@cmmd-center/forge 0.13.15 → 0.13.17

package/dist/bin.cjs

@@ -12,7 +12,7 @@ const require_Cache = require("./Cache-BmGc_2BZ.cjs");
 const require_SqlError = require("./SqlError-g4pLzNWR.cjs");
 const require_Mime = require("./Mime-Bilnh8zE.cjs");
 const require_esm = require("./esm-BZhXwX5p.cjs");
-const require_runtimeControlAuthority = require("./runtimeControlAuthority-BkVB0uAA.cjs");
+const require_runtimeControlAuthority = require("./runtimeControlAuthority-DCitZFTk.cjs");
 const require_PTY = require("./PTY-B4ZctbwQ.cjs");
 let node_child_process = require("node:child_process");
 node_child_process = require_chunk.__toESM(node_child_process);
@@ -25802,160 +25802,6 @@ const WorkspaceEnsureScratchResult = require_Schema$1.Struct({
 	workspaceRoot: require_Schema$1.String,
 	title: require_Schema$1.String
 });
-const CodeGraphRelation = require_Schema$1.Literals([
-	"contains",
-	"imports",
-	"calls",
-	"imports_from",
-	"method",
-	"references",
-	"re_exports",
-	"indirect_call",
-	"dynamic_import",
-	"inherits",
-	"rationale_for",
-	"implements",
-	"cites",
-	"triggers"
-]);
-const CodeGraphConfidence = require_Schema$1.Literals(["EXTRACTED", "INFERRED"]);
-const CodeGraphEdgeClass = require_Schema$1.Literals([
-	"containment",
-	"dependency",
-	"behavior"
-]);
-/**
-* Relation to drawn class. Exhaustive over CODE_GRAPH_RELATIONS by construction
-* — `codeGraph.test.ts` fails if a relation is added without a class.
-*/
-const CODE_GRAPH_RELATION_CLASS = {
-	contains: "containment",
-	method: "containment",
-	imports: "dependency",
-	imports_from: "dependency",
-	re_exports: "dependency",
-	dynamic_import: "dependency",
-	inherits: "dependency",
-	implements: "dependency",
-	calls: "behavior",
-	indirect_call: "behavior",
-	references: "behavior",
-	triggers: "behavior",
-	cites: "behavior",
-	rationale_for: "behavior"
-};
-const CodeGraphNodeKind = require_Schema$1.Literals(["file", "symbol"]);
-/**
-* One community, positioned.
-*
-* Positions are computed server-side and are stable for a given graph build, so
-* the map does not rearrange itself between openings. A map you have to re-learn
-* every time is not a map.
-*/
-const CodeGraphRegion = require_Schema$1.Struct({
-	id: NonNegativeInt,
-	label: TrimmedNonEmptyString,
-	nodeCount: PositiveInt,
-	x: require_Schema$1.Number,
-	y: require_Schema$1.Number
-});
-/** An aggregated edge between two regions, weighted by how many edges cross. */
-const CodeGraphRegionLink = require_Schema$1.Struct({
-	source: NonNegativeInt,
-	target: NonNegativeInt,
-	weight: PositiveInt
-});
-/**
-* The default view: the whole repository as ~120 named regions.
-*
-* `truncatedRegions` is not decoration. When a graph has more regions than the
-* map shows, the surface says so — a view that silently drops a third of the
-* codebase while looking complete is the failure mode this field exists to
-* prevent.
-*/
-const CodeGraphSummary = require_Schema$1.Struct({
-	repoLabel: TrimmedNonEmptyString,
-	builtAtCommit: require_Schema$1.NullOr(require_Schema$1.String),
-	nodeCount: NonNegativeInt,
-	edgeCount: NonNegativeInt,
-	extractedEdgeCount: NonNegativeInt,
-	inferredEdgeCount: NonNegativeInt,
-	regionCount: NonNegativeInt,
-	regions: require_Schema$1.ArraySchema(CodeGraphRegion),
-	links: require_Schema$1.ArraySchema(CodeGraphRegionLink),
-	truncatedRegions: NonNegativeInt
-});
-/** A node as it appears in a list, a search result, or a neighborhood. */
-const CodeGraphNodeSummary = require_Schema$1.Struct({
-	id: TrimmedNonEmptyString,
-	label: TrimmedNonEmptyString,
-	kind: CodeGraphNodeKind,
-	sourceFile: require_Schema$1.NullOr(require_Schema$1.String),
-	sourceLocation: require_Schema$1.NullOr(require_Schema$1.String),
-	regionId: require_Schema$1.NullOr(NonNegativeInt),
-	regionLabel: require_Schema$1.NullOr(require_Schema$1.String),
-	degree: NonNegativeInt
-});
-/** One edge, carrying both the exact relation and the class it is drawn as. */
-const CodeGraphEdgeView = require_Schema$1.Struct({
-	source: TrimmedNonEmptyString,
-	target: TrimmedNonEmptyString,
-	relation: CodeGraphRelation,
-	edgeClass: CodeGraphEdgeClass,
-	confidence: CodeGraphConfidence,
-	confidenceScore: require_Schema$1.Number
-});
-/**
-* One node and what surrounds it — the view a person actually works in.
-*
-* `truncated` fires when a hub's fan-out exceeds the cap. A god node with
-* thousands of edges must degrade to "showing 150 of 2,310", never to a frozen
-* tab or a quietly partial picture.
-*/
-const CodeGraphNeighborhood = require_Schema$1.Struct({
-	root: CodeGraphNodeSummary,
-	nodes: require_Schema$1.ArraySchema(CodeGraphNodeSummary),
-	edges: require_Schema$1.ArraySchema(CodeGraphEdgeView),
-	depth: PositiveInt,
-	truncated: require_Schema$1.Boolean,
-	omittedCount: NonNegativeInt
-});
-const CodeGraphSearchResult = require_Schema$1.Struct({
-	nodes: require_Schema$1.ArraySchema(CodeGraphNodeSummary),
-	truncated: require_Schema$1.Boolean
-});
-const CodeGraphSummaryInput = require_Schema$1.Struct({ cwd: TrimmedNonEmptyString });
-const CodeGraphNeighborhoodInput = require_Schema$1.Struct({
-	cwd: TrimmedNonEmptyString,
-	nodeId: TrimmedNonEmptyString,
-	depth: require_Schema$1.optional(PositiveInt)
-});
-const CodeGraphSearchInput = require_Schema$1.Struct({
-	cwd: TrimmedNonEmptyString,
-	query: TrimmedNonEmptyString,
-	limit: require_Schema$1.optional(PositiveInt)
-});
-/** Where the extractor writes, relative to the project root. */
-const CODE_GRAPH_ARTIFACT_PATH = "graphify-out/graph.json";
-/**
-* No graph in this checkout, or one that cannot be read.
-*
-* Distinct from a read failure on purpose: "not indexed yet" is the normal
-* first-run state and gets an action, while a malformed or unreadable artifact
-* is a fault and gets an explanation. Collapsing them would tell a user with a
-* corrupt file to run a build they have already run.
