@cmmd-center/forge 0.13.125 → 0.13.127

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -50658,7 +50658,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53101,7 +53101,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53123,7 +53123,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66046,7 +66046,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.125";
+var version$1 = "0.13.127";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -72318,20 +72318,25 @@ const legacyCmmdToolBridge = {
 };
 //#endregion
 //#region src/command/workIntakeCache.ts
-const cacheBySessionId = /* @__PURE__ */ new Map();
+const cacheByKey = /* @__PURE__ */ new Map();
+function cacheKeyFor(sessionId, orgId) {
+	return `${sessionId}\u0000${orgId ?? ""}`;
+}
 function resolveCmmdWorkIntakeCacheIdentity(subject, cmmdUserId) {
 	return cmmdUserId ? `cmmd-user:${cmmdUserId}` : `forge-subject:${subject}`;
 }
 function fingerprintToken(token) {
 	return createHash("sha256").update(token).digest("hex");
 }
-async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, existing) {
+async function fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, existing) {
 	if (existing?.inFlight) return existing.inFlight;
 	const nowMs = input.nowMs ?? Date.now;
 	let promise;
 	promise = input.fetchFresh().then((snapshot) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheBySessionId.set(input.sessionId, {
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) cacheByKey.set(cacheKey, {
+			sessionId: input.sessionId,
+			orgId: input.orgId,
 			identityKey,
 			tokenFingerprint,
 			snapshot,
@@ -72340,12 +72345,14 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 		});
 		return snapshot;
 	}).catch((error) => {
-		const current = cacheBySessionId.get(input.sessionId);
-		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheBySessionId.delete(input.sessionId);
+		const current = cacheByKey.get(cacheKey);
+		if (current?.tokenFingerprint === tokenFingerprint && current.inFlight === promise) if (legacyCmmdToolBridge.isAuthError(error)) cacheByKey.delete(cacheKey);
 		else current.inFlight = null;
 		throw error;
 	});
-	cacheBySessionId.set(input.sessionId, {
+	cacheByKey.set(cacheKey, {
+		sessionId: input.sessionId,
+		orgId: input.orgId,
 		identityKey,
 		tokenFingerprint,
 		snapshot: existing?.snapshot ?? null,
@@ -72361,9 +72368,9 @@ async function fetchBlockingSnapshot(input, identityKey, tokenFingerprint, exist
 * opportunistically on every read.
 */
 function sweepExpiredWorkIntakeEntries(nowMs) {
-	for (const [sessionId, entry] of cacheBySessionId) {
+	for (const [key, entry] of cacheByKey) {
 		if (entry.inFlight) continue;
-		if (nowMs - entry.cachedAtMs > 3e5) cacheBySessionId.delete(sessionId);
+		if (nowMs - entry.cachedAtMs > 3e5) cacheByKey.delete(key);
 	}
 }
 async function readCachedCmmdWorkIntakeForSession(input) {
@@ -72372,17 +72379,18 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 	const identityKey = input.identityKey ?? input.sessionId;
 	if (input.forceFresh) invalidateCachedCmmdWorkIntakeForIdentity(identityKey);
 	const tokenFingerprint = fingerprintToken(input.token);
-	const existing = cacheBySessionId.get(input.sessionId);
-	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheBySessionId.delete(input.sessionId);
-	const current = cacheBySessionId.get(input.sessionId);
-	if (!current?.snapshot) return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	const cacheKey = cacheKeyFor(input.sessionId, input.orgId);
+	const existing = cacheByKey.get(cacheKey);
+	if (existing && (existing.identityKey !== identityKey || existing.tokenFingerprint !== tokenFingerprint)) cacheByKey.delete(cacheKey);
