@cmmd-center/forge 0.13.14 → 0.13.15

package/dist/bin.mjs

@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -26921,6 +26921,44 @@ function encodeCmmdRuntimeWorktreeLaunchActivityPayload(kind, payload) {
 function isCmmdRuntimeWorktreeLaunchActivityKind(kind) {
 	return WORKTREE_LAUNCH_ACTIVITY_KINDS.has(kind);
 }
+/**
+* A plan update rides the `tool_call` event kind because the forge-context
+* contract has no plan event kind, the same trade the launch rows make. The
+* steps are carried verbatim under a versioned marker so a cloud client can
+* rebuild the composer plan banner from the durable replica. (#3319)
+*/
+const CMMD_RUNTIME_PLAN_ACTIVITY_KIND = "turn.plan.updated";
+function encodeCmmdRuntimePlanActivityPayload(kind, payload) {
+	return {
+		...isRecord$23(payload) ? payload : { sourcePayload: payload },
+		forgePlanActivity: {
+			schemaVersion: 1,
+			source: "native",
+			kind
+		}
+	};
+}
+function decodeCmmdRuntimePlanActivity(payload) {
+	if (!isRecord$23(payload)) return null;
+	const metadata = payload["forgePlanActivity"];
+	if (!isRecord$23(metadata)) return null;
+	if (metadata["schemaVersion"] !== 1 || metadata["source"] !== "native" || metadata["kind"] !== "turn.plan.updated") return null;
+	const rawPlan = payload["plan"];
+	return {
+		kind: CMMD_RUNTIME_PLAN_ACTIVITY_KIND,
+		plan: Array.isArray(rawPlan) ? rawPlan.flatMap((entry) => {
+			if (!isRecord$23(entry)) return [];
+			const step = entry["step"];
+			const status = entry["status"];
+			if (typeof step !== "string" || step.trim().length === 0) return [];
+			if (status !== "pending" && status !== "inProgress" && status !== "completed") return [];
+			return [{
+				step,
+				status
+			}];
+		}) : []
+	};
+}
 //#endregion
 //#region ../../packages/contracts/src/cmmdProjectPatch.ts
 const CMMD_PROJECT_PATCH_FIELDS = {
@@ -50697,7 +50735,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53140,7 +53178,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53162,7 +53200,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66085,7 +66123,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.14";
+var version$1 = "0.13.15";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -66965,6 +67003,121 @@ function verifyCmmdForgeCloudOwnerAssertion(token, publicKeyPem, expectedKeyId,
 	};
 }
 //#endregion
+//#region src/observability/Attributes.ts
+function isPlainObject$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function markSeen(value, seen) {
+	if (seen.has(value)) return true;
+	seen.add(value);
+	return false;
+}
+function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
+	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
+	if (typeof value === "bigint") return value.toString();
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
+	if (value instanceof Error) return {
+		name: value.name,
+		message: value.message,
+		...value.stack ? { stack: value.stack } : {}
+	};
+	if (Array.isArray(value)) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return value.map((entry) => normalizeJsonValue(entry, seen));
+	}
+	if (value instanceof Map) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
+	}
+	if (value instanceof Set) {
+		if (markSeen(value, seen)) return "[Circular]";
+		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
+	}
+	if (!isPlainObject$1(value)) return String(value);
+	if (markSeen(value, seen)) return "[Circular]";
+	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
+}
+function compactTraceAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
+}
+function compactMetricAttributes(attributes) {
+	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
+		if (value === void 0 || value === null) return [];
+		if (typeof value === "string") return [[key, value]];
+		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
+		return [];
+	}));
+}
+function outcomeFromExit(exit) {
+	if (isSuccess(exit)) return "success";
+	return hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
+}
+function normalizeModelMetricLabel(model) {
+	const normalized = model?.trim().toLowerCase();
+	if (!normalized) return;
+	if (normalized.includes("gpt")) return "gpt";
+	if (normalized.includes("claude")) return "claude";
+	if (normalized.includes("gemini")) return "gemini";
+	return "other";
+}
+//#endregion
+//#region src/observability/Metrics.ts
+const rpcRequestsTotal = counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
+const rpcRequestDuration = timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
+const orchestrationCommandsTotal = counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
+const orchestrationCommandDuration = timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
+const orchestrationCommandAckDuration = timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
+const orchestrationEventsProcessedTotal = counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
+const providerSessionsTotal = counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
+const providerTurnsTotal = counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
+const providerTurnDuration = timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
+const providerRuntimeEventsTotal = counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
+const gitCommandsTotal = counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