-*/
-var CodeGraphUnavailableError = class extends require_Schema$1.TaggedErrorClass()("CodeGraphUnavailableError", {
-	reason: require_Schema$1.Literals([
-		"missing",
-		"unreadable",
-		"malformed",
-		"lfs-pointer"
-	]),
-	message: require_Schema$1.String
-}) {};
-/** A node id that is not in this graph — usually a stale link into a rebuilt graph. */
-var CodeGraphNodeNotFoundError = class extends require_Schema$1.TaggedErrorClass()("CodeGraphNodeNotFoundError", { nodeId: require_Schema$1.String }) {};
 //#endregion
 //#region ../../packages/contracts/src/relay.ts
 const RELAY_PROTOCOL_FAMILY = "forge-relay";
@@ -26342,9 +26188,6 @@ const WS_METHODS = {
 	projectsWriteFile: "projects.writeFile",
 	projectCheckoutDeletionPreview: "projectCheckoutDeletion.preview",
 	projectCheckoutDeletionExecute: "projectCheckoutDeletion.execute",
-	codeGraphSummary: "codeGraph.summary",
-	codeGraphNeighborhood: "codeGraph.neighborhood",
-	codeGraphSearch: "codeGraph.search",
 	workspaceReadFile: "workspace.readFile",
 	workspaceBeginWriteFile: "workspace.beginWriteFile",
 	workspaceWriteFileChunk: "workspace.writeFileChunk",
@@ -26630,21 +26473,6 @@ const WsProjectCheckoutDeletionExecuteRpc = make$30(WS_METHODS.projectCheckoutDe
 	payload: ProjectCheckoutDeletionExecuteInput,
 	success: ProjectCheckoutDeletionResult
 });
-const WsCodeGraphSummaryRpc = make$30(WS_METHODS.codeGraphSummary, {
-	payload: CodeGraphSummaryInput,
-	success: CodeGraphSummary,
-	error: CodeGraphUnavailableError
-});
-const WsCodeGraphNeighborhoodRpc = make$30(WS_METHODS.codeGraphNeighborhood, {
-	payload: CodeGraphNeighborhoodInput,
-	success: CodeGraphNeighborhood,
-	error: require_Schema$1.Union([CodeGraphUnavailableError, CodeGraphNodeNotFoundError])
-});
-const WsCodeGraphSearchRpc = make$30(WS_METHODS.codeGraphSearch, {
-	payload: CodeGraphSearchInput,
-	success: CodeGraphSearchResult,
-	error: CodeGraphUnavailableError
-});
 const WsWorkspaceReadFileRpc = make$30(WS_METHODS.workspaceReadFile, {
 	payload: BulkTransferReadFileInput,
 	success: BulkTransferStreamEvent,
@@ -27094,7 +26922,7 @@ const WsRpcGroup = make$29(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, Ws
 	payload: UsageSummaryInput,
 	success: UsageSummary,
 	error: UsageReadError
-}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsCodeGraphSummaryRpc, WsCodeGraphNeighborhoodRpc, WsCodeGraphSearchRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
+}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchContentsRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
 	payload: AssetsRpcSchemas.createUrl.input,
 	success: AssetsRpcSchemas.createUrl.output,
 	error: AssetAccessError
@@ -31791,21 +31619,6 @@ const RELAY_METHOD_POLICY_BASES = [
 		requiredScope: "runtime.read",
 		deliveryClass: "read"
 	},
-	{
-		method: WS_METHODS.codeGraphSummary,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
-	{
-		method: WS_METHODS.codeGraphNeighborhood,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
-	{
-		method: WS_METHODS.codeGraphSearch,
-		requiredScope: "workspace.read",
-		deliveryClass: "read"
-	},
 	{
 		method: WS_METHODS.projectsWriteFile,
 		requiredScope: "workspace.write",
@@ -51315,21 +51128,21 @@ var require_module_details_from_path = /* @__PURE__ */ require_chunk.__commonJSM
 		var lastBaseDirSegmentIndex = index + offset - 1;
 		for (var i = 0; i <= lastBaseDirSegmentIndex; i++) if (i === lastBaseDirSegmentIndex) basedir += segments[i];
 		else basedir += segments[i] + sep$2;
-		var path$18 = "";
+		var path$17 = "";
 		var lastSegmentIndex = segments.length - 1;
-		for (var i2 = index + offset; i2 <= lastSegmentIndex; i2++) if (i2 === lastSegmentIndex) path$18 += segments[i2];
-		else path$18 += segments[i2] + sep$2;
+		for (var i2 = index + offset; i2 <= lastSegmentIndex; i2++) if (i2 === lastSegmentIndex) path$17 += segments[i2];
+		else path$17 += segments[i2] + sep$2;
 		return {
 			name,
 			basedir,
-			path: path$18
+			path: path$17
 		};
 	};
 }));
 //#endregion
 //#region ../../node_modules/.bun/require-in-the-middle@8.0.1/node_modules/require-in-the-middle/index.js
 var require_require_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
-	const path$17 = require("path");
+	const path$16 = require("path");
 	const Module = require("module");
 	const debug = require_src$5()("require-in-the-middle");
 	const moduleDetailsFromPath = require_module_details_from_path();
@@ -51460,7 +51273,7 @@ var require_require_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin(
 				}
 				moduleName = filename;
 			} else if (hasWhitelist === true && modules.includes(filename)) {
-				const parsedPath = path$17.parse(filename);
+				const parsedPath = path$16.parse(filename);
 				moduleName = parsedPath.name;
 				basedir = parsedPath.dir;
 			} else {
@@ -51495,7 +51308,7 @@ var require_require_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin(
 						return exports$12;
 					}
 					if (res !== filename) if (internals === true) {
-						moduleName = moduleName + path$17.sep + path$17.relative(basedir, filename);
+						moduleName = moduleName + path$16.sep + path$16.relative(basedir, filename);
 						debug("preparing to process require of internal file: %s", moduleName);
 					} else {
 						debug("ignoring require of non-main module file: %s", res);
@@ -51524,8 +51337,8 @@ var require_require_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin(
 		} else debug("process.getBuiltinModule unhook unsuccessful");
 	};
 	function resolveModuleName(stat) {
-		const normalizedPath = path$17.sep !== "/" ? stat.path.split(path$17.sep).join("/") : stat.path;
-		return path$17.posix.join(stat.name, normalizedPath).replace(normalize, "");
+		const normalizedPath = path$16.sep !== "/" ? stat.path.split(path$16.sep).join("/") : stat.path;
+		return path$16.posix.join(stat.name, normalizedPath).replace(normalize, "");
 	}
 }));
 //#endregion
@@ -51603,7 +51416,7 @@ var require_RequireInTheMiddleSingleton = /* @__PURE__ */ require_chunk.__common
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.RequireInTheMiddleSingleton = void 0;
 	const require_in_the_middle_1 = require_require_in_the_middle();
-	const path$16 = require("path");
+	const path$15 = require("path");
 	const ModuleNameTrie_1 = require_ModuleNameTrie();
 	/**
 	* Whether Mocha is running in this process
@@ -51670,7 +51483,7 @@ var require_RequireInTheMiddleSingleton = /* @__PURE__ */ require_chunk.__common
 	* @returns {string} Normalized module name or path
 	*/
 	function normalizePathSeparators(moduleNameOrPath) {
-		return path$16.sep !== ModuleNameTrie_1.ModuleNameSeparator ? moduleNameOrPath.split(path$16.sep).join(ModuleNameTrie_1.ModuleNameSeparator) : moduleNameOrPath;
+		return path$15.sep !== ModuleNameTrie_1.ModuleNameSeparator ? moduleNameOrPath.split(path$15.sep).join(ModuleNameTrie_1.ModuleNameSeparator) : moduleNameOrPath;
 	}
 }));
 //#endregion
