@cmmd-center/forge 0.13.134 → 0.13.136

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -17438,6 +17438,22 @@ const RuntimeMode$1 = Literals([
 	"full-access"
 ]);
 const DEFAULT_RUNTIME_MODE$2 = "full-access";
+/**
+* Which wallet pays for a CMMD Work Session's provider usage. The values
+* match CMMD's `forgeWorkSessionWallets` in `shared/schema/forge-work-sessions.ts`.
+*
+* CMMD stamps it on the kick `thread.turn.start` (CMMD#5917). An absent value
+* means the turn carries no wallet claim, which Forge treats the way it
+* treated every turn before the field existed: on the personal login. On a
+* CMMD cloud runtime a `workspace` Claude turn must run through CMMD's metered
+* egress and is refused if CMMD will not mint for it. It never falls back to
+* the personal login in the VM.
+*/
+const WorkSessionWallet = Literals([
+	"personal",
+	"workspace",
+	"byok"
+]);
 const ProviderInteractionMode = Literals(["default", "plan"]);
 const DEFAULT_PROVIDER_INTERACTION_MODE = "default";
 const ProviderRequestKind = Literals([
@@ -17795,6 +17811,7 @@ const OrchestrationThread = Struct({
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
 	workSessionBoundAt: optionalKey(NullOr(String$1)),
+	wallet: optionalKey(NullOr(WorkSessionWallet)),
 	pendingAutoCreatePrompt: optional$4(NullOr(AutoCreateTaskPrompt)).pipe(withDecodingDefault(succeed(null))),
 	goal: NullOr(TrimmedNonEmptyString).pipe(withDecodingDefault(succeed(null))),
 	titleRegeneration: NullOr(ThreadTitleRegeneration).pipe(withDecodingDefault(succeed(null))),
@@ -17965,6 +17982,7 @@ const ThreadCreateCommand = Struct({
 	anchorKind: optional$4(CmmdAnchorKind),
 	anchorCmmdId: optional$4(NullOr(String$1)),
 	workSessionId: optional$4(NullOr(CommandWorkSessionId)),
+	wallet: optional$4(WorkSessionWallet),
 	goal: optional$4(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optional$4(NullOr(LinkedPullRequest)),
 	kind: optional$4(ThreadKind),
@@ -18075,7 +18093,8 @@ const ThreadTurnStartCommand = Struct({
 	kind: optional$4(ThreadKind),
 	parentThreadId: optional$4(NullOr(ThreadId)),
 	createdAt: IsoDateTime,
-	workSessionId: optional$4(NullOr(CommandWorkSessionId))
+	workSessionId: optional$4(NullOr(CommandWorkSessionId)),
+	wallet: optional$4(WorkSessionWallet)
 });
 const ClientThreadTurnStartCommand = Struct({
 	type: Literal("thread.turn.start"),
@@ -18099,7 +18118,8 @@ const ClientThreadTurnStartCommand = Struct({
 	kind: optional$4(ThreadKind),
 	parentThreadId: optional$4(NullOr(ThreadId)),
 	createdAt: IsoDateTime,
-	workSessionId: optional$4(NullOr(CommandWorkSessionId))
+	workSessionId: optional$4(NullOr(CommandWorkSessionId)),
+	wallet: optional$4(WorkSessionWallet)
 });
 const ThreadTurnInterruptCommand = Struct({
 	type: Literal("thread.turn.interrupt"),
@@ -18377,6 +18397,7 @@ const ThreadCreatedPayload$1 = Struct({
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
 	workSessionBoundAt: optionalKey(NullOr(String$1)),
+	wallet: optionalKey(NullOr(WorkSessionWallet)),
 	goal: optionalKey(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	kind: ThreadKind.pipe(withDecodingDefault(succeed("master"))),
@@ -18420,6 +18441,7 @@ const ThreadMetaUpdatedPayload$1 = Struct({
 	workerRole: optional$4(NullOr(WorkerRole)),
 	workSessionId: optional$4(NullOr(String$1)),
 	workSessionBoundAt: optional$4(String$1),
+	wallet: optional$4(WorkSessionWallet),
 	goal: optional$4(NullOr(TrimmedNonEmptyString)),
 	linkedPullRequest: optional$4(NullOr(LinkedPullRequest)),
 	regenerateTitle: optional$4(Literal(true)),
@@ -18456,6 +18478,7 @@ const ThreadTurnStartRequestedPayload = Struct({
 	runtimeMode: RuntimeMode$1.pipe(withDecodingDefault(succeed(DEFAULT_RUNTIME_MODE$2))),
 	interactionMode: ProviderInteractionMode.pipe(withDecodingDefault(succeed(DEFAULT_PROVIDER_INTERACTION_MODE))),
 	sourceProposedPlan: optional$4(SourceProposedPlanReference),
+	wallet: optional$4(WorkSessionWallet),
 	createdAt: IsoDateTime
 });
 const ThreadTurnInterruptRequestedPayload = Struct({
@@ -20921,7 +20944,8 @@ const ProviderSessionStartInput = Struct({
 	resumeCursor: optional$4(Unknown),
 	approvalPolicy: optional$4(ProviderApprovalPolicy),
 	sandboxMode: optional$4(ProviderSandboxMode),
-	runtimeMode: RuntimeMode$1
+	runtimeMode: RuntimeMode$1,
+	wallet: optional$4(WorkSessionWallet)
 });
 const ProviderSendTurnInput = Struct({
 	threadId: ThreadId,
@@ -50727,7 +50751,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53170,7 +53194,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53192,7 +53216,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66115,7 +66139,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.134";
+var version$1 = "0.13.136";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -75882,7 +75906,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75890,8 +75914,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93735,7 +93759,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -97817,6 +97841,16 @@ const PUBLIC_PROVIDER_LEAK_PATTERNS = [
 	/https?:\/\/[^\s'"<>)]*(?:apex|deepseek|moonshot|kimi)[^\s'"<>)]*/i
 ];
 const DEFAULT_PUBLIC_PROVIDER_ERROR = "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
+/**
+* The sentence a Workspace-wallet Claude turn fails with on a CMMD runtime when
+* CMMD will not mint its egress token (CMMD#5917). The Claude adapter opens its
+* refusal with it, and `categorizePublicProviderError` returns it unchanged, so
+* the refusal still reads as a refusal when a production stack forces the
+* failure detail through sanitization. Anything else would read as an outage
+* and invite a retry on the personal login.
