@cmmd-center/forge 0.13.125 → 0.13.126

package/dist/bin.cjs

@@ -66337,7 +66337,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.125";
+var version$1 = "0.13.126";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -72634,20 +72634,25 @@ const legacyCmmdToolBridge = {
 };
 //#endregion
 //#region src/command/workIntakeCache.ts
-const cacheBySessionId = /* @__PURE__ */ new Map();
+const cacheByKey = /* @__PURE__ */ new Map();
+function cacheKeyFor(sessionId, orgId) {
+	return `${sessionId}\u0000${orgId ?? ""}`;
+}
 function resolveCmmdWorkIntakeCacheIdentity(subject, cmmdUserId) {
 	return cmmdUserId ? `cmmd-user:${cmmdUserId}` : `forge-subject:${subject}`;
 }
 function fingerprintToken(token) {
 	return (0, node_crypto.createHash)("sha256").update(token).digest("hex");
 }
-async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, existing) {
+async function fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, existing) {
 	if (existing?.inFlight) return existing.inFlight;
 	const nowMs = input.nowMs ?? Date.now;
 	let promise;
 	promise = input.fetchFresh().then((snapshot) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheBySessionId.set(input.sessionId, {
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheByKey.set(cacheKey, {
+			sessionId: input.sessionId,
+			orgId: input.orgId,
 			identityKey,
 			tokenFingerprint,
 			snapshot,
@@ -72656,12 +72661,14 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 		});
 		return snapshot;
 	}).catch((error) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheBySessionId.delete(input.sessionId);
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheByKey.delete(cacheKey);
 		else current.inFlight = null;
 		throw error;
 	});
-	cacheBySessionId.set(input.sessionId, {
+	cacheByKey.set(cacheKey, {
+		sessionId: input.sessionId,
+		orgId: input.orgId,
 		identityKey,
 		tokenFingerprint,
 		snapshot: existing?.snapshot ?? null,
@@ -72677,9 +72684,9 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 * opportunistically on every read.
 */
 function sweepExpiredWorkIntakeEntries(nowMs) {
-	for (const [sessionId, entry] of cacheBySessionId) {
+	for (const [key, entry] of cacheByKey) {
 		if (entry.inFlight) continue;
-		if (nowMs - entry.cachedAtMs > 3e5) cacheBySessionId.delete(sessionId);
+		if (nowMs - entry.cachedAtMs > 3e5) cacheByKey.delete(key);
 	}
 }
 async function readCachedCmmdWorkIntakeForSession(input) {
@@ -72688,17 +72695,18 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 	const identityKey = input.identityKey ?? input.sessionId;
 	if (input.forceFresh) invalidateCachedCmmdWorkIntakeForIdentity(identityKey);
 	const tokenFingerprint = fingerprintToken(input.token);
-	const existing = cacheBySessionId.get(input.sessionId);
-	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheBySessionId.delete(input.sessionId);
-	const current = cacheBySessionId.get(input.sessionId);
-	if (!current?.snapshot) return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	const cacheKey = cacheKeyFor(input.sessionId, input.orgId);
+	const existing = cacheByKey.get(cacheKey);
+	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheByKey.delete(cacheKey);
+	const current = cacheByKey.get(cacheKey);
+	if (!current?.snapshot) return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 	const ageMs = Math.max(0, nowMs() - current.cachedAtMs);
 	if (ageMs <= 12e4) return current.snapshot;
 	if (ageMs <= 3e5) {
 		if (!current.inFlight) {
 			let refreshPromise;
 			refreshPromise = input.fetchFresh().then((snapshot) => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) {
 					latest.snapshot = snapshot;
 					latest.cachedAtMs = nowMs();
@@ -72706,25 +72714,25 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 				return snapshot;
 			}).catch((error) => {
 				if (legacyCmmdToolBridge.isAuthError(error)) {
-					const latest = cacheBySessionId.get(input.sessionId);
-					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheBySessionId.delete(input.sessionId);
+					const latest = cacheByKey.get(cacheKey);
+					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheByKey.delete(cacheKey);
 				}
 				return current.snapshot;
 			}).finally(() => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) latest.inFlight = null;
 			});
 			current.inFlight = refreshPromise;
 		}
 		return current.snapshot;
 	}
-	return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 }
 function invalidateCachedCmmdWorkIntakeForSession(sessionId) {
-	cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.sessionId === sessionId) cacheByKey.delete(key);
 }
 function invalidateCachedCmmdWorkIntakeForIdentity(identityKey) {
-	for (const [sessionId, entry] of cacheBySessionId) if (entry.identityKey === identityKey) cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.identityKey === identityKey) cacheByKey.delete(key);
 }
 //#endregion
 //#region src/cmmdData/proxyRouteRegistry.ts
@@ -105231,6 +105239,29 @@ function warn$1(label, cause) {
 	return `${label} fetch failed: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
 /**
+* Reads the workspace catalog off a settled bootstrap call. No explicit org
+* means CMMD answered `activeWorkspace` with its own default-organization
+* guess, not a confirmed fact -- leave it null rather than publish it
+* (forge#3636).
