@cmmd-center/forge 0.13.124 → 0.13.126

package/dist/bin.cjs

@@ -30767,7 +30767,7 @@ function frameClassByte(frameClass) {
 	if (frameClass === "application") return Uint8Array.of(1);
 	return Uint8Array.of(2);
 }
-function encodeBase64Url$1(value) {
+function encodeBase64Url$2(value) {
 	let output = "";
 	for (let index = 0; index < value.byteLength; index += 3) {
 		const first = value[index] ?? 0;
@@ -30797,7 +30797,7 @@ function decodeBase64Url$1(value) {
 			outputIndex += 1;
 		}
 	}
-	if (encodeBase64Url$1(output) !== value) throw new RelayPayloadChannelFailure("channel_authentication_failed", "Encrypted relay frame has a non-canonical base64url encoding.");
+	if (encodeBase64Url$2(output) !== value) throw new RelayPayloadChannelFailure("channel_authentication_failed", "Encrypted relay frame has a non-canonical base64url encoding.");
 	return output;
 }
 function isLowOrderX25519PublicKey(value) {
@@ -30836,7 +30836,7 @@ async function createRelayPayloadBinding(input, digestProvider = defaultDigestPr
 	};
 }
 function relayPayloadTicketDigestBase64Url(binding) {
-	return encodeBase64Url$1(binding.ticketDigest);
+	return encodeBase64Url$2(binding.ticketDigest);
 }
 function relayPayloadInfo(binding) {
 	return concat([
@@ -30873,7 +30873,7 @@ async function generateRelayEndpointKeyPair(randomSource = defaultRandomSource)
 }
 async function serializeRelayEndpointPublicKey(publicKey) {
 	try {
-		return encodeBase64Url$1(bytes(await suite.kem.serializePublicKey(publicKey)));
+		return encodeBase64Url$2(bytes(await suite.kem.serializePublicKey(publicKey)));
 	} catch (error) {
 		throw new RelayPayloadChannelFailure("endpoint_key_invalid", error instanceof Error ? error.message : "Endpoint public-key serialization failed.");
 	}
@@ -30928,7 +30928,7 @@ var HpkeRelayPayloadSender = class {
 	constructor(binding, context) {
 		this.binding = binding;
 		this.context = context;
-		this.encapsulatedKey = encodeBase64Url$1(bytes(context.enc));
+		this.encapsulatedKey = encodeBase64Url$2(bytes(context.enc));
 	}
 	seal(input) {
 		return this.queue.run(async () => {
@@ -30958,7 +30958,7 @@ var HpkeRelayPayloadSender = class {
 				direction: this.binding.direction,
 				frameClass: input.frameClass,
 				sequence,
-				ciphertext: encodeBase64Url$1(ciphertext)
+				ciphertext: encodeBase64Url$2(ciphertext)
 			};
 		});
 	}
@@ -66337,7 +66337,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.124";
+var version$1 = "0.13.126";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -71414,6 +71414,19 @@ function mintCmmdShortLivedToken(grantToken) {
 	});
 }
 /**
+* The redemption request body. `popPublicKeyPem` is the server's PoP identity
+* (forge#3534): presented when bound sessions are enabled so CMMD stamps the
+* returned JWT with this server's key (`cnf.jkt`), omitted otherwise.
+*/
+function buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem) {
+	return {
+		grant_type: "forge_session_grant",
+		grant_token: grantToken,
+		client_id: "cmmd-forge-web",
+		...popPublicKeyPem ? { pop_public_key: popPublicKeyPem } : {}
+	};
+}
+/**
 * Redeem a durable CMMD session grant for a fresh credential set.
 *
 * The grant is CMMD's designed recovery path for exactly the case a rotating
@@ -71425,15 +71438,11 @@ function mintCmmdShortLivedToken(grantToken) {
 * Returns the new MCP PAT alongside the JWT/refresh pair, because CMMD mints a
 * fresh PAT on redemption and the old one is not carried over.
 */
-function redeemCmmdSessionGrant(grantToken) {
+function redeemCmmdSessionGrant(grantToken, popPublicKeyPem) {
 	return fetch(new URL("/api/mcp-server/oauth/token", resolveCommandAppUrl()).toString(), {
 		method: "POST",
 		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			grant_type: "forge_session_grant",
-			grant_token: grantToken,
-			client_id: "cmmd-forge-web"
-		})
+		body: JSON.stringify(buildSessionGrantRedemptionBody(grantToken, popPublicKeyPem))
 	}).then(async (response) => {
 		if (!response.ok) return null;
 		const payload = await response.json();
@@ -71504,6 +71513,140 @@ async function readOAuthErrorCode(response) {
 	}
 }
 //#endregion
+//#region ../../packages/shared/src/cmmdSessionPop.ts
+/**
+* CMMD session proof-of-possession client protocol (forge#3517).
+*
+* A CMMD session issued to a Forge client can be bound to the client's Ed25519
+* device key: the public key travels with the login (`pop_public_key`), CMMD
+* stamps its thumbprint into the token (`cnf.jkt`), and every authenticated
+* request must then carry a detached Ed25519 signature over a canonical
+* request binding (method + path + timestamp + nonce). A stolen bearer token
+* alone is unusable.