+*/
+const CLAUDE_WORKSPACE_EGRESS_REFUSAL = "Claude could not get a Workspace egress token from CMMD for this turn. Refusing rather than falling back to the personal login.";
+const CLAUDE_WORKSPACE_EGRESS_REFUSAL_LOWER = CLAUDE_WORKSPACE_EGRESS_REFUSAL.toLowerCase();
 function isProviderRateOrQuotaError(message) {
 	if (!message) return false;
 	const normalized = message.toLowerCase();
@@ -97840,6 +97874,7 @@ function providerLifecycleOrAccountCopy(message) {
 function categorizePublicProviderError(message) {
 	if (!message) return null;
 	const m = message.toLowerCase();
+	if (m.includes(CLAUDE_WORKSPACE_EGRESS_REFUSAL_LOWER)) return CLAUDE_WORKSPACE_EGRESS_REFUSAL;
 	const lifecycleOrAccountCopy = providerLifecycleOrAccountCopy(m);
 	if (lifecycleOrAccountCopy !== null) return lifecycleOrAccountCopy;
 	if (/\bforge_provider_model_not_allowed\b/.test(m) || /\bnot\s+scoped\s+to\s+the\s+requested\s+model\b/.test(m)) return "The workspace AI credential does not cover the model this turn asked for. Retry, or pick that model for the thread.";
@@ -115458,7 +115493,7 @@ const postgresSchemaStatements = [
 	"CREATE TABLE IF NOT EXISTS checkpoint_diff_blobs (\n      thread_id TEXT NOT NULL,\n      from_turn_count INTEGER NOT NULL,\n      to_turn_count INTEGER NOT NULL,\n      diff TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      UNIQUE (thread_id, from_turn_count, to_turn_count)\n    )",
 	"CREATE TABLE IF NOT EXISTS provider_session_runtime (\n      thread_id TEXT PRIMARY KEY,\n      provider_name TEXT NOT NULL,\n      adapter_key TEXT NOT NULL,\n      runtime_mode TEXT NOT NULL DEFAULT 'full-access',\n      status TEXT NOT NULL,\n      last_seen_at TEXT NOT NULL,\n      resume_cursor_json TEXT,\n      runtime_payload_json TEXT\n    )",
 	"CREATE TABLE IF NOT EXISTS projection_projects (\n      project_id TEXT PRIMARY KEY,\n      title TEXT NOT NULL,\n      workspace_root TEXT NOT NULL,\n      scripts_json TEXT NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , default_model_selection_json TEXT, default_thread_env_mode TEXT, cmmd_registration_json TEXT)",
-	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT, work_session_bound_at TEXT)",
+	"CREATE TABLE IF NOT EXISTS projection_threads (\n      thread_id TEXT PRIMARY KEY,\n      project_id TEXT NOT NULL,\n      title TEXT NOT NULL,\n      branch TEXT,\n      worktree_path TEXT,\n      latest_turn_id TEXT,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL,\n      deleted_at TEXT\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access', interaction_mode TEXT NOT NULL DEFAULT 'default', model_selection_json TEXT, archived_at TEXT, latest_user_message_at TEXT, pending_approval_count INTEGER NOT NULL DEFAULT 0, pending_user_input_count INTEGER NOT NULL DEFAULT 0, has_actionable_proposed_plan INTEGER NOT NULL DEFAULT 0, kind TEXT NOT NULL DEFAULT 'master', parent_thread_id TEXT, status TEXT NOT NULL DEFAULT 'idle', anchor_kind TEXT NOT NULL DEFAULT 'scratch', anchor_cmmd_id TEXT, worker_role TEXT DEFAULT NULL, goal TEXT, pending_auto_create_prompt_json TEXT, title_regeneration_json TEXT, rate_limit_status_json TEXT, linked_pull_request_json TEXT, settled_at TEXT, settled_override TEXT, work_session_id TEXT, work_session_bound_at TEXT, wallet TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_messages (\n      message_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      role TEXT NOT NULL,\n      text TEXT NOT NULL,\n      is_streaming INTEGER NOT NULL,\n      created_at TEXT NOT NULL,\n      updated_at TEXT NOT NULL\n    , attachments_json TEXT)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_activities (\n      activity_id TEXT PRIMARY KEY,\n      thread_id TEXT NOT NULL,\n      turn_id TEXT,\n      tone TEXT NOT NULL,\n      kind TEXT NOT NULL,\n      summary TEXT NOT NULL,\n      payload_json TEXT NOT NULL,\n      created_at TEXT NOT NULL\n    , sequence INTEGER)",
 	"CREATE TABLE IF NOT EXISTS projection_thread_sessions (\n      thread_id TEXT PRIMARY KEY,\n      status TEXT NOT NULL,\n      provider_name TEXT,\n      provider_session_id TEXT,\n      provider_thread_id TEXT,\n      active_turn_id TEXT,\n      last_error TEXT,\n      updated_at TEXT NOT NULL\n    , runtime_mode TEXT NOT NULL DEFAULT 'full-access')",
@@ -115782,7 +115817,8 @@ const postgresUpgradeMigrations = new Map([
 	]],
 	[77, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_id TEXT`]],
 	[78, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS work_session_bound_at TEXT`]],
-	[79, [`ALTER TABLE command_access_tokens DROP COLUMN IF EXISTS refresh_token`]]
+	[79, [`ALTER TABLE command_access_tokens DROP COLUMN IF EXISTS refresh_token`]],
+	[80, [`ALTER TABLE projection_threads ADD COLUMN IF NOT EXISTS wallet TEXT`]]
 ]);
 function requirePostgresUpgradeStatements(version) {
 	const statements = postgresUpgradeMigrations.get(version);
@@ -115808,15 +115844,15 @@ const runPostgresMigrations = fn$1("runPostgresMigrations")(function* () {
         ORDER BY version DESC
         LIMIT 1
       `)[0]?.version ?? 0;
-		if (currentVersion > 79) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 79.`));
+		if (currentVersion > 80) return yield* die$1(/* @__PURE__ */ new Error(`Forge Postgres schema ${currentVersion} is newer than server schema 80.`));
 		if (currentVersion === 0) {
 			for (const statement of postgresSchemaStatements) yield* sql.unsafe(statement);
 			yield* sql`
           INSERT INTO forge_schema_migrations (version)
-          VALUES (${79})
+          VALUES (${80})
           ON CONFLICT (version) DO NOTHING
         `;
-		} else for (let version = currentVersion + 1; version <= 79; version += 1) {
+		} else for (let version = currentVersion + 1; version <= 80; version += 1) {
 			const statements = yield* sync$1(() => requirePostgresUpgradeStatements(version));
 			for (const statement of statements) yield* sql.unsafe(statement);
 			yield* sql`
@@ -118644,6 +118680,21 @@ var _079_DropCommandRefreshToken_default = gen(function* () {
 	yield* (yield* SqlClient)`ALTER TABLE command_access_tokens DROP COLUMN refresh_token`;
 });
 //#endregion
+//#region src/persistence/Migrations/080_ProjectionThreadWallet.ts
+/**
+* Stores the wallet the last CMMD kick named on a thread (CMMD#5917), so a
+* turn without one starts on it even after a server restart.
+*/
+var _080_ProjectionThreadWallet_default = gen(function* () {
+	const sql = yield* SqlClient;
+	if (!(yield* sql`
+    PRAGMA table_info(projection_threads)
+  `).some((column) => column.name === "wallet")) yield* sql`
+      ALTER TABLE projection_threads
+      ADD COLUMN wallet TEXT
+    `;
+});
+//#endregion
 //#region src/persistence/Migrations.ts
 /**
 * MigrationsLive - Migration runner with inline loader
@@ -119059,6 +119110,11 @@ const migrationEntries = [
 		79,
 		"DropCommandRefreshToken",
 		_079_DropCommandRefreshToken_default
+	],
+	[
+		80,
+		"ProjectionThreadWallet",
+		_080_ProjectionThreadWallet_default
 	]
 ];
 const makeMigrationLoader = (throughId) => fromRecord(Object.fromEntries(migrationEntries.filter(([id]) => throughId === void 0 || id <= throughId).map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -152400,6 +152456,15 @@ function canIssueProviderEgressToken() {
 function canIssueApexProviderEgressToken() {
 	return canIssueProviderEgressToken() || canRequestCmmdLocalUserProviderEgressToken();
 }
+/**
+* True on a CMMD cloud runtime that has everything the runtime mint route
+* needs: runtime mode, the control plane URL, the runtime id, a grant token,
+* and the provider proxy URL. `issueProviderEgressCredential` takes the
+* runtime mint path exactly when this holds.
+*
+* Exported for the Claude adapter, which mints Workspace Anthropic egress on
+* such a runtime for a turn stamped with the Workspace wallet (CMMD#5917).
