +18376,7 @@ const ThreadCreatedPayload$1 = Struct({
 	anchorKind: CmmdAnchorKind.pipe(withDecodingDefault(succeed("scratch"))),
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
+	workSessionBoundAt: optionalKey(NullOr(String$1)),
 	goal: optionalKey(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	kind: ThreadKind.pipe(withDecodingDefault(succeed("master"))),
@@ -18417,6 +18419,7 @@ const ThreadMetaUpdatedPayload$1 = Struct({
 	parentThreadId: optional$4(NullOr(ThreadId)),
 	workerRole: optional$4(NullOr(WorkerRole)),
 	workSessionId: optional$4(NullOr(String$1)),
+	workSessionBoundAt: optional$4(String$1),
 	goal: optional$4(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optional$4(NullOr(LinkedPullRequest)),
 	regenerateTitle: optional$4(Literal(true)),
@@ -50653,7 +50656,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53096,7 +53099,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53118,7 +53121,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66041,7 +66044,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.104";
+var version$1 = "0.13.105";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -76111,7 +76114,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76119,8 +76122,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93964,7 +93967,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -115637,7 +115640,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS checkpoint_diff_blobs (\n      thread_id TEXT NOT NULL,\n      from_turn_count INTEGER NOT NULL,\n      to_turn_count INTEGER NOT NULL,\n      diff TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      UNIQUE (thread_id, from_turn_count, to_turn_count)\n    )",
 	"CREATE TABLE IF NOT EXISTS provider_session_runtime (\n      thread_id TEXT PRIMARY KEY,\n      provider_name TEXT NOT NULL,\n      adapter_key TEXT NOT NULL,\n      runtime_mode TEXT NOT NULL DEFAULT 'full-access',\n      status TEXT NOT NULL,\n      last_seen_at TEXT NOT NULL,\n      resume_cursor_json TEXT,\n      runtime_payload_json TEXT\n    )",
 	"CREATE TABLE IF NOT EXISTS projection_projects (\n      project_id TEXT PRIMARY KEY,\n      title TEXT NOT NULL,\n      workspace_root TEXT NOT NULL,\n      scripts_json TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , default_model_selection_json TEXT, default_thread_env_mode TEXT, cmmd_registration_json TEXT)",
-	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT)",
+	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT, work_session_bound_at TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_messages (\n      message_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      role TEXT NOT NULL,\n      text TEXT NOT NULL,\n      is_streaming INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , attachments_json TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_activities (\n      activity_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      tone TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      summary TEXT NOT NULL,\n      payload_json TEXT NOT NULL,\n      created_at TEXT NOT NULL\n    , sequence INTEGER)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_sessions (\n      thread_id TEXT PRIMARY KEY,\n      status TEXT NOT NULL,\n      provider_name TEXT,\n      provider_session_id TEXT,\n      provider_thread_id TEXT,\n      active_turn_id TEXT,\n      last_error TEXT,\n      updated_at TEXT NOT NULL\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access')",
@@ -115959,7 +115962,8 @@ const postgresUpgradeMigrations = new Map([
         )
         WHERE model_selection_json IS NULL`
 	]],
-	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]]
+	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]],
+	[78, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_bound_at TEXT`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -115985,15 +115989,15 @@ const runPostgresMigrations = fn$1("runPostgresMigrations")(function* () {
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 77) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 77.`));
+		if (currentVersion > 78) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 78.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${77})
+          VALUES (${78})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 77; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 78; version += 1) {
 			const statements = yield* sync$1(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -118789,6 +118793,18 @@ var _077_ProjectionThreadWorkSessionId_default = gen(function* () {
     `;
 });
 //#endregion
+//#region src/persistence/Migrations/078_ProjectionThreadWorkSessionBoundAt.ts
+/** Stores the timestamp of the last Work Session binding on a thread (forge#3597). */
+var _078_ProjectionThreadWorkSessionBoundAt_default = gen(function* () {
+	const sql = yield* SqlClient;
+	if (!(yield* sql`
+    PRAGMA table_info(projection_threads)
+  `).some((column) => column.name === "work_session_bound_at")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN work_session_bound_at TEXT
+    `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -119194,6 +119210,11 @@ const migrationEntries = [
 		77,
 		"ProjectionThreadWorkSessionId",
 		_077_ProjectionThreadWorkSessionId_default
+	],
+	[
+		78,
+		"ProjectionThreadWorkSessionBoundAt",
+		_078_ProjectionThreadWorkSessionBoundAt_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -192215,7 +192236,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202415,12 +202436,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -202435,7 +202456,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -202446,14 +202467,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202468,7 +202489,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -202483,13 +202504,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -271014,7 +271035,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271145,14 +271166,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271160,7 +271181,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -288425,6 +288446,7 @@ const ProjectionThread = Struct({
 	anchorKind: CmmdAnchorKind.pipe(withDecodingDefault(succeed("scratch"))),
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
+	workSessionBoundAt: optionalKey(NullOr(String$1)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	status: ThreadStatus.pipe(withDecodingDefault(succeed("idle"))),
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
@@ -293179,6 +293201,15 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 	* (FOR-2605).