+*
+* This module is the client half of the scheme CMMD verifies in
+* `server/services/auth/session-pop-binding.ts`. The protocol deliberately
+* reuses CMMD's existing crypto shapes rather than inventing a new scheme: the
+* thumbprint is the same sha256-over-SPKI-DER base64url digest as the forge
+* device registry and the desktop relay identity, and the signature covers
+* `<purpose>.<base64url payload>`, the forge relay challenge shape, with
+* Ed25519. It is not a DPoP port: proofs are plain headers, not JWTs.
+*/
+const HEADER_KEY = "x-cmmd-pop-key";
+const HEADER_INPUT = "x-cmmd-pop-input";
+const HEADER_SIGNATURE = "x-cmmd-pop-signature";
+const CMMD_SESSION_POP_PURPOSE = "cmmd-session-pop-v1";
+function encodeBase64Url$1(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/u, "");
+}
+function buildCmmdSessionPopSigningInput(payload) {
+	return `${CMMD_SESSION_POP_PURPOSE}.${encodeBase64Url$1(new TextEncoder().encode(JSON.stringify(payload)))}`;
+}
+function randomNonce() {
+	const bytes = new Uint8Array(16);
+	crypto.getRandomValues(bytes);
+	return encodeBase64Url$1(bytes);
+}
+/**
+* Build the three proof headers for one request. Each call produces a fresh
+* nonce; callers must not reuse the returned headers across attempts
+* (retries included), because CMMD rejects replayed nonces.
+*/
+async function buildCmmdSessionPopProofHeaders(input) {
+	const payload = {
+		version: 1,
+		htm: input.method.toUpperCase(),
+		htu: input.path,
+		ts: input.nowSeconds ?? Math.floor(Date.now() / 1e3),
+		nonce: input.nonce ?? randomNonce()
+	};
+	const signingInput = buildCmmdSessionPopSigningInput(payload);
+	const signature = await input.signer.sign(signingInput);
+	const spkiDer = decodePemSpkiDer(input.signer.publicKeyPem);
+	return {
+		[HEADER_KEY]: encodeBase64Url$1(spkiDer),
+		[HEADER_INPUT]: encodeBase64Url$1(new TextEncoder().encode(JSON.stringify(payload))),
+		[HEADER_SIGNATURE]: encodeBase64Url$1(signature)
+	};
+}
+function decodePemSpkiDer(pem) {
+	const base64 = pem.replace("-----BEGIN PUBLIC KEY-----", "").replace("-----END PUBLIC KEY-----", "").replace(/\s+/gu, "").replace(/-/g, "+").replace(/_/g, "/");
+	const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+	return bytes;
+}
+//#endregion
+//#region src/cmmd/cmmdSessionPopServer.ts
+/**
+* The Forge server's own CMMD session proof-of-possession identity (forge#3534,
+* D3): the server holds an Ed25519 key, presents its SPKI PEM as
+* `pop_public_key` when it redeems a CMMD session grant, and signs every
+* CMMD-origin REST call it makes with detached proofs, so a stolen bearer JWT
+* alone is unusable. CMMD verifies the scheme in
+* `server/services/auth/session-pop-binding.ts`.
+*
+* Rollout order (docs/forge-cmmd-auth-lanes.md): CMMD deploys first; Forge
+* flips `FORGE_CMMD_SESSION_POP_ENABLED` afterwards; CMMD's
+* `JWT_REQUIRE_BOUND_SESSIONS=true` is the contract phase. While the flag is
+* off this module produces no keys and no headers, and CMMD treats tokens as
+* plain bearers.
+*
+* The identity lives in memory for the process lifetime. After a restart the
+* server mints a new identity; CMMD then refuses proofs from the old one, and
+* the JWT resolver's recovery ladder re-mints the affected credentials. The
+* persistence duty (a stable identity across restarts) lands with the flag
+* rollout, not with this plumbing.
+*/
+const ENABLED_FLAG = "FORGE_CMMD_SESSION_POP_ENABLED";
+/** Enables session proofs only when the rollout flag is exactly "true". */
+function isCmmdSessionPopEnabled() {
+	return process.env[ENABLED_FLAG] === "true";
+}
+let cachedSigner = null;
+/** Creates an in-memory Ed25519 identity with a public SPKI PEM and a detached signer. */
+function createServerSigner() {
+	const { publicKey, privateKey } = (0, node_crypto.generateKeyPairSync)("ed25519");
+	const exported = publicKey.export({
+		type: "spki",
+		format: "pem"
+	});
+	return {
+		publicKeyPem: typeof exported === "string" ? exported : exported.toString("utf8"),
+		sign: async (signingInput) => new Uint8Array((0, node_crypto.sign)(null, Buffer.from(signingInput, "utf8"), privateKey))
+	};
+}
+/**
+* The server's PoP identity, created on first use under the flag and stable
+* for the process lifetime. Null while the flag is off.