+const gitCommandDuration = timer("t3_git_command_duration", { description: "Git command execution duration." });
+const terminalSessionsTotal = counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
+const browserSessionsReapedTotal = counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
+const terminalRestartsTotal = counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
+const runtimeReplicationOutboxDepth = gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
+const runtimeReplicationOutboxOldestEventAge = gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
+const runtimeReplicationPublicationAttemptsTotal = counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
+const runtimeReplicationPublicationRetriesTotal = counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
+const runtimeReplicationPublicationLatency = timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
+const cmmdCredentialRefreshTotal = counter("t3_cmmd_credential_refresh_total", { description: "CMMD JWT refresh attempts for a Forge session, by rung (self-refresh | grant-redemption) and outcome (attempted | succeeded)." });
+const cmmdRotationFenceAppliedTotal = counter("t3_cmmd_rotation_fence_applied_total", { description: "Sessions Forge refused to rotate CMMD credentials for, because the rotation fence applied." });
+const cmmdCredentialRowDeletedTotal = counter("t3_cmmd_credential_row_deleted_total", { description: "command_access_tokens rows actually deleted by clearUnrecoverableCmmdAuthForSession, by reason." });
+const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
+const increment = (metric, attributes, amount = 1) => update$3(withAttributes(metric, metricAttributes(attributes)), amount);
+const withMetricsImpl = (effect, options) => gen(function* () {
+	const startedAt = Date.now();
+	const exit$2 = yield* exit(effect);
+	const duration = millis(Math.max(0, Date.now() - startedAt));
+	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
+	if (options.timer) yield* update$3(withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
+	if (options.counter) {
+		const outcome = outcomeFromExit(exit$2);
+		yield* update$3(withAttributes(options.counter, metricAttributes({
+			...baseAttributes,
+			outcome,
+			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
+		})), 1);
+	}
+	if (isSuccess(exit$2)) return exit$2.value;
+	return yield* failCause$1(exit$2.cause);
+});
+const withMetrics = dual(2, withMetricsImpl);
+const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
+	provider,
+	...extra
+});
+const providerTurnMetricAttributes = (input) => {
+	const modelFamily = normalizeModelMetricLabel(input.model);
+	return compactMetricAttributes({
+		provider: input.provider,
+		...modelFamily ? { modelFamily } : {},
+		...input.extra
+	});
+};
+//#endregion
 //#region src/persistence/Errors.ts
 var PersistenceSqlError = class extends TaggedErrorClass()("PersistenceSqlError", {
 	operation: String$1,
@@ -67655,8 +67808,14 @@ const scheduleExpiredForgeCloudOwnerCredentialMaintenance = sleep$4(minutes(5)).
 *
 * Clearing every active owner row unconditionally (the pre-CMMD-1871 behaviour)
 * turned a single expired tab into a sign-out on every browser and device.
+*
+* Destroys a refresh token good for months, so every call is logged with a
+* `reason` naming the caller's own decision (never the credential itself) and
+* the actual row count deleted, at info level so it shows up without raising
+* the server's log level. `reason` is optional only so a caller that has not
+* been updated yet still compiles; every current caller passes one.
 */
-const clearUnrecoverableCmmdAuthForSession = (sessionId) => gen(function* () {
+const clearUnrecoverableCmmdAuthForSession = (sessionId, reason) => gen(function* () {
 	const sql = yield* SqlClient;
 	const rows = yield* sql`
       DELETE FROM command_access_tokens
@@ -67681,6 +67840,14 @@ const clearUnrecoverableCmmdAuthForSession = (sessionId) => gen(function* () {
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.clearUnrecoverableCmmdAuth:query")));
 	forgetCommandAccessTokenCachesForSession(sessionId);
 	for (const row of rows) forgetCommandAccessTokenCachesForSession(row.sessionId);
+	if (rows.length > 0) {
+		yield* logInfo("CMMD credential row deleted.", {
+			sessionId,
+			reason: reason ?? "unspecified",
+			rowsDeleted: rows.length
+		});
+		yield* update$3(withAttributes(cmmdCredentialRowDeletedTotal, metricAttributes({ reason: reason ?? "unspecified" })), rows.length);
+	}
 });
 /**
 * Retire refresh credentials copied into historical desktop bearer sessions.
@@ -67736,6 +67903,23 @@ const isDesktopBearerAuthSession = (sessionId) => gen(function* () {
     `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.isDesktopBearerSession:query")));
 	return rows[0]?.method === "bearer-session-token" && rows[0].clientDeviceType === "desktop";
 });
+/**
+* The device type a session's bearer bootstrap declared, for log lines only.
+*
+* Mirrors `isDesktopBearerAuthSession`'s read but returns the raw column
+* instead of collapsing it into a rotation verdict — a log line wants to say
+* what made the request, not whether Forge may rotate for it. Never fails:
+* an unreadable or missing row logs as `"unknown"` rather than losing the
+* decision-point log line it is attached to.
