@cmmd-center/forge 0.13.143 → 0.13.145

package/dist/bin.cjs

@@ -18122,9 +18122,11 @@ const ThreadTurnStartBootstrapCreateThread = require_Schema$1.Struct({
 	createdAt: IsoDateTime
 });
 const ThreadTurnStartBootstrapPrepareWorktree = require_Schema$1.Struct({
-	projectCwd: TrimmedNonEmptyString,
+	projectId: require_Schema$1.optional(ProjectId),
+	projectCwd: require_Schema$1.optional(TrimmedNonEmptyString),
 	baseBranch: require_Schema$1.NullOr(TrimmedNonEmptyString),
-	branch: require_Schema$1.optional(TrimmedNonEmptyString)
+	branch: require_Schema$1.optional(TrimmedNonEmptyString),
+	startFromOrigin: require_Schema$1.optional(require_Schema$1.Boolean)
 });
 const ThreadTurnStartBootstrap = require_Schema$1.Struct({
 	createThread: require_Schema$1.optional(ThreadTurnStartBootstrapCreateThread),
@@ -66431,7 +66433,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.143";
+var version$1 = "0.13.145";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -94617,14 +94619,62 @@ const dispatchBootstrapThreadCreate = (input) => require_Schema$1.gen(function*
 	});
 	return !threadAlreadyExists;
 });
+/** Reject a removed or unknown project before any Git operation uses its checkout. */
+const requireBootstrapProject = (input) => {
+	const project = input.readModel.projects.find((candidate) => candidate.id === input.projectId);
+	return project && project.deletedAt === null ? require_Schema$1.succeed(project) : require_Schema$1.fail(/* @__PURE__ */ new Error(`Worktree project '${input.projectId}' does not exist.`));
+};
+/** Require the target thread to be live before preparing its worktree. */
+const requireBootstrapThread = (input) => {
+	const thread = input.readModel.threads.find((candidate) => candidate.id === input.threadId);
+	return thread && thread.deletedAt === null ? require_Schema$1.succeed(thread) : require_Schema$1.fail(/* @__PURE__ */ new Error(`Worktree thread '${input.threadId}' does not exist.`));
+};
+/** Resolve a CMMD Work Session's checkout from Forge's persisted project identity. */
+const resolveAuthoritativeBootstrapProjectCwd = (input) => require_Schema$1.gen(function* () {
+	const projectId = input.bootstrapWorktree.projectId;
+	if (projectId === void 0) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Missing project identity."));
+	const project = yield* requireBootstrapProject({
+		readModel: input.readModel,
+		projectId
+	});
+	const thread = yield* requireBootstrapThread({
+		readModel: input.readModel,
+		threadId: input.command.threadId
+	});
+	if (thread.projectId !== projectId) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error(`Worktree project '${projectId}' does not match thread project '${thread.projectId}'.`));
+	const createdThreadProjectId = input.command.bootstrap?.createThread?.projectId;
+	if (createdThreadProjectId && createdThreadProjectId !== projectId) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error(`Worktree project '${projectId}' does not match created thread project '${createdThreadProjectId}'.`));
+	if (input.bootstrapWorktree.branch === void 0) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Authoritative worktree preparation requires a branch."));
+	if (input.bootstrapWorktree.startFromOrigin && input.bootstrapWorktree.baseBranch !== "main") return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Authoritative Work Session worktrees must start from origin/main."));
+	return project.workspaceRoot;
+});
+/** Keep legacy path-based commands working while routing identified projects through Forge records. */
+const resolveBootstrapProjectCwd = (input) => require_Schema$1.gen(function* () {
+	const { bootstrapWorktree } = input;
+	if (bootstrapWorktree.projectId === void 0) {
+		if (!bootstrapWorktree.projectCwd) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Worktree preparation requires a project checkout path."));
+		return bootstrapWorktree.projectCwd;
+	}
+	return yield* resolveAuthoritativeBootstrapProjectCwd({
+		readModel: yield* input.orchestrationEngine.getReadModel(),
+		command: input.command,
+		bootstrapWorktree
+	});
+});
 const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 	const bootstrapWorktree = input.command.bootstrap?.prepareWorktree;
 	if (!bootstrapWorktree) return null;