+*/
+function resolveCmmdSessionPopSigner() {
+	if (!isCmmdSessionPopEnabled()) return null;
+	cachedSigner ??= createServerSigner();
+	return cachedSigner;
+}
+/** The `pop_public_key` value to present at issuance, or null while disabled. */
+function cmmdSessionPopPublicKey() {
+	return resolveCmmdSessionPopSigner()?.publicKeyPem ?? null;
+}
+/**
+* The three proof headers for one CMMD-origin request, or no headers while
+* disabled. Each call carries a fresh nonce; never reuse the result across
+* attempts, because CMMD rejects replayed nonces.
+*/
+async function cmmdSessionPopRequestHeaders(input) {
+	const signer = resolveCmmdSessionPopSigner();
+	if (!signer) return {};
+	return buildCmmdSessionPopProofHeaders({
+		signer,
+		method: input.method,
+		path: input.path
+	});
+}
+//#endregion
 //#region src/command/cmmdTokenMintLane.ts
 /**
 * The CMMD token-mint lane (forge#3518, expand phase).
@@ -71756,7 +71899,7 @@ function tryGrantRedemption(sessionId, context) {
 	return require_Schema$1.gen(function* () {
 		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
 		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
-		const redeemed = yield* require_Schema$1.promise(() => redeemCmmdSessionGrant(grantToken)).pipe(require_Schema$1.orElseSucceed(() => null));
+		const redeemed = yield* require_Schema$1.promise(() => redeemCmmdSessionGrant(grantToken, cmmdSessionPopPublicKey())).pipe(require_Schema$1.orElseSucceed(() => null));
 		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
 		if (!accessToken) {
 			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
@@ -72045,11 +72188,25 @@ async function requireCmmdProxySuccess(response, signal) {
 * Uses the stored JWT (set after OAuth auth-code flow with post-update CMMD)
 * to make authenticated REST calls on behalf of the user. A missing delegated
 * JWT is an authentication-required state, not a CMMD availability failure.
+*
+* Every request this module sends can carry the server's session
+* proof-of-possession headers (forge#3534): while
+* `FORGE_CMMD_SESSION_POP_ENABLED` is true, `authHeaders` attaches detached
+* Ed25519 proofs over each request's method and path, which CMMD requires for
+* tokens bound with `cnf.jkt` and ignores otherwise. Each call gets a fresh
+* nonce, so retries re-sign rather than replay.
 */
-function authHeaders(jwt, orgId) {
+/** Builds owner JWT and optional organization headers with fresh, flag-gated session proofs. */
+async function authHeaders(jwt, orgId, method, path) {
 	const headers = { Authorization: `Bearer ${jwt}` };
 	if (orgId) headers["X-Organization-ID"] = orgId;
-	return headers;
+	return {
+		...headers,
+		...await cmmdSessionPopRequestHeaders({
+			method,
+			path
+		})
+	};
 }
 async function fetchResponse(url, init, options) {
 	try {
@@ -72061,18 +72218,20 @@ async function fetchResponse(url, init, options) {
 		rethrowCmmdProxyTimeout(error, options?.signal);
 	}
 }
+/** Fetches a CMMD JSON resource with optional query parameters and caller cancellation. */
 async function proxyGet(jwt, path, searchParams, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	if (searchParams) for (const [k, v] of Object.entries(searchParams)) url.searchParams.set(k, v);
-	return handleCmmdProxyResponse(await fetchResponse(url.toString(), { headers: authHeaders(jwt, orgId) }, options), options?.signal);
+	return handleCmmdProxyResponse(await fetchResponse(url.toString(), { headers: await authHeaders(jwt, orgId, "GET", path) }, options), options?.signal);
 }
+/** Posts JSON to CMMD on the owner JWT lane and decodes the response or upstream error. */
 async function proxyPost(jwt, path, body, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	return handleCmmdProxyResponse(await fetchResponse(new URL(path, cmmdBase).toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
@@ -72086,44 +72245,49 @@ async function responseWithMetadata(response, signal) {
 		retryAfter: response.headers.get("retry-after")
 	};
 }
+/** Fetches a CMMD resource while preserving status, Location, and Retry-After metadata. */
 async function proxyGetWithMetadata(jwt, path, orgId, options) {
-	return responseWithMetadata(await fetchResponse(new URL(path, resolveCommandAppUrl()).toString(), { headers: authHeaders(jwt, orgId) }, options), options?.signal);
+	return responseWithMetadata(await fetchResponse(new URL(path, resolveCommandAppUrl()).toString(), { headers: await authHeaders(jwt, orgId, "GET", path) }, options), options?.signal);
 }
+/** Posts JSON to CMMD while preserving status, Location, and Retry-After metadata. */
 async function proxyPostWithMetadata(jwt, path, body, orgId, options) {
 	const cmmdBase = resolveCommandAppUrl();
 	return responseWithMetadata(await fetchResponse(new URL(path, cmmdBase).toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}, options), options?.signal);
 }
+/** Applies a JSON patch request to CMMD using the owner JWT and optional organization. */
 async function proxyPatch(jwt, path, body, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "PATCH",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "PATCH", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}));
 }
+/** Sends a JSON replacement request to CMMD and decodes its response or upstream error. */
 async function proxyPut(jwt, path, body, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "PUT",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "PUT", path),
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify(body)
 	}));
 }
+/** Deletes a CMMD resource with optional query parameters and JSON body; 204 returns undefined. */
 async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
@@ -72131,7 +72295,7 @@ async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	const response = await fetch(url.toString(), {
 		method: "DELETE",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "DELETE", path),
 			...body === void 0 ? {} : { "Content-Type": "application/json" }