+*/
+const readClientDeviceTypeForSession = (sessionId) => gen(function* () {
+	return (yield* (yield* SqlClient)`
+      SELECT client_device_type AS "clientDeviceType"
+      FROM auth_sessions
+      WHERE session_id = ${sessionId}
+      LIMIT 1
+    `.pipe(mapError(toPersistenceSqlError("CommandAccessTokenStore.readClientDeviceType:query"))))[0]?.clientDeviceType ?? "unknown";
+}).pipe(orElseSucceed(() => "unknown"));
 //#endregion
 //#region src/auth/http/oauthCookies.ts
 const OAUTH_STATE_COOKIE = "forge_oauth_state";
@@ -67938,9 +68122,20 @@ const authLogoutRouteLayer = add$1("POST", "/api/auth/logout", gen(function* ()
 		onSuccess: (session) => session.sessionId
 	}));
 	if (sessionId) {
+		yield* logInfo("Auth logout.", {
+			sessionId,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			outcome: "session-cleared",
+			reason: cloudShell ? "forge-cloud-shell-session" : "local-session"
+		});
 		if (!cloudShell) yield* sessions.revoke(sessionId).pipe(ignore({ log: false }));
 		yield* clearCommandAccessTokenForSession(sessionId).pipe(ignore({ log: false }));
-	}
+	} else yield* logInfo("Auth logout.", {
+		sessionId: null,
+		deviceType: "unknown",
+		outcome: "no-op",
+		reason: "no authenticated session presented"
+	});
 	const secure = shouldUseSecureCookie(forgePublicUrlForRequest(request));
 	let response = yield* jsonUnsafe({ loggedOut: true }, { status: 200 }).pipe(setCookie(sessions.cookieName, "", {
 		expires: /* @__PURE__ */ new Date(0),
@@ -68539,16 +68734,32 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	if (limited) return limited;
 	const serverAuth = yield* ServerAuth;
 	const sessions = yield* SessionCredentialService;
-	if (serverAuth.isForgeCloudShell?.() === true) return yield* new AuthError({
-		message: "Forge Cloud accepts owner assertions from CMMD only.",
-		status: 403
-	});
+	if (serverAuth.isForgeCloudShell?.() === true) {
+		yield* logWarning$1("CMMD bearer bootstrap failed.", {
+			deviceType: "unknown",
+			outcome: "failed",
+			reason: "forge-cloud-shell-rejects-non-cmmd-bootstrap"
+		});
+		return yield* new AuthError({
+			message: "Forge Cloud accepts owner assertions from CMMD only.",
+			status: 403
+		});
+	}
 	const payload = yield* schemaBodyJson(CommandBootstrapInput).pipe(mapError((cause) => new AuthError({
 		message: "Invalid CMMD OAuth bearer bootstrap payload.",
 		status: 400,
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType: "unknown",
+		outcome: "failed",
+		reason: "invalid-payload"
+	})));
+	const deviceType = payload.clientDeviceType ?? "desktop";
+	const validated = yield* validateCommandBootstrapPayload(payload).pipe(tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "invalid-command-bootstrap-payload"
 	})));
-	const validated = yield* validateCommandBootstrapPayload(payload);
 	const sessionSubject = resolveCommandOAuthSubject(validated.subjectUserId);
 	const issued = yield* sessions.issue({
 		method: "bearer-session-token",
@@ -68561,20 +68772,34 @@ const authCommandBearerBootstrapRouteLayer = add$1("POST", "/api/auth/bootstrap/
 	}).pipe(mapError((cause) => new AuthError({
 		message: "Failed to issue authenticated bearer session.",
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		deviceType,
+		outcome: "failed",
+		reason: "session-issuance-failed"
 	})));
 	const cmmdIdentity = yield* persistCommandBootstrapSessionArtifacts({
 		sessionId: issued.sessionId,
 		payload,
 		cmmdIdentity: validated.cmmdIdentity
 	});
-	if ((payload.clientDeviceType ?? "desktop") === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
+	if (deviceType === "desktop" && !payload.refreshToken?.trim()) yield* clearDesktopBearerRefreshTokensForSubject({
 		subject: sessionSubject,
 		clientUserAgent: request.headers["user-agent"]
 	}).pipe(mapError((cause) => new AuthError({
 		message: "Failed to retire legacy desktop refresh credentials.",
 		status: 500,
 		cause
+	})), tapError(() => logWarning$1("CMMD bearer bootstrap failed.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "failed",
+		reason: "legacy-desktop-refresh-retirement-failed"
 	})));
+	yield* logInfo("CMMD bearer bootstrap succeeded.", {
+		sessionId: issued.sessionId,
+		deviceType,
+		outcome: "succeeded"
+	});
 	return jsonUnsafe({
 		authenticated: true,
 		role: issued.role,
@@ -69865,64 +70090,6 @@ function parseAttachmentIdFromRelativePath(relativePath) {
 	return id.length > 0 && !id.includes(".") ? id : null;
 }
 //#endregion
-//#region src/observability/Attributes.ts
-function isPlainObject$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function markSeen(value, seen) {
-	if (seen.has(value)) return true;
-	seen.add(value);
-	return false;
-}
-function normalizeJsonValue(value, seen = /* @__PURE__ */ new WeakSet()) {
-	if (value === null || value === void 0 || typeof value === "string" || typeof value === "number" || typeof value === "boolean") return value ?? null;
-	if (typeof value === "bigint") return value.toString();
-	if (value instanceof Date) return Number.isNaN(value.getTime()) ? "Invalid Date" : value.toISOString();
-	if (value instanceof Error) return {
-		name: value.name,
-		message: value.message,
-		...value.stack ? { stack: value.stack } : {}
-	};
-	if (Array.isArray(value)) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return value.map((entry) => normalizeJsonValue(entry, seen));
-	}
-	if (value instanceof Map) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Object.fromEntries(Array.from(value.entries(), ([key, entryValue]) => [String(key), normalizeJsonValue(entryValue, seen)]));
-	}
-	if (value instanceof Set) {
-		if (markSeen(value, seen)) return "[Circular]";
-		return Array.from(value.values(), (entry) => normalizeJsonValue(entry, seen));
-	}
-	if (!isPlainObject$1(value)) return String(value);
-	if (markSeen(value, seen)) return "[Circular]";
-	return Object.fromEntries(Object.entries(value).map(([key, entryValue]) => [key, normalizeJsonValue(entryValue, seen)]));
-}
-function compactTraceAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).filter(([, value]) => value !== void 0).map(([key, value]) => [key, normalizeJsonValue(value)]));
-}
-function compactMetricAttributes(attributes) {
-	return Object.fromEntries(Object.entries(attributes).flatMap(([key, value]) => {
-		if (value === void 0 || value === null) return [];
-		if (typeof value === "string") return [[key, value]];
-		if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") return [[key, String(value)]];
-		return [];
-	}));
-}
-function outcomeFromExit(exit) {
-	if (isSuccess(exit)) return "success";
-	return hasInterruptsOnly(exit.cause) ? "interrupt" : "failure";
-}
-function normalizeModelMetricLabel(model) {
-	const normalized = model?.trim().toLowerCase();
-	if (!normalized) return;
-	if (normalized.includes("gpt")) return "gpt";
-	if (normalized.includes("claude")) return "claude";
-	if (normalized.includes("gemini")) return "gemini";
-	return "other";
-}
-//#endregion
 //#region src/observability/TraceRecord.ts
 function formatTraceExit(exit) {
 	if (isSuccess(exit)) return { _tag: "Success" };
@@ -70978,6 +71145,22 @@ async function readOAuthErrorCode(response) {
 //#endregion
 //#region src/command/cmmdRotationFence.ts
 /**
+* Log and count a fence application, without changing the verdict it reports.