@@ -51721,7 +51534,7 @@ var require_register = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) =>
 //#endregion
 //#region ../../node_modules/.bun/import-in-the-middle@3.0.1/node_modules/import-in-the-middle/index.js
 var require_import_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
-	const path$15 = require("path");
+	const path$14 = require("path");
 	const moduleDetailsFromPath = require_module_details_from_path();
 	const { fileURLToPath } = require("url");
 	const { MessageChannel } = require("worker_threads");
@@ -51864,7 +51677,7 @@ var require_import_in_the_middle = /* @__PURE__ */ require_chunk.__commonJSMin((
 					if (!baseDir) callHookFn(hookFn, namespace, name, baseDir);
 					else if (baseDir.endsWith(specifiers.get(loadUrl)) || isTurbopackSpecifier(specifiers.get(loadUrl), baseDir)) callHookFn(hookFn, namespace, name, baseDir);
 					else if (internals) {
-						const internalPath = name + path$15.sep + path$15.relative(baseDir, filePath);
+						const internalPath = name + path$14.sep + path$14.relative(baseDir, filePath);
 						callHookFn(hookFn, namespace, internalPath, baseDir);
 					}
 				} else if (matchArg === specifier) callHookFn(hookFn, namespace, specifier, baseDir);
@@ -51938,7 +51751,7 @@ var require_utils$9 = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) =>
 var require_instrumentation = /* @__PURE__ */ require_chunk.__commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });
 	exports.InstrumentationBase = void 0;
-	const path$14 = require("path");
+	const path$13 = require("path");
 	const util_1$4 = require("util");
 	const semver_1 = require_semver();
 	const shimmer_1 = require_shimmer();
@@ -52020,7 +51833,7 @@ var require_instrumentation = /* @__PURE__ */ require_chunk.__commonJSMin(((expo
 		}
 		_extractPackageVersion(baseDir) {
 			try {
-				const json = (0, fs_1.readFileSync)(path$14.join(baseDir, "package.json"), { encoding: "utf8" });
+				const json = (0, fs_1.readFileSync)(path$13.join(baseDir, "package.json"), { encoding: "utf8" });
 				const version = JSON.parse(json).version;
 				return typeof version === "string" ? version : void 0;
 			} catch {
@@ -52057,7 +51870,7 @@ var require_instrumentation = /* @__PURE__ */ require_chunk.__commonJSMin(((expo
 				return exports$7;
 			}
 			const files = module$4.files ?? [];
-			const normalizedName = path$14.normalize(name);
+			const normalizedName = path$13.normalize(name);
 			return files.filter((f) => f.name === normalizedName && isSupported(f.supportedVersions, version, module$4.includePrerelease)).reduce((patchedExports, file) => {
 				file.moduleExports = patchedExports;
 				if (this._enabled) {
@@ -52098,8 +51911,8 @@ var require_instrumentation = /* @__PURE__ */ require_chunk.__commonJSMin(((expo
 			this._warnOnPreloadedModules();
 			for (const module$6 of this._modules) {
 				const hookFn = (exports$8, name, baseDir) => {
-					if (!baseDir && path$14.isAbsolute(name)) {
-						const parsedPath = path$14.parse(name);
+					if (!baseDir && path$13.isAbsolute(name)) {
+						const parsedPath = path$13.parse(name);
 						name = parsedPath.name;
 						baseDir = parsedPath.dir;
 					}
@@ -52108,7 +51921,7 @@ var require_instrumentation = /* @__PURE__ */ require_chunk.__commonJSMin(((expo
 				const onRequire = (exports$9, name, baseDir) => {
 					return this._onRequire(module$6, exports$9, name, baseDir);
 				};
-				const hook = path$14.isAbsolute(module$6.name) ? new require_in_the_middle_1.Hook([module$6.name], { internals: true }, onRequire) : this._requireInTheMiddleSingleton.register(module$6.name, onRequire);
+				const hook = path$13.isAbsolute(module$6.name) ? new require_in_the_middle_1.Hook([module$6.name], { internals: true }, onRequire) : this._requireInTheMiddleSingleton.register(module$6.name, onRequire);
 				this._hooks.push(hook);
 				const esmHook = new import_in_the_middle_1.Hook([module$6.name], { internals: true }, hookFn);
 				this._hooks.push(esmHook);
@@ -66418,7 +66231,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.15";
+var version$1 = "0.13.17";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -67456,7 +67269,7 @@ function toPersistenceDecodeDefect(operation) {
 const isPersistenceError = (u) => require_Schema$1.is(PersistenceSqlError)(u) || require_Schema$1.is(PersistenceDecodeError)(u);
 //#endregion
 //#region src/cmmdConnection/CmmdConnectionStore.ts
-const cache$1 = /* @__PURE__ */ new Map();
+const cache = /* @__PURE__ */ new Map();
 const jwtCache = /* @__PURE__ */ new Map();
 const jwtExpiryCache = /* @__PURE__ */ new Map();
 const refreshTokenCache = /* @__PURE__ */ new Map();
@@ -67597,7 +67410,7 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
       session_grant AS "sessionGrant"
     FROM command_access_tokens
   `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.hydrate:query")))).pipe(require_Schema$1.mapError(toPersistenceDecodeError("CommandAccessTokenStore.hydrate:decodeRows")));
-	cache$1.clear();
+	cache.clear();
 	jwtCache.clear();
 	jwtExpiryCache.clear();
 	refreshTokenCache.clear();
@@ -67607,7 +67420,7 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
 		try: () => {
 			for (const row of decoded) {
 				const sessionId = row.sessionId;
-				cache$1.set(sessionId, decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken));
+				cache.set(sessionId, decodeSensitiveValue(ACCESS_TOKEN_SCOPE, row.accessToken));
 				const jwtToken = decryptNullable(JWT_TOKEN_SCOPE, row.jwtToken);
 				if (jwtToken) jwtCache.set(sessionId, jwtToken);
 				if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
@@ -67627,7 +67440,7 @@ const hydrateCommandAccessTokenStore = require_Schema$1.gen(function* () {
 * Returns `null` when the session has no paired CMMD token.
 */
 function readCommandAccessTokenForSession(sessionId) {
-	return cache$1.get(sessionId) ?? null;
+	return cache.get(sessionId) ?? null;
 }
 const threadSessions = /* @__PURE__ */ new Map();
 /**
@@ -68004,7 +67817,7 @@ const promoteMostRecentOwnerCommandAuthToSession = (sessionId) => require_Schema
         cmmd_user_identity = excluded.cmmd_user_identity,
         updated_at = excluded.updated_at
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.promoteLatestOwnerAuth:upsert")));
-	cache$1.set(sessionId, accessToken);
+	cache.set(sessionId, accessToken);
 	if (jwtToken) jwtCache.set(sessionId, jwtToken);
 	else jwtCache.delete(sessionId);
 	if (row.jwtExpiresAt) jwtExpiryCache.set(sessionId, row.jwtExpiresAt);
@@ -68049,7 +67862,7 @@ const setCommandAccessTokenForSession = (sessionId, accessToken) => require_Sche
         access_token = excluded.access_token,
         updated_at = excluded.updated_at
     `.pipe(require_Schema$1.mapError(toPersistenceSqlError("CommandAccessTokenStore.set:query")));
-	cache$1.set(sessionId, token);
+	cache.set(sessionId, token);
 });
 /**
 * Remove the PAT for a session from both durable persistence and the in-memory cache.