+*/
+function resolveWorkspacesFromBootstrap(bootstrapResult, orgId, warnings) {
+	if (bootstrapResult.status !== "fulfilled") {
+		warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+		return {
+			workspaces: [],
+			activeWorkspace: null
+		};
+	}
+	const bootstrap = unwrapRestObject(bootstrapResult.value);
+	const rawWorkspaces = bootstrap?.["workspaces"];
+	const workspaces = Array.isArray(rawWorkspaces) ? rawWorkspaces.map(adaptBootstrapWorkspace) : [];
+	const rawActive = orgId !== void 0 ? bootstrap?.["activeWorkspace"] : void 0;
+	return {
+		workspaces,
+		activeWorkspace: rawActive && typeof rawActive === "object" ? adaptBootstrapWorkspace(rawActive) : null
+	};
+}
+/**
 * Build the CMMD work-intake snapshot via the JWT REST API:
 * bootstrap (workspaces) + campaigns + projects + center-board (tasks WITH deps).
 * `identity` is supplied by the session (resolved at login), matching the MCP builder.
@@ -105238,21 +105269,13 @@ function warn$1(label, cause) {
 async function fetchCmmdWorkIntakeViaRest(jwt, identity, deps = {}) {
 	const get = deps.proxyGet ?? proxyGet;
 	const [bootstrapResult, campaignsResult, projectsResult, boardResult] = await Promise.allSettled([
-		get(jwt, "/api/forge/context/bootstrap"),
+		get(jwt, "/api/forge/context/bootstrap", void 0, deps.orgId),
 		get(jwt, "/api/forge/context/campaigns"),
 		fetchAllProjects(get, jwt),
 		get(jwt, "/api/forge/context/work-items/board")
 	]);
 	const warnings = [];
-	let workspaces = [];
-	let activeWorkspace = null;
-	if (bootstrapResult.status === "fulfilled") {
-		const bootstrap = unwrapRestObject(bootstrapResult.value);
-		const rawWorkspaces = bootstrap?.["workspaces"];
-		if (Array.isArray(rawWorkspaces)) workspaces = rawWorkspaces.map(adaptBootstrapWorkspace);
-		const rawActive = bootstrap?.["activeWorkspace"];
-		if (rawActive && typeof rawActive === "object") activeWorkspace = adaptBootstrapWorkspace(rawActive);
-	} else warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+	const { workspaces, activeWorkspace } = resolveWorkspacesFromBootstrap(bootstrapResult, deps.orgId, warnings);
 	if (projectsResult.status === "rejected") throw projectsResult.reason;
 	if (campaignsResult.status === "rejected") warnings.push(warn$1("Campaigns", campaignsResult.reason));
 	if (boardResult.status === "rejected") warnings.push(warn$1("Tasks (board)", boardResult.reason));
@@ -300572,7 +300595,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "2b217d6b85f7c98cf77e2a23bce2ef8102d3a0a5";
+	return "8a4057a4a58eeb014b73143ffbb1bb091089d750";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -310992,6 +311015,24 @@ function logWorkIntakeFailure(cause) {
 	}
 	console.error("[work-intake] fetch failed:", cause);
 }
+/**
+* `?orgId=` present but empty (a stripped or malformed query string) is not
+* an explicit org. Treat it the same as an absent param rather than sending
+* CMMD an empty `X-Organization-ID` header (forge#3636).