 		},
 		...body === void 0 ? {} : { body: JSON.stringify(body) }
@@ -72139,13 +72303,14 @@ async function proxyDelete(jwt, path, searchParams, orgId, body) {
 	if (!response.ok && response.status !== 204) await requireCmmdProxySuccess(response);
 	return response.status === 204 ? void 0 : handleCmmdProxyResponse(response);
 }
+/** Forwards multipart bytes to CMMD, preserving the caller's content type and boundary. */
 async function proxyMultipart(jwt, path, body, contentType, orgId) {
 	const cmmdBase = resolveCommandAppUrl();
 	const url = new URL(path, cmmdBase);
 	return handleCmmdProxyResponse(await fetch(url.toString(), {
 		method: "POST",
 		headers: {
-			...authHeaders(jwt, orgId),
+			...await authHeaders(jwt, orgId, "POST", path),
 			"Content-Type": contentType
 		},
 		body
@@ -72469,20 +72634,25 @@ const legacyCmmdToolBridge = {
 };
 //#endregion
 //#region src/command/workIntakeCache.ts
-const cacheBySessionId = /* @__PURE__ */ new Map();
+const cacheByKey = /* @__PURE__ */ new Map();
+function cacheKeyFor(sessionId, orgId) {
+	return `${sessionId}\u0000${orgId ?? ""}`;
+}
 function resolveCmmdWorkIntakeCacheIdentity(subject, cmmdUserId) {
 	return cmmdUserId ? `cmmd-user:${cmmdUserId}` : `forge-subject:${subject}`;
 }
 function fingerprintToken(token) {
 	return (0, node_crypto.createHash)("sha256").update(token).digest("hex");
 }
-async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, existing) {
+async function fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, existing) {
 	if (existing?.inFlight) return existing.inFlight;
 	const nowMs = input.nowMs ?? Date.now;
 	let promise;
 	promise = input.fetchFresh().then((snapshot) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheBySessionId.set(input.sessionId, {
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheByKey.set(cacheKey, {
+			sessionId: input.sessionId,
+			orgId: input.orgId,
 			identityKey,
 			tokenFingerprint,
 			snapshot,
@@ -72491,12 +72661,14 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 		});
 		return snapshot;
 	}).catch((error) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheBySessionId.delete(input.sessionId);
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheByKey.delete(cacheKey);
 		else current.inFlight = null;
 		throw error;
 	});
-	cacheBySessionId.set(input.sessionId, {
+	cacheByKey.set(cacheKey, {
+		sessionId: input.sessionId,
+		orgId: input.orgId,
 		identityKey,
 		tokenFingerprint,
 		snapshot: existing?.snapshot ?? null,
@@ -72512,9 +72684,9 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 * opportunistically on every read.
 */
 function sweepExpiredWorkIntakeEntries(nowMs) {
-	for (const [sessionId, entry] of cacheBySessionId) {
+	for (const [key, entry] of cacheByKey) {
 		if (entry.inFlight) continue;
-		if (nowMs - entry.cachedAtMs > 3e5) cacheBySessionId.delete(sessionId);
+		if (nowMs - entry.cachedAtMs > 3e5) cacheByKey.delete(key);
 	}
 }
 async function readCachedCmmdWorkIntakeForSession(input) {
@@ -72523,17 +72695,18 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 	const identityKey = input.identityKey ?? input.sessionId;
 	if (input.forceFresh) invalidateCachedCmmdWorkIntakeForIdentity(identityKey);
 	const tokenFingerprint = fingerprintToken(input.token);
-	const existing = cacheBySessionId.get(input.sessionId);
-	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheBySessionId.delete(input.sessionId);
-	const current = cacheBySessionId.get(input.sessionId);
-	if (!current?.snapshot) return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	const cacheKey = cacheKeyFor(input.sessionId, input.orgId);
+	const existing = cacheByKey.get(cacheKey);
+	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheByKey.delete(cacheKey);
+	const current = cacheByKey.get(cacheKey);
+	if (!current?.snapshot) return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 	const ageMs = Math.max(0, nowMs() - current.cachedAtMs);
 	if (ageMs <= 12e4) return current.snapshot;
 	if (ageMs <= 3e5) {
 		if (!current.inFlight) {
 			let refreshPromise;
 			refreshPromise = input.fetchFresh().then((snapshot) => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) {
 					latest.snapshot = snapshot;
 					latest.cachedAtMs = nowMs();
@@ -72541,25 +72714,25 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 				return snapshot;
 			}).catch((error) => {
 				if (legacyCmmdToolBridge.isAuthError(error)) {
-					const latest = cacheBySessionId.get(input.sessionId);
-					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheBySessionId.delete(input.sessionId);
+					const latest = cacheByKey.get(cacheKey);
+					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheByKey.delete(cacheKey);
 				}
 				return current.snapshot;
 			}).finally(() => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) latest.inFlight = null;
 			});
 			current.inFlight = refreshPromise;
 		}
 		return current.snapshot;
 	}
-	return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 }
 function invalidateCachedCmmdWorkIntakeForSession(sessionId) {
-	cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.sessionId === sessionId) cacheByKey.delete(key);
 }
 function invalidateCachedCmmdWorkIntakeForIdentity(identityKey) {
-	for (const [sessionId, entry] of cacheBySessionId) if (entry.identityKey === identityKey) cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.identityKey === identityKey) cacheByKey.delete(key);
 }
 //#endregion
 //#region src/cmmdData/proxyRouteRegistry.ts
@@ -105066,6 +105239,29 @@ function warn$1(label, cause) {
 	return `${label} fetch failed: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
 /**
+* Reads the workspace catalog off a settled bootstrap call. No explicit org
+* means CMMD answered `activeWorkspace` with its own default-organization
+* guess, not a confirmed fact -- leave it null rather than publish it
+* (forge#3636).