+*
+* The two facts named in the log line are exactly the ones the predicate
+* above the caller already computed — whether this session ever deposited a
+* refresh token of its own, and (only when that was false) whether the
+* session row reads as a desktop bearer session. Neither fact nor the log
+* line changes what the caller returns.
+*/
+function logRotationFenceApplied(input) {
+	return logInfo("CMMD rotation fence applied: session may not rotate its own credential.", {
+		sessionId: input.sessionId,
+		hasStoredRefreshToken: input.hasStoredRefreshToken,
+		isDesktopBearerSession: input.isDesktopBearerSession
+	}).pipe(andThen(() => update$3(withAttributes(cmmdRotationFenceAppliedTotal, metricAttributes({})), 1)));
+}
+/**
 * True when Forge must not rotate this session's CMMD credentials.
 *
 * Fails closed: if the session row cannot be read, assume the fence applies.
@@ -70985,8 +71168,22 @@ async function readOAuthErrorCode(response) {
 * reconnect.
 */
 function isRotationFencedSession(sessionId) {
-	if (readCommandRefreshTokenForSession(sessionId)) return succeed(false);
-	return isDesktopBearerAuthSession(sessionId).pipe(orElseSucceed(() => true));
+	const hasStoredRefreshToken = readCommandRefreshTokenForSession(sessionId) !== null;
+	if (hasStoredRefreshToken) return succeed(false);
+	return isDesktopBearerAuthSession(sessionId).pipe(match$1({
+		onFailure: () => ({
+			fenced: true,
+			isDesktopBearerSession: null
+		}),
+		onSuccess: (isDesktopBearerSession) => ({
+			fenced: isDesktopBearerSession,
+			isDesktopBearerSession
+		})
+	}), tap(({ fenced, isDesktopBearerSession }) => fenced ? logRotationFenceApplied({
+		sessionId,
+		hasStoredRefreshToken,
+		isDesktopBearerSession
+	}) : void_$1), map$3(({ fenced }) => fenced));
 }
 //#endregion
 //#region src/cmmdConnection/cmmdCredentialRejection.ts
@@ -71023,7 +71220,7 @@ function forgetCmmdCredentialRejection(sessionId) {
 */
 const clearCmmdAuthAfterCmmdRejection = (sessionId) => gen(function* () {
 	if (!hasCmmdCredentialRejection(sessionId)) return;
-	yield* clearUnrecoverableCmmdAuthForSession(sessionId);
+	yield* clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-rejected-credential");
 	forgetCmmdCredentialRejection(sessionId);
 });
 //#endregion
@@ -71034,6 +71231,23 @@ function usableCmmdUserJwt(token) {
 function storeResolvedJwt(sessionId, accessToken, refreshToken) {
 	return setCommandJwtForSession(sessionId, accessToken, refreshToken ? { refreshToken } : {}).pipe(ignore({ log: true }));
 }
+function logCmmdJwtRung(context, rung, outcome, reason) {
+	return (outcome === "failed" ? logWarning$1 : logInfo)("CMMD JWT resolver rung.", {
+		sessionId: context.sessionId,
+		subject: context.subject,
+		deviceType: context.deviceType,
+		caller: context.caller,
+		rung,
+		outcome,
+		reason
+	});
+}
+function recordCmmdCredentialRefreshMetric(rung, outcome) {
+	return update$3(withAttributes(cmmdCredentialRefreshTotal, metricAttributes({
+		rung,
+		outcome
+	})), 1);
+}
 const inFlightRefreshes = /* @__PURE__ */ new Map();
 function refreshOnceForSession(sessionId, refreshToken) {
 	return promise(() => {
@@ -71055,15 +71269,21 @@ function refreshOnceForSession(sessionId, refreshToken) {
 * sibling session's token silently invalidates that sibling's stored copy and
 * signs it out.