+*/
+function normalizeOrgIdQueryParam(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* `{ orgId }` when present, `{}` when not -- the `exactOptionalPropertyTypes`
+* shape every `orgId?: string` deps object here needs, since spreading
+* `{ orgId: possiblyUndefined }` inline assigns `undefined` to a property
+* the type says is only ever absent or a string.
+*/
+function orgIdDeps(orgId) {
+	return orgId !== void 0 ? { orgId } : {};
+}
 function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 	return require_Schema$1.gen(function* () {
 		const jwt = yield* (dependencies.resolveJwt ?? resolveCmmdJwtForSession)({
@@ -311003,7 +311044,7 @@ function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 		const identity = (dependencies.readIdentity ?? readCmmdUserIdentityForSession)(session.sessionId);
 		const fetchFallback = dependencies.fetchFallback ?? fetchCmmdWorkIntakeViaRest;
 		return yield* require_Schema$1.tryPromise({
-			try: () => fetchFallback(jwt, identity),
+			try: () => fetchFallback(jwt, identity, orgIdDeps(dependencies.orgId)),
 			catch: (cause) => new WorkIntakeSnapshotReadError({
 				detail: "Failed to build CMMD REST work-intake fallback.",
 				cause
@@ -311115,7 +311156,9 @@ function unwrapForgeEnvelopeJsonText(text) {
 const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_Schema$1.gen(function* () {
 	const request = yield* require_HttpServer.HttpServerRequest;
 	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const forceFresh = new URL(request.url, "http://localhost").searchParams.get("fresh") === "1";
+	const requestUrl = new URL(request.url, "http://localhost");
+	const forceFresh = requestUrl.searchParams.get("fresh") === "1";
+	const orgId = normalizeOrgIdQueryParam(requestUrl.searchParams.get("orgId"));
 	let accessToken = readCommandAccessTokenForSession(session.sessionId);
 	if (!accessToken && session.role === "owner" && (session.subject === "owner-bootstrap" || session.subject === "desktop-bootstrap")) accessToken = (yield* promoteMostRecentOwnerCommandAuthToSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to promote owner CMMD auth for work intake.", {
 		cause: error,
@@ -311160,8 +311203,9 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 			sessionId: session.sessionId,
 			identityKey: workIntakeCacheIdentity,
 			token: accessToken,
+			...orgIdDeps(orgId),
 			forceFresh,
-			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
+			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity, orgIdDeps(orgId)) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
 		}),
 		catch: (cause) => new WorkIntakeSnapshotReadError({
 			detail: "Failed to read CMMD work intake snapshot.",
@@ -311179,7 +311223,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 		if (isCmmdMcpAuthError(cause)) {
 			console.error("[WORK_INTAKE] CMMD_AUTH_EXPIRED mcp_error:", cause instanceof Error ? cause.message : String(cause));
 			invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 			yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear expired CMMD token after MCP auth failure.", {
 				cause: error,
 				sessionId: session.sessionId
@@ -311204,7 +311248,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", require_S
 			connected: snapshot.connected
 		});
 		invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 		yield* clearCommandAccessTokenForSession(session.sessionId).pipe(require_Schema$1.catch_((error) => require_Schema$1.logWarning("Failed to clear expired CMMD token after auth warning.", {
 			cause: error,
 			sessionId: session.sessionId
@@ -312560,12 +312604,65 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-registerProxyRoute({
+function parseCmmdBootstrapRequest(request) {
+	return require_Schema$1.sync(() => {
+		return {
+			ok: true,
+			value: normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"))
+		};
+	});
+}
+/**
+* Nulls `activeWorkspace` on a bootstrap body, wherever it sits. CMMD answers
+* `GET /api/forge/context/bootstrap` either flat (`{ activeWorkspace, ... }`)
+* or enveloped (`{ data: { activeWorkspace, ... } }`) -- `workIntakeRest.ts`'s
+* `unwrapRestObject` already treats both as live shapes for this exact
+* endpoint. Nulling only the top level left `data.activeWorkspace` (CMMD's
+* guess) untouched on the enveloped shape.