@@ -68062,7 +67875,7 @@ const clearCommandAccessTokenForSession = (sessionId) => require_Schema$1.gen(fu
 	forgetCommandAccessTokenCachesForSession(sessionId);
 });
 function forgetCommandAccessTokenCachesForSession(sessionId) {
-	cache$1.delete(sessionId);
+	cache.delete(sessionId);
 	jwtCache.delete(sessionId);
 	jwtExpiryCache.delete(sessionId);
 	refreshTokenCache.delete(sessionId);
@@ -76295,7 +76108,7 @@ var require_detect_libc = /* @__PURE__ */ require_chunk.__commonJSMin(((exports,
 //#region ../../node_modules/.bun/node-gyp-build-optional-packages@5.2.2/node_modules/node-gyp-build-optional-packages/node-gyp-build.js
 var require_node_gyp_build = /* @__PURE__ */ require_chunk.__commonJSMin(((exports, module) => {
 	var fs$8 = require("fs");
-	var path$12 = require("path");
+	var path$11 = require("path");
 	var url$2 = require("url");
 	var os$3 = require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : require;
@@ -76315,30 +76128,30 @@ var require_node_gyp_build = /* @__PURE__ */ require_chunk.__commonJSMin(((expor
 		return runtimeRequire(load.resolve(dir));
 	}
 	load.resolve = load.path = function(dir) {
-		dir = path$12.resolve(dir || ".");
+		dir = path$11.resolve(dir || ".");
 		var packageName = "";
 		var packageNameError;
 		try {
-			packageName = runtimeRequire(path$12.join(dir, "package.json")).name;
+			packageName = runtimeRequire(path$11.join(dir, "package.json")).name;
 			var varName = packageName.toUpperCase().replace(/-/g, "_");
 			if (process.env[varName + "_PREBUILD"]) dir = process.env[varName + "_PREBUILD"];
 		} catch (err) {
 			packageNameError = err;
 		}
 		if (!prebuildsOnly) {
-			var release = getFirst(path$12.join(dir, "build/Release"), matchBuild);
+			var release = getFirst(path$11.join(dir, "build/Release"), matchBuild);
 			if (release) return release;
-			var debug = getFirst(path$12.join(dir, "build/Debug"), matchBuild);
+			var debug = getFirst(path$11.join(dir, "build/Debug"), matchBuild);
 			if (debug) return debug;
 		}
 		var prebuild = resolve(dir);
 		if (prebuild) return prebuild;
-		var nearby = resolve(path$12.dirname(process.execPath));
+		var nearby = resolve(path$11.dirname(process.execPath));
 		if (nearby) return nearby;
 		var platformPackage = (packageName[0] == "@" ? "" : "@" + packageName + "/") + packageName + "-" + platform + "-" + arch;
 		var packageResolutionError;
 		try {
-			return resolveFile(path$12.dirname(require("module").createRequire(url$2.pathToFileURL(path$12.join(dir, "package.json"))).resolve(platformPackage)));
+			return resolveFile(path$11.dirname(require("module").createRequire(url$2.pathToFileURL(path$11.join(dir, "package.json"))).resolve(platformPackage)));
 		} catch (error) {
 			packageResolutionError = error;
 		}
@@ -76358,13 +76171,13 @@ var require_node_gyp_build = /* @__PURE__ */ require_chunk.__commonJSMin(((expor
 		if (packageResolutionError) errMessage += "Error resolving package: " + packageResolutionError.message + "\n";
 		throw new Error(errMessage);
 		function resolve(dir) {
-			var tuple = readdirSync(path$12.join(dir, "prebuilds")).map(parseTuple).filter(matchTuple(platform, arch)).sort(compareTuples)[0];
+			var tuple = readdirSync(path$11.join(dir, "prebuilds")).map(parseTuple).filter(matchTuple(platform, arch)).sort(compareTuples)[0];
 			if (!tuple) return;
-			return resolveFile(path$12.join(dir, "prebuilds", tuple.name));
+			return resolveFile(path$11.join(dir, "prebuilds", tuple.name));
 		}
 		function resolveFile(prebuilds) {
 			var winner = readdirSync(prebuilds).map(parseTags).filter(matchTags(runtime, abi)).sort(compareTags(runtime))[0];
-			if (winner) return path$12.join(prebuilds, winner.file);
+			if (winner) return path$11.join(prebuilds, winner.file);
 		}
 	};
 	function readdirSync(dir) {
@@ -76376,7 +76189,7 @@ var require_node_gyp_build = /* @__PURE__ */ require_chunk.__commonJSMin(((expor
 	}
 	function getFirst(dir, filter) {
 		var files = readdirSync(dir).filter(filter);
-		return files[0] && path$12.join(dir, files[0]);
+		return files[0] && path$11.join(dir, files[0]);
 	}
 	function matchBuild(name) {
 		return /\.node$/.test(name);
@@ -77646,500 +77459,6 @@ const makeSocketProtocol = /* @__PURE__ */ require_Schema$1.gen(function* () {
 	};
 });
 //#endregion
-//#region src/codeGraph/aggregate.ts
-/**
-* Turning a 26 MB graph into slices small enough to draw.
-*
-* Pure functions over an already-parsed graph, deliberately free of Effect, the
-* filesystem and the RPC layer, so the interesting parts — capping, ranking,
-* hub suppression — are testable without a runtime or a fixture file on disk.
-*
-* The whole module exists because of one number: this repo's graph is 34,102
-* nodes and 86,347 edges. Nothing here ever returns more than a few hundred of
-* either. A view that tries to show everything shows nothing.
-*/
-function pushInto(map, key, link) {
-	const existing = map.get(key);
-	if (existing === void 0) {
-		map.set(key, [link]);
-		return;
-	}
-	existing.push(link);
-}
-function isKnownRelation(relation) {
-	return Object.hasOwn(CODE_GRAPH_RELATION_CLASS, relation);
-}
-/**
-* Index a parsed graph once so every later query is a map lookup.
-*
-* Edges naming a node the artifact does not define are dropped rather than
-* synthesised. Graphify does emit these — a call into a module outside the scan
-* root — and inventing a placeholder node for one would put a file in the map
-* that is not in the repository.
-*/
-function indexGraph(raw, repoLabel) {
-	const nodes = /* @__PURE__ */ new Map();
-	for (const node of raw.nodes) nodes.set(node.id, node);
-	const outbound = /* @__PURE__ */ new Map();
-	const inbound = /* @__PURE__ */ new Map();
-	const degree = /* @__PURE__ */ new Map();
-	const unknownRelations = /* @__PURE__ */ new Set();
-	let extractedEdgeCount = 0;
-	let inferredEdgeCount = 0;
-	let edgeCount = 0;
-	for (const link of raw.links) {
-		if (!nodes.has(link.source) || !nodes.has(link.target)) continue;
-		const relation = link.relation ?? "";
-		if (relation !== "" && !isKnownRelation(relation)) {
-			unknownRelations.add(relation);
-			continue;
-		}
-		edgeCount += 1;
-		if (link.confidence === "INFERRED") inferredEdgeCount += 1;
-		else extractedEdgeCount += 1;
-		pushInto(outbound, link.source, link);
-		pushInto(inbound, link.target, link);
-		degree.set(link.source, (degree.get(link.source) ?? 0) + 1);
-		degree.set(link.target, (degree.get(link.target) ?? 0) + 1);
-	}
-	return {
-		repoLabel,
-		builtAtCommit: raw.built_at_commit ?? null,
-		nodes,
-		outbound,
-		inbound,
-		degree,
-		edgeCount,
-		extractedEdgeCount,
-		inferredEdgeCount,
-		unknownRelations: [...unknownRelations].toSorted()
-	};
-}
-/**
-* Deterministic sunflower placement.
-*
-* A phyllotaxis spiral rather than a force simulation, for three reasons: it
-* needs no dependency, it is O(n), and — the one that actually matters — it is
-* *stable*. The same graph opens to the same picture every time, so the spatial
-* memory a person builds up survives closing the panel. A force layout reshuffles
-* on every mount and quietly costs them that.
-*
-* Index 0 lands nearest the centre, so ordering regions by size puts the
-* architectural core where the eye starts.
