@cmmd-center/forge 0.13.15 → 0.13.16

package/dist/bin.cjs

@@ -12,7 +12,7 @@ const require_Cache = require("./Cache-BmGc_2BZ.cjs");
 const require_SqlError = require("./SqlError-g4pLzNWR.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-BkVB0uAA.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-DCitZFTk.cjs");
 const require_PTY = require("./PTY-B4ZctbwQ.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -66418,7 +66418,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.15";
+var version$1 = "0.13.16";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -97076,6 +97076,7 @@ const registerCloudRuntimeForReplicaHydration = require_Schema$1.gen(function* (
 			credentialEpoch,
 			activeTurnCount: 0,
 			activeSessionCount: 0,
+			acceptingTurns: false,
 			...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 			forgeServerVersion: installedForgeServerVersion
 		}),
@@ -97112,6 +97113,128 @@ const hydrateCloudRuntimeReplica = require_Schema$1.gen(function* () {
 	return yield* hydrateRuntimeReplica({ expectedRuntimeId: grant.runtimeId }, dependencies);
 });
 //#endregion
+//#region src/runtimeDrain/RuntimeDrainState.ts
+/**
+* The positive facts this process must observe before it can claim a turn.
+*
+* Every entry is required, so adding one here is the whole change: the
+* derivation below reads this list rather than naming fields, and the record
+* it indexes cannot be built with a member missing.
+*/
+const RUNTIME_EXECUTION_PRECONDITIONS = ["orchestrationEngine", "providerLayer"];
+/**
+* The single definition of the accepting-turns fact.
+*
+* Exported so test stubs of this service derive it exactly as the live state
+* does. A stub that recomputed it by hand could disagree with production and
+* still pass.
+*/
+function deriveAcceptingTurns(input) {
+	return RUNTIME_EXECUTION_PRECONDITIONS.every((precondition) => input.preconditions[precondition]) && !input.draining && !input.shutdownRequested;
+}
+const initialState = {
+	activeTurns: /* @__PURE__ */ new Set(),
+	activeTurnCount: 0,
+	activeSessionCount: 0,
+	draining: false,
+	drainReason: null,
+	drainTargetImageRef: null,
+	drainTargetImageVersion: null,
+	drainForceRequired: false,
+	preconditions: {
+		orchestrationEngine: false,
+		providerLayer: false
+	},
+	shutdownRequested: false
+};
+function snapshotFromState(state) {
+	return {
+		activeTurnCount: state.activeTurnCount,
+		activeSessionCount: state.activeSessionCount,
+		draining: state.draining,
+		drainReason: state.drainReason,
+		drainTargetImageRef: state.drainTargetImageRef,
+		drainTargetImageVersion: state.drainTargetImageVersion,
+		drainForceRequired: state.drainForceRequired,
+		acceptingTurns: deriveAcceptingTurns(state)
+	};
+}
+function turnKey(input) {
+	return `${input.threadId}:${input.turnId ?? "unknown"}`;
+}
+function normalizeCount(count) {
+	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
+}
+const makeRuntimeDrainState = require_Schema$1.gen(function* () {
+	const stateRef = yield* require_HttpServer.make$3(initialState);
+	const update = (f) => require_HttpServer.updateAndGet(stateRef, f).pipe(require_Schema$1.map(snapshotFromState));
+	return {
+		beginTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.add(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		completeTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.delete(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		clearActiveTurns: update((state) => ({
+			...state,
+			activeTurns: /* @__PURE__ */ new Set(),
+			activeTurnCount: 0
+		})),
+		setActiveSessionCount: (count) => update((state) => ({
+			...state,
+			activeSessionCount: normalizeCount(count)
+		})),
+		reconcileProviderSessions: (sessions) => update((state) => {
+			const activeSessions = sessions.filter((session) => session.status !== "closed");
+			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
+				threadId: session.threadId,
+				turnId: session.activeTurnId
+			})]));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size,
+				activeSessionCount: activeSessions.length
+			};
+		}),
+		applyControlPlaneState: (input) => update((state) => ({
+			...state,
+			draining: input.draining ?? state.draining,
+			drainReason: input.drainReason ?? state.drainReason,
+			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
+			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
+			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
+		})),
+		markExecutionPrecondition: (precondition) => update((state) => ({
+			...state,
+			preconditions: {
+				...state.preconditions,
+				[precondition]: true
+			}
+		})),
+		requestShutdown: update((state) => ({
+			...state,
+			shutdownRequested: true
+		})),
+		snapshot: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map(snapshotFromState)),
+		isDraining: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map((state) => state.draining))
+	};
+});
+var RuntimeDrainState = class extends require_Schema$1.Service()("forge/runtimeDrain/RuntimeDrainState") {};
+const RuntimeDrainStateLive = require_Schema$1.effect(RuntimeDrainState, makeRuntimeDrainState);
+//#endregion
 //#region src/persistence/Services/LocalAutomations.ts
 const LocalAutomationStatus = require_Schema$1.Literals([
 	"active",
@@ -100748,6 +100871,30 @@ const makeCommandGate = require_Schema$1.gen(function* () {
 		})
 	};
 });
+/**
+* Settle the command gate for a finished startup, and report whether commands
+* are now accepted.