+*/
 function canIssueCmmdRuntimeProviderEgressToken() {
 	return process.env.FORGE_CMMD_RUNTIME_MODE === "true" && Boolean(process.env.FORGE_COMMAND_APP_URL) && Boolean(process.env.FORGE_CMMD_RUNTIME_ID) && Boolean(runtimeGrantToken()) && Boolean(process.env.FORGE_PROVIDER_PROXY_URL);
 }
@@ -152977,7 +153042,7 @@ const CODEX_SKILLS_LIST_TIMEOUT_MS = 4e3;
 const CODEX_SUBAGENT_TOKEN_USAGE_METHOD = "forge/subagentTokenUsage/updated";
 const CODEX_VERSION_CHECK_TIMEOUT_MS = 15e3;
 const PROVIDER_EGRESS_TOKEN_REFRESH_MS = 1500 * 1e3;
-const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS = 60 * 1e3;
+const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS$1 = 60 * 1e3;
 const INTERRUPT_REQUEST_TIMEOUT_MS = 2e3;
 const ANSI_ESCAPE_CHAR = String.fromCharCode(27);
 const ANSI_ESCAPE_REGEX = new RegExp(`${ANSI_ESCAPE_CHAR}\\[[0-9;]*m`, "g");
@@ -153799,7 +153864,7 @@ var CodexAppServerManager = class extends EventEmitter$1 {
 		if (!context || context.stopping) return;
 		if (context.session.activeTurnId || context.pending.size > 0) {
 			this.emitLifecycleEvent(context, "session/tokenRefreshDeferred", "Workspace provider token refresh deferred until the active Codex turn finishes.");
-			this.scheduleProviderEgressTokenRefresh(context, PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS);
+			this.scheduleProviderEgressTokenRefresh(context, PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS$1);
 			return;
 		}
 		this.emitLifecycleEvent(context, "session/tokenRefreshRequired", "Workspace provider token is nearing expiry; restarting Codex session for recovery.");
@@ -192080,7 +192145,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202280,12 +202345,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -202300,7 +202365,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -202311,14 +202376,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202333,7 +202398,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -202348,13 +202413,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -213972,6 +214037,48 @@ function hasConfiguredApexCredential(profiles) {
 	}));
 }
 //#endregion
+//#region src/egress/providerEgressTokenRefresh.ts
+/**
+* How long to wait before restarting a session whose provider egress
+* credential is about to expire.
+*
+* CMMD-Center/CMMD#5917 review: the Workspace Anthropic egress token lives
+* one hour and is minted once, when a Claude session starts. The session
+* itself can run for many turns past that hour through its own prompt
+* queue, so without this the first turn after expiry fails with an opaque
+* 401 instead of an honest refusal. Restarting near expiry mints a fresh
+* token on the next turn instead, the same trade Codex already makes in
+* `codexAppServerManager.ts` (`scheduleProviderEgressTokenRefresh`).
+*
+* Kept in its own module so the delay math is testable without an Effect
+* runtime or a session map.
+*/
+/** Restart this long before the token actually expires. */
+const PROVIDER_EGRESS_TOKEN_REFRESH_MARGIN_MS = 300 * 1e3;
+/**
+* Used when the credential carries no `expiresAt`, or one that fails to
+* parse. Conservative relative to the one-hour token life the review names,
+* so a missing timestamp fails toward an early, harmless restart rather than
+* toward never restarting at all.
+*/
+const PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS = 1500 * 1e3;
+/**
+* How long to wait before checking again when the refresh threshold arrives
+* mid-turn. Matches Codex's `PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS`.
+*/
+const PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS = 60 * 1e3;
+/**
+* How long a session should wait, once idle, before restarting to mint a
+* fresh credential. Never negative: a credential that already expired, or
+* expires inside the margin, restarts immediately.
+*/
+function providerEgressTokenRefreshDelayMs(expiresAt, nowMs) {
+	if (!expiresAt) return PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS;
+	const expiresAtMs = Date.parse(expiresAt);
+	if (Number.isNaN(expiresAtMs)) return PROVIDER_EGRESS_TOKEN_REFRESH_FALLBACK_MS;
+	return Math.max(0, expiresAtMs - nowMs - PROVIDER_EGRESS_TOKEN_REFRESH_MARGIN_MS);
+}
+//#endregion
 //#region src/provider/claudeCredentialDirectory.ts
 /** Per-account credentials share the existing Claude transcript directory. */
 /** Repoints `.credentials.json` without moving the transcripts. */
@@ -216363,7 +216470,7 @@ function claudeForgeAttributionPrompt() {
 * turn, an API key is, so pointing the variable there would add a second source
 * of truth that a later reader has to rule out.
 */
-function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential, credentialDirectory, selectedSubscription = false) {
+function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, providerProxyCredential, credentialDirectory, selectedSubscription = false, mintedEgressModel) {
 	if (selectedSubscription) return claudeSubscriptionChildEnv(baseProcessEnv, credentialDirectory, true);
 	const baseEnv = scrubForgeProviderChildEnvSecrets(baseProcessEnv);
 	const effectiveBaseUrl = resolveClaudeQueryBaseUrl(endpointProfile, claudeSettings, providerProxyCredential);
@@ -216377,7 +216484,28 @@ function buildClaudeQueryEnv(baseProcessEnv, endpointProfile, claudeSettings, pr
 			CLAUDE_CODE_MAX_RETRIES: "0",
 			API_TIMEOUT_MS: "90000"
 		} : {},
-		...endpointProfile?.disableToolSearch === true ? { ENABLE_TOOL_SEARCH: "false" } : {}
+		...endpointProfile?.disableToolSearch === true ? { ENABLE_TOOL_SEARCH: "false" } : {},
+		...!endpointProfile && providerProxyCredential && mintedEgressModel ? claudeWorkspaceEgressModelPins(mintedEgressModel) : {}
+	};
+}
+/**
+* CMMD's Workspace egress proxy only accepts the model(s) named on the mint
+* request that issued `providerProxyCredential`, and the mint above scopes to
+* one selected model (`forge-provider-egress.routes.ts` `modelScopeError`).
+* Left alone, Claude Code and its subagents still pick their own smaller
+* models for background and Explore-subagent calls, which fall outside that
+* scope and get refused. Pinning every one of those picks to the same model
+* the mint requested keeps the whole session inside it.
+*
+* Only the plain Anthropic egress branch gets these — never an
+* endpoint-profile turn (Apex / DeepSeek / Moonshot), whose upstream model
+* catalog and scoping this does not apply to.
+*/
+function claudeWorkspaceEgressModelPins(model) {
+	return {
+		ANTHROPIC_SMALL_FAST_MODEL: model,
+		ANTHROPIC_DEFAULT_HAIKU_MODEL: model,
+		CLAUDE_CODE_SUBAGENT_MODEL: model
 	};
 }
 function resolveClaudeQueryBaseUrl(endpointProfile, claudeSettings, providerProxyCredential) {
@@ -216481,7 +216609,8 @@ function buildClaudeSessionContext(input) {
 		lastThreadStartedId: void 0,
 		stopped: false,
 		currentApiModelId: input.effectiveApiModelId,
-		currentEffort: input.effectiveEffort
+		currentEffort: input.effectiveEffort,
+		tokenRefreshFiber: void 0
 	};
 }
 function claudeSessionConfiguredConfig(input) {
@@ -216782,8 +216911,34 @@ function shouldUseProviderEgressProxy(profile) {
 	const normalized = profile.baseUrl.toLowerCase();
 	return normalized.includes("apex.cmmd.ai") || normalized.includes("deepseek") || normalized.includes("moonshot");
 }
-function resolveClaudeProviderEgressProvider(profile) {
+/**
+* True for a plain Claude turn (no custom endpoint profile) stamped with the
+* Workspace wallet on a CMMD cloud runtime.
+*
+* That turn has to run through CMMD's metered Workspace egress, because CMMD
+* accepted the wallet choice and enforces it only at mint time and at the
+* proxy. The personal Claude login in the VM is never an acceptable stand-in,
+* so every path below refuses the turn rather than falling back to it
+* (CMMD#5917). Runtime mode alone decides "on a CMMD runtime": a runtime whose
+* mint settings are incomplete still counts, and is refused.
+*/
+function isClaudeWorkspaceWalletTurnOnCmmdRuntime(profile, wallet) {
+	return wallet === "workspace" && !profile?.baseUrl && process.env.FORGE_CMMD_RUNTIME_MODE === "true";
+}
+/**
+* Which egress lane, if any, a Claude session mints a proxy token for.
+*
+* - `apex`: a centrally managed Apex profile, whatever the wallet.
+* - `anthropic` for a Workspace-wallet turn on a CMMD runtime that can mint.
+*   This is a narrow exception to `WORKSPACE_PROVIDER_ACCESS_DISABLED`, which
+*   still governs every other plain Claude turn (CMMD#5917).
+* - `anthropic` through the local-user lane when the shared kill switch is
+*   off. Unchanged, and never reached on a CMMD runtime.