+*/
+function nullActiveWorkspace(body) {
+	const data = body["data"];
+	const nulledData = typeof data === "object" && data !== null && !Array.isArray(data) ? {
+		...data,
+		activeWorkspace: null
+	} : data;
+	return {
+		...body,
+		activeWorkspace: null,
+		...data !== void 0 ? { data: nulledData } : {}
+	};
+}
+/**
+* CMMD resolves `activeWorkspace` to the caller's own default organization
+* whenever the request carries no `X-Organization-ID` header (forge#3636:
+* the owner working in org 2119 kept getting org 2142, CMMD's default, back).
+* Passing the client's explicit `?orgId=` scopes CMMD's answer to that
+* workspace; without one, CMMD still guesses, so `activeWorkspace` is nulled
+* here rather than forwarded as fact. Everything else in the bootstrap
+* response passes through untouched.
+*/
+function runCmmdBootstrap(orgId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.request({
+		method: "GET",
+		jwt,
+		path: "/api/forge/context/bootstrap",
+		...orgId !== void 0 ? { orgId } : {}
+	}), (value) => {
+		if (orgId !== void 0 || value === null || typeof value !== "object") return {
+			status: 200,
+			body: value
+		};
+		return {
+			status: 200,
+			body: nullActiveWorkspace(value)
+		};
+	});
+}
+registerProxyHandler({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
-	cmmdPath: "/api/forge/context/bootstrap",
-	orgIdSource: "none",
-	responseShape: "passthrough"
+	parse: parseCmmdBootstrapRequest,
+	run: runCmmdBootstrap
 });
 registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",

package/dist/bin.mjs

@@ -66046,7 +66046,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.125";
+var version$1 = "0.13.126";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -72318,20 +72318,25 @@ const legacyCmmdToolBridge = {
 };
 //#endregion
 //#region src/command/workIntakeCache.ts
-const cacheBySessionId = /* @__PURE__ */ new Map();
+const cacheByKey = /* @__PURE__ */ new Map();
+function cacheKeyFor(sessionId, orgId) {
+	return `${sessionId}\u0000${orgId ?? ""}`;
+}
 function resolveCmmdWorkIntakeCacheIdentity(subject, cmmdUserId) {
 	return cmmdUserId ? `cmmd-user:${cmmdUserId}` : `forge-subject:${subject}`;
 }
 function fingerprintToken(token) {
 	return createHash("sha256").update(token).digest("hex");
 }
-async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, existing) {
+async function fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, existing) {
 	if (existing?.inFlight) return existing.inFlight;
 	const nowMs = input.nowMs ?? Date.now;
 	let promise;
 	promise = input.fetchFresh().then((snapshot) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheBySessionId.set(input.sessionId, {
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheByKey.set(cacheKey, {
+			sessionId: input.sessionId,
+			orgId: input.orgId,
 			identityKey,
 			tokenFingerprint,
 			snapshot,
@@ -72340,12 +72345,14 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 		});
 		return snapshot;
 	}).catch((error) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheBySessionId.delete(input.sessionId);
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheByKey.delete(cacheKey);
 		else current.inFlight = null;
 		throw error;
 	});
-	cacheBySessionId.set(input.sessionId, {
+	cacheByKey.set(cacheKey, {
+		sessionId: input.sessionId,
+		orgId: input.orgId,
 		identityKey,
 		tokenFingerprint,
 		snapshot: existing?.snapshot ?? null,
@@ -72361,9 +72368,9 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 * opportunistically on every read.
