@cmmd-center/forge 0.13.134 → 0.13.136

package/dist/bin.cjs

@@ -17489,6 +17489,22 @@ const RuntimeMode$1 = require_Schema$1.Literals([
 	"full-access"
 ]);
 const DEFAULT_RUNTIME_MODE$2 = "full-access";
+/**
+* Which wallet pays for a CMMD Work Session's provider usage. The values
+* match CMMD's `forgeWorkSessionWallets` in `shared/schema/forge-work-sessions.ts`.
+*
+* CMMD stamps it on the kick `thread.turn.start` (CMMD#5917). An absent value
+* means the turn carries no wallet claim, which Forge treats the way it
+* treated every turn before the field existed: on the personal login. On a
+* CMMD cloud runtime a `workspace` Claude turn must run through CMMD's metered
+* egress and is refused if CMMD will not mint for it. It never falls back to
+* the personal login in the VM.
+*/
+const WorkSessionWallet = require_Schema$1.Literals([
+	"personal",
+	"workspace",
+	"byok"
+]);
 const ProviderInteractionMode = require_Schema$1.Literals(["default", "plan"]);
 const DEFAULT_PROVIDER_INTERACTION_MODE = "default";
 const ProviderRequestKind = require_Schema$1.Literals([
@@ -17847,6 +17863,7 @@ const OrchestrationThread = require_Schema$1.Struct({
 	workerRole: require_Schema$1.NullOr(WorkerRole).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	workSessionBoundAt: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
+	wallet: require_Schema$1.optionalKey(require_Schema$1.NullOr(WorkSessionWallet)),
 	pendingAutoCreatePrompt: require_Schema$1.optional(require_Schema$1.NullOr(AutoCreateTaskPrompt)).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	goal: require_Schema$1.NullOr(TrimmedNonEmptyString).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	titleRegeneration: require_Schema$1.NullOr(ThreadTitleRegeneration).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
@@ -18025,6 +18042,7 @@ const ThreadCreateCommand = require_Schema$1.Struct({
 	anchorKind: require_Schema$1.optional(CmmdAnchorKind),
 	anchorCmmdId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
 	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId)),
+	wallet: require_Schema$1.optional(WorkSessionWallet),
 	goal: require_Schema$1.optional(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optional(require_Schema$1.NullOr(LinkedPullRequest)),
 	kind: require_Schema$1.optional(ThreadKind),
@@ -18135,7 +18153,8 @@ const ThreadTurnStartCommand = require_Schema$1.Struct({
 	kind: require_Schema$1.optional(ThreadKind),
 	parentThreadId: require_Schema$1.optional(require_Schema$1.NullOr(ThreadId)),
 	createdAt: IsoDateTime,
-	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId))
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId)),
+	wallet: require_Schema$1.optional(WorkSessionWallet)
 });
 const ClientThreadTurnStartCommand = require_Schema$1.Struct({
 	type: require_Schema$1.Literal("thread.turn.start"),
@@ -18159,7 +18178,8 @@ const ClientThreadTurnStartCommand = require_Schema$1.Struct({
 	kind: require_Schema$1.optional(ThreadKind),
 	parentThreadId: require_Schema$1.optional(require_Schema$1.NullOr(ThreadId)),
 	createdAt: IsoDateTime,
-	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId))
+	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(CommandWorkSessionId)),
+	wallet: require_Schema$1.optional(WorkSessionWallet)
 });
 const ThreadTurnInterruptCommand = require_Schema$1.Struct({
 	type: require_Schema$1.Literal("thread.turn.interrupt"),
@@ -18457,6 +18477,7 @@ const ThreadCreatedPayload$1 = require_Schema$1.Struct({
 	anchorCmmdId: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	workSessionBoundAt: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
+	wallet: require_Schema$1.optionalKey(require_Schema$1.NullOr(WorkSessionWallet)),
 	goal: require_Schema$1.optionalKey(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optionalKey(require_Schema$1.NullOr(LinkedPullRequest)),
 	kind: ThreadKind.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("master"))),
@@ -18500,6 +18521,7 @@ const ThreadMetaUpdatedPayload$1 = require_Schema$1.Struct({
 	workerRole: require_Schema$1.optional(require_Schema$1.NullOr(WorkerRole)),
 	workSessionId: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.String)),
 	workSessionBoundAt: require_Schema$1.optional(require_Schema$1.String),
+	wallet: require_Schema$1.optional(WorkSessionWallet),
 	goal: require_Schema$1.optional(require_Schema$1.NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: require_Schema$1.optional(require_Schema$1.NullOr(LinkedPullRequest)),
 	regenerateTitle: require_Schema$1.optional(require_Schema$1.Literal(true)),
@@ -18536,6 +18558,7 @@ const ThreadTurnStartRequestedPayload = require_Schema$1.Struct({
 	runtimeMode: RuntimeMode$1.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(DEFAULT_RUNTIME_MODE$2))),
 	interactionMode: ProviderInteractionMode.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(DEFAULT_PROVIDER_INTERACTION_MODE))),
 	sourceProposedPlan: require_Schema$1.optional(SourceProposedPlanReference),
+	wallet: require_Schema$1.optional(WorkSessionWallet),
 	createdAt: IsoDateTime
 });
 const ThreadTurnInterruptRequestedPayload = require_Schema$1.Struct({
@@ -21051,7 +21074,8 @@ const ProviderSessionStartInput = require_Schema$1.Struct({
 	resumeCursor: require_Schema$1.optional(require_Schema$1.Unknown),
 	approvalPolicy: require_Schema$1.optional(ProviderApprovalPolicy),
 	sandboxMode: require_Schema$1.optional(ProviderSandboxMode),
-	runtimeMode: RuntimeMode$1
+	runtimeMode: RuntimeMode$1,
+	wallet: require_Schema$1.optional(WorkSessionWallet)
 });
 const ProviderSendTurnInput = require_Schema$1.Struct({
 	threadId: ThreadId,
@@ -66407,7 +66431,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.134";
+var version$1 = "0.13.136";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -98208,6 +98232,16 @@ const PUBLIC_PROVIDER_LEAK_PATTERNS = [
 	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
 ];
 const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+/**
+* The sentence a Workspace-wallet Claude turn fails with on a CMMD runtime when
+* CMMD will not mint its egress token (CMMD#5917). The Claude adapter opens its
+* refusal with it, and `categorizePublicProviderError` returns it unchanged, so
+* the refusal still reads as a refusal when a production stack forces the
+* failure detail through sanitization. Anything else would read as an outage
+* and invite a retry on the personal login.