-*/
-function spiralPosition(index, total) {
-	const goldenAngle = Math.PI * (3 - Math.sqrt(5));
-	const radius = total <= 1 ? 0 : Math.sqrt(index / (total - 1));
-	const angle = index * goldenAngle;
-	return {
-		x: .5 + radius * Math.cos(angle) * .44,
-		y: .5 + radius * Math.sin(angle) * .44
-	};
-}
-/** Group nodes into their communities, and remember which community each is in. */
-function accumulateRegions(graph) {
-	const accumulators = /* @__PURE__ */ new Map();
-	const regionOfNode = /* @__PURE__ */ new Map();
-	for (const node of graph.nodes.values()) {
-		const community = node.community;
-		if (community === void 0) continue;
-		regionOfNode.set(node.id, community);
-		const existing = accumulators.get(community);
-		if (existing === void 0) {
-			accumulators.set(community, {
-				id: community,
-				label: node.community_name ?? `Region ${String(community)}`,
-				nodeCount: 1
-			});
-			continue;
-		}
-		existing.nodeCount += 1;
-	}
-	return {
-		ordered: [...accumulators.values()].toSorted((a, b) => b.nodeCount - a.nodeCount || a.id - b.id),
-		regionOfNode
-	};
-}
-/**
-* Collapse node-level edges into weighted links between drawn regions.
-*
-* Undirected: "these two areas talk" is the question at this altitude, and
-* drawing both arcs doubles the ink for no added meaning.
-*/
-function aggregateRegionLinks(graph, regionOfNode, shownIds) {
-	const linkWeights = /* @__PURE__ */ new Map();
-	for (const links of graph.outbound.values()) for (const link of links) {
-		const from = regionOfNode.get(link.source);
-		const to = regionOfNode.get(link.target);
-		if (from === void 0 || to === void 0 || from === to) continue;
-		if (!shownIds.has(from) || !shownIds.has(to)) continue;
-		const key = `${String(Math.min(from, to))}:${String(Math.max(from, to))}`;
-		linkWeights.set(key, (linkWeights.get(key) ?? 0) + 1);
-	}
-	return [...linkWeights.entries()].map(([key, weight]) => {
-		const [source, target] = key.split(":");
-		return {
-			source: Number(source),
-			target: Number(target),
-			weight
-		};
-	});
-}
-/**
-* The default view: the repository as named regions.
-*
-* Regions come from graphify's own community detection, and their names come
-* from the community's hub node — so a region is labelled `AIGateway.ts` or
-* `IStorage`, something a person recognises, rather than "Community 469".
-*/
-function buildSummary(graph) {
-	const { ordered, regionOfNode } = accumulateRegions(graph);
-	const shown = ordered.slice(0, 120);
-	const shownIds = new Set(shown.map((region) => region.id));
-	const regions = shown.map((region, index) => {
-		const position = spiralPosition(index, shown.length);
-		return {
-			id: region.id,
-			label: region.label,
-			nodeCount: region.nodeCount,
-			x: position.x,
-			y: position.y
-		};
-	});
-	return {
-		repoLabel: graph.repoLabel,
-		builtAtCommit: graph.builtAtCommit,
-		nodeCount: graph.nodes.size,
-		edgeCount: graph.edgeCount,
-		extractedEdgeCount: graph.extractedEdgeCount,
-		inferredEdgeCount: graph.inferredEdgeCount,
-		regionCount: ordered.length,
-		regions,
-		links: aggregateRegionLinks(graph, regionOfNode, shownIds),
-		truncatedRegions: Math.max(0, ordered.length - shown.length)
-	};
-}
-function summariseNode(graph, node) {
-	return {
-		id: node.id,
-		label: node.label ?? node.id,
-		kind: node._callable === true ? "symbol" : "file",
-		sourceFile: node.source_file ?? null,
-		sourceLocation: node.source_location ?? null,
-		regionId: node.community ?? null,
-		regionLabel: node.community_name ?? null,
-		degree: graph.degree.get(node.id) ?? 0
-	};
-}
-function toEdgeView(link) {
-	const relation = link.relation ?? "";
-	if (!isKnownRelation(relation)) return null;
-	const confidence = link.confidence === "INFERRED" ? "INFERRED" : "EXTRACTED";
-	return {
-		source: link.source,
-		target: link.target,
-		relation,
-		edgeClass: CODE_GRAPH_RELATION_CLASS[relation],
-		confidence,
-		confidenceScore: link.confidence_score ?? 1
-	};
-}
-/**
-* Pull one node's neighbours into the result; return how many it had to drop.
-*
-* Split out of `buildNeighborhood` because the two read differently: the caller
-* owns *how far to walk*, this owns *what one step collects*. Together they sat
-* well past the repo's cognitive-complexity gate.
-*/
-/** Links touching a node, most-connected neighbour first. */
-function rankNeighbourLinks(graph, current) {
-	return [...graph.outbound.get(current) ?? [], ...graph.inbound.get(current) ?? []].toSorted((a, b) => {
-		const aOther = a.source === current ? a.target : a.source;
-		const bOther = b.source === current ? b.target : b.source;
-		return (graph.degree.get(bOther) ?? 0) - (graph.degree.get(aOther) ?? 0);
-	});
-}
-/** Take a neighbour into the result. False means the budget is spent. */
-function admitNeighbour(state, id, node) {
-	if (state.included.has(id)) return true;
-	if (state.included.size >= 150) return false;
-	state.included.set(id, node);
-	state.next.push(id);
-	return true;
-}
-/** Record an edge once, dropping any relation this build cannot classify. */
-function recordEdge(state, link) {
-	const edgeKey = `${link.source}>${link.target}:${link.relation ?? ""}`;
-	if (state.seenEdges.has(edgeKey)) return;
-	const view = toEdgeView(link);
-	if (view === null) return;
-	state.seenEdges.add(edgeKey);
-	state.edges.push(view);
-}
-/**
-* Pull one node's neighbours into the result; return how many it had to drop.
-*
-* Split out of `buildNeighborhood` because the two read differently: the caller
-* owns *how far to walk*, this owns *what one step collects*.
-*/
-function expandNode(graph, current, state) {
-	let omitted = 0;
-	for (const link of rankNeighbourLinks(graph, current)) {
-		const other = link.source === current ? link.target : link.source;
-		const otherNode = graph.nodes.get(other);
-		if (otherNode === void 0) continue;
-		if (!admitNeighbour(state, other, otherNode)) {
-			omitted += 1;
-			continue;
-		}
-		recordEdge(state, link);
-	}
-	return omitted;
-}
-/**
-* One node and what surrounds it.
-*
-* Two caps, and they do different jobs. `CODE_GRAPH_MAX_NEIGHBORS` bounds the
-* answer so the canvas stays drawable. `CODE_GRAPH_MAX_FANOUT` bounds the
-* *traversal*: a hub is included as a neighbor but never expanded through, so
-* one `logger.ts` in the second ring cannot drag the entire repository in
-* behind it. Without the second cap the first one is reached instantly and the
-* result is 150 arbitrary nodes rather than the 150 nearest ones.
-*/
-function buildNeighborhood(graph, nodeId, requestedDepth) {
-	const root = graph.nodes.get(nodeId);
-	if (root === void 0) return null;
-	const depth = Math.min(Math.max(1, requestedDepth), 2);
-	const included = new Map([[root.id, root]]);
-	const seenEdges = /* @__PURE__ */ new Set();
-	const edges = [];
-	let omittedCount = 0;
-	let frontier = [root.id];
-	for (let level = 0; level < depth; level += 1) {
-		const next = [];
-		for (const current of frontier) {
-			const fanout = graph.degree.get(current) ?? 0;
-			if (current !== root.id && fanout > 200) continue;
-			omittedCount += expandNode(graph, current, {
-				included,
-				seenEdges,
-				edges,
-				next
-			});
-		}
-		frontier = next;
-		if (frontier.length === 0) break;
-	}
-	const nodes = [...included.values()].filter((node) => node.id !== root.id).map((node) => summariseNode(graph, node)).toSorted((a, b) => b.degree - a.degree || a.label.localeCompare(b.label));
-	return {
-		root: summariseNode(graph, root),
-		nodes,
-		edges: edges.filter((edge) => included.has(edge.source) && included.has(edge.target)),
-		depth,
-		truncated: omittedCount > 0,
-		omittedCount
-	};
-}
-/**
-* Rank one node against a query: lower is better, negative means no match.