+	const projectCwd = yield* resolveBootstrapProjectCwd({
+		orchestrationEngine: input.orchestrationEngine,
+		command: input.command,
+		bootstrapWorktree
+	});
 	const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const baseBranchLabel = bootstrapWorktree.baseBranch ?? "<default>";
 	const requestedPayload = {
 		turnRequestedAt: input.command.createdAt,
-		projectCwd: bootstrapWorktree.projectCwd,
+		...bootstrapWorktree.projectId ? { projectId: bootstrapWorktree.projectId } : {},
+		projectCwd,
 		baseBranch: bootstrapWorktree.baseBranch,
 		branch: bootstrapWorktree.branch,
 		command: `git worktree add -b ${bootstrapWorktree.branch} <generated-path> ${baseBranchLabel}`
@@ -94639,11 +94689,38 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 		payload: requestedPayload,
 		tone: "info"
 	});
+	if (bootstrapWorktree.startFromOrigin) {
+		if (!input.git.fetch) return yield* require_Schema$1.fail(/* @__PURE__ */ new Error("Git fetch is unavailable for origin worktree preparation."));
+		yield* input.git.fetch({
+			cwd: projectCwd,
+			remote: "origin",
+			ref: bootstrapWorktree.baseBranch ?? "main"
+		}).pipe(require_Schema$1.catchCause((cause) => {
+			if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.failCause(cause);
+			const error = require_Schema$1.squash(cause);
+			const detail = error instanceof Error ? error.message : "Unknown fetch failure.";
+			return appendWorktreeActivity({
+				orchestrationEngine: input.orchestrationEngine,
+				threadId: input.command.threadId,
+				commandId: bootstrapCommandId(input.command, "bootstrap-worktree-failed"),
+				kind: "worktree.failed",
+				summary: "Worktree preparation failed",
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				payload: {
+					...requestedPayload,
+					detail,
+					stage: "fetch"
+				},
+				tone: "error"
+			}).pipe(require_Schema$1.andThen(require_Schema$1.failCause(cause)));
+		}));
+	}
 	const worktree = yield* input.git.createWorktree({
-		cwd: bootstrapWorktree.projectCwd,
+		cwd: projectCwd,
 		branch: bootstrapWorktree.baseBranch,
 		newBranch: bootstrapWorktree.branch,
 		path: null,
+		...bootstrapWorktree.startFromOrigin ? { startFromOrigin: true } : {},
 		onStage: (update) => appendWorktreeActivity({
 			orchestrationEngine: input.orchestrationEngine,
 			threadId: input.command.threadId,
@@ -94735,7 +94812,7 @@ const prepareBootstrapWorktree = (input) => require_Schema$1.gen(function* () {
 	});
 	return {
 		worktreePath,
-		projectCwd: bootstrapWorktree.projectCwd
+		projectCwd
 	};
 });
 const dispatchBootstrapTurnStart$1 = (input, command) => require_Schema$1.gen(function* () {
@@ -236026,6 +236103,13 @@ function createGitCommandError(operation, cwd, args, detail, cause) {
 		...cause !== void 0 ? { cause } : {}
 	});
 }
+function isValidGitRef(value) {
+	if (value.length === 0 || value.startsWith("-") || value.endsWith(".") || value.endsWith("/") || value.endsWith(".lock") || value.includes("..") || value.includes("@{") || /[~^:?*[\\]/.test(value) || [...value].some((character) => {
+		const code = character.charCodeAt(0);
+		return code <= 32 || code === 127;
+	})) return false;
+	return value.split("/").every((part) => part.length > 0 && part !== "." && part !== "..");
+}
 function quoteGitCommand(args) {
 	return `git ${args.join(" ")}`;
 }
@@ -237038,7 +237122,7 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		}) ?? require_Schema$1.void_;
 		yield* report("resolve", "running");
 		const base = input.branch ?? (yield* resolveDefaultBaseBranch(input.cwd));
-		const startPoint = yield* resolveWorktreeStartPoint({
+		const startPoint = input.startFromOrigin ? `origin/${base}` : yield* resolveWorktreeStartPoint({
 			cwd: input.cwd,
 			base,
 			creatingNewBranch: input.newBranch !== void 0
@@ -237108,6 +237192,20 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 			fallbackErrorMessage: "git fetch pull request branch failed"
 		});
 	});
+	const fetch = require_Schema$1.fn("fetch")(function* (input) {
+		if (!isValidGitRef(input.ref)) return yield* require_Schema$1.fail(createGitCommandError("GitCore.fetch", input.cwd, [
+			"fetch",
+			input.remote,
+			input.ref
+		], `Invalid Git ref: ${input.ref}`));