+*/
+const CLAUDE_WORKSPACE_EGRESS_REFUSAL = "Claude could not get a Workspace egress token from CMMD for this turn. Refusing rather than falling back to the personal login.";
+const CLAUDE_WORKSPACE_EGRESS_REFUSAL_LOWER = CLAUDE_WORKSPACE_EGRESS_REFUSAL.toLowerCase();
 function isProviderRateOrQuotaError(message) {
 	if (!message) return false;
 	const normalized = message.toLowerCase();
@@ -98231,6 +98265,7 @@ function providerLifecycleOrAccountCopy(message) {
 function categorizePublicProviderError(message) {
 	if (!message) return null;
 	const m = message.toLowerCase();
+	if (m.includes(CLAUDE_WORKSPACE_EGRESS_REFUSAL_LOWER)) return CLAUDE_WORKSPACE_EGRESS_REFUSAL;
 	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
 	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
 	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
@@ -115871,7 +115906,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS checkpoint_diff_blobs (\n      thread_id TEXT NOT NULL,\n      from_turn_count INTEGER NOT NULL,\n      to_turn_count INTEGER NOT NULL,\n      diff TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      UNIQUE (thread_id, from_turn_count, to_turn_count)\n    )",
 	"CREATE TABLE IF NOT EXISTS provider_session_runtime (\n      thread_id TEXT PRIMARY KEY,\n      provider_name TEXT NOT NULL,\n      adapter_key TEXT NOT NULL,\n      runtime_mode TEXT NOT NULL DEFAULT 'full-access',\n      status TEXT NOT NULL,\n      last_seen_at TEXT NOT NULL,\n      resume_cursor_json TEXT,\n      runtime_payload_json TEXT\n    )",
 	"CREATE TABLE IF NOT EXISTS projection_projects (\n      project_id TEXT PRIMARY KEY,\n      title TEXT NOT NULL,\n      workspace_root TEXT NOT NULL,\n      scripts_json TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , default_model_selection_json TEXT, default_thread_env_mode TEXT, cmmd_registration_json TEXT)",
-	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT, work_session_bound_at TEXT)",
+	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT, work_session_bound_at TEXT, wallet TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_messages (\n      message_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      role TEXT NOT NULL,\n      text TEXT NOT NULL,\n      is_streaming INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , attachments_json TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_activities (\n      activity_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      tone TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      summary TEXT NOT NULL,\n      payload_json TEXT NOT NULL,\n      created_at TEXT NOT NULL\n    , sequence INTEGER)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_sessions (\n      thread_id TEXT PRIMARY KEY,\n      status TEXT NOT NULL,\n      provider_name TEXT,\n      provider_session_id TEXT,\n      provider_thread_id TEXT,\n      active_turn_id TEXT,\n      last_error TEXT,\n      updated_at TEXT NOT NULL\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access')",
@@ -116195,7 +116230,8 @@ const postgresUpgradeMigrations = new Map([
 	]],
 	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]],
 	[78, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_bound_at TEXT`]],
-	[79, [`ALTER TABLE command_access_tokens DROP COLUMN IF EXISTS refresh_token`]]
+	[79, [`ALTER TABLE command_access_tokens DROP COLUMN IF EXISTS refresh_token`]],
+	[80, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS wallet TEXT`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -116221,15 +116257,15 @@ const runPostgresMigrations = require_Schema$1.fn("runPostgresMigrations")(funct
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 79) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 79.`));
+		if (currentVersion > 80) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 80.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${79})
+          VALUES (${80})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 79; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 80; version += 1) {
 			const statements = yield* require_Schema$1.sync(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -119058,6 +119094,21 @@ var _079_DropCommandRefreshToken_default = require_Schema$1.gen(function* () {
 	yield* (yield* require_SqlError.SqlClient)`ALTER TABLE command_access_tokens DROP COLUMN refresh_token`;
 });
 //#endregion
+//#region src/persistence/Migrations/080_ProjectionThreadWallet.ts
+/**
+* Stores the wallet the last CMMD kick named on a thread (CMMD#5917), so a
+* turn without one starts on it even after a server restart.
+*/
+var _080_ProjectionThreadWallet_default = require_Schema$1.gen(function* () {
+	const sql = yield* require_SqlError.SqlClient;
+	if (!(yield* sql`
+    PRAGMA table_info(projection_threads)
+  `).some((column) => column.name === "wallet")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN wallet TEXT
+    `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -119473,6 +119524,11 @@ const migrationEntries = [
 		79,
 		"DropCommandRefreshToken",
 		_079_DropCommandRefreshToken_default
+	],
+	[
+		80,
+		"ProjectionThreadWallet",
+		_080_ProjectionThreadWallet_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -152823,6 +152879,15 @@ function canIssueProviderEgressToken() {
 function canIssueApexProviderEgressToken() {
 	return canIssueProviderEgressToken() || canRequestCmmdLocalUserProviderEgressToken();
 }
+/**
+* True on a CMMD cloud runtime that has everything the runtime mint route
+* needs: runtime mode, the control plane URL, the runtime id, a grant token,
+* and the provider proxy URL. `issueProviderEgressCredential` takes the
+* runtime mint path exactly when this holds.
+*
+* Exported for the Claude adapter, which mints Workspace Anthropic egress on
+* such a runtime for a turn stamped with the Workspace wallet (CMMD#5917).
+*/
 function canIssueCmmdRuntimeProviderEgressToken() {
 	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" && Boolean(process.env.FORGE_COMMAND_APP_URL) && Boolean(process.env.FORGE_CMMD_RUNTIME_ID) && Boolean(require_runtimeControlAuthority.runtimeGrantToken()) && Boolean(process.env.FORGE_PROVIDER_PROXY_URL);
 }
@@ -153400,7 +153465,7 @@ const CODEX_SKILLS_LIST_TIMEOUT_MS = 4e3;
 const CODEX_SUBAGENT_TOKEN_USAGE_METHOD = "forge/subagentTokenUsage/updated";
 const CODEX_VERSION_CHECK_TIMEOUT_MS = 15e3;
 const PROVIDER_EGRESS_TOKEN_REFRESH_MS = 1500 * 1e3;
-const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS = 60 * 1e3;
+const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS$1 = 60 * 1e3;
 const INTERRUPT_REQUEST_TIMEOUT_MS = 2e3;
 const ANSI_ESCAPE_CHAR = String.fromCharCode(27);
 const ANSI_ESCAPE_REGEX = new RegExp(`${ANSI_ESCAPE_CHAR}\\[[0-9;]*m`, "g");
@@ -154222,7 +154287,7 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 		if (!context || context.stopping) return;
 		if (context.session.activeTurnId || context.pending.size > 0) {
 			this.emitLifecycleEvent(context, "session/tokenRefreshDeferred", "Workspace provider token refresh deferred until the active Codex turn finishes.");
-			this.scheduleProviderEgressTokenRefresh(context, PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS);
+			this.scheduleProviderEgressTokenRefresh(context, PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS$1);
 			return;
 		}
 		this.emitLifecycleEvent(context, "session/tokenRefreshRequired", "Workspace provider token is nearing expiry; restarting Codex session for recovery.");
@@ -214400,6 +214465,48 @@ function hasConfiguredApexCredential(profiles) {
 	}));
 }
 //#endregion
+//#region src/egress/providerEgressTokenRefresh.ts
+/**
+* How long to wait before restarting a session whose provider egress
+* credential is about to expire.
+*
+* CMMD-Center/CMMD#5917 review: the Workspace Anthropic egress token lives
+* one hour and is minted once, when a Claude session starts. The session
+* itself can run for many turns past that hour through its own prompt
+* queue, so without this the first turn after expiry fails with an opaque
+* 401 instead of an honest refusal. Restarting near expiry mints a fresh
+* token on the next turn instead, the same trade Codex already makes in
+* `codexAppServerManager.ts` (`scheduleProviderEgressTokenRefresh`).
+*
+* Kept in its own module so the delay math is testable without an Effect
+* runtime or a session map.
+*/
+/** Restart this long before the token actually expires. */
+const PROVIDER_EGRESS_TOKEN_REFRESH_MARGIN_MS = 300 * 1e3;
+/**
+* Used when the credential carries no `expiresAt`, or one that fails to
+* parse. Conservative relative to the one-hour token life the review names,
+* so a missing timestamp fails toward an early, harmless restart rather than
+* toward never restarting at all.
+*/
+const PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS = 1500 * 1e3;
+/**
+* How long to wait before checking again when the refresh threshold arrives
+* mid-turn. Matches Codex's `PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS`.