+*
+* The success branch is the moment the orchestration engine can take work, so
+* it is where the engine half of the accepting-turns fact is marked. A failed
+* startup accepts nothing and must leave the fact untouched: absent must not
+* read as healthy.
+*/
+const settleCommandReadiness = (input) => require_Schema$1.gen(function* () {
+	if (require_Schema$1.isFailure(input.startupExit)) {
+		const error = new ServerRuntimeStartupError({
+			message: startupFailureMessage(input.startupExit.cause),
+			cause: input.startupExit.cause
+		});
+		yield* require_Schema$1.logError("server runtime startup failed", { cause: describeStartupFailure(input.startupExit.cause) });
+		yield* input.commandGate.failCommandReady(error);
+		return false;
+	}
+	yield* require_Schema$1.logDebug("Accepting commands");
+	yield* input.commandGate.signalCommandReady;
+	yield* input.drainState.markExecutionPrecondition("orchestrationEngine");
+	return true;
+});
 const launchStartupHeartbeat = require_Schema$1.gen(function* () {
 	const analytics = yield* AnalyticsService;
 	const { threadCount, projectCount } = yield* (yield* ProjectionSnapshotQuery).getCounts().pipe(require_Schema$1.catch_((cause) => require_Schema$1.logWarning("failed to gather startup projection counts for telemetry", { cause }).pipe(require_Schema$1.as({
@@ -100929,6 +101076,7 @@ const makeServerRuntimeStartup = require_Schema$1.gen(function* () {
 	const serverSettings = yield* ServerSettingsService;
 	const serverEnvironment = yield* ServerEnvironment;
 	const usage = yield* UsageService;
+	const drainState = yield* RuntimeDrainState;
 	const commandGate = yield* makeCommandGate;
 	const httpListening = yield* require_Schema$1.make$4();
 	const reactorScope = yield* require_Schema$1.make$3("sequential");
@@ -101011,18 +101159,11 @@ const makeServerRuntimeStartup = require_Schema$1.gen(function* () {
 		root: true
 	}));
 	yield* require_Schema$1.forkScoped(require_Schema$1.gen(function* () {
-		const startupExit = yield* require_Schema$1.exit(startup);
-		if (require_Schema$1.isFailure(startupExit)) {
-			const error = new ServerRuntimeStartupError({
-				message: startupFailureMessage(startupExit.cause),
-				cause: startupExit.cause
-			});
-			yield* require_Schema$1.logError("server runtime startup failed", { cause: describeStartupFailure(startupExit.cause) });
-			yield* commandGate.failCommandReady(error);
-			return;
-		}
-		yield* require_Schema$1.logDebug("Accepting commands");
-		yield* commandGate.signalCommandReady;
+		if (!(yield* settleCommandReadiness({
+			startupExit: yield* require_Schema$1.exit(startup),
+			commandGate,
+			drainState
+		}))) return;
 		yield* require_Schema$1.logDebug("startup phase: starting the usage scan warm-up");
 		yield* require_Schema$1.forkScoped(runUsageScanWarmup({ readSummary: usage.readSummary }));
 		yield* require_Schema$1.logDebug("startup phase: waiting for http listener");
@@ -153634,7 +153775,9 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 	scheduleProviderEgressTokenRefresh(context, delayMs) {
 		if (context.tokenRefreshTimer) clearTimeout(context.tokenRefreshTimer);
 		const tokenRefreshTimer = setTimeout(() => {
-			this.handleProviderEgressTokenRefresh(context.session.threadId).catch(() => void 0);
+			this.handleProviderEgressTokenRefresh(context.session.threadId).catch((error) => {
+				this.emitErrorEvent(context, "session/tokenRefreshFailed", error instanceof Error ? error.message : String(error));
+			});
 		}, delayMs);
 		tokenRefreshTimer.unref?.();
 		context.tokenRefreshTimer = tokenRefreshTimer;