 */
 function sweepExpiredWorkIntakeEntries(nowMs) {
-	for (const [sessionId, entry] of cacheBySessionId) {
+	for (const [key, entry] of cacheByKey) {
 		if (entry.inFlight) continue;
-		if (nowMs - entry.cachedAtMs > 3e5) cacheBySessionId.delete(sessionId);
+		if (nowMs - entry.cachedAtMs > 3e5) cacheByKey.delete(key);
 	}
 }
 async function readCachedCmmdWorkIntakeForSession(input) {
@@ -72372,17 +72379,18 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 	const identityKey = input.identityKey ?? input.sessionId;
 	if (input.forceFresh) invalidateCachedCmmdWorkIntakeForIdentity(identityKey);
 	const tokenFingerprint = fingerprintToken(input.token);
-	const existing = cacheBySessionId.get(input.sessionId);
-	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheBySessionId.delete(input.sessionId);
-	const current = cacheBySessionId.get(input.sessionId);
-	if (!current?.snapshot) return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	const cacheKey = cacheKeyFor(input.sessionId, input.orgId);
+	const existing = cacheByKey.get(cacheKey);
+	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheByKey.delete(cacheKey);
+	const current = cacheByKey.get(cacheKey);
+	if (!current?.snapshot) return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 	const ageMs = Math.max(0, nowMs() - current.cachedAtMs);
 	if (ageMs <= 12e4) return current.snapshot;
 	if (ageMs <= 3e5) {
 		if (!current.inFlight) {
 			let refreshPromise;
 			refreshPromise = input.fetchFresh().then((snapshot) => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) {
 					latest.snapshot = snapshot;
 					latest.cachedAtMs = nowMs();
@@ -72390,25 +72398,25 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 				return snapshot;
 			}).catch((error) => {
 				if (legacyCmmdToolBridge.isAuthError(error)) {
-					const latest = cacheBySessionId.get(input.sessionId);
-					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheBySessionId.delete(input.sessionId);
+					const latest = cacheByKey.get(cacheKey);
+					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheByKey.delete(cacheKey);
 				}
 				return current.snapshot;
 			}).finally(() => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) latest.inFlight = null;
 			});
 			current.inFlight = refreshPromise;
 		}
 		return current.snapshot;
 	}
-	return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 }
 function invalidateCachedCmmdWorkIntakeForSession(sessionId) {
-	cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.sessionId === sessionId) cacheByKey.delete(key);
 }
 function invalidateCachedCmmdWorkIntakeForIdentity(identityKey) {
-	for (const [sessionId, entry] of cacheBySessionId) if (entry.identityKey === identityKey) cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.identityKey === identityKey) cacheByKey.delete(key);
 }
 //#endregion
 //#region src/cmmdData/proxyRouteRegistry.ts
@@ -104835,6 +104843,29 @@ function warn$1(label, cause) {
 	return `${label} fetch failed: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
 /**
+* Reads the workspace catalog off a settled bootstrap call. No explicit org
+* means CMMD answered `activeWorkspace` with its own default-organization
+* guess, not a confirmed fact -- leave it null rather than publish it
+* (forge#3636).
+*/
+function resolveWorkspacesFromBootstrap(bootstrapResult, orgId, warnings) {
+	if (bootstrapResult.status !== "fulfilled") {
+		warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+		return {
+			workspaces: [],
+			activeWorkspace: null
+		};
+	}
+	const bootstrap = unwrapRestObject(bootstrapResult.value);
+	const rawWorkspaces = bootstrap?.["workspaces"];
+	const workspaces = Array.isArray(rawWorkspaces) ? rawWorkspaces.map(adaptBootstrapWorkspace) : [];
+	const rawActive = orgId !== void 0 ? bootstrap?.["activeWorkspace"] : void 0;
+	return {
+		workspaces,
+		activeWorkspace: rawActive && typeof rawActive === "object" ? adaptBootstrapWorkspace(rawActive) : null
+	};
+}
+/**
 * Build the CMMD work-intake snapshot via the JWT REST API:
 * bootstrap (workspaces) + campaigns + projects + center-board (tasks WITH deps).