 */
-function trySelfRefresh(sessionId, logPrefix) {
+function trySelfRefresh(sessionId, context) {
 	const currentRefreshToken = readCommandRefreshTokenForSession(sessionId);
-	if (!currentRefreshToken) return succeed(null);
+	if (!currentRefreshToken) return logCmmdJwtRung(context, "self-refresh", "skipped", "no refresh token stored for this session").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "self-refresh", "attempted", "rotating this session's own stored refresh token");
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "attempted");
 		const refreshed = yield* refreshOnceForSession(sessionId, currentRefreshToken);
 		const accessToken = usableCmmdUserJwt(refreshed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "self-refresh", "failed", "CMMD refresh did not return a usable user access JWT");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, accessToken, refreshed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD JWT refreshed for session ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("self-refresh", "succeeded");
+		yield* logCmmdJwtRung(context, "self-refresh", "succeeded", "CMMD rotated the stored refresh token");
 		return accessToken;
 	});
 }
@@ -71080,16 +71300,22 @@ function trySelfRefresh(sessionId, logPrefix) {
 * CMMD owns its lifetime, and a transient network failure must not throw away
 * the one credential that can still recover the session.
 */
-function tryGrantRedemption(sessionId, logPrefix) {
+function tryGrantRedemption(sessionId, context) {
 	const grantToken = readCommandSessionGrantForSession(sessionId);
-	if (!grantToken) return succeed(null);
+	if (!grantToken) return logCmmdJwtRung(context, "grant-redemption", "skipped", "no session grant stored for this session").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "grant-redemption", "attempted", "redeeming this session's durable CMMD session grant");
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "attempted");
 		const redeemed = yield* promise(() => redeemCmmdSessionGrant(grantToken)).pipe(orElseSucceed(() => null));
 		const accessToken = usableCmmdUserJwt(redeemed?.accessToken);
-		if (!accessToken) return null;
+		if (!accessToken) {
+			yield* logCmmdJwtRung(context, "grant-redemption", "failed", "session grant redemption did not return a usable user access JWT");
+			return null;
+		}
 		if (redeemed?.mcpToken) yield* setCommandAccessTokenForSession(sessionId, redeemed.mcpToken).pipe(ignore({ log: true }));
 		yield* storeResolvedJwt(sessionId, accessToken, redeemed?.refreshToken);
-		console.log(`[${logPrefix}] CMMD credentials recovered via session grant for ${sessionId}`);
+		yield* recordCmmdCredentialRefreshMetric("grant-redemption", "succeeded");
+		yield* logCmmdJwtRung(context, "grant-redemption", "succeeded", "session grant redeemed");
 		return accessToken;
 	});
 }
@@ -71100,23 +71326,28 @@ function tryGrantRedemption(sessionId, logPrefix) {
 * fallback for when that rotation is already gone. Neither touches another
 * session's credentials, so this ladder is safe to run from any path.
 */
-function tryOwnCredentialRecovery(sessionId, logPrefix) {
+function tryOwnCredentialRecovery(sessionId, context) {
 	return gen(function* () {
-		const refreshed = yield* trySelfRefresh(sessionId, logPrefix);
+		const refreshed = yield* trySelfRefresh(sessionId, context);
 		if (refreshed) return refreshed;
-		return yield* tryGrantRedemption(sessionId, logPrefix);
+		return yield* tryGrantRedemption(sessionId, context);
 	});
 }
-function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
-	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return succeed(null);
+function tryPromoteBootstrap(sessionId, subject, forceRefresh, context) {
+	if (subject !== "owner-bootstrap" && subject !== "desktop-bootstrap") return logCmmdJwtRung(context, "promote-bootstrap", "skipped", "subject is not a bootstrap subject").pipe(as$3(null));
 	return gen(function* () {
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "attempted", "promoting the most recent owner CMMD auth to this bootstrap session");
 		yield* promoteMostRecentOwnerCommandAuthToSession(sessionId).pipe(catch_((error) => logWarning$1("Failed to promote owner CMMD auth for REST JWT resolution.", {
 			cause: error,
 			sessionId,
 			subject
 		})));
 		const promotedJwt = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
-		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) return promotedJwt;
+		if (!forceRefresh && promotedJwt && !isJwtExpiredForSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "promote-bootstrap", "succeeded", "promoted owner JWT is usable");
+			return promotedJwt;
+		}
+		yield* logCmmdJwtRung(context, "promote-bootstrap", "failed", forceRefresh ? "forced refresh: a promoted JWT is never reused as-is" : "no promoted JWT available, or it is already expired");
 		return null;
 	});
 }
@@ -71129,17 +71360,50 @@ function tryPromoteBootstrap(sessionId, subject, forceRefresh) {
 * must stay private to the session it was issued to (see `trySelfRefresh`).
 * Copying it is what let one expired tab sign the user out everywhere.