@@ -290988,93 +291131,6 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	return "refreshed";
 }
 //#endregion
-//#region src/runtimeDrain/RuntimeDrainState.ts
-const initialState = {
-	activeTurns: /* @__PURE__ */ new Set(),
-	activeTurnCount: 0,
-	activeSessionCount: 0,
-	draining: false,
-	drainReason: null,
-	drainTargetImageRef: null,
-	drainTargetImageVersion: null,
-	drainForceRequired: false
-};
-function snapshotFromState(state) {
-	return {
-		activeTurnCount: state.activeTurnCount,
-		activeSessionCount: state.activeSessionCount,
-		draining: state.draining,
-		drainReason: state.drainReason,
-		drainTargetImageRef: state.drainTargetImageRef,
-		drainTargetImageVersion: state.drainTargetImageVersion,
-		drainForceRequired: state.drainForceRequired
-	};
-}
-function turnKey(input) {
-	return `${input.threadId}:${input.turnId ?? "unknown"}`;
-}
-function normalizeCount(count) {
-	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
-}
-const makeRuntimeDrainState = require_Schema$1.gen(function* () {
-	const stateRef = yield* require_HttpServer.make$3(initialState);
-	const update = (f) => require_HttpServer.updateAndGet(stateRef, f).pipe(require_Schema$1.map(snapshotFromState));
-	return {
-		beginTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.add(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		completeTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.delete(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		clearActiveTurns: update((state) => ({
-			...state,
-			activeTurns: /* @__PURE__ */ new Set(),
-			activeTurnCount: 0
-		})),
-		setActiveSessionCount: (count) => update((state) => ({
-			...state,
-			activeSessionCount: normalizeCount(count)
-		})),
-		reconcileProviderSessions: (sessions) => update((state) => {
-			const activeSessions = sessions.filter((session) => session.status !== "closed");
-			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
-				threadId: session.threadId,
-				turnId: session.activeTurnId
-			})]));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size,
-				activeSessionCount: activeSessions.length
-			};
-		}),
-		applyControlPlaneState: (input) => update((state) => ({
-			...state,
-			draining: input.draining ?? state.draining,
-			drainReason: input.drainReason ?? state.drainReason,
-			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
-			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
-			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
-		})),
-		snapshot: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map(snapshotFromState)),
-		isDraining: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map((state) => state.draining))
-	};
-});
-var RuntimeDrainState = class extends require_Schema$1.Service()("forge/runtimeDrain/RuntimeDrainState") {};
-const RuntimeDrainStateLive = require_Schema$1.effect(RuntimeDrainState, makeRuntimeDrainState);
-//#endregion
 //#region src/runtimeDrain/RuntimeDrainReporter.ts
 const HEARTBEAT_INTERVAL = require_Schema$1.seconds(30);
 const HEARTBEAT_TICK_TIMEOUT = require_Schema$1.seconds(60);
@@ -291132,6 +291188,7 @@ const postRuntimeHeartbeat = (config, snapshot) => require_Schema$1.promise(asyn
 		...config,
 		activeTurnCount: snapshot.activeTurnCount,
 		activeSessionCount: snapshot.activeSessionCount,
+		acceptingTurns: snapshot.acceptingTurns,
 		...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 		forgeServerVersion: installedForgeServerVersion
 	});
@@ -291240,6 +291297,7 @@ const makeRuntimeDrainReporter = require_Schema$1.gen(function* () {
 				work: reportOnce,
 				interval: HEARTBEAT_INTERVAL
 			}));
+			yield* require_Schema$1.addFinalizer(() => drainState.requestShutdown);