+	const current = cacheByKey.get(cacheKey);
+	if (!current?.snapshot) return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 	const ageMs = Math.max(0, nowMs() - current.cachedAtMs);
 	if (ageMs <= 12e4) return current.snapshot;
 	if (ageMs <= 3e5) {
 		if (!current.inFlight) {
 			let refreshPromise;
 			refreshPromise = input.fetchFresh().then((snapshot) => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) {
 					latest.snapshot = snapshot;
 					latest.cachedAtMs = nowMs();
@@ -72390,25 +72398,25 @@ async function readCachedCmmdWorkIntakeForSession(input) {
 				return snapshot;
 			}).catch((error) => {
 				if (legacyCmmdToolBridge.isAuthError(error)) {
-					const latest = cacheBySessionId.get(input.sessionId);
-					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheBySessionId.delete(input.sessionId);
+					const latest = cacheByKey.get(cacheKey);
+					if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) cacheByKey.delete(cacheKey);
 				}
 				return current.snapshot;
 			}).finally(() => {
-				const latest = cacheBySessionId.get(input.sessionId);
+				const latest = cacheByKey.get(cacheKey);
 				if (latest?.tokenFingerprint === tokenFingerprint && latest.inFlight === refreshPromise) latest.inFlight = null;
 			});
 			current.inFlight = refreshPromise;
 		}
 		return current.snapshot;
 	}
-	return fetchBlockingSnapshot(input, identityKey, tokenFingerprint, current);
+	return fetchBlockingSnapshot(input, cacheKey, identityKey, tokenFingerprint, current);
 }
 function invalidateCachedCmmdWorkIntakeForSession(sessionId) {
-	cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.sessionId === sessionId) cacheByKey.delete(key);
 }
 function invalidateCachedCmmdWorkIntakeForIdentity(identityKey) {
-	for (const [sessionId, entry] of cacheBySessionId) if (entry.identityKey === identityKey) cacheBySessionId.delete(sessionId);
+	for (const [key, entry] of cacheByKey) if (entry.identityKey === identityKey) cacheByKey.delete(key);
 }
 //#endregion
 //#region src/cmmdData/proxyRouteRegistry.ts
@@ -76281,7 +76289,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -76289,8 +76297,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -94134,7 +94142,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-yHTUkd2Y.mjs"),
+		try: () => import("./open-2-reBrpv.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -104835,6 +104843,29 @@ function warn$1(label, cause) {
 	return `${label} fetch failed: ${cause instanceof Error ? cause.message : String(cause)}`;
 }
 /**
+* Reads the workspace catalog off a settled bootstrap call. No explicit org
+* means CMMD answered `activeWorkspace` with its own default-organization
+* guess, not a confirmed fact -- leave it null rather than publish it
+* (forge#3636).
+*/
+function resolveWorkspacesFromBootstrap(bootstrapResult, orgId, warnings) {
+	if (bootstrapResult.status !== "fulfilled") {
+		warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+		return {
+			workspaces: [],
+			activeWorkspace: null
+		};
+	}
+	const bootstrap = unwrapRestObject(bootstrapResult.value);
+	const rawWorkspaces = bootstrap?.["workspaces"];
+	const workspaces = Array.isArray(rawWorkspaces) ? rawWorkspaces.map(adaptBootstrapWorkspace) : [];
+	const rawActive = orgId !== void 0 ? bootstrap?.["activeWorkspace"] : void 0;
+	return {
+		workspaces,
+		activeWorkspace: rawActive && typeof rawActive === "object" ? adaptBootstrapWorkspace(rawActive) : null
+	};
+}
+/**
 * Build the CMMD work-intake snapshot via the JWT REST API:
 * bootstrap (workspaces) + campaigns + projects + center-board (tasks WITH deps).
 * `identity` is supplied by the session (resolved at login), matching the MCP builder.