+*/
+function resolveWorkspacesFromBootstrap(bootstrapResult, orgId, warnings) {
+	if (bootstrapResult.status !== "fulfilled") {
+		warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+		return {
+			workspaces: [],
+			activeWorkspace: null
+		};
+	}
+	const bootstrap = unwrapRestObject(bootstrapResult.value);
+	const rawWorkspaces = bootstrap?.["workspaces"];
+	const workspaces = Array.isArray(rawWorkspaces) ? rawWorkspaces.map(adaptBootstrapWorkspace) : [];
+	const rawActive = orgId !== void 0 ? bootstrap?.["activeWorkspace"] : void 0;
+	return {
+		workspaces,
+		activeWorkspace: rawActive && typeof rawActive === "object" ? adaptBootstrapWorkspace(rawActive) : null
+	};
+}
+/**
 * Build the CMMD work-intake snapshot via the JWT REST API:
 * bootstrap (workspaces) + campaigns + projects + center-board (tasks WITH deps).
 * `identity` is supplied by the session (resolved at login), matching the MCP builder.
@@ -105073,21 +105269,13 @@ function warn$1(label, cause) {
 async function fetchCmmdWorkIntakeViaRest(jwt, identity, deps = {}) {
 	const get = deps.proxyGet ?? proxyGet;
 	const [bootstrapResult, campaignsResult, projectsResult, boardResult] = await Promise.allSettled([
-		get(jwt, "/api/forge/context/bootstrap"),
+		get(jwt, "/api/forge/context/bootstrap", void 0, deps.orgId),
 		get(jwt, "/api/forge/context/campaigns"),
 		fetchAllProjects(get, jwt),
 		get(jwt, "/api/forge/context/work-items/board")
 	]);
 	const warnings = [];
-	let workspaces = [];
-	let activeWorkspace = null;
-	if (bootstrapResult.status === "fulfilled") {
-		const bootstrap = unwrapRestObject(bootstrapResult.value);
-		const rawWorkspaces = bootstrap?.["workspaces"];
-		if (Array.isArray(rawWorkspaces)) workspaces = rawWorkspaces.map(adaptBootstrapWorkspace);
-		const rawActive = bootstrap?.["activeWorkspace"];
-		if (rawActive && typeof rawActive === "object") activeWorkspace = adaptBootstrapWorkspace(rawActive);
-	} else warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+	const { workspaces, activeWorkspace } = resolveWorkspacesFromBootstrap(bootstrapResult, deps.orgId, warnings);
 	if (projectsResult.status === "rejected") throw projectsResult.reason;
 	if (campaignsResult.status === "rejected") warnings.push(warn$1("Campaigns", campaignsResult.reason));
 	if (boardResult.status === "rejected") warnings.push(warn$1("Tasks (board)", boardResult.reason));
@@ -300407,7 +300595,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "52e8c25f0de536143b44ff1ac86510aa93d35772";
+	return "8a4057a4a58eeb014b73143ffbb1bb091089d750";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -310827,6 +311015,24 @@ function logWorkIntakeFailure(cause) {
 	}
 	console.error("[work-intake] fetch failed:", cause);
 }
+/**
+* `?orgId=` present but empty (a stripped or malformed query string) is not
+* an explicit org. Treat it the same as an absent param rather than sending
+* CMMD an empty `X-Organization-ID` header (forge#3636).
+*/
+function normalizeOrgIdQueryParam(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* `{ orgId }` when present, `{}` when not -- the `exactOptionalPropertyTypes`
+* shape every `orgId?: string` deps object here needs, since spreading
+* `{ orgId: possiblyUndefined }` inline assigns `undefined` to a property
+* the type says is only ever absent or a string.