+* - `null` otherwise, which leaves the turn on the personal login.
+*/
+function resolveClaudeProviderEgressProvider(profile, wallet) {
 	if (shouldUseProviderEgressProxy(profile)) return "apex";
+	if (isClaudeWorkspaceWalletTurnOnCmmdRuntime(profile, wallet) && canIssueCmmdRuntimeProviderEgressToken()) return "anthropic";
 	if (!profile?.baseUrl && false);
 	return null;
 }
@@ -218404,6 +218559,9 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		const streamFiber = context.streamFiber;
 		context.streamFiber = void 0;
 		if (streamFiber && streamFiber.pollUnsafe() === void 0) yield* interrupt$4(streamFiber);
+		const tokenRefreshFiber = context.tokenRefreshFiber;
+		context.tokenRefreshFiber = void 0;
+		if (tokenRefreshFiber && tokenRefreshFiber.pollUnsafe() === void 0) yield* interrupt$4(tokenRefreshFiber);
 		try {
 			context.query.close();
 			selectedClaudeCredentialStore(serverConfig.baseDir).release(context.session.threadId);
@@ -218434,6 +218592,35 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		}
 		sessions.delete(context.session.threadId);
 	});
+	/**
+	* Restarts `threadId`'s session near its Workspace Anthropic egress
+	* credential's expiry, once idle (CMMD-Center/CMMD#5917 review). Deferred
+	* rather than run while a turn is active, the same trade
+	* `scheduleProviderEgressTokenRefresh` makes for Codex in
+	* `codexAppServerManager.ts`: interrupting mid-turn would trade a clean
+	* 401 for a broken one.
+	*
+	* A known gap, same as Codex's: a single turn that runs past the
+	* credential's actual expiry still fails mid-turn with a 401. This only
+	* covers the idle-session case.
+	*/
+	const scheduleWorkspaceEgressTokenRefresh = (context, credential, runFork) => {
+		const threadId = context.session.threadId;
+		context.tokenRefreshFiber = runFork(gen(function* () {
+			let delayMs = providerEgressTokenRefreshDelayMs(credential.expiresAt, Date.now());
+			while (true) {
+				yield* sleep$4(delayMs);
+				const current = sessions.get(threadId);
+				if (!current || current !== context || current.stopped) return;
+				if (current.turnState) {
+					delayMs = PROVIDER_EGRESS_TOKEN_REFRESH_DEFER_MS;
+					continue;
+				}
+				yield* stopSessionInternal(current, { emitExitEvent: true });
+				return;
+			}
+		}));
+	};
 	const requireSession = (threadId) => {
 		const context = sessions.get(threadId);
 		if (!context) return fail(new ProviderAdapterSessionNotFoundError({
@@ -218628,19 +218815,46 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 		});
 		return (toolName, toolInput, callbackOptions) => runPromise(canUseToolEffect(toolName, toolInput, callbackOptions));
 	};
-	const issueClaudeProviderProxyCredential = fn$1("issueClaudeProviderProxyCredential")(function* (endpointProfile, model, threadId) {
-		const provider = resolveClaudeProviderEgressProvider(endpointProfile);
-		if (!provider) return null;
-		return yield* issueProviderEgressCredential({
+	/**
+	* Mints the egress proxy credential this session runs on, or returns null
+	* when the session runs on the personal login.
+	*
+	* A Workspace-wallet turn on a CMMD runtime never gets null: it either mints
+	* Anthropic egress on a workspace_key receipt or fails here with
+	* CLAUDE_WORKSPACE_EGRESS_REFUSAL, which
+	* stops `startSession` before the child environment is built, so the
+	* personal-login branch of `buildClaudeQueryEnv` is never reached for it.
+	*/
+	const issueClaudeProviderProxyCredential = fn$1("issueClaudeProviderProxyCredential")(function* (endpointProfile, model, threadId, wallet) {
+		const workspaceWalletTurn = isClaudeWorkspaceWalletTurnOnCmmdRuntime(endpointProfile, wallet);
+		const provider = resolveClaudeProviderEgressProvider(endpointProfile, wallet);
+		if (!provider) {
+			if (workspaceWalletTurn) return yield* new ProviderAdapterProcessError({
+				provider: PROVIDER$11,
+				threadId,
+				detail: `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} This runtime is missing the CMMD settings it needs to request one.`
+			});
+			return null;
+		}
+		const credential = yield* issueProviderEgressCredential({
 			provider,
 			model,
 			threadId
-		}).pipe(mapError((cause) => new ProviderAdapterProcessError({
+		}).pipe(mapError((cause) => {
+			const reason = toMessage(cause, "Failed to issue provider proxy token.");
+			return new ProviderAdapterProcessError({
+				provider: PROVIDER$11,
+				threadId,
+				detail: workspaceWalletTurn && provider === "anthropic" ? `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} ${reason}` : reason,
+				cause
+			});
+		}));
+		if (workspaceWalletTurn && provider === "anthropic" && credential.deliveryReceipt?.identity.kind !== "workspace_key") return yield* new ProviderAdapterProcessError({
 			provider: PROVIDER$11,
 			threadId,
-			detail: toMessage(cause, "Failed to issue provider proxy token."),
-			cause
-		})));
+			detail: `${CLAUDE_WORKSPACE_EGRESS_REFUSAL} CMMD issued a credential that is not a Workspace key.`
+		});
+		return credential;
 	});
 	const createClaudeQueryRuntime = fn$1("createClaudeQueryRuntime")(function* (prompt, queryOptions, threadId) {
 		return yield* try_({
@@ -218755,6 +218969,12 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			claudeCredentialDirectory: credentialDirectoryDecision.outcome === "set" ? credentialDirectoryDecision.directory : null
 		};
 	});
+	/**
+	* Starts a Claude SDK session for a thread. The model access it runs on is
+	* decided here, once: a selected account's credential, a minted egress proxy
+	* credential, an endpoint profile, or the personal login. A Workspace-wallet
+	* turn on a CMMD runtime is refused rather than given the personal login.
+	*/
 	const startSession = fn$1("startSession")(function* (input) {
 		const sessionProvider = yield* validateClaudeStartSessionProvider(input.provider);
 		const startedAt = yield* nowIso;
@@ -218843,7 +219063,13 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			operation: "startSession",
 			issue: "The selected Claude account cannot be used with a custom API endpoint. Choose a subscription model."
 		});
-		const providerProxyCredential = selectedAccountIdentity !== null ? null : yield* issueClaudeProviderProxyCredential(modelConfig.endpointProfile, modelConfig.modelSlug ?? modelConfig.effectiveApiModelId ?? "unknown", threadId);
+		if (selectedAccountIdentity !== null && isClaudeWorkspaceWalletTurnOnCmmdRuntime(modelConfig.endpointProfile, input.wallet)) return yield* new ProviderAdapterValidationError({
+			provider: PROVIDER$11,
+			operation: "startSession",
+			issue: "This turn is billed to the Workspace wallet, so it cannot run on a selected personal Claude account. Clear the account choice, or start the task on your own wallet."