+*/
+const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS = 60 * 1e3;
+/**
+* How long a session should wait, once idle, before restarting to mint a
+* fresh credential. Never negative: a credential that already expired, or
+* expires inside the margin, restarts immediately.
+*/
+function providerEgressTokenRefreshDelayMs(expiresAt, nowMs) {
+	if (!expiresAt) return PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS;
+	const expiresAtMs = Date.parse(expiresAt);
+	if (Number.isNaN(expiresAtMs)) return PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS;
+	return Math.max(0, expiresAtMs - nowMs - PROVIDER_EGRESS_TOKEN_REFRESH_MARGIN_MS);
+}
+//#endregion
 //#region src/provider/claudeCredentialDirectory.ts
 /** Per-account credentials share the existing Claude transcript directory. */
 /** Repoints `.credentials.json` without moving the transcripts. */
@@ -216794,7 +216901,7 @@ function claudeForgeAttributionPrompt() {
 * turn, an API key is, so pointing the variable there would add a second source
 * of truth that a later reader has to rule out.
 */
-function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential, credentialDirectory, selectedSubscription = false) {
+function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential, credentialDirectory, selectedSubscription = false, mintedEgressModel) {
 	if (selectedSubscription) return claudeSubscriptionChildEnv(baseProcessEnv, credentialDirectory, true);
 	const baseEnv = scrubForgeProviderChildEnvSecrets(baseProcessEnv);
 	const effectiveBaseUrl = resolveClaudeQueryBaseUrl(endpointProfile, claudeSettings, providerProxyCredential);
@@ -216808,7 +216915,28 @@ function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, pr
 			CLAUDE_CODE_MAX_RETRIES: "0",
 			API_TIMEOUT_MS: "90000"
 		} : {},
-		...endpointProfile?.disableToolSearch === true ? { ENABLE_TOOL_SEARCH: "false" } : {}
+		...endpointProfile?.disableToolSearch === true ? { ENABLE_TOOL_SEARCH: "false" } : {},
+		...!endpointProfile && providerProxyCredential && mintedEgressModel ? claudeWorkspaceEgressModelPins(mintedEgressModel) : {}
+	};
+}
+/**
+* CMMD's Workspace egress proxy only accepts the model(s) named on the mint
+* request that issued `providerProxyCredential`, and the mint above scopes to
+* one selected model (`forge-provider-egress.routes.ts` `modelScopeError`).
+* Left alone, Claude Code and its subagents still pick their own smaller
+* models for background and Explore-subagent calls, which fall outside that
+* scope and get refused. Pinning every one of those picks to the same model
+* the mint requested keeps the whole session inside it.
+*
+* Only the plain Anthropic egress branch gets these — never an
+* endpoint-profile turn (Apex / DeepSeek / Moonshot), whose upstream model
+* catalog and scoping this does not apply to.
+*/
+function claudeWorkspaceEgressModelPins(model) {
+	return {
+		ANTHROPIC_SMALL_FAST_MODEL: model,
+		ANTHROPIC_DEFAULT_HAIKU_MODEL: model,
+		CLAUDE_CODE_SUBAGENT_MODEL: model
 	};
 }
 function resolveClaudeQueryBaseUrl(endpointProfile, claudeSettings, providerProxyCredential) {
@@ -216912,7 +217040,8 @@ function buildClaudeSessionContext(input) {
 		lastThreadStartedId: void 0,
 		stopped: false,
 		currentApiModelId: input.effectiveApiModelId,
-		currentEffort: input.effectiveEffort
+		currentEffort: input.effectiveEffort,
+		tokenRefreshFiber: void 0
 	};
 }
 function claudeSessionConfiguredConfig(input) {
@@ -217213,8 +217342,34 @@ function shouldUseProviderEgressProxy(profile) {
 	const normalized = profile.baseUrl.toLowerCase();
 	return normalized.includes("apex.cmmd.ai") || normalized.includes("deepseek") || normalized.includes("moonshot");
 }
-function resolveClaudeProviderEgressProvider(profile) {
+/**
+* True for a plain Claude turn (no custom endpoint profile) stamped with the
+* Workspace wallet on a CMMD cloud runtime.
+*
+* That turn has to run through CMMD's metered Workspace egress, because CMMD
+* accepted the wallet choice and enforces it only at mint time and at the
+* proxy. The personal Claude login in the VM is never an acceptable stand-in,
+* so every path below refuses the turn rather than falling back to it
+* (CMMD#5917). Runtime mode alone decides "on a CMMD runtime": a runtime whose
+* mint settings are incomplete still counts, and is refused.
+*/
+function isClaudeWorkspaceWalletTurnOnCmmdRuntime(profile, wallet) {
+	return wallet === "workspace" && !profile?.baseUrl && process.env.FORGE_CMMD_RUNTIME_MODE === "true";
+}
+/**
+* Which egress lane, if any, a Claude session mints a proxy token for.
+*
+* - `apex`: a centrally managed Apex profile, whatever the wallet.
+* - `anthropic` for a Workspace-wallet turn on a CMMD runtime that can mint.
+*   This is a narrow exception to `WORKSPACE_PROVIDER_ACCESS_DISABLED`, which
+*   still governs every other plain Claude turn (CMMD#5917).
+* - `anthropic` through the local-user lane when the shared kill switch is
+*   off. Unchanged, and never reached on a CMMD runtime.
+* - `null` otherwise, which leaves the turn on the personal login.
+*/
+function resolveClaudeProviderEgressProvider(profile, wallet) {
 	if (shouldUseProviderEgressProxy(profile)) return "apex";
+	if (isClaudeWorkspaceWalletTurnOnCmmdRuntime(profile, wallet) && canIssueCmmdRuntimeProviderEgressToken()) return "anthropic";
 	if (!profile?.baseUrl && false);
 	return null;
 }
@@ -218836,6 +218991,9 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		const streamFiber = context.streamFiber;
 		context.streamFiber = void 0;
 		if (streamFiber && streamFiber.pollUnsafe() === void 0) yield* require_Path.interrupt(streamFiber);
+		const tokenRefreshFiber = context.tokenRefreshFiber;
+		context.tokenRefreshFiber = void 0;
+		if (tokenRefreshFiber && tokenRefreshFiber.pollUnsafe() === void 0) yield* require_Path.interrupt(tokenRefreshFiber);
 		try {
 			context.query.close();
 			selectedClaudeCredentialStore(serverConfig.baseDir).release(context.session.threadId);
@@ -218866,6 +219024,35 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		}
 		sessions.delete(context.session.threadId);
 	});
+	/**
+	* Restarts `threadId`'s session near its Workspace Anthropic egress
+	* credential's expiry, once idle (CMMD-Center/CMMD#5917 review). Deferred
+	* rather than run while a turn is active, the same trade
+	* `scheduleProviderEgressTokenRefresh` makes for Codex in
+	* `codexAppServerManager.ts`: interrupting mid-turn would trade a clean
+	* 401 for a broken one.
+	*
+	* A known gap, same as Codex's: a single turn that runs past the
+	* credential's actual expiry still fails mid-turn with a 401. This only
+	* covers the idle-session case.