 		})
 	};
 });
@@ -291450,6 +291508,7 @@ function decodeCodexRateLimitWindows(raw) {
 function publicProviderRuntimeError(message) {
 	return sanitizePublicProviderText(message, { fallback: DEFAULT_PUBLIC_PROVIDER_ERROR });
 }
+const processDomainEvent = (_event) => require_Schema$1.void_;
 function isAssistantTextDeltaEvent(event) {
 	return event.type === "content.delta" && event.payload.streamKind === "assistant_text";
 }
@@ -292245,7 +292304,6 @@ const make$9 = require_Schema$1.fn("make")(function* () {
 			yield* runtimeDrainReporter.reportOnce;
 		}
 	});
-	const processDomainEvent = (_event) => require_Schema$1.void_;
 	const processInput = (input) => input.source === "runtime" ? processRuntimeEvent(input.event) : processDomainEvent(input.event);
 	const processInputSafely = (input) => processInput(input).pipe(require_Schema$1.catchCause((cause) => {
 		if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.failCause(cause);
@@ -292296,6 +292354,7 @@ const make$9 = require_Schema$1.fn("make")(function* () {
 	return {
 		start: require_Schema$1.fn("start")(function* () {
 			yield* reconcileOrphanedRunningSessions();
+			yield* runtimeDrainState.markExecutionPrecondition("providerLayer");
 			yield* runtimeDrainReporter.start;
 			yield* require_Schema$1.forkScoped(require_Path.runForEach(providerService.streamEvents, (event) => enqueueInput({
 				source: "runtime",
@@ -292535,6 +292594,8 @@ const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = require_Schema$1.minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
+const isProviderValidationError = require_Schema$1.is(ProviderValidationError);
+const isProviderKind = require_Schema$1.is(ProviderKind);
 function isPathInsideRoot(candidatePath, rootPath) {
 	let resolvedCandidate;
 	let resolvedRoot;
@@ -292571,6 +292632,38 @@ function resolveExistingWorkspaceCwd(input) {
 function publicProviderFailureDetail(detail) {
 	return sanitizePublicProviderText(detail, { fallback: "CMMD is temporarily unavailable. Check the workspace AI connection and retry." }) ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
 }
+/**
+* The failure detail a transcript shows, judged on the text and not the envelope.
+*
+* Forge writes its own validation copy, so `ProviderValidationError.issue` is
+* not raw provider output. Every envelope around it hides it, each in its own
+* way: `Cause.pretty` prints the error tag, and the sanitizer counts
+* "ProviderValidationError" as a provider leak, so a validation failure
+* rendered through `Cause.pretty` tripped the guard on its own wrapper. The
+* `message` getter spells the same tag out in prose. On 2026-09-16 the first of
+* those replaced "Reconnect the account and try again" with "CMMD is
+* temporarily unavailable" (#3337).
+*
+* The issue still goes through the sanitizer. `ProviderService` builds some
+* issues from a schema formatter, which echoes the decoded payload, so this is a
+* narrower input to the same guard rather than a way around it.
+*/
+function publicProviderFailureDetailFromError(error) {
+	if (isProviderValidationError(error)) return publicProviderFailureDetail(error.issue);
+	return publicProviderFailureDetail(error instanceof Error ? error.message : String(error));
+}
+/**
+* The same judgement for a failure that arrives as a cause.
+*
+* Only the validation branch delegates. A cause carries what a bare error does
+* not: defects, interrupts, and more than one failure, all of which
+* `Cause.pretty` renders and `.message` would drop. Squashing every failure into
+* its message to reach one shared line would lose that.