+		});
+		const mintedEgressModel = modelConfig.modelSlug ?? modelConfig.effectiveApiModelId ?? "unknown";
+		const providerProxyCredential = selectedAccountIdentity !== null ? null : yield* issueClaudeProviderProxyCredential(modelConfig.endpointProfile, mintedEgressModel, threadId, input.wallet);
 		const permissionMode = permissionModeForRuntimeMode(input.runtimeMode);
 		const settings = claudeQuerySettings(modelConfig.thinking, modelConfig.fastMode);
 		const workspacePreflight = input.cwd ? formatWorkspaceEnvironmentPreflightForAgent(runWorkspaceEnvironmentPreflight({ cwd: input.cwd })) : void 0;
@@ -218866,7 +219092,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			existingResumeSessionId,
 			newSessionId,
 			canUseTool,
-			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential, claudeCredentialDirectory, selectedAccountIdentity !== null),
+			env: buildClaudeQueryEnv(process.env, modelConfig.endpointProfile, claudeSettings, providerProxyCredential, claudeCredentialDirectory, selectedAccountIdentity !== null, mintedEgressModel),
 			browserManager,
 			threadId,
 			browserToolEnvironmentId,
@@ -218919,6 +219145,7 @@ const makeClaudeAdapter = fn$1("makeClaudeAdapter")(function* (options) {
 			})
 		});
 		attachClaudeStreamFiber(context$4, runFork);
+		if (providerProxyCredential?.deliveryReceipt?.identity.kind === "workspace_key") scheduleWorkspaceEgressTokenRefresh(context$4, providerProxyCredential, runFork);
 		return { ...session };
 	}, (effect, input) => effect.pipe(onExit((exit) => sync$1(() => {
 		if (exit._tag === "Failure") selectedClaudeCredentialStore(serverConfig.baseDir).release(input.threadId);
@@ -233284,6 +233511,11 @@ function toRuntimeStatus(session) {
 		default: return "running";
 	}
 }
+/**
+* The runtime payload persisted beside a session binding. The session directory
+* merges it shallowly into what is already stored, so a key left out here
+* (a later upsert with no wallet, say) keeps its earlier value.
+*/
 function toRuntimePayloadFromSession(session, extra) {
 	return {
 		cwd: session.cwd ?? null,
@@ -233291,6 +233523,7 @@ function toRuntimePayloadFromSession(session, extra) {
 		activeTurnId: session.activeTurnId ?? null,
 		lastError: session.lastError ?? null,
 		...extra?.modelSelection !== void 0 ? { modelSelection: extra.modelSelection } : {},
+		...extra?.wallet !== void 0 ? { wallet: extra.wallet } : {},
 		...extra?.lastRuntimeEvent !== void 0 ? { lastRuntimeEvent: extra.lastRuntimeEvent } : {},
 		...extra?.lastRuntimeEventAt !== void 0 ? { lastRuntimeEventAt: extra.lastRuntimeEventAt } : {}
 	};
@@ -233300,6 +233533,34 @@ function readPersistedModelSelection(runtimePayload) {
 	const raw = "modelSelection" in runtimePayload ? runtimePayload.modelSelection : void 0;
 	return is$1(ModelSelection)(raw) ? raw : void 0;
 }
+/**
+* The wallet the thread's provider session last started with, read back from
+* the persisted runtime payload (CMMD#5917).
+*
+* Only a CMMD kick names a wallet. Every other start (a person's follow-up
+* that changes the model, a recovery after the adapter lost the session)
+* reuses this one, so a thread billed to the Workspace wallet does not drop to
+* the personal login the first time its session restarts. Undefined when no
+* kick ever named one, which keeps today's behavior.
+*/
+const isWorkSessionWallet = is$1(WorkSessionWallet);
+function readPersistedWallet(runtimePayload) {
+	if (!runtimePayload || typeof runtimePayload !== "object" || Array.isArray(runtimePayload)) return;
+	const raw = "wallet" in runtimePayload ? runtimePayload.wallet : void 0;
+	return isWorkSessionWallet(raw) ? raw : void 0;
+}
+/**
+* The wallet a new session starts on: the one the kick named, else the one the
+* thread's session last ran with, whatever provider that was, because the
+* wallet belongs to the Work Session and not to the provider (CMMD#5917).
+*/
+function resolveStartSessionWallet(requested, persistedBinding) {
+	return requested ?? readPersistedWallet(persistedBinding?.runtimePayload);
+}
+/** `{ wallet }` when one is known, an empty object otherwise (exactOptionalPropertyTypes). */
+function walletField$1(wallet) {
+	return wallet === void 0 ? {} : { wallet };
+}
 function readProviderAccountIdFromModelSelection(modelSelection) {
 	if (!modelSelection) return void 0;
 	switch (modelSelection.provider) {
@@ -233334,12 +233595,18 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 	const withSessionLock = (threadId, effect) => get$5(sessionLocks, threadId).pipe(flatMap((lock) => lock.withPermit(effect)), scoped);
 	const runtimeEventPubSub = yield* unbounded$1();
 	const assertProviderExecutable = options?.assertProviderExecutable ?? (() => succeed(null));
+	/**
+	* Re-runs the readiness guard for an existing session before a turn or a
+	* continuation, with the account and wallet the session was started on, and
+	* refuses if the delivered identity drifted from the persisted one.
+	*/
 	const assertCurrentProviderDelivery = fn$1("assertCurrentProviderDelivery")(function* (input) {
 		const persistedBinding = getOrUndefined(yield* directory.getBinding(input.threadId));
 		const providerAccountId = readPersistedProviderAccountId(persistedBinding?.runtimePayload);
 		const currentBinding = yield* assertProviderExecutable({
 			...input,
-			...selectedAccountGuardFields(providerAccountId)
+			...selectedAccountGuardFields(providerAccountId),
+			...walletField$1(readPersistedWallet(persistedBinding?.runtimePayload))
 		});
 		if (!currentBinding) return;
 		if (!persistedBinding || persistedBinding.provider !== input.provider) return yield* toValidationError(input.operation, `Cannot verify the delivered provider identity for thread '${input.threadId}'.`);
@@ -233355,6 +233622,11 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 		return yield* toValidationError(input.operation, `Thread '${input.threadId}' is bound to provider account '${input.persistedAccountId}' and cannot use provider account '${input.requestedAccountId}'.`);
 	});
 	const publishRuntimeEvent = (event) => succeed(event).pipe(tap((canonicalEvent) => canonicalEventLogger ? canonicalEventLogger.write(canonicalEvent, null) : void_$1), flatMap((canonicalEvent) => publish(runtimeEventPubSub, canonicalEvent)), asVoid);
+	/**
+	* Writes the thread's session binding. `extra` carries what only a start
+	* knows, the model selection and the wallet, so a later runtime-event upsert
+	* that omits them leaves the stored values in place.
+	*/
 	const upsertSessionBinding = (session, threadId, extra) => directory.upsert({
 		threadId,
 		provider: session.provider,
@@ -233369,6 +233641,11 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 		eventType: event.type
 	}).pipe(andThen(publishRuntimeEvent(event)));
 	yield* forEach(adapters, (adapter) => runForEach(adapter.streamEvents, processRuntimeEvent).pipe(forkScoped)).pipe(asVoid);
+	/**
+	* Restarts a session the adapter lost, from the persisted binding alone: cwd,
+	* model selection, wallet and resume cursor. It has no read model, so what
+	* the binding stored is all it can go on.
+	*/
 	const recoverSessionForThread = fn$1("recoverSessionForThread")(function* (input) {
 		yield* annotateCurrentSpan({
 			"provider.operation": "recover-session",
@@ -233397,11 +233674,13 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 			const persistedCwd = readPersistedCwd(input.binding.runtimePayload);
 			const persistedModelSelection = readPersistedModelSelection(input.binding.runtimePayload);
 			const persistedProviderAccountId = readProviderAccountIdFromModelSelection(persistedModelSelection);
+			const persistedWallet = readPersistedWallet(input.binding.runtimePayload);
 			const currentDeliveryBinding = yield* assertProviderExecutable({
 				threadId: input.binding.threadId,
 				provider: input.binding.provider,
 				operation: input.operation,
-				...selectedAccountGuardFields(persistedProviderAccountId)
+				...selectedAccountGuardFields(persistedProviderAccountId),
+				...walletField$1(persistedWallet)
 			});
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: input.operation,
@@ -233415,7 +233694,8 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 				...persistedCwd ? { cwd: persistedCwd } : {},
 				...persistedModelSelection ? { modelSelection: persistedModelSelection } : {},
 				...hasResumeCursor ? { resumeCursor: boundResumeCursor } : {},
-				runtimeMode: input.binding.runtimeMode ?? "full-access"
+				runtimeMode: input.binding.runtimeMode ?? "full-access",
+				...walletField$1(persistedWallet)
 			});
 			if (resumed.provider !== adapter.provider) return yield* toValidationError(input.operation, `Adapter/provider mismatch while recovering thread '${input.binding.threadId}'. Expected '${adapter.provider}', received '${resumed.provider}'.`);
 			yield* upsertSessionBinding(resumed, input.binding.threadId);
@@ -233487,6 +233767,11 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 			isActive: true
 		};
 	});
+	/**
+	* Starts a provider session for a thread: decodes the input, resolves the
+	* provider, guards account and delivery identity, resolves the wallet, then
+	* persists the binding the adapter returns.