+	*/
+	const scheduleWorkspaceEgressTokenRefresh = (context, credential, runFork) => {
+		const threadId = context.session.threadId;
+		context.tokenRefreshFiber = runFork(require_Schema$1.gen(function* () {
+			let delayMs = providerEgressTokenRefreshDelayMs(credential.expiresAt, Date.now());
+			while (true) {
+				yield* require_Schema$1.sleep(delayMs);
+				const current = sessions.get(threadId);
+				if (!current || current !== context || current.stopped) return;
+				if (current.turnState) {
+					delayMs = PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS;
+					continue;
+				}
+				yield* stopSessionInternal(current, { emitExitEvent: true });
+				return;
+			}
+		}));
+	};
 	const requireSession = (threadId) => {
 		const context = sessions.get(threadId);
 		if (!context) return require_Schema$1.fail(new ProviderAdapterSessionNotFoundError({
@@ -219060,19 +219247,46 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 		});
 		return (toolName, toolInput, callbackOptions) => runPromise(canUseToolEffect(toolName, toolInput, callbackOptions));
 	};
-	const issueClaudeProviderProxyCredential = require_Schema$1.fn("issueClaudeProviderProxyCredential")(function* (endpointProfile, model, threadId) {
-		const provider = resolveClaudeProviderEgressProvider(endpointProfile);
-		if (!provider) return null;
-		return yield* issueProviderEgressCredential({
+	/**
+	* Mints the egress proxy credential this session runs on, or returns null
+	* when the session runs on the personal login.
+	*
+	* A Workspace-wallet turn on a CMMD runtime never gets null: it either mints
+	* Anthropic egress on a workspace_key receipt or fails here with
+	* CLAUDE_WORKSPACE_EGRESS_REFUSAL, which
+	* stops `startSession` before the child environment is built, so the
+	* personal-login branch of `buildClaudeQueryEnv` is never reached for it.
+	*/
+	const issueClaudeProviderProxyCredential = require_Schema$1.fn("issueClaudeProviderProxyCredential")(function* (endpointProfile, model, threadId, wallet) {
+		const workspaceWalletTurn = isClaudeWorkspaceWalletTurnOnCmmdRuntime(endpointProfile, wallet);
+		const provider = resolveClaudeProviderEgressProvider(endpointProfile, wallet);
+		if (!provider) {
+			if (workspaceWalletTurn) return yield* new ProviderAdapterProcessError({
+				provider: PROVIDER$11,
+				threadId,
+				detail: `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} This runtime is missing the CMMD settings it needs to request one.`
+			});
+			return null;
+		}
+		const credential = yield* issueProviderEgressCredential({
 			provider,
 			model,
 			threadId
-		}).pipe(require_Schema$1.mapError((cause) => new ProviderAdapterProcessError({
+		}).pipe(require_Schema$1.mapError((cause) => {
+			const reason = toMessage(cause, "Failed to issue provider proxy token.");
+			return new ProviderAdapterProcessError({
+				provider: PROVIDER$11,
+				threadId,
+				detail: workspaceWalletTurn && provider === "anthropic" ? `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} ${reason}` : reason,
+				cause
+			});
+		}));
+		if (workspaceWalletTurn && provider === "anthropic" && credential.deliveryReceipt?.identity.kind !== "workspace_key") return yield* new ProviderAdapterProcessError({
 			provider: PROVIDER$11,
 			threadId,
-			detail: toMessage(cause, "Failed to issue provider proxy token."),
-			cause
-		})));
+			detail: `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} CMMD issued a credential that is not a Workspace key.`
+		});
+		return credential;
 	});
 	const createClaudeQueryRuntime = require_Schema$1.fn("createClaudeQueryRuntime")(function* (prompt, queryOptions, threadId) {
 		return yield* require_Schema$1.try_({
@@ -219187,6 +219401,12 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			claudeCredentialDirectory: credentialDirectoryDecision.outcome === "set" ? credentialDirectoryDecision.directory : null
 		};
 	});
+	/**
+	* Starts a Claude SDK session for a thread. The model access it runs on is
+	* decided here, once: a selected account's credential, a minted egress proxy
+	* credential, an endpoint profile, or the personal login. A Workspace-wallet
+	* turn on a CMMD runtime is refused rather than given the personal login.
+	*/
 	const startSession = require_Schema$1.fn("startSession")(function* (input) {
 		const sessionProvider = yield* validateClaudeStartSessionProvider(input.provider);
 		const startedAt = yield* nowIso;
@@ -219275,7 +219495,13 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			operation: "startSession",
 			issue: "The selected Claude account cannot be used with a custom API endpoint. Choose a subscription model."
 		});
-		const providerProxyCredential = selectedAccountIdentity !== null ? null : yield* issueClaudeProviderProxyCredential(modelConfig.endpointProfile, modelConfig.modelSlug ?? modelConfig.effectiveApiModelId ?? "unknown", threadId);
+		if (selectedAccountIdentity !== null && isClaudeWorkspaceWalletTurnOnCmmdRuntime(modelConfig.endpointProfile, input.wallet)) return yield* new ProviderAdapterValidationError({
+			provider: PROVIDER$11,
+			operation: "startSession",
+			issue: "This turn is billed to the Workspace wallet, so it cannot run on a selected personal Claude account. Clear the account choice, or start the task on your own wallet."
+		});
+		const mintedEgressModel = modelConfig.modelSlug ?? modelConfig.effectiveApiModelId ?? "unknown";
+		const providerProxyCredential = selectedAccountIdentity !== null ? null : yield* issueClaudeProviderProxyCredential(modelConfig.endpointProfile, mintedEgressModel, threadId, input.wallet);
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
 		const settings = claudeQuerySettings(modelConfig.thinking, modelConfig.fastMode);
 		const workspacePreflight = input.cwd ? formatWorkspaceEnvironmentPreflightForAgent(runWorkspaceEnvironmentPreflight({ cwd: input.cwd })) : void 0;
@@ -219298,7 +219524,7 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			existingResumeSessionId,
 			newSessionId,
 			canUseTool,
-			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential, claudeCredentialDirectory, selectedAccountIdentity !== null),
+			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential, claudeCredentialDirectory, selectedAccountIdentity !== null, mintedEgressModel),
 			browserManager,
 			threadId,
 			browserToolEnvironmentId,
@@ -219351,6 +219577,7 @@ const makeClaudeAdapter = require_Schema$1.fn("makeClaudeAdapter")(function* (op
 			})
 		});
 		attachClaudeStreamFiber(context$4, runFork);
+		if (providerProxyCredential?.deliveryReceipt?.identity.kind === "workspace_key") scheduleWorkspaceEgressTokenRefresh(context$4, providerProxyCredential, runFork);
 		return { ...session };
 	}, (effect, input) => effect.pipe(require_Schema$1.onExit((exit) => require_Schema$1.sync(() => {
 		if (exit._tag === "Failure") selectedClaudeCredentialStore(serverConfig.baseDir).release(input.threadId);
@@ -233743,6 +233970,11 @@ function toRuntimeStatus(session) {
 		default: return "running";
 	}
 }
+/**
+* The runtime payload persisted beside a session binding. The session directory
+* merges it shallowly into what is already stored, so a key left out here
+* (a later upsert with no wallet, say) keeps its earlier value.
+*/
 function toRuntimePayloadFromSession(session, extra) {
 	return {
 		cwd: session.cwd ?? null,
@@ -233750,6 +233982,7 @@ function toRuntimePayloadFromSession(session, extra) {
 		activeTurnId: session.activeTurnId ?? null,
 		lastError: session.lastError ?? null,
 		...extra?.modelSelection !== void 0 ? { modelSelection: extra.modelSelection } : {},
+		...extra?.wallet !== void 0 ? { wallet: extra.wallet } : {},
 		...extra?.lastRuntimeEvent !== void 0 ? { lastRuntimeEvent: extra.lastRuntimeEvent } : {},
 		...extra?.lastRuntimeEventAt !== void 0 ? { lastRuntimeEventAt: extra.lastRuntimeEventAt } : {}
 	};
@@ -233759,6 +233992,34 @@ function readPersistedModelSelection(runtimePayload) {
 	const raw = "modelSelection" in runtimePayload ? runtimePayload.modelSelection : void 0;
 	return require_Schema$1.is(ModelSelection)(raw) ? raw : void 0;
 }
+/**
+* The wallet the thread's provider session last started with, read back from
+* the persisted runtime payload (CMMD#5917).