+*/
+function orgIdDeps(orgId) {
+	return orgId !== void 0 ? { orgId } : {};
+}
 function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 	return require_Schema$1.gen(function* () {
 		const jwt = yield* (dependencies.resolveJwt ?? resolveCmmdJwtForSession)({
@@ -310838,7 +311044,7 @@ function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 		const identity = (dependencies.readIdentity ?? readCmmdUserIdentityForSession)(session.sessionId);
 		const fetchFallback = dependencies.fetchFallback ?? fetchCmmdWorkIntakeViaRest;
 		return yield* require_Schema$1.tryPromise({
-			try: () => fetchFallback(jwt, identity),
+			try: () => fetchFallback(jwt, identity, orgIdDeps(dependencies.orgId)),
 			catch: (cause) => new WorkIntakeSnapshotReadError({
 				detail: "Failed to build CMMD REST work-intake fallback.",
 				cause
@@ -310950,7 +311156,9 @@ function unwrapForgeEnvelopeJsonText(text) {
 const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_Schema$1.gen(function* () {
 	const request = yield* require_HttpServer.HttpServerRequest;
 	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const forceFresh = new URL(request.url, "http://localhost").searchParams.get("fresh") === "1";
+	const requestUrl = new URL(request.url, "http://localhost");
+	const forceFresh = requestUrl.searchParams.get("fresh") === "1";
+	const orgId = normalizeOrgIdQueryParam(requestUrl.searchParams.get("orgId"));
 	let accessToken = readCommandAccessTokenForSession(session.sessionId);
 	if (!accessToken && session.role === "owner" && (session.subject === "owner-bootstrap" || session.subject === "desktop-bootstrap")) accessToken = (yield* promoteMostRecentOwnerCommandAuthToSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to promote owner CMMD auth for work intake.", {
 		cause: error,
@@ -310995,8 +311203,9 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 			sessionId: session.sessionId,
 			identityKey: workIntakeCacheIdentity,
 			token: accessToken,
+			...orgIdDeps(orgId),
 			forceFresh,
-			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
+			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity, orgIdDeps(orgId)) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
 		}),
 		catch: (cause) => new WorkIntakeSnapshotReadError({
 			detail: "Failed to read CMMD work intake snapshot.",
@@ -311014,7 +311223,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 		if (isCmmdMcpAuthError(cause)) {
 			console.error("[WORK_INTAKE] CMMD_AUTH_EXPIRED mcp_error:", cause instanceof Error ? cause.message : String(cause));
 			invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 			yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear expired CMMD token after MCP auth failure.", {
 				cause: error,
 				sessionId: session.sessionId
@@ -311039,7 +311248,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 			connected: snapshot.connected
 		});
 		invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 		yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear expired CMMD token after auth warning.", {
 			cause: error,
 			sessionId: session.sessionId
@@ -312395,12 +312604,65 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-registerProxyRoute({
+function parseCmmdBootstrapRequest(request) {
+	return require_Schema$1.sync(() => {
+		return {
+			ok: true,
+			value: normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"))
+		};
+	});
+}
+/**
+* Nulls `activeWorkspace` on a bootstrap body, wherever it sits. CMMD answers
+* `GET /api/forge/context/bootstrap` either flat (`{ activeWorkspace, ... }`)
+* or enveloped (`{ data: { activeWorkspace, ... } }`) -- `workIntakeRest.ts`'s
+* `unwrapRestObject` already treats both as live shapes for this exact
+* endpoint. Nulling only the top level left `data.activeWorkspace` (CMMD's
+* guess) untouched on the enveloped shape.
+*/
+function nullActiveWorkspace(body) {
+	const data = body["data"];
+	const nulledData = typeof data === "object" && data !== null && !Array.isArray(data) ? {
+		...data,
+		activeWorkspace: null
+	} : data;
+	return {
+		...body,
+		activeWorkspace: null,
+		...data !== void 0 ? { data: nulledData } : {}
+	};
+}
+/**
+* CMMD resolves `activeWorkspace` to the caller's own default organization
+* whenever the request carries no `X-Organization-ID` header (forge#3636:
+* the owner working in org 2119 kept getting org 2142, CMMD's default, back).
+* Passing the client's explicit `?orgId=` scopes CMMD's answer to that
+* workspace; without one, CMMD still guesses, so `activeWorkspace` is nulled
+* here rather than forwarded as fact. Everything else in the bootstrap
+* response passes through untouched.
+*/
+function runCmmdBootstrap(orgId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.request({
+		method: "GET",
+		jwt,
+		path: "/api/forge/context/bootstrap",
+		...orgId !== void 0 ? { orgId } : {}
+	}), (value) => {
+		if (orgId !== void 0 || value === null || typeof value !== "object") return {
+			status: 200,
+			body: value
+		};
+		return {
+			status: 200,
+			body: nullActiveWorkspace(value)
+		};
+	});
+}
+registerProxyHandler({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
-	cmmdPath: "/api/forge/context/bootstrap",
-	orgIdSource: "none",
-	responseShape: "passthrough"
+	parse: parseCmmdBootstrapRequest,
+	run: runCmmdBootstrap
 });
 registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",
@@ -313335,6 +313597,44 @@ const cmmdUpdateProjectAgentMemberAvatarRouteLayer = registerProxyRoute({
 	responseShape: "unwrapData"
 });
 //#endregion
+//#region src/command/cmmdPushProxyRoutes.ts
+/**
+* The signed-in phone's push registration, forwarded to CMMD's push
+* device-token API on the owner's stored CMMD JWT (forge#3534).