+	*/
 	const startSession = fn$1("startSession")(function* (threadId, rawInput) {
 		const parsed = yield* decodeInputOrValidationError({
 			operation: "ProviderService.startSession",
@@ -233519,24 +233804,31 @@ const makeProviderService = fn$1("makeProviderService")(function* (options) {
 				persistedAccountId: priorAccountId,
 				requestedAccountId
 			});
+			const effectiveResumeCursor = input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0);
+			const effectiveWallet = resolveStartSessionWallet(input.wallet, persistedBinding);
 			const boundResumeCursor = yield* bindProviderDeliveryToResumeCursor({
 				operation: "ProviderService.startSession",
 				provider: effectiveProvider,
-				resumeCursor: input.resumeCursor ?? (persistedBinding?.provider === effectiveProvider ? persistedBinding.resumeCursor : void 0),
+				resumeCursor: effectiveResumeCursor,
 				currentBinding: yield* assertProviderExecutable({
 					threadId,
 					provider: effectiveProvider,
 					operation: "ProviderService.startSession",
-					...selectedAccountGuardFields(requestedAccountId)
+					...selectedAccountGuardFields(requestedAccountId),
+					...walletField$1(effectiveWallet)
 				})
 			});
 			const session = yield* adapter.startSession({
 				...input,
 				accountTransition: explicitProviderAccountTransition(priorAccountId, requestedAccountId),
-				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {}
+				...boundResumeCursor !== void 0 ? { resumeCursor: boundResumeCursor } : {},
+				...walletField$1(effectiveWallet)
 			});
 			if (session.provider !== adapter.provider) return yield* toValidationError("ProviderService.startSession", `Adapter/provider mismatch: requested '${adapter.provider}', received '${session.provider}'.`);
-			yield* upsertSessionBinding(session, threadId, { modelSelection: input.modelSelection });
+			yield* upsertSessionBinding(session, threadId, {
+				modelSelection: input.modelSelection,
+				...walletField$1(effectiveWallet)
+			});
 			yield* analytics.record("provider.session.started", {
 				provider: session.provider,
 				runtimeMode: input.runtimeMode,
@@ -234337,8 +234629,13 @@ function makeClaudeRuntimeReadinessGuard(config, dependencies) {
 	};
 	return (input) => claudeReadinessGuardEffect(config, dependencies, resolved, input);
 }
+/**
+* One guard run: skip when the turn needs no delivered Claude credential,
+* prepare a selected account's credential when one is named, otherwise verify
+* the owner's native runtime generation against CMMD.
+*/
 function claudeReadinessGuardEffect(config, dependencies, resolved, input) {
-	if (!requiresNativeClaudeReadiness(config, input.provider, input.providerAccountId)) return succeed(null);
+	if (!requiresNativeClaudeReadiness(config, input.provider, input.providerAccountId, input.wallet)) return succeed(null);
 	if (input.providerAccountId !== void 0) {
 		const prepareSelectedCredential = dependencies.prepareSelectedCredential ?? makeClaudeSelectedCredentialPreparer(config, {
 			resolveJwt: dependencies.resolveJwt,
@@ -234361,9 +234658,21 @@ function claudeReadinessGuardEffect(config, dependencies, resolved, input) {
 		catch: (cause) => readinessValidationError(input.operation, cause)
 	});
 }
-function requiresNativeClaudeReadiness(config, provider, providerAccountId) {
+/**
+* Whether this turn runs on a Claude credential delivered into the VM, and so
+* has to prove that credential is the one CMMD applied before it runs.
+*
+* A turn billed to the Workspace wallet with no selected account does not: the
+* Claude adapter runs it on CMMD's metered egress and refuses it when CMMD
+* will not mint (CMMD#5917). Checking the owner's personal login there would
+* refuse a Workspace turn for a personal credential it never uses. A selected
+* account still goes through its own preparation, and the adapter then refuses
+* the Workspace-plus-account combination.
+*/
+function requiresNativeClaudeReadiness(config, provider, providerAccountId, wallet) {
 	if (provider !== "claudeAgent" || config.forgeCmmdRuntimeMode !== true) return false;
-	return providerAccountId !== void 0 || personalClaudeInVmEnabled();
+	if (providerAccountId !== void 0) return true;
+	return wallet !== "workspace" && personalClaudeInVmEnabled();
 }
 function resolveGuardAuthority(config, readSessionId, input) {
 	const runtimeId = config.forgeCmmdRuntimeId?.trim();
@@ -270898,7 +271207,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271029,14 +271338,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271044,7 +271353,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -288310,6 +288619,7 @@ const ProjectionThread = Struct({
 	anchorCmmdId: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	workSessionId: optionalKey(NullOr(String$1)),
 	workSessionBoundAt: optionalKey(NullOr(String$1)),
+	wallet: optionalKey(NullOr(WorkSessionWallet)),
 	linkedPullRequest: optionalKey(NullOr(LinkedPullRequest)),
 	status: ThreadStatus.pipe(withDecodingDefault(succeed("idle"))),
 	workerRole: NullOr(WorkerRole).pipe(withDecodingDefault(succeed(null))),
@@ -292781,6 +293091,18 @@ function publicProviderFailureDetailFromCause(cause) {
 	const error = squash(cause);
 	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(pretty(cause));
 }
+/**
+* The wallet a session start asks for: the one on the turn-start event, which
+* the decider stamps at acceptance, else the one persisted on the thread row,
+* for older events and starts not driven by a turn (CMMD#5917). The decider writes the kick's
+* wallet to the thread before this reactor sees the turn, and the row
+* survives a restart, so a turn refused before any session start, or a
+* person's follow-up after a restart, still starts on the kick's wallet.
+* Undefined when no kick ever named one.
+*/
+function resolveRequestedWallet(kickWallet, threadWallet) {
+	return kickWallet ?? threadWallet ?? void 0;
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -293101,6 +293423,16 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 	* detect the mismatch and restart, dropping A's cached token (forge#3597).
 	*/
 	const threadSessionWorkSessionIds = /* @__PURE__ */ new Map();
+	/**
+	* The wallet each LIVE provider session was started with, or null when the
+	* start carried none (CMMD#5917).
+	*
+	* The Claude adapter reads the wallet once, at session start, to decide
+	* whether the session runs on CMMD's Workspace egress or the personal
+	* login. A kick naming a different wallet than the live session's has to
+	* restart it, or the new wallet's turn runs on the old session's credential.
+	*/
+	const threadSessionWallets = /* @__PURE__ */ new Map();
 	const appendProviderFailureActivity = (input) => orchestrationEngine.dispatch({
 		type: "thread.activity.append",
 		commandId: serverCommandId$2("provider-failure-activity"),
@@ -293146,10 +293478,16 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		if (thread.anchorKind === "task" && project?.repositoryIdentity == null && !isGitWorkspace(cwd)) return "Forge created this task thread, but the project folder is not a Git repository yet. Import or link the repository before starting an agent turn.";
 		return null;
 	});
+	/**
+	* Returns the thread id of a live provider session for the thread, starting
+	* one, or restarting the live one when its provider, model, account, Work
+	* Session or wallet no longer matches what this turn asks for.