+*
+* Only a CMMD kick names a wallet. Every other start (a person's follow-up
+* that changes the model, a recovery after the adapter lost the session)
+* reuses this one, so a thread billed to the Workspace wallet does not drop to
+* the personal login the first time its session restarts. Undefined when no
+* kick ever named one, which keeps today's behavior.
+*/
+const isWorkSessionWallet = require_Schema$1.is(WorkSessionWallet);
+function readPersistedWallet(runtimePayload) {
+	if (!runtimePayload || typeof runtimePayload !== "object" || Array.isArray(runtimePayload)) return;
+	const raw = "wallet" in runtimePayload ? runtimePayload.wallet : void 0;
+	return isWorkSessionWallet(raw) ? raw : void 0;
+}
+/**
+* The wallet a new session starts on: the one the kick named, else the one the
+* thread's session last ran with, whatever provider that was, because the
+* wallet belongs to the Work Session and not to the provider (CMMD#5917).
+*/
+function resolveStartSessionWallet(requested, persistedBinding) {
+	return requested ?? readPersistedWallet(persistedBinding?.runtimePayload);
+}
+/** `{ wallet }` when one is known, an empty object otherwise (exactOptionalPropertyTypes). */
+function walletField$1(wallet) {
+	return wallet === void 0 ? {} : { wallet };
+}
 function readProviderAccountIdFromModelSelection(modelSelection) {
 	if (!modelSelection) return void 0;
 	switch (modelSelection.provider) {
@@ -233793,12 +234054,18 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 	const withSessionLock = (threadId, effect) => require_Path.get$1(sessionLocks, threadId).pipe(require_Schema$1.flatMap((lock) => lock.withPermit(effect)), require_Schema$1.scoped);
 	const runtimeEventPubSub = yield* require_Path.unbounded$1();
 	const assertProviderExecutable = options?.assertProviderExecutable ?? (() => require_Schema$1.succeed(null));
+	/**
+	* Re-runs the readiness guard for an existing session before a turn or a
+	* continuation, with the account and wallet the session was started on, and
+	* refuses if the delivered identity drifted from the persisted one.
+	*/
 	const assertCurrentProviderDelivery = require_Schema$1.fn("assertCurrentProviderDelivery")(function* (input) {
 		const persistedBinding = require_Schema$1.getOrUndefined$1(yield* directory.getBinding(input.threadId));
 		const providerAccountId = readPersistedProviderAccountId(persistedBinding?.runtimePayload);
 		const currentBinding = yield* assertProviderExecutable({
 			...input,
-			...selectedAccountGuardFields(providerAccountId)
+			...selectedAccountGuardFields(providerAccountId),
+			...walletField$1(readPersistedWallet(persistedBinding?.runtimePayload))
 		});
 		if (!currentBinding) return;
 		if (!persistedBinding || persistedBinding.provider !== input.provider) return yield* toValidationError(input.operation, `Cannot verify the delivered provider identity for thread '${input.threadId}'.`);
@@ -233814,6 +234081,11 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 		return yield* toValidationError(input.operation, `Thread '${input.threadId}' is bound to provider account '${input.persistedAccountId}' and cannot use provider account '${input.requestedAccountId}'.`);
 	});
 	const publishRuntimeEvent = (event) => require_Schema$1.succeed(event).pipe(require_Schema$1.tap((canonicalEvent) => canonicalEventLogger ? canonicalEventLogger.write(canonicalEvent, null) : require_Schema$1.void_), require_Schema$1.flatMap((canonicalEvent) => require_Path.publish(runtimeEventPubSub, canonicalEvent)), require_Schema$1.asVoid);
+	/**
+	* Writes the thread's session binding. `extra` carries what only a start
+	* knows, the model selection and the wallet, so a later runtime-event upsert
+	* that omits them leaves the stored values in place.
+	*/
 	const upsertSessionBinding = (session, threadId, extra) => directory.upsert({
 		threadId,
 		provider: session.provider,
@@ -233829,6 +234101,11 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 		eventType: event.type
 	}).pipe(require_Schema$1.andThen(publishRuntimeEvent(event)));
 	yield* require_Schema$1.forEach(adapters, (adapter) => require_Path.runForEach(adapter.streamEvents, processRuntimeEvent).pipe(require_Schema$1.forkScoped)).pipe(require_Schema$1.asVoid);
+	/**
+	* Restarts a session the adapter lost, from the persisted binding alone: cwd,
+	* model selection, wallet and resume cursor. It has no read model, so what
+	* the binding stored is all it can go on.
+	*/
 	const recoverSessionForThread = require_Schema$1.fn("recoverSessionForThread")(function* (input) {
 		yield* require_Schema$1.annotateCurrentSpan({
 			"provider.operation": "recover-session",
@@ -233857,11 +234134,13 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 			const persistedCwd = readPersistedCwd(input.binding.runtimePayload);
 			const persistedModelSelection = readPersistedModelSelection(input.binding.runtimePayload);
 			const persistedProviderAccountId = readProviderAccountIdFromModelSelection(persistedModelSelection);
+			const persistedWallet = readPersistedWallet(input.binding.runtimePayload);
 			const currentDeliveryBinding = yield* assertProviderExecutable({
 				threadId: input.binding.threadId,
 				provider: input.binding.provider,
 				operation: input.operation,
-				...selectedAccountGuardFields(persistedProviderAccountId)
+				...selectedAccountGuardFields(persistedProviderAccountId),
+				...walletField$1(persistedWallet)
 			});
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: input.operation,
@@ -233875,7 +234154,8 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 				...persistedCwd ? { cwd: persistedCwd } : {},
 				...persistedModelSelection ? { modelSelection: persistedModelSelection } : {},
 				...hasResumeCursor ? { resumeCursor: boundResumeCursor } : {},
-				runtimeMode: input.binding.runtimeMode ?? "full-access"
+				runtimeMode: input.binding.runtimeMode ?? "full-access",
+				...walletField$1(persistedWallet)
 			});
 			if (resumed.provider !== adapter.provider) return yield* toValidationError(input.operation, `Adapter/provider mismatch while recovering thread '${input.binding.threadId}'. Expected '${adapter.provider}', received '${resumed.provider}'.`);
 			yield* upsertSessionBinding(resumed, input.binding.threadId);
@@ -233948,6 +234228,11 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 			isActive: true
 		};
 	});
+	/**
+	* Starts a provider session for a thread: decodes the input, resolves the
+	* provider, guards account and delivery identity, resolves the wallet, then
+	* persists the binding the adapter returns.