+*
+* CMMD owns push delivery: the `device_push_tokens` table, the Expo transport,
+* and the `mobile_push_v1` delivery flag are all CMMD-side, and its
+* registration API lives at `/api/push`, not under `/api/forge/context`. The
+* mobile push delivery spec (docs/specs/2026-09-09-mobile-push-delivery.md,
+* stage 2) recommends reusing that API over adding a forge-context doorway
+* first: the Forge server already holds the phone's CMMD credential, and the
+* registry prologue here provides the same session auth, CMMD-connection
+* gate, and `CMMD_AUTH_REQUIRED` mapping every `/api/cmmd` route gets. The
+* deny-listed legacy owner control paths are untouched. If review wants a
+* forge-context doorway first, these two routes are the only call sites to
+* repoint.
+*
+* `orgIdSource` is `none` (the organization comes from the JWT, like the
+* settings and device-registry routes): a phone registers against its default
+* organization and has no workspace context to pass.
+*/
+const cmmdRegisterMobilePushDeviceRouteLayer = registerProxyRoute({
+	forgePath: "/api/cmmd/mobile/push/registration",
+	method: "POST",
+	cmmdPath: "/api/push/device-tokens",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	successStatus: 201
+});
+const cmmdDeleteMobilePushDeviceRouteLayer = registerProxyRoute({
+	forgePath: "/api/cmmd/mobile/push/registration",
+	method: "DELETE",
+	cmmdPath: "/api/push/device-tokens",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	requestBody: "json"
+});
+//#endregion
 //#region src/command/runtimeProviderAuthorityUpgradeModel.ts
 const AUTHORITY_UPGRADE_OPERATION_KEYS = new Set([
 	"operationId",
@@ -324954,7 +325254,7 @@ const MiscRuntimeLayerLive = require_Schema$1.mergeAll(AnalyticsServiceLayerLive
 const RuntimeDependenciesWithoutPullRequestsLive = ReactorLayerLive.pipe(require_Schema$1.provideMerge(CheckpointingLayerLive), require_Schema$1.provideMerge(GitLayerLive), require_Schema$1.provideMerge(OrchestrationLayerLive), require_Schema$1.provideMerge(ProviderLayerLive), require_Schema$1.provideMerge(TerminalLayerLive), require_Schema$1.provideMerge(AgentBrowserManagerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ThreadDevRuntimeLive, DevTunnelLive.pipe(require_Schema$1.provide$1(ThreadDevRuntimeLive)))), require_Schema$1.provideMerge(PersistenceLayerLive), require_Schema$1.provideMerge(KeybindingsLive), require_Schema$1.provideMerge(ProviderRegistryLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(ServerSettingsLive, UsageServiceLive.pipe(require_Schema$1.provide$1(ServerSettingsLive), require_Schema$1.provide$1(UsageSessionLookupLive), require_Schema$1.provide$1(UsageRecordedSourceLive.pipe(require_Schema$1.provide$1(OrchestrationLayerLive), require_Schema$1.provide$1(RuntimeReplicationOutboxLive), require_Schema$1.provide$1(ProviderSessionRuntimeRepositoryLive), require_Schema$1.provide$1(TextGenerationSessionRepositoryLive)))))), require_Schema$1.provideMerge(WorkspaceLayerLive), require_Schema$1.provideMerge(WorkspaceReadinessStateLive), require_Schema$1.provideMerge(ProjectFaviconResolverLive), require_Schema$1.provideMerge(RepositoryIdentityResolverLive), require_Schema$1.provideMerge(ServerEnvironmentLive), require_Schema$1.provideMerge(AuthLayerLive), require_Schema$1.provideMerge(ServerSecretStoreLayerLive), require_Schema$1.provideMerge(require_Schema$1.mergeAll(CloudRedisCoordinationLive, CloudStateSyncLive.pipe(require_Schema$1.provide$1(PersistenceLayerLive)))), require_Schema$1.provideMerge(MiscRuntimeLayerLive));
 const RuntimeDependenciesLive = pullRequestServiceFactoryLayer.pipe(require_Schema$1.provideMerge(RuntimeDependenciesWithoutPullRequestsLive), require_Schema$1.provideMerge(cmmdProjectIdentityResolverLive.pipe(require_Schema$1.provide$1(RuntimeDependenciesWithoutPullRequestsLive))), require_Schema$1.provideMerge(pullRequestProviderRuntimeLive));
 const RuntimeServicesLive = ServerRuntimeStartupLive.pipe(require_Schema$1.provideMerge(RuntimeDependenciesLive));