+	*/
 	const ensureSessionForThread = fn$1("ensureSessionForThread")(function* (threadId, createdAt, options) {
 		const readModel = yield* orchestrationEngine.getReadModel();
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* die$1(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
+		const requestedWallet = resolveRequestedWallet(options?.wallet, thread.wallet);
 		const desiredRuntimeMode = thread.runtimeMode;
 		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const requestedModelSelection = options?.modelSelection;
@@ -293166,10 +293504,12 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			...effectiveCwd ? { cwd: effectiveCwd } : {},
 			modelSelection: desiredModelSelection,
 			...input?.resumeCursor !== void 0 ? { resumeCursor: input.resumeCursor } : {},
-			runtimeMode: desiredRuntimeMode
+			runtimeMode: desiredRuntimeMode,
+			...requestedWallet !== void 0 ? { wallet: requestedWallet } : {}
 		}), () => sync$1(() => {
 			threadSessionAccountIds.set(threadId, readProviderAccountId(desiredModelSelection));
 			threadSessionWorkSessionIds.set(threadId, thread.workSessionId ?? null);
+			threadSessionWallets.set(threadId, requestedWallet ?? threadSessionWallets.get(threadId) ?? null);
 		}));
 		const bindSessionToThread = (session) => setThreadSession({
 			threadId,
@@ -293219,7 +293559,15 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			const currentWorkSessionId = thread.workSessionId ?? null;
 			const sessionWorkSessionId = threadSessionWorkSessionIds.get(threadId);
 			const shouldRestartForWorkSessionChange = threadSessionWorkSessionIds.has(threadId) && sessionWorkSessionId !== currentWorkSessionId;
-			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange && !shouldRestartForWorkSessionChange) return existingSessionThreadId;
+			/**
+			* A kick that names a wallet other than the one the live session started
+			* with restarts it, so the Claude adapter re-decides its egress from the
+			* new wallet (CMMD#5917). A live session this reactor did not start has
+			* no recorded wallet and restarts too, which costs a resume and never
+			* leaves a Workspace turn on a personal session.
+			*/
+			const shouldRestartForWalletChange = requestedWallet !== void 0 && threadSessionWallets.get(threadId) !== requestedWallet;
+			if (!runtimeModeChanged && !providerChanged && !shouldRestartForModelChange && !shouldRestartForModelSelectionChange && !shouldRestartForAccountChange && !shouldRestartForWorkSessionChange && !shouldRestartForWalletChange) return existingSessionThreadId;
 			const resumeCursor = providerChanged || shouldRestartForModelChange ? void 0 : activeSession?.resumeCursor ?? void 0;
 			yield* logInfo("provider command reactor restarting provider session", {
 				threadId,
@@ -293235,9 +293583,10 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				shouldRestartForModelSelectionChange,
 				shouldRestartForAccountChange,
 				shouldRestartForWorkSessionChange,
+				shouldRestartForWalletChange,
 				hasResumeCursor: resumeCursor !== void 0
 			});
-			if (shouldRestartForAccountChange || shouldRestartForWorkSessionChange || providerChanged) yield* providerService.stopSession({
+			if (shouldRestartForAccountChange || shouldRestartForWorkSessionChange || shouldRestartForWalletChange || providerChanged) yield* providerService.stopSession({
 				threadId,
 				preserveResumeState: true
 			});
@@ -293337,6 +293686,11 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 		turnId: input.turnId,
 		cause: pretty(cause)
 	})), onInterrupt(() => releaseTurnStart(input.holdKey)), ensuring(closeTurnStartEventBuffer(input.holdKey, input.events)));
+	/**
+	* Ensures a session with the turn's model and wallet, then sends the turn.
+	* A session-start failure (a refused Workspace egress mint, for one)
+	* propagates to the caller, which records it on the thread.
+	*/
 	const sendTurnForThread = fn$1("sendTurnForThread")(function* (input) {
 		const thread = yield* resolveThread(input.threadId);
 		if (!thread) return { _tag: "skipped" };
@@ -293351,7 +293705,10 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			});
 			return { _tag: "skipped" };
 		}
-		yield* ensureSessionForThread(input.threadId, input.createdAt, input.modelSelection !== void 0 ? { modelSelection: input.modelSelection } : {});
+		yield* ensureSessionForThread(input.threadId, input.createdAt, {
+			...input.modelSelection !== void 0 ? { modelSelection: input.modelSelection } : {},
+			...input.wallet !== void 0 ? { wallet: input.wallet } : {}
+		});
 		if (input.modelSelection !== void 0) threadModelSelections.set(input.threadId, input.modelSelection);
 		const cmmdTaskId = thread.anchorKind === "task" ? thread.anchorCmmdId : null;
 		const cmmdCwd = resolveThreadWorkspaceCwd({
@@ -293563,6 +293920,11 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			...result.title !== void 0 ? { title: result.title } : {}
 		});
 	});
+	/**
+	* Handles one `thread.turn-start-requested` event: validates the workspace,
+	* forks first-turn title and branch generation, then sends the turn with the
+	* event's model selection and wallet and records any failure on the thread.
+	*/
 	const processTurnStartRequested = fn$1("processTurnStartRequested")(function* (event) {
 		const key = turnStartKeyForEvent(event);
 		if (yield* hasHandledTurnStartRecently(key)) return;
@@ -293626,7 +293988,8 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				...message.attachments !== void 0 ? { attachments: message.attachments } : {},
 				...event.payload.modelSelection !== void 0 ? { modelSelection: event.payload.modelSelection } : {},
 				interactionMode: event.payload.interactionMode,
-				createdAt: event.payload.createdAt
+				createdAt: event.payload.createdAt,
+				...event.payload.wallet !== void 0 ? { wallet: event.payload.wallet } : {}
 			}),
 			close: closeTurnStartEventBuffer(turnStartHoldKey, turnStartEvents),
 			onFailure: (cause) => appendProviderFailureActivity({
@@ -299777,7 +300140,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "ba1d9d7ef5237a6a7d52a06b10c4d15f8cff00b8";
+	return "5716c4b70da370f76d24ac48e65aafc1819dd6c1";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -303460,6 +303823,23 @@ function resolveThreadCommandAnchor(input) {
 		anchorCmmdId: null
 	};
 }
+/**
+* `{ wallet }` when a kick names a wallet other than the thread's, otherwise
+* null. Kept out of the decider body so its complexity budget does not grow
+* (CMMD#5917).
+*/
+function turnWalletUpdate(current, requested) {
+	return requested !== void 0 && requested !== current ? { wallet: requested } : null;
+}
+/**
+* `{ wallet }` for a turn-start event: the kick's wallet, else the thread's
+* wallet at acceptance, else nothing, which leaves an older-style event the
+* reactor falls back on thread state for (CMMD#5917).