+	*/
 	const startSession = require_Schema$1.fn("startSession")(function* (threadId, rawInput) {
 		const parsed = yield* decodeInputOrValidationError({
 			operation: "ProviderService.startSession",
@@ -233980,24 +234265,31 @@ const makeProviderService = require_Schema$1.fn("makeProviderService")(function*
 				persistedAccountId: priorAccountId,
 				requestedAccountId
 			});
+			const effectiveResumeCursor = input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0);
+			const effectiveWallet = resolveStartSessionWallet(input.wallet, persistedBinding);
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: "ProviderService.startSession",
 				provider: effectiveProvider,
-				resumeCursor: input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0),
+				resumeCursor: effectiveResumeCursor,
 				currentBinding: yield* assertProviderExecutable({
 					threadId,
 					provider: effectiveProvider,
 					operation: "ProviderService.startSession",
-					...selectedAccountGuardFields(requestedAccountId)
+					...selectedAccountGuardFields(requestedAccountId),
+					...walletField$1(effectiveWallet)
 				})
 			});
 			const session = yield* adapter.startSession({
 				...input,
 				accountTransition: explicitProviderAccountTransition(priorAccountId, requestedAccountId),
-				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {}
+				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {},
+				...walletField$1(effectiveWallet)
 			});
 			if (session.provider !== adapter.provider) return yield* toValidationError("ProviderService.startSession", `Adapter/provider mismatch: requested '${adapter.provider}', received '${session.provider}'.`);
-			yield* upsertSessionBinding(session, threadId, { modelSelection: input.modelSelection });
+			yield* upsertSessionBinding(session, threadId, {
+				modelSelection: input.modelSelection,
+				...walletField$1(effectiveWallet)
+			});
 			yield* analytics.record("provider.session.started", {
 				provider: session.provider,
 				runtimeMode: input.runtimeMode,
@@ -234799,8 +235091,13 @@ function makeClaudeRuntimeReadinessGuard(config, dependencies) {
 	};
 	return (input) => claudeReadinessGuardEffect(config, dependencies, resolved, input);
 }
+/**
+* One guard run: skip when the turn needs no delivered Claude credential,
+* prepare a selected account's credential when one is named, otherwise verify
+* the owner's native runtime generation against CMMD.
+*/
 function claudeReadinessGuardEffect(config, dependencies, resolved, input) {
-	if (!requiresNativeClaudeReadiness(config, input.provider, input.providerAccountId)) return require_Schema$1.succeed(null);
+	if (!requiresNativeClaudeReadiness(config, input.provider, input.providerAccountId, input.wallet)) return require_Schema$1.succeed(null);
 	if (input.providerAccountId !== void 0) {
 		const prepareSelectedCredential = dependencies.prepareSelectedCredential ?? makeClaudeSelectedCredentialPreparer(config, {
 			resolveJwt: dependencies.resolveJwt,
@@ -234823,9 +235120,21 @@ function claudeReadinessGuardEffect(config, dependencies, resolved, input) {
 		catch: (cause) => readinessValidationError(input.operation, cause)
 	});
 }
-function requiresNativeClaudeReadiness(config, provider, providerAccountId) {
+/**
+* Whether this turn runs on a Claude credential delivered into the VM, and so
+* has to prove that credential is the one CMMD applied before it runs.
+*
+* A turn billed to the Workspace wallet with no selected account does not: the
+* Claude adapter runs it on CMMD's metered egress and refuses it when CMMD
+* will not mint (CMMD#5917). Checking the owner's personal login there would
+* refuse a Workspace turn for a personal credential it never uses. A selected
+* account still goes through its own preparation, and the adapter then refuses
+* the Workspace-plus-account combination.
+*/
+function requiresNativeClaudeReadiness(config, provider, providerAccountId, wallet) {
 	if (provider !== "claudeAgent" || config.forgeCmmdRuntimeMode !== true) return false;
-	return providerAccountId !== void 0 || personalClaudeInVmEnabled();
+	if (providerAccountId !== void 0) return true;
+	return wallet !== "workspace" && personalClaudeInVmEnabled();
 }
 function resolveGuardAuthority(config, readSessionId, input) {
 	const runtimeId = config.forgeCmmdRuntimeId?.trim();
@@ -288800,6 +289109,7 @@ const ProjectionThread = require_Schema$1.Struct({
 	anchorCmmdId: require_Schema$1.NullOr(require_Schema$1.String).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
 	workSessionId: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
 	workSessionBoundAt: require_Schema$1.optionalKey(require_Schema$1.NullOr(require_Schema$1.String)),
+	wallet: require_Schema$1.optionalKey(require_Schema$1.NullOr(WorkSessionWallet)),
 	linkedPullRequest: require_Schema$1.optionalKey(require_Schema$1.NullOr(LinkedPullRequest)),
 	status: ThreadStatus.pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed("idle"))),
 	workerRole: require_Schema$1.NullOr(WorkerRole).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed(null))),
@@ -293301,6 +293611,18 @@ function publicProviderFailureDetailFromCause(cause) {
 	const error = require_Schema$1.squash(cause);
 	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(require_Schema$1.pretty(cause));
 }
+/**
+* The wallet a session start asks for: the one on the turn-start event, which
+* the decider stamps at acceptance, else the one persisted on the thread row,
+* for older events and starts not driven by a turn (CMMD#5917). The decider writes the kick's
+* wallet to the thread before this reactor sees the turn, and the row
+* survives a restart, so a turn refused before any session start, or a
+* person's follow-up after a restart, still starts on the kick's wallet.
+* Undefined when no kick ever named one.
+*/
+function resolveRequestedWallet(kickWallet, threadWallet) {
+	return kickWallet ?? threadWallet ?? void 0;
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -293621,6 +293943,16 @@ const make$7 = require_Schema$1.gen(function* () {
 	* detect the mismatch and restart, dropping A's cached token (forge#3597).
 	*/
 	const threadSessionWorkSessionIds = /* @__PURE__ */ new Map();
+	/**
+	* The wallet each LIVE provider session was started with, or null when the
+	* start carried none (CMMD#5917).
+	*
+	* The Claude adapter reads the wallet once, at session start, to decide
+	* whether the session runs on CMMD's Workspace egress or the personal
+	* login. A kick naming a different wallet than the live session's has to
+	* restart it, or the new wallet's turn runs on the old session's credential.
+	*/
+	const threadSessionWallets = /* @__PURE__ */ new Map();
 	const appendProviderFailureActivity = (input) => orchestrationEngine.dispatch({
 		type: "thread.activity.append",
 		commandId: serverCommandId$2("provider-failure-activity"),
@@ -293666,10 +293998,16 @@ const make$7 = require_Schema$1.gen(function* () {
 		if (thread.anchorKind === "task" && project?.repositoryIdentity == null && !isGitWorkspace(cwd)) return "Forge created this task thread, but the project folder is not a Git repository yet. Import or link the repository before starting an agent turn.";
 		return null;
 	});
+	/**
+	* Returns the thread id of a live provider session for the thread, starting
+	* one, or restarting the live one when its provider, model, account, Work
+	* Session or wallet no longer matches what this turn asks for.
+	*/
 	const ensureSessionForThread = require_Schema$1.fn("ensureSessionForThread")(function* (threadId, createdAt, options) {
 		const readModel = yield* orchestrationEngine.getReadModel();
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
+		const requestedWallet = resolveRequestedWallet(options?.wallet, thread.wallet);
 		const desiredRuntimeMode = thread.runtimeMode;
 		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const requestedModelSelection = options?.modelSelection;
@@ -293686,10 +294024,12 @@ const make$7 = require_Schema$1.gen(function* () {
 			...effectiveCwd ? { cwd: effectiveCwd } : {},
 			modelSelection: desiredModelSelection,
 			...input?.resumeCursor !== void 0 ? { resumeCursor: input.resumeCursor } : {},
-			runtimeMode: desiredRuntimeMode
+			runtimeMode: desiredRuntimeMode,
+			...requestedWallet !== void 0 ? { wallet: requestedWallet } : {}
 		}), () => require_Schema$1.sync(() => {
 			threadSessionAccountIds.set(threadId, readProviderAccountId(desiredModelSelection));
 			threadSessionWorkSessionIds.set(threadId, thread.workSessionId ?? null);
+			threadSessionWallets.set(threadId, requestedWallet ?? threadSessionWallets.get(threadId) ?? null);
 		}));
 		const bindSessionToThread = (session) => setThreadSession({
 			threadId,
@@ -293739,7 +294079,15 @@ const make$7 = require_Schema$1.gen(function* () {
 			const currentWorkSessionId = thread.workSessionId ?? null;
 			const sessionWorkSessionId = threadSessionWorkSessionIds.get(threadId);
 			const shouldRestartForWorkSessionChange = threadSessionWorkSessionIds.has(threadId) && sessionWorkSessionId !== currentWorkSessionId;
-			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange && !shouldRestartForWorkSessionChange) return existingSessionThreadId;
+			/**
+			* A kick that names a wallet other than the one the live session started
+			* with restarts it, so the Claude adapter re-decides its egress from the
+			* new wallet (CMMD#5917). A live session this reactor did not start has
+			* no recorded wallet and restarts too, which costs a resume and never
+			* leaves a Workspace turn on a personal session.