+		yield* runGit("GitCore.fetch", input.cwd, [
+			"fetch",
+			"--quiet",
+			"--no-tags",
+			input.remote,
+			input.ref
+		]);
+	});
 	const fetchRemoteBranch = require_Schema$1.fn("fetchRemoteBranch")(function* (input) {
 		yield* runGit("GitCore.fetchRemoteBranch.fetch", input.cwd, [
 			"fetch",
@@ -237305,6 +237403,7 @@ const makeGitCore = require_Schema$1.fn("makeGitCore")(function* (options) {
 		listBranches,
 		createWorktree,
 		fetchPullRequestBranch,
+		fetch,
 		ensureRemote,
 		fetchRemoteBranch,
 		setBranchUpstream,
@@ -300774,7 +300873,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "bbf42772eb03753c72fd6043fdc17df49c776702";
+	return "ccee17906caa33ee1121ad57b882116aac6ca527";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;

package/dist/bin.mjs

@@ -23,7 +23,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
+import os, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -18062,9 +18062,11 @@ const ThreadTurnStartBootstrapCreateThread = Struct({
 	createdAt: IsoDateTime
 });
 const ThreadTurnStartBootstrapPrepareWorktree = Struct({
-	projectCwd: TrimmedNonEmptyString,
+	projectId: optional$4(ProjectId),
+	projectCwd: optional$4(TrimmedNonEmptyString),
 	baseBranch: NullOr(TrimmedNonEmptyString),
-	branch: optional$4(TrimmedNonEmptyString)
+	branch: optional$4(TrimmedNonEmptyString),
+	startFromOrigin: optional$4(Boolean$1)
 });
 const ThreadTurnStartBootstrap = Struct({
 	createThread: optional$4(ThreadTurnStartBootstrapCreateThread),
@@ -50751,7 +50753,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = $U.release().split(".");
+		const osRelease = os.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -53194,7 +53196,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$3 = __require("os");
+	const os$4 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -53216,7 +53218,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$3.userInfo();
+				const userInfo = os$4.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -66139,7 +66141,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.143";
+var version$1 = "0.13.145";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -75906,7 +75908,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$2 = __require("os");
+	var os$3 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -75914,8 +75916,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$2.arch();
-	var platform = process.env.npm_config_platform || os$2.platform();
+	var arch = process.env.npm_config_arch || os$3.arch();
+	var platform = process.env.npm_config_platform || os$3.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -93759,7 +93761,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-2-reBrpv.mjs"),
+		try: () => import("./open-yHTUkd2Y.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -94257,14 +94259,62 @@ const dispatchBootstrapThreadCreate = (input) => gen(function* () {
 	});
 	return !threadAlreadyExists;
 });
+/** Reject a removed or unknown project before any Git operation uses its checkout. */
+const requireBootstrapProject = (input) => {
+	const project = input.readModel.projects.find((candidate) => candidate.id === input.projectId);
+	return project && project.deletedAt === null ? succeed(project) : fail(/* @__PURE__ */ new Error(`Worktree project '${input.projectId}' does not exist.`));
+};
+/** Require the target thread to be live before preparing its worktree. */
+const requireBootstrapThread = (input) => {
+	const thread = input.readModel.threads.find((candidate) => candidate.id === input.threadId);
+	return thread && thread.deletedAt === null ? succeed(thread) : fail(/* @__PURE__ */ new Error(`Worktree thread '${input.threadId}' does not exist.`));
+};
+/** Resolve a CMMD Work Session's checkout from Forge's persisted project identity. */
+const resolveAuthoritativeBootstrapProjectCwd = (input) => gen(function* () {
+	const projectId = input.bootstrapWorktree.projectId;
+	if (projectId === void 0) return yield* fail(/* @__PURE__ */ new Error("Missing project identity."));
+	const project = yield* requireBootstrapProject({
+		readModel: input.readModel,
+		projectId
+	});
+	const thread = yield* requireBootstrapThread({
+		readModel: input.readModel,
+		threadId: input.command.threadId
+	});