+*/
+function turnStartWallet(requested, current) {
+	const wallet = requested ?? current ?? void 0;
+	return wallet === void 0 ? {} : { wallet };
+}
 const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function* ({ command, readModel }) {
 	switch (command.type) {
 		case "project.create":
@@ -303622,6 +304002,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 					anchorCmmdId: anchor.anchorCmmdId,
 					workSessionId: command.workSessionId ?? null,
 					...command.workSessionId != null ? { workSessionBoundAt: command.createdAt } : {},
+					...command.wallet !== void 0 ? { wallet: command.wallet } : {},
 					goal: command.goal ?? null,
 					linkedPullRequest: command.linkedPullRequest ?? null,
 					kind,
@@ -303864,6 +304245,9 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 				command,
 				threadId: command.threadId
 			});
+			const isClientOriginTurnStart = command.workSessionId === void 0 || command.workSessionId === null;
+			const threadHasWorkSession = targetThread.workSessionId !== void 0 && targetThread.workSessionId !== null;
+			const authorizedWalletOverride = isClientOriginTurnStart && threadHasWorkSession ? void 0 : command.wallet;
 			const nextAnchor = command.anchorKind !== void 0 || command.anchorCmmdId !== void 0 || command.cmmdTaskId !== void 0 ? resolveThreadCommandAnchor({
 				anchorKind: command.anchorKind,
 				anchorCmmdId: command.anchorCmmdId,
@@ -303924,6 +304308,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 					runtimeMode: targetThread.runtimeMode,
 					interactionMode: targetThread.interactionMode,
 					...sourceProposedPlan !== void 0 ? { sourceProposedPlan } : {},
+					...turnStartWallet(authorizedWalletOverride, targetThread.wallet),
 					createdAt: command.createdAt
 				}
 			};
@@ -303937,7 +304322,8 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 			});
 			const shouldRebindWorkSession = command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId !== targetThread.workSessionId;
 			const shouldAdvanceBoundTimestamp = !shouldRebindWorkSession && command.workSessionId !== void 0 && command.workSessionId !== null && command.workSessionId === targetThread.workSessionId && (targetThread.workSessionBoundAt === null || targetThread.workSessionBoundAt === void 0 || command.createdAt > targetThread.workSessionBoundAt);
-			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession && !shouldAdvanceBoundTimestamp) return [userMessageEvent, turnStartRequestedEvent];
+			const walletUpdate = turnWalletUpdate(targetThread.wallet, authorizedWalletOverride);
+			if (!shouldUpdateAnchor && !turnModelSelection && !shouldRebindWorkSession && !shouldAdvanceBoundTimestamp && !walletUpdate) return [userMessageEvent, turnStartRequestedEvent];
 			return [
 				{
 					...withEventBase({
@@ -303956,6 +304342,7 @@ const decideOrchestrationCommand = fn$1("decideOrchestrationCommand")(function*
 							workSessionId: command.workSessionId,
 							workSessionBoundAt: command.createdAt
 						} : shouldAdvanceBoundTimestamp ? { workSessionBoundAt: command.createdAt } : {},
+						...walletUpdate,
 						updatedAt: command.createdAt
 					}
 				},
@@ -304527,6 +304914,7 @@ function projectEvent(model, event) {
 				anchorCmmdId: payload.anchorCmmdId,
 				workSessionId: payload.workSessionId ?? null,
 				workSessionBoundAt: payload.workSessionBoundAt ?? null,
+				wallet: payload.wallet ?? null,
 				goal: payload.goal ?? null,
 				linkedPullRequest: payload.linkedPullRequest ?? null,
 				titleRegeneration: null,
@@ -304609,6 +304997,7 @@ function projectEvent(model, event) {
 				...payload.titleRegeneration !== void 0 ? { titleRegeneration: payload.titleRegeneration } : {},
 				...payload.workSessionId !== void 0 ? { workSessionId: payload.workSessionId } : {},
 				...payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: payload.workSessionBoundAt } : {},
+				...payload.wallet !== void 0 ? { wallet: payload.wallet } : {},
 				updatedAt: payload.updatedAt
 			})
 		})));
@@ -305630,6 +306019,14 @@ const ProjectionThreadDbRow = ProjectionThread.mapFields(assign({
 	rateLimitStatus: fromJsonString(ArraySchema(ThreadProviderRateLimitStatus)),
 	linkedPullRequest: NullOr(fromJsonString(LinkedPullRequest))
 }));
+/**
+* The `wallet` column value: the row's wallet, or SQL null when it has none.
+* Module-level so the upsert's own complexity budget does not grow
+* (CMMD#5917).
+*/
+function walletColumn(wallet) {
+	return wallet ?? null;
+}
 const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(function* () {
 	const sql = yield* SqlClient;
 	const upsertProjectionThreadRow = void_({
@@ -305661,6 +306058,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_cmmd_id,
           work_session_id,
           work_session_bound_at,
+          wallet,
           linked_pull_request_json,
           status,
           worker_role,
@@ -305695,6 +306093,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           ${row.anchorCmmdId},
           ${row.workSessionId ?? null},
           ${row.workSessionBoundAt ?? null},
+          ${walletColumn(row.wallet)},
           ${row.linkedPullRequest == null ? null : JSON.stringify(row.linkedPullRequest)},
           ${row.status},
           ${row.workerRole},
@@ -305729,6 +306128,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_cmmd_id = excluded.anchor_cmmd_id,
           work_session_id = excluded.work_session_id,
           work_session_bound_at = excluded.work_session_bound_at,
+          wallet = excluded.wallet,
           linked_pull_request_json = excluded.linked_pull_request_json,
           status = excluded.status,
           worker_role = excluded.worker_role,
@@ -305768,6 +306168,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -305809,6 +306210,7 @@ const ProjectionThreadRepositoryLive = effect(ProjectionThreadRepository, gen(fu
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -305998,6 +306400,13 @@ function collectThreadUserInputAttachmentRelativePaths(threadId, events) {
 function projectedWorkSessionId(workSessionId) {
 	return workSessionId ?? null;
 }
+/**
+* Coalesces an optional wallet to the persisted default, top-level for the
+* same complexity reason as `projectedWorkSessionId` (CMMD#5917).
+*/
+function projectedWallet(wallet) {
+	return wallet ?? null;
+}
 const runAttachmentSideEffects = fn$1("runAttachmentSideEffects")(function* (sideEffects) {
 	const serverConfig = yield* service(ServerConfig);
 	const fileSystem = yield* service(FileSystem);
@@ -306162,6 +306571,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					anchorCmmdId: event.payload.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(event.payload.workSessionId),
 					workSessionBoundAt: event.payload.workSessionBoundAt ?? null,
+					wallet: projectedWallet(event.payload.wallet),
 					linkedPullRequest: event.payload.linkedPullRequest ?? null,
 					status: event.payload.status,
 					workerRole: event.payload.workerRole,
@@ -306201,6 +306611,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					anchorCmmdId: thread.anchorCmmdId,
 					workSessionId: projectedWorkSessionId(thread.workSessionId),
 					workSessionBoundAt: thread.workSessionBoundAt ?? null,
+					wallet: projectedWallet(thread.wallet),
 					linkedPullRequest: thread.linkedPullRequest ?? null,
 					status: thread.status,
 					workerRole: thread.workerRole,
@@ -306271,6 +306682,7 @@ const OrchestrationProjectionPipelineLive = effect(OrchestrationProjectionPipeli
 					...event.payload.titleRegeneration !== void 0 ? { titleRegeneration: event.payload.titleRegeneration } : {},
 					...event.payload.workSessionId !== void 0 ? { workSessionId: projectedWorkSessionId(event.payload.workSessionId) } : {},
 					...event.payload.workSessionBoundAt !== void 0 ? { workSessionBoundAt: event.payload.workSessionBoundAt } : {},
+					...event.payload.wallet !== void 0 ? { wallet: event.payload.wallet } : {},
 					updatedAt: event.payload.updatedAt
 				});
 				return;
@@ -307286,6 +307698,13 @@ function workSessionIdField(workSessionId) {
 function workSessionBoundAtField(workSessionBoundAt) {
 	return workSessionBoundAt !== void 0 ? { workSessionBoundAt } : {};
 }
+/**
+* `{ wallet }` when the row carries one, an empty object when absent. Mirrors
+* `workSessionIdField` so `exactOptionalPropertyTypes` is satisfied (CMMD#5917).
+*/
+function walletField(wallet) {
+	return wallet !== void 0 ? { wallet } : {};
+}
 const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQuery, gen(function* () {
 	const sql = yield* SqlClient;
 	const repositoryIdentityResolver = yield* RepositoryIdentityResolver;
@@ -307340,6 +307759,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307380,6 +307800,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307486,6 +307907,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -307820,6 +308242,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           anchor_cmmd_id AS "anchorCmmdId",
           work_session_id AS "workSessionId",
           work_session_bound_at AS "workSessionBoundAt",
+          wallet,
           linked_pull_request_json AS "linkedPullRequest",
           status,
           worker_role AS "workerRole",
@@ -308134,6 +308557,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			anchorCmmdId: row.anchorCmmdId,
 			...workSessionIdField(row.workSessionId),
 			...workSessionBoundAtField(row.workSessionBoundAt),
+			...walletField(row.wallet),
 			linkedPullRequest: row.linkedPullRequest,
 			kind: row.kind,
 			parentThreadId: row.parentThreadId,
@@ -308385,6 +308809,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 			anchorCmmdId: threadRow.value.anchorCmmdId,
 			...workSessionIdField(threadRow.value.workSessionId),
 			...workSessionBoundAtField(threadRow.value.workSessionBoundAt),
+			...walletField(threadRow.value.wallet),
 			linkedPullRequest: threadRow.value.linkedPullRequest,
 			kind: threadRow.value.kind,
 			parentThreadId: threadRow.value.parentThreadId,
@@ -325243,7 +325668,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},