-const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdEmbedExchangeRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
+const makeRoutesLayer = require_Schema$1.mergeAll(attachmentUploadRouteLayer, authBearerBootstrapRouteLayer, authBootstrapRouteLayer, authCommandBearerBootstrapRouteLayer, authCommandBootstrapRouteLayer, authCmmdEmbedExchangeRouteLayer, authOAuthTokenExchangeRouteLayer, authWebSocketTicketRouteLayer, authCmmdOAuthDeviceRouteLayer, authCmmdOAuthTokenRouteLayer, authCmmdPasswordTokenRouteLayer, authClientsRevokeOthersRouteLayer, authClientsRevokeRouteLayer, authClientsRouteLayer, authLogoutRouteLayer, authPairingLinksRevokeRouteLayer, authPairingLinksRouteLayer, authPairingCredentialRouteLayer, authSessionRenewRouteLayer, authSessionRouteLayer, authWebSocketTokenRouteLayer, authWebLoginRouteLayer, authWebCallbackRouteLayer, cloudOwnerSessionRedeemRouteLayer, cloudOwnerSessionRevokeRouteLayer, desktopLocalWebBridgePublishRouteLayer, desktopLocalWebBridgeBootstrapRouteLayer, desktopRelayControlPlaneRouteLayer, apiDocsHtmlRouteLayer, apiDocsOpenApiRouteLayer, pulseSignalStateListRouteLayer, pulseSignalStateUpsertRouteLayer, cmmdProfileRouteLayer, ...cmmdProxyRouteLayers, cmmdWorkIntakeRouteLayer, cmmdWsTokenRouteLayer, cmmdGetProjectCommentsRouteLayer, cmmdAddProjectCommentRouteLayer, cmmdUpdateProjectRouteLayer, cmmdUploadTaskAttachmentRouteLayer, cmmdUpdateTaskCommentRouteLayer, cmmdListWorkspaceMembersRouteLayer, cmmdAddProjectMemberRouteLayer, cmmdUpdateProjectAgentMemberAvatarRouteLayer, runtimeReplicationStatusRouteLayer, cmmdRefreshProviderUsageRouteLayer, cmmdForgeCloudProjectsListRouteLayer, cmmdForgeCloudProjectsEventsRouteLayer, cmmdForgeEnvironmentsEventsRouteLayer, cmmdForgeRuntimesEnsureRouteLayer, cmmdForgeRuntimesConnectRouteLayer, ownerRuntimeCodexReadinessRouteLayer, cmmdRegisterMobilePushDeviceRouteLayer, cmmdDeleteMobilePushDeviceRouteLayer, cmmdForgeRuntimesStatusRouteLayer, cmmdForgeRuntimesStartRouteLayer, cmmdForgeRuntimesStopRouteLayer, cmmdForgeRuntimesRecycleRouteLayer, cmmdForgeRuntimesUpdateCommitRouteLayer, cmmdForgeRuntimesDestroyRouteLayer, mobileProviderCatalogRouteLayer, attachmentsRouteLayer, orchestrationDispatchRouteLayer, orchestrationCmmdWorkRunEventRouteLayer, orchestrationAutomationStartThreadRouteLayer, orchestrationAutomationRebindRouteLayer, orchestrationAutomationTerminalReconcileRouteLayer, mobileGitRunStackedActionRouteLayer, pullRequestDiffRouteLayer, orchestrationSnapshotRouteLayer, orchestrationThreadSnapshotRouteLayer, localAutomationListRouteLayer, localAutomationCreateRouteLayer, localAutomationUpdateRouteLayer, localAutomationDeleteRouteLayer, localAutomationRunRouteLayer, otlpTracesProxyRouteLayer, devTunnelProxyRouteLayer, devTunnelLocalPortProxyRouteLayer, projectFaviconRouteLayer, serverEnvironmentRouteLayer, browserWebRtcReadinessRouteLayer, staticAndDevRouteLayer, githubStatusRouteLayer, githubAuthorizeUrlRouteLayer, githubDisconnectRouteLayer, githubReposRouteLayer, githubCloneRouteLayer, githubCloneJobStartRouteLayer, githubCloneJobStatusRouteLayer, githubRefreshCredentialsRouteLayer, githubToolConfirmationApproveRouteLayer, projectLinkGetRouteLayer, projectLinkListRouteLayer, projectLinkSetRouteLayer, projectLinkDeleteRouteLayer, cmmdWorkspacesRouteLayer, cmmdCampaignsRouteLayer, cmmdProjectLinksRouteLayer, cmmdEnsureGitHubProjectContextRouteLayer, cmmdProjectRepositoryEnsureRouteLayer, cmmdProjectsGetRouteLayer, cmmdProjectsCreateRouteLayer, workspaceReadinessRouteLayer, runtimeLivenessRouteLayer, runtimeFilesystemHealthRouteLayer, claudeNativeGenerationProofRouteLayer, claudeUsageRouteLayer, codexRuntimeProviderReadinessRouteLayer, runtimeDiagnosticsRouteLayer, cloudFoldersRouteLayer, cloudProjectCreateRouteLayer, gitUrlCloneRouteLayer, websocketRpcRouteLayer).pipe(require_Schema$1.provide$1(browserApiCorsLayer));
 const makeServerLayer = require_Schema$1.unwrap(require_Schema$1.gen(function* () {
 	const config = yield* ServerConfig;
 	fixPath({ preferProcessPath: config.forgeCmmdRuntimeMode === true });