@@ -104842,21 +104873,13 @@ function warn$1(label, cause) {
 async function fetchCmmdWorkIntakeViaRest(jwt, identity, deps = {}) {
 	const get = deps.proxyGet ?? proxyGet;
 	const [bootstrapResult, campaignsResult, projectsResult, boardResult] = await Promise.allSettled([
-		get(jwt, "/api/forge/context/bootstrap"),
+		get(jwt, "/api/forge/context/bootstrap", void 0, deps.orgId),
 		get(jwt, "/api/forge/context/campaigns"),
 		fetchAllProjects(get, jwt),
 		get(jwt, "/api/forge/context/work-items/board")
 	]);
 	const warnings = [];
-	let workspaces = [];
-	let activeWorkspace = null;
-	if (bootstrapResult.status === "fulfilled") {
-		const bootstrap = unwrapRestObject(bootstrapResult.value);
-		const rawWorkspaces = bootstrap?.["workspaces"];
-		if (Array.isArray(rawWorkspaces)) workspaces = rawWorkspaces.map(adaptBootstrapWorkspace);
-		const rawActive = bootstrap?.["activeWorkspace"];
-		if (rawActive && typeof rawActive === "object") activeWorkspace = adaptBootstrapWorkspace(rawActive);
-	} else warnings.push(warn$1("Workspaces (bootstrap)", bootstrapResult.reason));
+	const { workspaces, activeWorkspace } = resolveWorkspacesFromBootstrap(bootstrapResult, deps.orgId, warnings);
 	if (projectsResult.status === "rejected") throw projectsResult.reason;
 	if (campaignsResult.status === "rejected") warnings.push(warn$1("Campaigns", campaignsResult.reason));
 	if (boardResult.status === "rejected") warnings.push(warn$1("Tasks (board)", boardResult.reason));
@@ -192420,7 +192443,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202620,12 +202643,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -202640,7 +202663,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -202651,14 +202674,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202673,7 +202696,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -202688,13 +202711,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -271238,7 +271261,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271369,14 +271392,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271384,7 +271407,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -300019,7 +300042,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "2b217d6b85f7c98cf77e2a23bce2ef8102d3a0a5";
+	return "c7fe2d96f51605b303a42c585157e3bc4d4af889";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -310369,6 +310392,24 @@ function logWorkIntakeFailure(cause) {
 	}
 	console.error("[work-intake] fetch failed:", cause);
 }
+/**
+* `?orgId=` present but empty (a stripped or malformed query string) is not
+* an explicit org. Treat it the same as an absent param rather than sending
+* CMMD an empty `X-Organization-ID` header (forge#3636).
+*/
+function normalizeOrgIdQueryParam(raw) {
+	const trimmed = raw?.trim();
+	return trimmed ? trimmed : void 0;
+}
+/**
+* `{ orgId }` when present, `{}` when not -- the `exactOptionalPropertyTypes`
+* shape every `orgId?: string` deps object here needs, since spreading
+* `{ orgId: possiblyUndefined }` inline assigns `undefined` to a property
+* the type says is only ever absent or a string.
+*/
+function orgIdDeps(orgId) {
+	return orgId !== void 0 ? { orgId } : {};
+}
 function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 	return gen(function* () {
 		const jwt = yield* (dependencies.resolveJwt ?? resolveCmmdJwtForSession)({
@@ -310380,7 +310421,7 @@ function fetchRestFallbackWorkIntakeForSession(session, dependencies = {}) {
 		const identity = (dependencies.readIdentity ?? readCmmdUserIdentityForSession)(session.sessionId);
 		const fetchFallback = dependencies.fetchFallback ?? fetchCmmdWorkIntakeViaRest;
 		return yield* tryPromise({
-			try: () => fetchFallback(jwt, identity),
+			try: () => fetchFallback(jwt, identity, orgIdDeps(dependencies.orgId)),
 			catch: (cause) => new WorkIntakeSnapshotReadError({
 				detail: "Failed to build CMMD REST work-intake fallback.",
 				cause
@@ -310492,7 +310533,9 @@ function unwrapForgeEnvelopeJsonText(text) {
 const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(function* () {
 	const request = yield* HttpServerRequest;
 	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const forceFresh = new URL(request.url, "http://localhost").searchParams.get("fresh") === "1";
+	const requestUrl = new URL(request.url, "http://localhost");
+	const forceFresh = requestUrl.searchParams.get("fresh") === "1";
+	const orgId = normalizeOrgIdQueryParam(requestUrl.searchParams.get("orgId"));
 	let accessToken = readCommandAccessTokenForSession(session.sessionId);
 	if (!accessToken && session.role === "owner" && (session.subject === "owner-bootstrap" || session.subject === "desktop-bootstrap")) accessToken = (yield* promoteMostRecentOwnerCommandAuthToSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to promote owner CMMD auth for work intake.", {
 		cause: error,
@@ -310537,8 +310580,9 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 			sessionId: session.sessionId,
 			identityKey: workIntakeCacheIdentity,
 			token: accessToken,
+			...orgIdDeps(orgId),
 			forceFresh,
-			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
+			fetchFresh: () => cmmdJwt ? fetchCmmdWorkIntakeViaRest(cmmdJwt, sessionIdentity, orgIdDeps(orgId)) : Promise.reject(/* @__PURE__ */ new Error("CMMD JWT unavailable for work-intake fetch."))