 */
-function trySubjectFallback(sessionId, subject, logPrefix) {
+function trySubjectFallback(sessionId, subject, context) {
 	return gen(function* () {
-		const fallback = yield* readMostRecentJwtForSubject(subject).pipe(orElseSucceed(() => null));
-		const fallbackJwt = usableCmmdUserJwt(fallback?.jwt);
-		if (!fallbackJwt) return null;
+		yield* logCmmdJwtRung(context, "subject-fallback", "attempted", "looking for a sibling session's still-valid JWT for this subject");
+		const fallbackJwt = usableCmmdUserJwt((yield* readMostRecentJwtForSubject(subject).pipe(orElseSucceed(() => null)))?.jwt);
+		if (!fallbackJwt) {
+			yield* logCmmdJwtRung(context, "subject-fallback", "failed", "no sibling session holds a still-valid JWT for this subject");
+			return null;
+		}
 		yield* storeResolvedJwt(sessionId, fallbackJwt, null);
-		console.log(`[${logPrefix}] JWT subject-fallback promoted for session ${sessionId} (owner: ${fallback?.sessionId})`);
+		yield* logCmmdJwtRung(context, "subject-fallback", "succeeded", "borrowed a sibling session's still-valid JWT");
 		return fallbackJwt;
 	});
 }
 /**
+* The rungs below the rotation fence: forced own-credential recovery,
+* bootstrap promotion, subject fallback, then own-credential recovery again
+* as the last resort. Split out of `resolveCmmdJwtForSession` so each half of
+* the ladder stays independently readable (and independently testable) —
+* the fence check above is the one decision the split does not touch.
+*/
+function runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context) {
+	return gen(function* () {
+		if (forceRefresh) {
+			const forced = yield* tryOwnCredentialRecovery(sessionId, context);
+			if (forced) return forced;
+		}
+		if (normalizedSubject) {
+			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh, context);
+			if (promoted) return promoted;
+		}
+		if (!normalizedSubject) {
+			yield* logCmmdJwtRung(context, "cache", "failed", "no subject to resolve and forced recovery already exhausted");
+			return null;
+		}
+		if (!forceRefresh) {
+			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, context);
+			if (fallback) return fallback;
+		}
+		const recovered = yield* tryOwnCredentialRecovery(sessionId, context);
+		if (!recovered) yield* logCmmdJwtRung(context, "cache", "failed", "recovery ladder exhausted: no rung produced a usable JWT");
+		return recovered;
+	});
+}
+/**
 * Resolve the CMMD REST JWT for a Forge session.
 *
 * Forge session auth is long-lived compared with the short-lived CMMD JWT.
@@ -71153,26 +71417,30 @@ function resolveCmmdJwtForSession({ sessionId, subject, logPrefix = "cmmd-auth",
 	const cached = usableCmmdUserJwt(readCommandJwtForSession(sessionId));
 	if (cached && !isJwtExpiredForSession(sessionId)) {
 		if (!forceRefresh) return succeed(cached);
-		if (staleAccessToken && cached !== staleAccessToken) return succeed(cached);
+		if (staleAccessToken && cached !== staleAccessToken) return succeed(cached).pipe(tap(() => gen(function* () {
+			const deviceType = yield* readClientDeviceTypeForSession(sessionId);
+			yield* logCmmdJwtRung({
+				sessionId,
+				subject: subject?.trim() || null,
+				deviceType,
+				caller: logPrefix
+			}, "cache", "skipped", "forced refresh skipped: cache already holds a token another caller rotated");
+		})));
 	}
 	const normalizedSubject = subject?.trim() || null;
 	if (!normalizedSubject && !forceRefresh) return succeed(null);
 	return gen(function* () {
-		if (yield* isRotationFencedSession(sessionId)) return null;
-		if (forceRefresh) {
-			const forced = yield* tryOwnCredentialRecovery(sessionId, logPrefix);
-			if (forced) return forced;
-		}
-		if (normalizedSubject) {
-			const promoted = yield* tryPromoteBootstrap(sessionId, normalizedSubject, forceRefresh);
-			if (promoted) return promoted;
-		}
-		if (!normalizedSubject) return null;
-		if (!forceRefresh) {
-			const fallback = yield* trySubjectFallback(sessionId, normalizedSubject, logPrefix);
-			if (fallback) return fallback;
+		const context = {
+			sessionId,
+			subject: normalizedSubject,
+			deviceType: yield* readClientDeviceTypeForSession(sessionId),
+			caller: logPrefix
+		};
+		if (yield* isRotationFencedSession(sessionId)) {
+			yield* logCmmdJwtRung(context, "rotation-fence", "failed", "session is fenced from rotating CMMD credentials");
+			return null;
 		}
-		return yield* tryOwnCredentialRecovery(sessionId, logPrefix);
+		return yield* runRecoveryLadder(sessionId, normalizedSubject, forceRefresh, context);
 	});
 }
 //#endregion
@@ -71909,9 +72177,14 @@ function buildProxyErrorResponse(error) {
 * warning rather than failing the request if the clear itself errors — a
 * session that already has no usable credential must still get its 401,
 * not a 500 from a failed best-effort cleanup.
+*
+* Reached only after CMMD itself rejected the request with both the original
+* and (if retried) the refreshed JWT, so — unlike `respondCmmdConnectionRequired`
+* below — this always deletes the row. `clearUnrecoverableCmmdAuthForSession`
+* logs the row count and the reason itself; this only names the reason.
 */
 function clearCmmdAuthAfterFailure(sessionId) {
-	return clearUnrecoverableCmmdAuthForSession(sessionId).pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
+	return clearUnrecoverableCmmdAuthForSession(sessionId, "cmmd-proxy-auth-error").pipe(catch_((error) => logWarning$1("Failed to clear unrecoverable CMMD auth after CMMD auth failure.", {
 		cause: error,
 		sessionId
 	})));
@@ -71932,7 +72205,7 @@ function clearCmmdAuthAfterFailure(sessionId) {
 * refused the credential, which `clearCmmdAuthAfterCmmdRejection` checks.