 * `identity` is supplied by the session (resolved at login), matching the MCP builder.
@@ -104842,21 +104873,13 @@ function warn$1(label, cause) {
 async function fetchCmmdWorkIntakeViaRest(jwt, identity, deps = {}) {
 	const get = deps.proxyGet ?? proxyGet;
 	const [bootstrapResult, campaignsResult, projectsResult, boardResult] = await Promise.allSettled([
-		get(jwt, "/api/forge/context/bootstrap"),
+		get(jwt, "/api/forge/context/bootstrap", void 0, deps.orgId),
 		get(jwt, "/api/forge/context/campaigns"),
 		fetchAllProjects(get, jwt),
 		get(jwt, "/api/forge/context/work-items/board")
 	]);
 	const warnings = [];
-	let workspaces = [];
-	let activeWorkspace = null;
-	if (bootstrapResult.status === "fulfilled") {
-		const bootstrap = unwrapRestObject(bootstrapResult.value);
-		const rawWorkspaces = bootstrap?.["workspaces"];
-		if (Array.isArray(rawWorkspaces)) workspaces = rawWorkspaces.map(adaptBootstrapWorkspace);
-		const rawActive = bootstrap?.["activeWorkspace"];
-		if (rawActive && typeof rawActive === "object") activeWorkspace = adaptBootstrapWorkspace(rawActive);
-	} else warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+	const { workspaces, activeWorkspace } = resolveWorkspacesFromBootstrap(bootstrapResult, deps.orgId, warnings);
 	if (projectsResult.status === "rejected") throw projectsResult.reason;
 	if (campaignsResult.status === "rejected") warnings.push(warn$1("Campaigns", campaignsResult.reason));
 	if (boardResult.status === "rejected") warnings.push(warn$1("Tasks (board)", boardResult.reason));
@@ -300019,7 +300042,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "2b217d6b85f7c98cf77e2a23bce2ef8102d3a0a5";
+	return "8a4057a4a58eeb014b73143ffbb1bb091089d750";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -310369,6 +310392,24 @@ function logWorkIntakeFailure(cause) {
 	}
 	console.error("[work-intake] fetch failed:", cause);
 }
+/**
+* `?orgId=` present but empty (a stripped or malformed query string) is not
+* an explicit org. Treat it the same as an absent param rather than sending
+* CMMD an empty `X-Organization-ID` header (forge#3636).
+*/
+function normalizeOrgIdQueryParam(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* `{ orgId }` when present, `{}` when not -- the `exactOptionalPropertyTypes`
+* shape every `orgId?: string` deps object here needs, since spreading
+* `{ orgId: possiblyUndefined }` inline assigns `undefined` to a property
+* the type says is only ever absent or a string.