+	if (thread.projectId !== projectId) return yield* fail(/* @__PURE__ */ new Error(`Worktree project '${projectId}' does not match thread project '${thread.projectId}'.`));
+	const createdThreadProjectId = input.command.bootstrap?.createThread?.projectId;
+	if (createdThreadProjectId && createdThreadProjectId !== projectId) return yield* fail(/* @__PURE__ */ new Error(`Worktree project '${projectId}' does not match created thread project '${createdThreadProjectId}'.`));
+	if (input.bootstrapWorktree.branch === void 0) return yield* fail(/* @__PURE__ */ new Error("Authoritative worktree preparation requires a branch."));
+	if (input.bootstrapWorktree.startFromOrigin && input.bootstrapWorktree.baseBranch !== "main") return yield* fail(/* @__PURE__ */ new Error("Authoritative Work Session worktrees must start from origin/main."));
+	return project.workspaceRoot;
+});
+/** Keep legacy path-based commands working while routing identified projects through Forge records. */
+const resolveBootstrapProjectCwd = (input) => gen(function* () {
+	const { bootstrapWorktree } = input;
+	if (bootstrapWorktree.projectId === void 0) {
+		if (!bootstrapWorktree.projectCwd) return yield* fail(/* @__PURE__ */ new Error("Worktree preparation requires a project checkout path."));
+		return bootstrapWorktree.projectCwd;
+	}
+	return yield* resolveAuthoritativeBootstrapProjectCwd({
+		readModel: yield* input.orchestrationEngine.getReadModel(),
+		command: input.command,
+		bootstrapWorktree
+	});
+});
 const prepareBootstrapWorktree = (input) => gen(function* () {
 	const bootstrapWorktree = input.command.bootstrap?.prepareWorktree;
 	if (!bootstrapWorktree) return null;
+	const projectCwd = yield* resolveBootstrapProjectCwd({
+		orchestrationEngine: input.orchestrationEngine,
+		command: input.command,
+		bootstrapWorktree
+	});
 	const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
 	const baseBranchLabel = bootstrapWorktree.baseBranch ?? "<default>";
 	const requestedPayload = {
 		turnRequestedAt: input.command.createdAt,
-		projectCwd: bootstrapWorktree.projectCwd,
+		...bootstrapWorktree.projectId ? { projectId: bootstrapWorktree.projectId } : {},
+		projectCwd,
 		baseBranch: bootstrapWorktree.baseBranch,
 		branch: bootstrapWorktree.branch,
 		command: `git worktree add -b ${bootstrapWorktree.branch} <generated-path> ${baseBranchLabel}`
@@ -94279,11 +94329,38 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 		payload: requestedPayload,
 		tone: "info"
 	});
+	if (bootstrapWorktree.startFromOrigin) {
+		if (!input.git.fetch) return yield* fail(/* @__PURE__ */ new Error("Git fetch is unavailable for origin worktree preparation."));
+		yield* input.git.fetch({
+			cwd: projectCwd,
+			remote: "origin",
+			ref: bootstrapWorktree.baseBranch ?? "main"
+		}).pipe(catchCause((cause) => {
+			if (hasInterruptsOnly(cause)) return failCause$1(cause);
+			const error = squash(cause);
+			const detail = error instanceof Error ? error.message : "Unknown fetch failure.";
+			return appendWorktreeActivity({
+				orchestrationEngine: input.orchestrationEngine,
+				threadId: input.command.threadId,
+				commandId: bootstrapCommandId(input.command, "bootstrap-worktree-failed"),
+				kind: "worktree.failed",
+				summary: "Worktree preparation failed",
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				payload: {
+					...requestedPayload,
+					detail,
+					stage: "fetch"
+				},
+				tone: "error"
+			}).pipe(andThen(failCause$1(cause)));
+		}));
+	}
 	const worktree = yield* input.git.createWorktree({
-		cwd: bootstrapWorktree.projectCwd,
+		cwd: projectCwd,
 		branch: bootstrapWorktree.baseBranch,
 		newBranch: bootstrapWorktree.branch,
 		path: null,
+		...bootstrapWorktree.startFromOrigin ? { startFromOrigin: true } : {},
 		onStage: (update) => appendWorktreeActivity({
 			orchestrationEngine: input.orchestrationEngine,
 			threadId: input.command.threadId,
@@ -94375,7 +94452,7 @@ const prepareBootstrapWorktree = (input) => gen(function* () {
 	});
 	return {
 		worktreePath,
-		projectCwd: bootstrapWorktree.projectCwd
+		projectCwd
 	};
 });
 const dispatchBootstrapTurnStart$1 = (input, command) => gen(function* () {