 */
 function respondCmmdConnectionRequired(sessionId) {
-	return clearCmmdAuthAfterCmmdRejection(sessionId).pipe(catch_((error) => logWarning$1("Failed to clear CMMD auth that CMMD itself rejected.", {
+	return logInfo("CMMD proxy request answered CMMD_AUTH_REQUIRED.", { sessionId }).pipe(andThen(() => clearCmmdAuthAfterCmmdRejection(sessionId)), catch_((error) => logWarning$1("Failed to clear CMMD auth that CMMD itself rejected.", {
 		cause: error,
 		sessionId
 	})), as$3(buildProxyErrorResponse(new CmmdProxyAuthenticationRequiredError("CMMD connection required. Reconnect CMMD to continue."))));
@@ -75698,7 +75971,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75706,8 +75979,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93889,7 +94162,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-D8mGyWmt.mjs"),
+		try: () => import("./open-FIgTDosf.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -94672,60 +94945,6 @@ const dispatchBootstrapTurnStart = (input, command) => gen(function* () {
 */
 var OrchestrationEngineService = class extends Service$1()("forge/orchestration/Services/OrchestrationEngine/OrchestrationEngineService") {};
 //#endregion
-//#region src/observability/Metrics.ts
-const rpcRequestsTotal = counter("t3_rpc_requests_total", { description: "Total RPC requests handled by the websocket RPC server." });
-const rpcRequestDuration = timer("t3_rpc_request_duration", { description: "RPC request handling duration." });
-const orchestrationCommandsTotal = counter("t3_orchestration_commands_total", { description: "Total orchestration commands dispatched." });
-const orchestrationCommandDuration = timer("t3_orchestration_command_duration", { description: "Orchestration command dispatch duration." });
-const orchestrationCommandAckDuration = timer("t3_orchestration_command_ack_duration", { description: "Time from orchestration command dispatch to the first committed domain event emitted for that command." });
-const orchestrationEventsProcessedTotal = counter("t3_orchestration_events_processed_total", { description: "Total orchestration intent events processed by runtime reactors." });
-const providerSessionsTotal = counter("t3_provider_sessions_total", { description: "Total provider session lifecycle operations." });
-const providerTurnsTotal = counter("t3_provider_turns_total", { description: "Total provider turn lifecycle operations." });
-const providerTurnDuration = timer("t3_provider_turn_duration", { description: "Provider turn request duration." });
-const providerRuntimeEventsTotal = counter("t3_provider_runtime_events_total", { description: "Total canonical provider runtime events processed." });
-const gitCommandsTotal = counter("t3_git_commands_total", { description: "Total git commands executed by the server runtime." });
-const gitCommandDuration = timer("t3_git_command_duration", { description: "Git command execution duration." });
-const terminalSessionsTotal = counter("t3_terminal_sessions_total", { description: "Total terminal sessions started." });
-const browserSessionsReapedTotal = counter("browser_sessions_reaped_total", { description: "Browser sessions and Chromium processes reclaimed by the orphan reaper, by reason (orphan | ttl | stale_profile)." });
-const terminalRestartsTotal = counter("t3_terminal_restarts_total", { description: "Total terminal restart requests handled." });
-const runtimeReplicationOutboxDepth = gauge("t3_runtime_replication_outbox_depth", { description: "Current runtime replication outbox items by durable state." });
-const runtimeReplicationOutboxOldestEventAge = gauge("t3_runtime_replication_outbox_oldest_event_age_seconds", { description: "Age in seconds of the oldest undelivered runtime replication payload." });
-const runtimeReplicationPublicationAttemptsTotal = counter("t3_runtime_replication_publication_attempts_total", { description: "Total canonical runtime replication publication attempts." });
-const runtimeReplicationPublicationRetriesTotal = counter("t3_runtime_replication_publication_retries_total", { description: "Total runtime replication retries scheduled after recoverable failures." });
-const runtimeReplicationPublicationLatency = timer("t3_runtime_replication_publication_latency", { description: "Time from durable enqueue to canonical CMMD acknowledgement." });
-const metricAttributes = (attributes) => Object.entries(compactMetricAttributes(attributes));
-const increment = (metric, attributes, amount = 1) => update$3(withAttributes(metric, metricAttributes(attributes)), amount);
-const withMetricsImpl = (effect, options) => gen(function* () {
-	const startedAt = Date.now();
-	const exit$2 = yield* exit(effect);
-	const duration = millis(Math.max(0, Date.now() - startedAt));
-	const baseAttributes = typeof options.attributes === "function" ? options.attributes() : options.attributes ?? {};
-	if (options.timer) yield* update$3(withAttributes(options.timer, metricAttributes(baseAttributes)), duration);
-	if (options.counter) {
-		const outcome = outcomeFromExit(exit$2);
-		yield* update$3(withAttributes(options.counter, metricAttributes({
-			...baseAttributes,
-			outcome,
-			...options.outcomeAttributes ? options.outcomeAttributes(outcome) : {}
-		})), 1);
-	}
-	if (isSuccess(exit$2)) return exit$2.value;
-	return yield* failCause$1(exit$2.cause);
-});
-const withMetrics = dual(2, withMetricsImpl);
-const providerMetricAttributes = (provider, extra) => compactMetricAttributes({
-	provider,
-	...extra
-});
-const providerTurnMetricAttributes = (input) => {