 	*/
 	const threadSessionAccountIds = /* @__PURE__ */ new Map();
+	/**
+	* The Work Session id each LIVE provider session was started for.
+	*
+	* A Retry creates a new Work Session B on a thread whose session ran for A.
+	* The reactor sees `thread.workSessionId === B` while the session still holds
+	* A's egress credential. Tracking the start-time value lets the reactor
+	* detect the mismatch and restart, dropping A's cached token (forge#3597).
+	*/
+	const threadSessionWorkSessionIds = /* @__PURE__ */ new Map();
 	const appendProviderFailureActivity = (input) => orchestrationEngine.dispatch({
 		type: "thread.activity.append",
 		commandId: serverCommandId$2("provider-failure-activity"),
@@ -293247,6 +293278,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			runtimeMode: desiredRuntimeMode
 		}), () => sync$1(() => {
 			threadSessionAccountIds.set(threadId, readProviderAccountId(desiredModelSelection));
+			threadSessionWorkSessionIds.set(threadId, thread.workSessionId ?? null);
 		}));
 		const bindSessionToThread = (session) => setThreadSession({
 			threadId,
@@ -293285,7 +293317,18 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			const desiredAccountId = readProviderAccountId(desiredModelSelection);
 			const activeAccountId = threadSessionAccountIds.get(threadId);
 			const shouldRestartForAccountChange = threadSessionAccountIds.has(threadId) && activeAccountId !== desiredAccountId;
-			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange) return existingSessionThreadId;
+			/**
+			* A Retry creates a new Work Session B on a thread whose session was
+			* running for A. Once the projector applies the rebind event,
+			* `thread.workSessionId` is B. The session's egress credential was
+			* issued for A and CMMD rejects it with `session_ended` on the first
+			* tool call. Restarting the session drops the cached credential so the
+			* new session mints one bound to B (forge#3597).