@@ -192145,7 +192222,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -202345,12 +202422,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$1 = "https://code.claude.com/docs/en", kKe = [
+var os$2 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$1}/iam#permission-modes`
+			docLink: `${os$2}/iam#permission-modes`
 		}
 	},
 	{
@@ -202365,7 +202442,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$1}/settings#environment-variables`
+			docLink: `${os$2}/settings#environment-variables`
 		}
 	},
 	{
@@ -202376,14 +202453,14 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$1}/hooks`
+			docLink: `${os$2}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$1}/hooks#exec-form-and-shell-form`
+			docLink: `${os$2}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -202398,7 +202475,7 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$1}/settings`
+			docLink: `${os$2}/settings`
 		}
 	},
 	{
@@ -202413,13 +202490,13 @@ var os$1 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$1}/iam#working-directories`
+			docLink: `${os$2}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$1}/iam#configuring-permissions`,
-	env: `${os$1}/settings#environment-variables`,
-	hooks: `${os$1}/hooks`
+	permissions: `${os$2}/iam#configuring-permissions`,
+	env: `${os$2}/settings#environment-variables`,
+	hooks: `${os$2}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -235562,6 +235639,13 @@ function createGitCommandError(operation, cwd, args, detail, cause) {
 		...cause !== void 0 ? { cause } : {}
 	});
 }
+function isValidGitRef(value) {
+	if (value.length === 0 || value.startsWith("-") || value.endsWith(".") || value.endsWith("/") || value.endsWith(".lock") || value.includes("..") || value.includes("@{") || /[~^:?*[\\]/.test(value) || [...value].some((character) => {
+		const code = character.charCodeAt(0);
+		return code <= 32 || code === 127;
+	})) return false;
+	return value.split("/").every((part) => part.length > 0 && part !== "." && part !== "..");
+}
 function quoteGitCommand(args) {
 	return `git ${args.join(" ")}`;
 }
@@ -236570,7 +236654,7 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		}) ?? void_$1;
 		yield* report("resolve", "running");
 		const base = input.branch ?? (yield* resolveDefaultBaseBranch(input.cwd));
-		const startPoint = yield* resolveWorktreeStartPoint({
+		const startPoint = input.startFromOrigin ? `origin/${base}` : yield* resolveWorktreeStartPoint({
 			cwd: input.cwd,
 			base,
 			creatingNewBranch: input.newBranch !== void 0
@@ -236640,6 +236724,20 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 			fallbackErrorMessage: "git fetch pull request branch failed"
 		});
 	});
+	const fetch = fn$1("fetch")(function* (input) {
+		if (!isValidGitRef(input.ref)) return yield* fail(createGitCommandError("GitCore.fetch", input.cwd, [
+			"fetch",
+			input.remote,
+			input.ref
+		], `Invalid Git ref: ${input.ref}`));
+		yield* runGit("GitCore.fetch", input.cwd, [
+			"fetch",
+			"--quiet",
+			"--no-tags",
+			input.remote,
+			input.ref
+		]);
+	});
 	const fetchRemoteBranch = fn$1("fetchRemoteBranch")(function* (input) {
 		yield* runGit("GitCore.fetchRemoteBranch.fetch", input.cwd, [
 			"fetch",
@@ -236837,6 +236935,7 @@ const GitCoreLive = effect(GitCore, fn$1("makeGitCore")(function* (options) {
 		listBranches,
 		createWorktree,
 		fetchPullRequestBranch,
+		fetch,
 		ensureRemote,
 		fetchRemoteBranch,
 		setBranchUpstream,
@@ -271207,7 +271306,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os = __require("os");
+	var os$1 = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -271338,14 +271437,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -271353,7 +271452,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os.networkInterfaces();
+		var networks = os$1.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -300218,7 +300317,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "bbf42772eb03753c72fd6043fdc17df49c776702";
+	return "ccee17906caa33ee1121ad57b882116aac6ca527";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -325746,7 +325845,7 @@ const connectLoginCommand = make$33("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-2-reBrpv.mjs")).default;
+			const open = (await import("./open-yHTUkd2Y.mjs")).default;
 			await open(url);
 			return true;
 		},