-	const modelFamily = normalizeModelMetricLabel(input.model);
-	return compactMetricAttributes({
-		provider: input.provider,
-		...modelFamily ? { modelFamily } : {},
-		...input.extra
-	});
-};
-//#endregion
 //#region src/observability/RpcInstrumentation.ts
 const annotateRpcSpan = (method, traceAttributes) => annotateCurrentSpan({
 	"rpc.method": method,
@@ -97906,6 +98125,28 @@ function serializeWorktreeLaunchActivity(activity) {
 function decodeWorktreeLaunchActivityKind(kind) {
 	return isCmmdRuntimeWorktreeLaunchActivityKind(kind) ? kind : null;
 }
+function planStepsOf(activity) {
+	const decoded = decodeCmmdRuntimePlanActivity(encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload));
+	return decoded !== null && decoded.plan.length > 0 ? decoded.plan : null;
+}
+function serializePlanActivity(activity) {
+	if (activity.kind !== "turn.plan.updated") return null;
+	const plan = planStepsOf(activity);
+	if (plan === null) return null;
+	const completed = plan.filter((step) => step.status === "completed").length;
+	return {
+		sourceSequence: null,
+		event: {
+			eventId: `activity:${activity.id}`,
+			occurredAt: canonicalRuntimeEventTimestamp(activity.createdAt),
+			...eventTurn(activity.turnId),
+			kind: "tool_call",
+			summary: `Plan: ${completed} of ${plan.length} steps done`,
+			status: "completed",
+			payload: encodeCmmdRuntimePlanActivityPayload(activity.kind, activity.payload)
+		}
+	};
+}
 function isReplicatedFailureActivity(activity) {
 	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
@@ -98290,6 +98531,10 @@ function serializeRuntimeThreadEvents(thread) {
 		const event = serializeWorktreeLaunchActivity(activity);
 		return event === null ? [] : [event];
 	});
+	const planActivities = thread.activities.flatMap((activity) => {
+		const event = serializePlanActivity(activity);
+		return event === null ? [] : [event];
+	});
 	const recordedTurns = serializeRecordedTurns(thread);
 	const textGenerations = serializeTextGenerations(thread);
 	return [
@@ -98297,6 +98542,7 @@ function serializeRuntimeThreadEvents(thread) {
 		...replicaActivities,
 		...toolActivities,
 		...worktreeLaunchActivities,
+		...planActivities,
 		...failureActivities,
 		...recordedTurns,
 		...textGenerations
@@ -191252,7 +191498,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -201452,12 +201698,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -201472,7 +201718,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -201483,14 +201729,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -201505,7 +201751,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -201520,13 +201766,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -268836,7 +269082,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -268967,14 +269213,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -268982,7 +269228,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -292287,7 +292533,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 				summary: "Provider turn start failed",
 				detail: `User message '${event.payload.messageId}' was not found for turn start request.`,
 				turnId: null,
-				createdAt: event.payload.createdAt
+				createdAt: (/* @__PURE__ */ new Date()).toISOString()
 			});
 			return;
 		}
@@ -292340,7 +292586,7 @@ const ProviderCommandReactorLive = effect(ProviderCommandReactor, gen(function*
 			summary: "Provider turn start failed",
 			detail: publicProviderFailureDetail(pretty(cause)),
 			turnId: null,
-			createdAt: event.payload.createdAt
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
 	});
 	const processTurnInterruptRequested = fn$1("processTurnInterruptRequested")(function* (event) {
@@ -297975,7 +298221,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "dea91e954d3d2f23154802ae304412fabe90dbbd";
+	return "78b0e072680ed734c4eb8337a6d38c87e7e34393";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -309327,6 +309573,33 @@ registerProxyRoute({
 	cmmdPath: "/api/projects/campaigns/:id",
 	orgIdSource: "none"
 });
+/**
+* Apple App Store guideline 5.1.1(v): an app that supports account creation
+* or sign-in must let the user start account deletion from inside the app.
+* CMMD owns the account, so this proxies to its existing deactivation route.
+*
+* `cmmdPath` is `/api/settings/delete-account`, not a `/api/forge/context/*`
+* route: CMMD never built a forge-context-scoped deletion endpoint. It is
+* still reachable through the same owner JWT this gateway already resolves
+* per session: CMMD's `optionalJwtAuth` runs ahead of every `/api/*` route
+* (not only forge-context ones), so the same Bearer that reaches
+* `/api/cmmd/bootstrap` also authenticates here.
+*
+* CMMD's route soft-deletes: it flips the user to `active: false` and
+* `lifecycleState: 'deactivated'`, revokes CMMD's own refresh tokens, and
+* destroys its session. It does not purge data on this call. The Forge
+* client is responsible for the rest: revoking the Forge session
+* (`/api/auth/logout`) and clearing local state, the same as a manual
+* sign-out.
+*/
+registerProxyRoute({
+	forgePath: "/api/cmmd/settings/delete-account",
+	method: "DELETE",
+	cmmdPath: "/api/settings/delete-account",
+	orgIdSource: "none",
+	responseShape: "unwrapData",
+	requestBody: "none"
+});
 registerProxyRoute({
 	forgePath: "/api/cmmd/bootstrap",
 	method: "GET",
@@ -322304,7 +322577,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-D8mGyWmt.mjs")).default;
+			const open = (await import("./open-FIgTDosf.mjs")).default;
 			await open(url);
 			return true;
 		},