+			*/
+			const shouldRestartForWalletChange = requestedWallet !== void 0 && threadSessionWallets.get(threadId) !== requestedWallet;
+			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange && !shouldRestartForWorkSessionChange && !shouldRestartForWalletChange) return existingSessionThreadId;
 			const resumeCursor = providerChanged || shouldRestartForModelChange ? void 0 : activeSession?.resumeCursor ?? void 0;
 			yield* require_Schema$1.logInfo("provider command reactor restarting provider session", {
 				threadId,
@@ -293755,9 +294103,10 @@ const make$7 = require_Schema$1.gen(function* () {
 				shouldRestartForModelSelectionChange,
 				shouldRestartForAccountChange,
 				shouldRestartForWorkSessionChange,
+				shouldRestartForWalletChange,
 				hasResumeCursor: resumeCursor !== void 0
 			});
-			if (shouldRestartForAccountChange || shouldRestartForWorkSessionChange || providerChanged) yield* providerService.stopSession({
+			if (shouldRestartForAccountChange || shouldRestartForWorkSessionChange || shouldRestartForWalletChange || providerChanged) yield* providerService.stopSession({
 				threadId,
 				preserveResumeState: true
 			});
@@ -293857,6 +294206,11 @@ const make$7 = require_Schema$1.gen(function* () {
 		turnId: input.turnId,
 		cause: require_Schema$1.pretty(cause)
 	})), require_Schema$1.onInterrupt(() => releaseTurnStart(input.holdKey)), require_Schema$1.ensuring(closeTurnStartEventBuffer(input.holdKey, input.events)));
+	/**
+	* Ensures a session with the turn's model and wallet, then sends the turn.
+	* A session-start failure (a refused Workspace egress mint, for one)
+	* propagates to the caller, which records it on the thread.
+	*/
 	const sendTurnForThread = require_Schema$1.fn("sendTurnForThread")(function* (input) {
 		const thread = yield* resolveThread(input.threadId);
 		if (!thread) return { _tag: "skipped" };
@@ -293871,7 +294225,10 @@ const make$7 = require_Schema$1.gen(function* () {
 			});
 			return { _tag: "skipped" };
 		}
-		yield* ensureSessionForThread(input.threadId, input.createdAt, input.modelSelection !== void 0 ? { modelSelection: input.modelSelection } : {});
+		yield* ensureSessionForThread(input.threadId, input.createdAt, {
+			...input.modelSelection !== void 0 ? { modelSelection: input.modelSelection } : {},
+			...input.wallet !== void 0 ? { wallet: input.wallet } : {}
+		});
 		if (input.modelSelection !== void 0) threadModelSelections.set(input.threadId, input.modelSelection);
 		const cmmdTaskId = thread.anchorKind === "task" ? thread.anchorCmmdId : null;
 		const cmmdCwd = resolveThreadWorkspaceCwd({
@@ -294084,6 +294441,11 @@ const make$7 = require_Schema$1.gen(function* () {
 			...result.title !== void 0 ? { title: result.title } : {}
 		});
 	});
+	/**
+	* Handles one `thread.turn-start-requested` event: validates the workspace,
+	* forks first-turn title and branch generation, then sends the turn with the
+	* event's model selection and wallet and records any failure on the thread.
+	*/
 	const processTurnStartRequested = require_Schema$1.fn("processTurnStartRequested")(function* (event) {
 		const key = turnStartKeyForEvent(event);
 		if (yield* hasHandledTurnStartRecently(key)) return;
@@ -294147,7 +294509,8 @@ const make$7 = require_Schema$1.gen(function* () {
 				...message.attachments !== void 0 ? { attachments: message.attachments } : {},
 				...event.payload.modelSelection !== void 0 ? { modelSelection: event.payload.modelSelection } : {},
 				interactionMode: event.payload.interactionMode,
-				createdAt: event.payload.createdAt
+				createdAt: event.payload.createdAt,
+				...event.payload.wallet !== void 0 ? { wallet: event.payload.wallet } : {}
 			}),
 			close: closeTurnStartEventBuffer(turnStartHoldKey, turnStartEvents),
 			onFailure: (cause) => appendProviderFailureActivity({
@@ -300333,7 +300696,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ba1d9d7ef5237a6a7d52a06b10c4d15f8cff00b8";
+	return "5716c4b70da370f76d24ac48e65aafc1819dd6c1";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -304036,6 +304399,23 @@ function resolveThreadCommandAnchor(input) {
 		anchorCmmdId: null
 	};
 }
+/**
+* `{ wallet }` when a kick names a wallet other than the thread's, otherwise
+* null. Kept out of the decider body so its complexity budget does not grow
+* (CMMD#5917).
+*/
+function turnWalletUpdate(current, requested) {
+	return requested !== void 0 && requested !== current ? { wallet: requested } : null;
+}
+/**
+* `{ wallet }` for a turn-start event: the kick's wallet, else the thread's
+* wallet at acceptance, else nothing, which leaves an older-style event the
+* reactor falls back on thread state for (CMMD#5917).