+			*/
+			const currentWorkSessionId = thread.workSessionId ?? null;
+			const sessionWorkSessionId = threadSessionWorkSessionIds.get(threadId);
+			const shouldRestartForWorkSessionChange = threadSessionWorkSessionIds.has(threadId) && sessionWorkSessionId !== currentWorkSessionId;
+			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange && !shouldRestartForWorkSessionChange) return existingSessionThreadId;
 			const resumeCursor = providerChanged || shouldRestartForModelChange ? void 0 : activeSession?.resumeCursor ?? void 0;
 			yield* logInfo("provider command reactor restarting provider session", {
 				threadId,
@@ -293300,9 +293343,10 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				shouldRestartForModelChange,
 				shouldRestartForModelSelectionChange,
 				shouldRestartForAccountChange,
+				shouldRestartForWorkSessionChange,
 				hasResumeCursor: resumeCursor !== void 0
 			});
-			if (shouldRestartForAccountChange || providerChanged) yield* providerService.stopSession({
+			if (shouldRestartForAccountChange || shouldRestartForWorkSessionChange || providerChanged) yield* providerService.stopSession({
 				threadId,
 				preserveResumeState: true
 			});
@@ -299744,7 +299788,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "e2a39e58fa5d81fe19ff492769b0aba4ddc75c7f";
+	return "52da43d14c8834d5585c39f2faed4463ed5c8132";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -303591,6 +303635,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 					anchorKind: anchor.anchorKind,
 					anchorCmmdId: anchor.anchorCmmdId,
 					workSessionId: command.workSessionId ?? null,
+					...command.workSessionId != null ? { workSessionBoundAt: command.createdAt } : {},
 					goal: command.goal ?? null,
 					linkedPullRequest: command.linkedPullRequest ?? null,
 					kind,
@@ -303900,8 +303945,13 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 			const providerSwitchSelection = command.modelSelection !== void 0 && command.modelSelection.provider !== targetThread.modelSelection.provider ? command.modelSelection : void 0;
 			const accountSelection = turnAccountSelection(targetThread.modelSelection, command.modelSelection);
 			const turnModelSelection = providerSwitchSelection ?? accountSelection;
+			if (command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId && targetThread.workSessionBoundAt !== void 0 && targetThread.workSessionBoundAt !== null && command.createdAt <= targetThread.workSessionBoundAt) return yield* new OrchestrationCommandInvariantError({
+				commandType: command.type,
+				detail: `Stale Work Session rebind: kick for session ${String(command.workSessionId)} at ${command.createdAt} is not after workSessionBoundAt ${String(targetThread.workSessionBoundAt)} on thread ${command.threadId}. Thread stays bound to ${String(targetThread.workSessionId)}.`
+			});
 			const shouldRebindWorkSession = command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId;
-			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession) return [userMessageEvent, turnStartRequestedEvent];
+			const shouldAdvanceBoundTimestamp = !shouldRebindWorkSession && command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId === targetThread.workSessionId && (targetThread.workSessionBoundAt === null || targetThread.workSessionBoundAt === void 0 || command.createdAt > targetThread.workSessionBoundAt);
+			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession && !shouldAdvanceBoundTimestamp) return [userMessageEvent, turnStartRequestedEvent];
 			return [
 				{
 					...withEventBase({
@@ -303916,7 +303966,10 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 						anchorKind: nextAnchor.anchorKind,
 						anchorCmmdId: nextAnchor.anchorCmmdId,
 						...turnModelSelection ? { modelSelection: turnModelSelection } : {},
-						...shouldRebindWorkSession ? { workSessionId: command.workSessionId } : {},
+						...shouldRebindWorkSession ? {
+							workSessionId: command.workSessionId,
+							workSessionBoundAt: command.createdAt
+						} : shouldAdvanceBoundTimestamp ? { workSessionBoundAt: command.createdAt } : {},
 						updatedAt: command.createdAt
 					}
 				},
@@ -304487,6 +304540,7 @@ function projectEvent(model, event) {
 				anchorKind: payload.anchorKind,
 				anchorCmmdId: payload.anchorCmmdId,
 				workSessionId: payload.workSessionId ?? null,
+				workSessionBoundAt: payload.workSessionBoundAt ?? null,
 				goal: payload.goal ?? null,
 				linkedPullRequest: payload.linkedPullRequest ?? null,
 				titleRegeneration: null,
@@ -304568,6 +304622,7 @@ function projectEvent(model, event) {
 				...payload.linkedPullRequest !== void 0 ? { linkedPullRequest: payload.linkedPullRequest } : {},
 				...payload.titleRegeneration !== void 0 ? { titleRegeneration: payload.titleRegeneration } : {},
 				...payload.workSessionId !== void 0 ? { workSessionId: payload.workSessionId } : {},