-*
-* A file-path hit ranks last because "the query appears somewhere in this path"
-* is much weaker evidence than "this thing is called that".
-*/
-function matchScore(node, query) {
-	const label = (node.label ?? node.id).toLowerCase();
-	if (label === query) return 0;
-	if (label.startsWith(query)) return 1;
-	if (label.includes(query)) return 2;
-	return (node.source_file ?? "").toLowerCase().includes(query) ? 3 : -1;
-}
-/**
-* Find a node by name or path.
-*
-* Entry to this surface is search, not the canvas — you usually arrive already
-* knowing what you are looking for, and clicking around 34,000 nodes to find it
-* is not a workflow. Ranking is exact, then prefix, then substring, with degree
-* breaking ties so the `logger.ts` everything imports outranks a test fixture
-* that merely shares the word.
-*/
-function searchNodes(graph, rawQuery, limit = 40) {
-	const query = rawQuery.trim().toLowerCase();
-	if (query === "") return {
-		nodes: [],
-		truncated: false
-	};
-	const scored = [];
-	for (const node of graph.nodes.values()) {
-		const score = matchScore(node, query);
-		if (score < 0) continue;
-		scored.push({
-			node,
-			score
-		});
-	}
-	const ranked = scored.toSorted((a, b) => a.score - b.score || (graph.degree.get(b.node.id) ?? 0) - (graph.degree.get(a.node.id) ?? 0) || (a.node.label ?? a.node.id).localeCompare(b.node.label ?? b.node.id));
-	const capped = ranked.slice(0, limit);
-	return {
-		nodes: capped.map((entry) => summariseNode(graph, entry.node)),
-		truncated: ranked.length > capped.length
-	};
-}
-//#endregion
-//#region src/codeGraph/graphArtifact.ts
-/**
-* Reading `graphify-out/graph.json` off disk, once.
-*
-* The artifact is 26 MB here and 40 MB for CMMD's server tree, and parsing it
-* costs roughly a second. Every panel open would pay that again without a cache,
-* so one indexed graph is held per project and reused until the file changes.
-*
-* Kept free of Effect on purpose: the failure modes worth distinguishing are all
-* filesystem-shaped, and a plain promise keeps this unit-testable against real
-* fixtures without constructing a runtime. `ws.ts` wraps it at the boundary.
-*/
-const cache = /* @__PURE__ */ new Map();
-/** Git LFS writes a pointer file that is valid text and useless as a graph. */
-const LFS_POINTER_PREFIX = "version https://git-lfs.github.com/spec/v1";
-function codeGraphArtifactPath(cwd) {
-	return node_path.default.join(cwd, CODE_GRAPH_ARTIFACT_PATH);
-}
-function isRawGraph(value) {
-	if (typeof value !== "object" || value === null) return false;
-	const candidate = value;
-	return Array.isArray(candidate.nodes) && Array.isArray(candidate.links);
-}
-/**
-* Load and index the graph for one project checkout.
-*
-* The LFS-pointer case is called out separately rather than folded into
-* "malformed" because it is the single most likely failure on a fresh clone —
-* the file is present, tracked, and 133 bytes of metadata. Telling someone their
-* graph is corrupt when they simply have not run `git lfs pull` sends them to
-* rebuild something that is fine.
-*/
-async function loadIndexedGraph(cwd) {
-	const artifactPath = codeGraphArtifactPath(cwd);
-	let stats;
-	try {
-		stats = await (0, node_fs_promises.stat)(artifactPath);
-	} catch {
-		return {
-			ok: false,
-			failure: {
-				kind: "missing",
-				artifactPath
-			}
-		};
-	}
-	if (!stats.isFile()) return {
-		ok: false,
-		failure: {
-			kind: "missing",
-			artifactPath
-		}
-	};
-	const cached = cache.get(artifactPath);
-	if (cached !== void 0 && cached.mtimeMs === stats.mtimeMs && cached.size === stats.size) return {
-		ok: true,
-		graph: cached.graph
-	};
-	let contents;
-	try {
-		contents = await (0, node_fs_promises.readFile)(artifactPath, "utf8");
-	} catch (error) {
-		return {
-			ok: false,
-			failure: {
-				kind: "unreadable",
-				artifactPath,
-				detail: error instanceof Error ? error.message : String(error)
-			}
-		};
-	}
-	if (contents.startsWith(LFS_POINTER_PREFIX)) return {
-		ok: false,
-		failure: {
-			kind: "lfs-pointer",
-			artifactPath
-		}
-	};
-	let parsed;
-	try {
-		parsed = JSON.parse(contents);
-	} catch (error) {
-		return {
-			ok: false,
-			failure: {
-				kind: "malformed",
-				artifactPath,
-				detail: error instanceof Error ? error.message : String(error)
-			}
-		};
-	}
-	if (!isRawGraph(parsed)) return {
-		ok: false,
-		failure: {
-			kind: "malformed",
-			artifactPath,
-			detail: "Expected an object with `nodes` and `links` arrays."
-		}
-	};
-	const graph = indexGraph(parsed, node_path.default.basename(cwd));
-	cache.set(artifactPath, {
-		mtimeMs: stats.mtimeMs,
-		size: stats.size,
-		graph
-	});
-	return {
-		ok: true,
-		graph
-	};
-}
-//#endregion
-//#region src/codeGraph/service.ts
-/**
-* The code-graph RPC surface, as Effects.
-*
-* A thin seam between `ws.ts` and the pure aggregator: load the artifact, turn
-* a filesystem failure into the tagged error the client can act on, and slice.
-*
-* The failure mapping is the substance here. Each reason produces different
-* advice — pull LFS, run the extractor, report a corrupt file — so collapsing
-* them into one "graph unavailable" would send people to fix the wrong thing.
-*/
-function toUnavailable(failure) {
-	switch (failure.kind) {
-		case "missing": return new CodeGraphUnavailableError({
-			reason: "missing",
-			message: `No code graph in this checkout. Run \`graphify update .\` to build ${failure.artifactPath}.`
-		});
-		case "lfs-pointer": return new CodeGraphUnavailableError({
-			reason: "lfs-pointer",
-			message: `The graph is a Git LFS pointer, not the graph itself. Run \`git lfs pull\` to fetch it.`
-		});
-		case "malformed": return new CodeGraphUnavailableError({
-			reason: "malformed",
-			message: `The graph file could not be parsed: ${failure.detail}`
-		});
-		case "unreadable": return new CodeGraphUnavailableError({
-			reason: "unreadable",
-			message: `The graph file could not be read: ${failure.detail}`
-		});
-	}
-}
-function withGraph(cwd, use) {
-	return require_Schema$1.flatMap(require_Schema$1.promise(() => loadIndexedGraph(cwd)), (result) => result.ok ? require_Schema$1.succeed(use(result.graph)) : require_Schema$1.fail(toUnavailable(result.failure)));
-}
-function readCodeGraphSummary(input) {
-	return withGraph(input.cwd, buildSummary);
-}
-function readCodeGraphNeighborhood(input) {
-	return require_Schema$1.flatMap(withGraph(input.cwd, (graph) => buildNeighborhood(graph, input.nodeId, input.depth ?? 1)), (neighborhood) => neighborhood === null ? require_Schema$1.fail(new CodeGraphNodeNotFoundError({ nodeId: input.nodeId })) : require_Schema$1.succeed(neighborhood));
-}
-function readCodeGraphSearch(input) {
-	return withGraph(input.cwd, (graph) => searchNodes(graph, input.query, input.limit ?? 40));
-}
-//#endregion
 //#region src/checkpointing/Services/CheckpointDiffQuery.ts
 /**
 * CheckpointDiffQuery - Service tag for checkpoint diff queries.