+*/
+function turnStartWallet(requested, current) {
+	const wallet = requested ?? current ?? void 0;
+	return wallet === void 0 ? {} : { wallet };
+}
 const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationCommand")(function* ({ command, readModel }) {
 	switch (command.type) {
 		case "project.create":
@@ -304198,6 +304578,7 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 					anchorCmmdId: anchor.anchorCmmdId,
 					workSessionId: command.workSessionId ?? null,
 					...command.workSessionId != null ? { workSessionBoundAt: command.createdAt } : {},
+					...command.wallet !== void 0 ? { wallet: command.wallet } : {},
 					goal: command.goal ?? null,
 					linkedPullRequest: command.linkedPullRequest ?? null,
 					kind,
@@ -304440,6 +304821,9 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 				command,
 				threadId: command.threadId
 			});
+			const isClientOriginTurnStart = command.workSessionId === void 0 || command.workSessionId === null;
+			const threadHasWorkSession = targetThread.workSessionId !== void 0 && targetThread.workSessionId !== null;
+			const authorizedWalletOverride = isClientOriginTurnStart && threadHasWorkSession ? void 0 : command.wallet;
 			const nextAnchor = command.anchorKind !== void 0 || command.anchorCmmdId !== void 0 || command.cmmdTaskId !== void 0 ? resolveThreadCommandAnchor({
 				anchorKind: command.anchorKind,
 				anchorCmmdId: command.anchorCmmdId,
@@ -304500,6 +304884,7 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 					runtimeMode: targetThread.runtimeMode,
 					interactionMode: targetThread.interactionMode,
 					...sourceProposedPlan !== void 0 ? { sourceProposedPlan } : {},
+					...turnStartWallet(authorizedWalletOverride, targetThread.wallet),
 					createdAt: command.createdAt
 				}
 			};
@@ -304513,7 +304898,8 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 			});
 			const shouldRebindWorkSession = command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId;
 			const shouldAdvanceBoundTimestamp = !shouldRebindWorkSession && command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId === targetThread.workSessionId && (targetThread.workSessionBoundAt === null || targetThread.workSessionBoundAt === void 0 || command.createdAt > targetThread.workSessionBoundAt);
-			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession && !shouldAdvanceBoundTimestamp) return [userMessageEvent, turnStartRequestedEvent];
+			const walletUpdate = turnWalletUpdate(targetThread.wallet, authorizedWalletOverride);
+			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession && !shouldAdvanceBoundTimestamp && !walletUpdate) return [userMessageEvent, turnStartRequestedEvent];
 			return [
 				{
 					...withEventBase({
@@ -304532,6 +304918,7 @@ const decideOrchestrationCommand = require_Schema$1.fn("decideOrchestrationComma
 							workSessionId: command.workSessionId,
 							workSessionBoundAt: command.createdAt
 						} : shouldAdvanceBoundTimestamp ? { workSessionBoundAt: command.createdAt } : {},
+						...walletUpdate,
 						updatedAt: command.createdAt
 					}
 				},
@@ -305103,6 +305490,7 @@ function projectEvent(model, event) {
 				anchorCmmdId: payload.anchorCmmdId,
 				workSessionId: payload.workSessionId ?? null,
 				workSessionBoundAt: payload.workSessionBoundAt ?? null,
+				wallet: payload.wallet ?? null,
 				goal: payload.goal ?? null,
 				linkedPullRequest: payload.linkedPullRequest ?? null,
 				titleRegeneration: null,
@@ -305185,6 +305573,7 @@ function projectEvent(model, event) {
 				...payload.titleRegeneration !== void 0 ? { titleRegeneration: payload.titleRegeneration } : {},
 				...payload.workSessionId !== void 0 ? { workSessionId: payload.workSessionId } : {},
 				...payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: payload.workSessionBoundAt } : {},
+				...payload.wallet !== void 0 ? { wallet: payload.wallet } : {},
 				updatedAt: payload.updatedAt
 			})
 		})));
@@ -306220,6 +306609,14 @@ const ProjectionThreadDbRow = ProjectionThread.mapFields(require_Schema$1.assign
 	rateLimitStatus: require_Schema$1.fromJsonString(require_Schema$1.ArraySchema(ThreadProviderRateLimitStatus)),
 	linkedPullRequest: require_Schema$1.NullOr(require_Schema$1.fromJsonString(LinkedPullRequest))
 }));
+/**
+* The `wallet` column value: the row's wallet, or SQL null when it has none.
+* Module-level so the upsert's own complexity budget does not grow
+* (CMMD#5917).
+*/
+function walletColumn(wallet) {
+	return wallet ?? null;
+}
 const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
 	const upsertProjectionThreadRow = void_({
@@ -306251,6 +306648,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           anchor_cmmd_id,
           work_session_id,
           work_session_bound_at,
+          wallet,
           linked_pull_request_json,
           status,
           worker_role,
@@ -306285,6 +306683,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           ${row.anchorCmmdId},
           ${row.workSessionId ?? null},
           ${row.workSessionBoundAt ?? null},
+          ${walletColumn(row.wallet)},
           ${row.linkedPullRequest == null ? null : JSON.stringify(row.linkedPullRequest)},
           ${row.status},
           ${row.workerRole},
@@ -306319,6 +306718,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           anchor_cmmd_id = excluded.anchor_cmmd_id,
           work_session_id = excluded.work_session_id,
           work_session_bound_at = excluded.work_session_bound_at,
+          wallet = excluded.wallet,
           linked_pull_request_json = excluded.linked_pull_request_json,
           status = excluded.status,
           worker_role = excluded.worker_role,
@@ -306358,6 +306758,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306399,6 +306800,7 @@ const makeProjectionThreadRepository = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -306589,6 +306991,13 @@ function collectThreadUserInputAttachmentRelativePaths(threadId, events) {
 function projectedWorkSessionId(workSessionId) {
 	return workSessionId ?? null;
 }
+/**
+* Coalesces an optional wallet to the persisted default, top-level for the
+* same complexity reason as `projectedWorkSessionId` (CMMD#5917).
+*/
+function projectedWallet(wallet) {
+	return wallet ?? null;
+}
 const runAttachmentSideEffects = require_Schema$1.fn("runAttachmentSideEffects")(function* (sideEffects) {
 	const serverConfig = yield* require_Schema$1.service(ServerConfig);
 	const fileSystem = yield* require_Schema$1.service(require_Path.FileSystem);
@@ -306756,6 +307165,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					anchorCmmdId: event.payload.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(event.payload.workSessionId),
 					workSessionBoundAt: event.payload.workSessionBoundAt ?? null,
+					wallet: projectedWallet(event.payload.wallet),
 					linkedPullRequest: event.payload.linkedPullRequest ?? null,
 					status: event.payload.status,
 					workerRole: event.payload.workerRole,
@@ -306796,6 +307206,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					anchorCmmdId: thread.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(thread.workSessionId),
 					workSessionBoundAt: thread.workSessionBoundAt ?? null,
+					wallet: projectedWallet(thread.wallet),
 					linkedPullRequest: thread.linkedPullRequest ?? null,
 					status: thread.status,
 					workerRole: thread.workerRole,
@@ -306866,6 +307277,7 @@ const makeOrchestrationProjectionPipeline = require_Schema$1.fn("makeOrchestrati
 					...event.payload.titleRegeneration !== void 0 ? { titleRegeneration: event.payload.titleRegeneration } : {},
 					...event.payload.workSessionId !== void 0 ? { workSessionId: projectedWorkSessionId(event.payload.workSessionId) } : {},
 					...event.payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: event.payload.workSessionBoundAt } : {},
+					...event.payload.wallet !== void 0 ? { wallet: event.payload.wallet } : {},
 					updatedAt: event.payload.updatedAt
 				});
 				return;
@@ -307883,6 +308295,13 @@ function workSessionIdField(workSessionId) {
 function workSessionBoundAtField(workSessionBoundAt) {
 	return workSessionBoundAt !== void 0 ? { workSessionBoundAt } : {};
 }
+/**
+* `{ wallet }` when the row carries one, an empty object when absent. Mirrors
+* `workSessionIdField` so `exactOptionalPropertyTypes` is satisfied (CMMD#5917).
+*/
+function walletField(wallet) {
+	return wallet !== void 0 ? { wallet } : {};
+}
 const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 	const sql = yield* require_SqlError.SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
@@ -307937,6 +308356,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307977,6 +308397,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -308083,6 +308504,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -308417,6 +308839,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -308731,6 +309154,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 			anchorCmmdId: row.anchorCmmdId,
 			...workSessionIdField(row.workSessionId),
 			...workSessionBoundAtField(row.workSessionBoundAt),
+			...walletField(row.wallet),
 			linkedPullRequest: row.linkedPullRequest,
 			kind: row.kind,
 			parentThreadId: row.parentThreadId,
@@ -308982,6 +309406,7 @@ const makeProjectionSnapshotQuery = require_Schema$1.gen(function* () {
 			anchorCmmdId: threadRow.value.anchorCmmdId,
 			...workSessionIdField(threadRow.value.workSessionId),
 			...workSessionBoundAtField(threadRow.value.workSessionBoundAt),
+			...walletField(threadRow.value.wallet),
 			linkedPullRequest: threadRow.value.linkedPullRequest,
 			kind: threadRow.value.kind,
 			parentThreadId: threadRow.value.parentThreadId,