 		}),
 		catch: (cause) => new WorkIntakeSnapshotReadError({
 			detail: "Failed to read CMMD work intake snapshot.",
@@ -310556,7 +310600,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 		if (isCmmdMcpAuthError(cause)) {
 			console.error("[WORK_INTAKE] CMMD_AUTH_EXPIRED mcp_error:", cause instanceof Error ? cause.message : String(cause));
 			invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+			const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 			yield* clearCommandAccessTokenForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear expired CMMD token after MCP auth failure.", {
 				cause: error,
 				sessionId: session.sessionId
@@ -310581,7 +310625,7 @@ const cmmdWorkIntakeRouteLayer = add$1("GET", "/api/cmmd/work-intake", gen(funct
 			connected: snapshot.connected
 		});
 		invalidateCachedCmmdWorkIntakeForSession(session.sessionId);
-		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session);
+		const fallback = yield* fetchRestFallbackWorkIntakeForSession(session, orgIdDeps(orgId));
 		yield* clearCommandAccessTokenForSession(session.sessionId).pipe(catch_((error) => logWarning$1("Failed to clear expired CMMD token after auth warning.", {
 			cause: error,
 			sessionId: session.sessionId
@@ -311936,12 +311980,65 @@ registerProxyRoute({
 	responseShape: "unwrapData",
 	requestBody: "none"
 });
-registerProxyRoute({
+function parseCmmdBootstrapRequest(request) {
+	return sync$1(() => {
+		return {
+			ok: true,
+			value: normalizeOrgIdQueryParam(new URL(request.url, "http://localhost").searchParams.get("orgId"))
+		};
+	});
+}
+/**
+* Nulls `activeWorkspace` on a bootstrap body, wherever it sits. CMMD answers
+* `GET /api/forge/context/bootstrap` either flat (`{ activeWorkspace, ... }`)
+* or enveloped (`{ data: { activeWorkspace, ... } }`) -- `workIntakeRest.ts`'s
+* `unwrapRestObject` already treats both as live shapes for this exact
+* endpoint. Nulling only the top level left `data.activeWorkspace` (CMMD's
+* guess) untouched on the enveloped shape.
+*/
+function nullActiveWorkspace(body) {
+	const data = body["data"];
+	const nulledData = typeof data === "object" && data !== null && !Array.isArray(data) ? {
+		...data,
+		activeWorkspace: null
+	} : data;
+	return {
+		...body,
+		activeWorkspace: null,
+		...data !== void 0 ? { data: nulledData } : {}
+	};
+}
+/**
+* CMMD resolves `activeWorkspace` to the caller's own default organization
+* whenever the request carries no `X-Organization-ID` header (forge#3636:
+* the owner working in org 2119 kept getting org 2142, CMMD's default, back).
+* Passing the client's explicit `?orgId=` scopes CMMD's answer to that
+* workspace; without one, CMMD still guesses, so `activeWorkspace` is nulled
+* here rather than forwarded as fact. Everything else in the bootstrap
+* response passes through untouched.
+*/
+function runCmmdBootstrap(orgId, { session }) {
+	return runCmmdRestProxyAsHandlerResult(session, (jwt) => cmmdGateway.request({
+		method: "GET",
+		jwt,
+		path: "/api/forge/context/bootstrap",
+		...orgId !== void 0 ? { orgId } : {}
+	}), (value) => {
+		if (orgId !== void 0 || value === null || typeof value !== "object") return {
+			status: 200,
+			body: value
+		};
+		return {
+			status: 200,
+			body: nullActiveWorkspace(value)
+		};
+	});
+}
+registerProxyHandler({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
-	cmmdPath: "/api/forge/context/bootstrap",
-	orgIdSource: "none",
-	responseShape: "passthrough"
+	parse: parseCmmdBootstrapRequest,
+	run: runCmmdBootstrap
 });
 registerProxyRoute({
 	forgePath: "/api/cmmd/account/preferences",
@@ -325414,7 +325511,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-yHTUkd2Y.mjs")).default;
+			const open = (await import("./open-2-reBrpv.mjs")).default;
 			await open(url);
 			return true;
 		},