@@ -97076,6 +96395,7 @@ const registerCloudRuntimeForReplicaHydration = require_Schema$1.gen(function* (
 			credentialEpoch,
 			activeTurnCount: 0,
 			activeSessionCount: 0,
+			acceptingTurns: false,
 			...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 			forgeServerVersion: installedForgeServerVersion
 		}),
@@ -97112,6 +96432,128 @@ const hydrateCloudRuntimeReplica = require_Schema$1.gen(function* () {
 	return yield* hydrateRuntimeReplica({ expectedRuntimeId: grant.runtimeId }, dependencies);
 });
 //#endregion
+//#region src/runtimeDrain/RuntimeDrainState.ts
+/**
+* The positive facts this process must observe before it can claim a turn.
+*
+* Every entry is required, so adding one here is the whole change: the
+* derivation below reads this list rather than naming fields, and the record
+* it indexes cannot be built with a member missing.
+*/
+const RUNTIME_EXECUTION_PRECONDITIONS = ["orchestrationEngine", "providerLayer"];
+/**
+* The single definition of the accepting-turns fact.
+*
+* Exported so test stubs of this service derive it exactly as the live state
+* does. A stub that recomputed it by hand could disagree with production and
+* still pass.
+*/
+function deriveAcceptingTurns(input) {
+	return RUNTIME_EXECUTION_PRECONDITIONS.every((precondition) => input.preconditions[precondition]) && !input.draining && !input.shutdownRequested;
+}
+const initialState = {
+	activeTurns: /* @__PURE__ */ new Set(),
+	activeTurnCount: 0,
+	activeSessionCount: 0,
+	draining: false,
+	drainReason: null,
+	drainTargetImageRef: null,
+	drainTargetImageVersion: null,
+	drainForceRequired: false,
+	preconditions: {
+		orchestrationEngine: false,
+		providerLayer: false
+	},
+	shutdownRequested: false
+};
+function snapshotFromState(state) {
+	return {
+		activeTurnCount: state.activeTurnCount,
+		activeSessionCount: state.activeSessionCount,
+		draining: state.draining,
+		drainReason: state.drainReason,
+		drainTargetImageRef: state.drainTargetImageRef,
+		drainTargetImageVersion: state.drainTargetImageVersion,
+		drainForceRequired: state.drainForceRequired,
+		acceptingTurns: deriveAcceptingTurns(state)
+	};
+}
+function turnKey(input) {
+	return `${input.threadId}:${input.turnId ?? "unknown"}`;
+}
+function normalizeCount(count) {
+	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
+}
+const makeRuntimeDrainState = require_Schema$1.gen(function* () {
+	const stateRef = yield* require_HttpServer.make$3(initialState);
+	const update = (f) => require_HttpServer.updateAndGet(stateRef, f).pipe(require_Schema$1.map(snapshotFromState));
+	return {
+		beginTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.add(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		completeTurn: (input) => update((state) => {
+			const activeTurns = new Set(state.activeTurns);
+			activeTurns.delete(turnKey(input));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size
+			};
+		}),
+		clearActiveTurns: update((state) => ({
+			...state,
+			activeTurns: /* @__PURE__ */ new Set(),
+			activeTurnCount: 0
+		})),
+		setActiveSessionCount: (count) => update((state) => ({
+			...state,
+			activeSessionCount: normalizeCount(count)
+		})),
+		reconcileProviderSessions: (sessions) => update((state) => {
+			const activeSessions = sessions.filter((session) => session.status !== "closed");
+			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
+				threadId: session.threadId,
+				turnId: session.activeTurnId
+			})]));
+			return {
+				...state,
+				activeTurns,
+				activeTurnCount: activeTurns.size,
+				activeSessionCount: activeSessions.length
+			};
+		}),
+		applyControlPlaneState: (input) => update((state) => ({
+			...state,
+			draining: input.draining ?? state.draining,
+			drainReason: input.drainReason ?? state.drainReason,
+			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
+			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
+			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
+		})),
+		markExecutionPrecondition: (precondition) => update((state) => ({
+			...state,
+			preconditions: {
+				...state.preconditions,
+				[precondition]: true
+			}
+		})),
+		requestShutdown: update((state) => ({
+			...state,
+			shutdownRequested: true
+		})),
+		snapshot: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map(snapshotFromState)),
+		isDraining: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map((state) => state.draining))
+	};
+});
+var RuntimeDrainState = class extends require_Schema$1.Service()("forge/runtimeDrain/RuntimeDrainState") {};
+const RuntimeDrainStateLive = require_Schema$1.effect(RuntimeDrainState, makeRuntimeDrainState);
+//#endregion
 //#region src/persistence/Services/LocalAutomations.ts
 const LocalAutomationStatus = require_Schema$1.Literals([
 	"active",
@@ -100748,6 +100190,30 @@ const makeCommandGate = require_Schema$1.gen(function* () {
 		})
 	};
 });
+/**
+* Settle the command gate for a finished startup, and report whether commands
+* are now accepted.
+*
+* The success branch is the moment the orchestration engine can take work, so
+* it is where the engine half of the accepting-turns fact is marked. A failed
+* startup accepts nothing and must leave the fact untouched: absent must not
+* read as healthy.