+				...payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: payload.workSessionBoundAt } : {},
 				updatedAt: payload.updatedAt
 			})
 		})));
@@ -305619,6 +305674,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_kind,
           anchor_cmmd_id,
           work_session_id,
+          work_session_bound_at,
           linked_pull_request_json,
           status,
           worker_role,
@@ -305652,6 +305708,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           ${row.anchorKind},
           ${row.anchorCmmdId},
           ${row.workSessionId ?? null},
+          ${row.workSessionBoundAt ?? null},
           ${row.linkedPullRequest == null ? null : JSON.stringify(row.linkedPullRequest)},
           ${row.status},
           ${row.workerRole},
@@ -305685,6 +305742,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_kind = excluded.anchor_kind,
           anchor_cmmd_id = excluded.anchor_cmmd_id,
           work_session_id = excluded.work_session_id,
+          work_session_bound_at = excluded.work_session_bound_at,
           linked_pull_request_json = excluded.linked_pull_request_json,
           status = excluded.status,
           worker_role = excluded.worker_role,
@@ -305723,6 +305781,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -305763,6 +305822,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306115,6 +306175,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					anchorKind: event.payload.anchorKind,
 					anchorCmmdId: event.payload.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(event.payload.workSessionId),
+					workSessionBoundAt: event.payload.workSessionBoundAt ?? null,
 					linkedPullRequest: event.payload.linkedPullRequest ?? null,
 					status: event.payload.status,
 					workerRole: event.payload.workerRole,
@@ -306153,6 +306214,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					anchorKind: thread.anchorKind,
 					anchorCmmdId: thread.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(thread.workSessionId),
+					workSessionBoundAt: thread.workSessionBoundAt ?? null,
 					linkedPullRequest: thread.linkedPullRequest ?? null,
 					status: thread.status,
 					workerRole: thread.workerRole,
@@ -306222,6 +306284,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					...event.payload.linkedPullRequest !== void 0 ? { linkedPullRequest: event.payload.linkedPullRequest } : {},
 					...event.payload.titleRegeneration !== void 0 ? { titleRegeneration: event.payload.titleRegeneration } : {},
 					...event.payload.workSessionId !== void 0 ? { workSessionId: projectedWorkSessionId(event.payload.workSessionId) } : {},
+					...event.payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: event.payload.workSessionBoundAt } : {},
 					updatedAt: event.payload.updatedAt
 				});
 				return;
@@ -307230,6 +307293,13 @@ function toPersistenceSqlOrDecodeError(sqlOperation, decodeOperation) {
 function workSessionIdField(workSessionId) {
 	return workSessionId !== void 0 ? { workSessionId } : {};
 }
+/**
+* `{ workSessionBoundAt }` when the row carries one, an empty object when absent.
+* Mirrors `workSessionIdField` so `exactOptionalPropertyTypes` is satisfied. See forge#3611.
+*/
+function workSessionBoundAtField(workSessionBoundAt) {
+	return workSessionBoundAt !== void 0 ? { workSessionBoundAt } : {};
+}
 const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQuery, gen(function* () {
 	const sql = yield* SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
@@ -307283,6 +307353,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307322,6 +307393,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307427,6 +307499,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307760,6 +307833,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_kind AS "anchorKind",
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
+          work_session_bound_at AS "workSessionBoundAt",
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -308073,6 +308147,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			anchorKind: row.anchorKind,
 			anchorCmmdId: row.anchorCmmdId,
 			...workSessionIdField(row.workSessionId),
+			...workSessionBoundAtField(row.workSessionBoundAt),
 			linkedPullRequest: row.linkedPullRequest,
 			kind: row.kind,
 			parentThreadId: row.parentThreadId,
@@ -308323,6 +308398,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			anchorKind: threadRow.value.anchorKind,
 			anchorCmmdId: threadRow.value.anchorCmmdId,
 			...workSessionIdField(threadRow.value.workSessionId),
+			...workSessionBoundAtField(threadRow.value.workSessionBoundAt),
 			linkedPullRequest: threadRow.value.linkedPullRequest,
 			kind: threadRow.value.kind,
 			parentThreadId: threadRow.value.parentThreadId,
@@ -324721,7 +324797,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},