+*/
+function orgIdDeps(orgId) {
+	return orgId !== void 0 ? { orgId } : {};
+}
 function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 	return gen(function* () {
 		const jwt = yield* (dependencies.resolveJwt ?? resolveCmmdJwtForSession)({
@@ -310380,7 +310421,7 @@ function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 		const identity = (dependencies.readIdentity ?? readCmmdUserIdentityForSession)(session.sessionId);
 		const fetchFallback = dependencies.fetchFallback ?? fetchCmmdWorkIntakeViaRest;
 		return yield* tryPromise({
-			try: () => fetchFallback(jwt, identity),
+			try: () => fetchFallback(jwt, identity, orgIdDeps(dependencies.orgId)),
 			catch: (cause) => new WorkIntakeSnapshotReadError({
 				detail: "Failed to build CMMD REST work-intake fallback.",
 				cause
@@ -310492,7 +310533,9 @@ function unwrapForgeEnvelopeJsonText(text) {
 const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(function* () {
 	const request = yield* HttpServerRequest;
 	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const forceFresh = new URL(request.url, "http://localhost").searchParams.get("fresh") === "1";
+	const requestUrl = new URL(request.url, "http://localhost");
+	const forceFresh = requestUrl.searchParams.get("fresh") === "1";
+	const orgId = normalizeOrgIdQueryParam(requestUrl.searchParams.get("orgId"));
 	let accessToken = readCommandAccessTokenForSession(session.sessionId);
 	if (!accessToken && session.role === "owner" && (session.subject === "owner-bootstrap" || session.subject === "desktop-bootstrap")) accessToken = (yield* promoteMostRecentOwnerCommandAuthToSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to promote owner CMMD auth for work intake.", {
 		cause: error,
@@ -310537,8 +310580,9 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 			sessionId: session.sessionId,
 			identityKey: workIntakeCacheIdentity,
 			token: accessToken,
+			...orgIdDeps(orgId),
 			forceFresh,
-			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
+			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity, orgIdDeps(orgId)) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
 		}),
 		catch: (cause) => new WorkIntakeSnapshotReadError({
 			detail: "Failed to read CMMD work intake snapshot.",
@@ -310556,7 +310600,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 		if (isCmmdMcpAuthError(cause)) {
 			console.error("[WORK_INTAKE] CMMD_AUTH_EXPIRED mcp_error:", cause instanceof Error ? cause.message : String(cause));
 			invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 			yield* clearCommandAccessTokenForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear expired CMMD token after MCP auth failure.", {
 				cause: error,
 				sessionId: session.sessionId
@@ -310581,7 +310625,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 			connected: snapshot.connected
 		});
 		invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 		yield* clearCommandAccessTokenForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear expired CMMD token after auth warning.", {
 			cause: error,
 			sessionId: session.sessionId
@@ -311936,12 +311980,65 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-registerProxyRoute({
+function parseCmmdBootstrapRequest(request) {
+	return sync$1(() => {
+		return {
+			ok: true,
+			value: normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"))
+		};
+	});
+}
+/**
+* Nulls `activeWorkspace` on a bootstrap body, wherever it sits. CMMD answers
+* `GET /api/forge/context/bootstrap` either flat (`{ activeWorkspace, ... }`)
+* or enveloped (`{ data: { activeWorkspace, ... } }`) -- `workIntakeRest.ts`'s
+* `unwrapRestObject` already treats both as live shapes for this exact
+* endpoint. Nulling only the top level left `data.activeWorkspace` (CMMD's
+* guess) untouched on the enveloped shape.
+*/
+function nullActiveWorkspace(body) {
+	const data = body["data"];
+	const nulledData = typeof data === "object" && data !== null && !Array.isArray(data) ? {
+		...data,
+		activeWorkspace: null
+	} : data;
+	return {
+		...body,
+		activeWorkspace: null,
+		...data !== void 0 ? { data: nulledData } : {}
+	};
+}
+/**
+* CMMD resolves `activeWorkspace` to the caller's own default organization
+* whenever the request carries no `X-Organization-ID` header (forge#3636:
+* the owner working in org 2119 kept getting org 2142, CMMD's default, back).
+* Passing the client's explicit `?orgId=` scopes CMMD's answer to that
+* workspace; without one, CMMD still guesses, so `activeWorkspace` is nulled
+* here rather than forwarded as fact. Everything else in the bootstrap
+* response passes through untouched.
+*/
+function runCmmdBootstrap(orgId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.request({
+		method: "GET",
+		jwt,
+		path: "/api/forge/context/bootstrap",
+		...orgId !== void 0 ? { orgId } : {}
+	}), (value) => {
+		if (orgId !== void 0 || value === null || typeof value !== "object") return {
+			status: 200,
+			body: value
+		};
+		return {
+			status: 200,
+			body: nullActiveWorkspace(value)
+		};
+	});
+}
+registerProxyHandler({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
-	cmmdPath: "/api/forge/context/bootstrap",
-	orgIdSource: "none",
-	responseShape: "passthrough"
+	parse: parseCmmdBootstrapRequest,
+	run: runCmmdBootstrap
 });
 registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",