+*/
+function publicProviderFailureDetailFromCause(cause) {
+	const error = require_Schema$1.squash(cause);
+	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(require_Schema$1.pretty(cause));
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -292726,7 +292819,7 @@ const make$8 = require_Schema$1.gen(function* () {
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
 		const desiredRuntimeMode = thread.runtimeMode;
-		const currentProvider = thread.session?.status !== "stopped" && require_Schema$1.is(ProviderKind)(thread.session?.providerName) ? thread.session.providerName : void 0;
+		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const rawRequestedModelSelection = options?.modelSelection;
 		const threadProvider = currentProvider ?? thread.modelSelection.provider;
 		const isStaleRequestedProvider = rawRequestedModelSelection !== void 0 && rawRequestedModelSelection.provider !== threadProvider;
@@ -293105,7 +293198,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start failed",
-			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			detail: publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
@@ -293121,7 +293214,14 @@ const make$8 = require_Schema$1.gen(function* () {
 			turnId: event.payload.turnId ?? null,
 			createdAt: event.payload.createdAt
 		});
-		yield* providerService.interruptTurn({ threadId: event.payload.threadId });
+		yield* providerService.interruptTurn({ threadId: event.payload.threadId }).pipe(require_Schema$1.catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.turn.interrupt.failed",
+			summary: "Provider turn interrupt failed",
+			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			turnId: event.payload.turnId ?? null,
+			createdAt: event.payload.createdAt
+		})));
 	});
 	const processApprovalResponseRequested = require_Schema$1.fn("processApprovalResponseRequested")(function* (event) {
 		const staged = peekThreadContinuationSession(event.commandId);
@@ -293158,7 +293258,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				threadId: event.payload.threadId,
 				kind: "provider.approval.respond.failed",
 				summary: "Provider approval response failed",
-				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 				turnId: null,
 				createdAt: event.payload.createdAt,
 				requestId: event.payload.requestId
@@ -293201,7 +293301,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.user-input.respond.failed",
 			summary: "Provider user input response failed",
-			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: event.payload.createdAt,
 			requestId: event.payload.requestId
@@ -293214,8 +293314,7 @@ const make$8 = require_Schema$1.gen(function* () {
 		yield* providerService.stopSession({
 			threadId: thread.id,
 			...event.payload.preserveResumeState === true ? { preserveResumeState: true } : {}
-		});
-		yield* setThreadSession({
+		}).pipe(require_Schema$1.tap(() => setThreadSession({
 			threadId: thread.id,
 			session: {
 				threadId: thread.id,
@@ -293227,7 +293326,14 @@ const make$8 = require_Schema$1.gen(function* () {
 				updatedAt: now
 			},
 			createdAt: now
-		});
+		})), require_Schema$1.catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.session.stop.failed",
+			summary: "Provider session stop failed",
+			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			turnId: null,
+			createdAt: now
+		})));
 	});
 	const processDomainEvent = require_Schema$1.fn("processDomainEvent")(function* (event) {
 		yield* require_Schema$1.annotateCurrentSpan({
@@ -293322,7 +293428,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start cleanup failed",
-			detail: publicProviderFailureDetail(cause instanceof Error ? cause.message : String(cause)),
+			detail: publicProviderFailureDetailFromError(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})
@@ -298790,7 +298896,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "78b0e072680ed734c4eb8337a6d38c87e7e34393";
+	return "b06001f4e16f7a336e9108920f9250b366862f3d";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -322280,7 +322386,7 @@ const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(functi
 }));
 const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(require_Schema$1.provideMerge(RuntimeReplicationClientLive), require_Schema$1.provideMerge(RuntimeReplicationOutboxLive), require_Schema$1.provideMerge(ActiveHourMeterLive.pipe(require_Schema$1.provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(require_Schema$1.provideMerge(RuntimeDrainStateLive));
-const RuntimeAwareProviderReactorsLive = require_Schema$1.mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(require_Schema$1.provide$1(RuntimeDrainLayerLive), require_Schema$1.provide$1(ClaudeUsageTelemetryLive));
+const RuntimeAwareProviderReactorsLive = require_Schema$1.mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(require_Schema$1.provide$1(RuntimeDrainLayerLive), require_Schema$1.provideMerge(RuntimeDrainStateLive), require_Schema$1.provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(require_Schema$1.provideMerge(PipelineRunClientLive));
 const AgentProtocolReactorLayerLive = AgentProtocolReactorLive.pipe(require_Schema$1.provideMerge(PipelineRunStoreLive));
 const PipelineRunCoordinatorLayerLive = PipelineRunCoordinatorLive.pipe(require_Schema$1.provideMerge(PipelineProviderAuthorityInstallerLive), require_Schema$1.provideMerge(PipelineChangeInspectorLive), require_Schema$1.provideMerge(PipelineContextArtifactStoreLive), require_Schema$1.provideMerge(PipelineModelPolicyLive), require_Schema$1.provideMerge(PipelineRunClientLive), require_Schema$1.provideMerge(PipelineRunStoreLive), require_Schema$1.provideMerge(PipelineRunWorkspaceAllocatorLive), require_Schema$1.provideMerge(PipelineStagePolicyLive), require_Schema$1.provideMerge(PipelineWorkerCoordinatorLayerLive));