+*/
+const settleCommandReadiness = (input) => require_Schema$1.gen(function* () {
+	if (require_Schema$1.isFailure(input.startupExit)) {
+		const error = new ServerRuntimeStartupError({
+			message: startupFailureMessage(input.startupExit.cause),
+			cause: input.startupExit.cause
+		});
+		yield* require_Schema$1.logError("server runtime startup failed", { cause: describeStartupFailure(input.startupExit.cause) });
+		yield* input.commandGate.failCommandReady(error);
+		return false;
+	}
+	yield* require_Schema$1.logDebug("Accepting commands");
+	yield* input.commandGate.signalCommandReady;
+	yield* input.drainState.markExecutionPrecondition("orchestrationEngine");
+	return true;
+});
 const launchStartupHeartbeat = require_Schema$1.gen(function* () {
 	const analytics = yield* AnalyticsService;
 	const { threadCount, projectCount } = yield* (yield* ProjectionSnapshotQuery).getCounts().pipe(require_Schema$1.catch_((cause) => require_Schema$1.logWarning("failed to gather startup projection counts for telemetry", { cause }).pipe(require_Schema$1.as({
@@ -100929,6 +100395,7 @@ const makeServerRuntimeStartup = require_Schema$1.gen(function* () {
 	const serverSettings = yield* ServerSettingsService;
 	const serverEnvironment = yield* ServerEnvironment;
 	const usage = yield* UsageService;
+	const drainState = yield* RuntimeDrainState;
 	const commandGate = yield* makeCommandGate;
 	const httpListening = yield* require_Schema$1.make$4();
 	const reactorScope = yield* require_Schema$1.make$3("sequential");
@@ -101011,18 +100478,11 @@ const makeServerRuntimeStartup = require_Schema$1.gen(function* () {
 		root: true
 	}));
 	yield* require_Schema$1.forkScoped(require_Schema$1.gen(function* () {
-		const startupExit = yield* require_Schema$1.exit(startup);
-		if (require_Schema$1.isFailure(startupExit)) {
-			const error = new ServerRuntimeStartupError({
-				message: startupFailureMessage(startupExit.cause),
-				cause: startupExit.cause
-			});
-			yield* require_Schema$1.logError("server runtime startup failed", { cause: describeStartupFailure(startupExit.cause) });
-			yield* commandGate.failCommandReady(error);
-			return;
-		}
-		yield* require_Schema$1.logDebug("Accepting commands");
-		yield* commandGate.signalCommandReady;
+		if (!(yield* settleCommandReadiness({
+			startupExit: yield* require_Schema$1.exit(startup),
+			commandGate,
+			drainState
+		}))) return;
 		yield* require_Schema$1.logDebug("startup phase: starting the usage scan warm-up");
 		yield* require_Schema$1.forkScoped(runUsageScanWarmup({ readSummary: usage.readSummary }));
 		yield* require_Schema$1.logDebug("startup phase: waiting for http listener");
@@ -107578,9 +107038,6 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(r
 		}))), { "rpc.aggregate": "workspace" }),
 		[WS_METHODS.serverDiscoverSourceControl]: () => observeRpcEffect(WS_METHODS.serverDiscoverSourceControl, discoverSourceControl, { "rpc.aggregate": "server" }),
 		[WS_METHODS.serverReportClientActivity]: () => observeRpcEffect(WS_METHODS.serverReportClientActivity, require_Schema$1.void_, { "rpc.aggregate": "server" }),
-		[WS_METHODS.codeGraphSummary]: (input) => observeRpcEffect(WS_METHODS.codeGraphSummary, readCodeGraphSummary(input), { "rpc.aggregate": "codeGraph" }),
-		[WS_METHODS.codeGraphNeighborhood]: (input) => observeRpcEffect(WS_METHODS.codeGraphNeighborhood, readCodeGraphNeighborhood(input), { "rpc.aggregate": "codeGraph" }),
-		[WS_METHODS.codeGraphSearch]: (input) => observeRpcEffect(WS_METHODS.codeGraphSearch, readCodeGraphSearch(input), { "rpc.aggregate": "codeGraph" }),
 		[WS_METHODS.projectsWriteFile]: (input) => observeRpcEffect(WS_METHODS.projectsWriteFile, workspaceFileSystem.writeFile(input).pipe(require_Schema$1.mapError((cause) => {
 			return new ProjectWriteFileError({
 				message: require_Schema$1.is(WorkspacePathOutsideRootError)(cause) ? "Workspace file path must stay within the project root." : "Failed to write workspace file",
@@ -153634,7 +153091,9 @@ var CodexAppServerManager = class extends node_events.EventEmitter {
 	scheduleProviderEgressTokenRefresh(context, delayMs) {
 		if (context.tokenRefreshTimer) clearTimeout(context.tokenRefreshTimer);
 		const tokenRefreshTimer = setTimeout(() => {
-			this.handleProviderEgressTokenRefresh(context.session.threadId).catch(() => void 0);
+			this.handleProviderEgressTokenRefresh(context.session.threadId).catch((error) => {
+				this.emitErrorEvent(context, "session/tokenRefreshFailed", error instanceof Error ? error.message : String(error));
+			});
 		}, delayMs);
 		tokenRefreshTimer.unref?.();
 		context.tokenRefreshTimer = tokenRefreshTimer;
@@ -290988,93 +290447,6 @@ async function maybeRefreshRuntimeProvisioningGrant(input) {
 	return "refreshed";
 }
 //#endregion
-//#region src/runtimeDrain/RuntimeDrainState.ts
-const initialState = {
-	activeTurns: /* @__PURE__ */ new Set(),
-	activeTurnCount: 0,
-	activeSessionCount: 0,
-	draining: false,
-	drainReason: null,
-	drainTargetImageRef: null,
-	drainTargetImageVersion: null,
-	drainForceRequired: false
-};
-function snapshotFromState(state) {
-	return {
-		activeTurnCount: state.activeTurnCount,
-		activeSessionCount: state.activeSessionCount,
-		draining: state.draining,
-		drainReason: state.drainReason,
-		drainTargetImageRef: state.drainTargetImageRef,
-		drainTargetImageVersion: state.drainTargetImageVersion,
-		drainForceRequired: state.drainForceRequired
-	};
-}
-function turnKey(input) {
-	return `${input.threadId}:${input.turnId ?? "unknown"}`;
-}
-function normalizeCount(count) {
-	return Number.isFinite(count) ? Math.max(0, Math.floor(count)) : 0;
-}
-const makeRuntimeDrainState = require_Schema$1.gen(function* () {
-	const stateRef = yield* require_HttpServer.make$3(initialState);
-	const update = (f) => require_HttpServer.updateAndGet(stateRef, f).pipe(require_Schema$1.map(snapshotFromState));
-	return {
-		beginTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.add(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		completeTurn: (input) => update((state) => {
-			const activeTurns = new Set(state.activeTurns);
-			activeTurns.delete(turnKey(input));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size
-			};
-		}),
-		clearActiveTurns: update((state) => ({
-			...state,
-			activeTurns: /* @__PURE__ */ new Set(),
-			activeTurnCount: 0
-		})),
-		setActiveSessionCount: (count) => update((state) => ({
-			...state,
-			activeSessionCount: normalizeCount(count)
-		})),
-		reconcileProviderSessions: (sessions) => update((state) => {
-			const activeSessions = sessions.filter((session) => session.status !== "closed");
-			const activeTurns = new Set(activeSessions.flatMap((session) => session.activeTurnId === void 0 ? [] : [turnKey({
-				threadId: session.threadId,
-				turnId: session.activeTurnId
-			})]));
-			return {
-				...state,
-				activeTurns,
-				activeTurnCount: activeTurns.size,
-				activeSessionCount: activeSessions.length
-			};
-		}),
-		applyControlPlaneState: (input) => update((state) => ({
-			...state,
-			draining: input.draining ?? state.draining,
-			drainReason: input.drainReason ?? state.drainReason,
-			drainTargetImageRef: input.drainTargetImageRef ?? state.drainTargetImageRef,
-			drainTargetImageVersion: input.drainTargetImageVersion ?? state.drainTargetImageVersion,
-			drainForceRequired: input.drainForceRequired ?? state.drainForceRequired
-		})),
-		snapshot: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map(snapshotFromState)),
-		isDraining: require_HttpServer.get$1(stateRef).pipe(require_Schema$1.map((state) => state.draining))
-	};
-});
-var RuntimeDrainState = class extends require_Schema$1.Service()("forge/runtimeDrain/RuntimeDrainState") {};
-const RuntimeDrainStateLive = require_Schema$1.effect(RuntimeDrainState, makeRuntimeDrainState);
-//#endregion
 //#region src/runtimeDrain/RuntimeDrainReporter.ts
 const HEARTBEAT_INTERVAL = require_Schema$1.seconds(30);
 const HEARTBEAT_TICK_TIMEOUT = require_Schema$1.seconds(60);
@@ -291132,6 +290504,7 @@ const postRuntimeHeartbeat = (config, snapshot) => require_Schema$1.promise(asyn
 		...config,
 		activeTurnCount: snapshot.activeTurnCount,
 		activeSessionCount: snapshot.activeSessionCount,
+		acceptingTurns: snapshot.acceptingTurns,
 		...forgeGitCommit !== void 0 ? { forgeGitCommit } : {},
 		forgeServerVersion: installedForgeServerVersion
 	});
@@ -291240,6 +290613,7 @@ const makeRuntimeDrainReporter = require_Schema$1.gen(function* () {
 				work: reportOnce,
 				interval: HEARTBEAT_INTERVAL
 			}));
+			yield* require_Schema$1.addFinalizer(() => drainState.requestShutdown);
 		})
 	};
 });
@@ -291450,6 +290824,7 @@ function decodeCodexRateLimitWindows(raw) {
 function publicProviderRuntimeError(message) {
 	return sanitizePublicProviderText(message, { fallback: DEFAULT_PUBLIC_PROVIDER_ERROR });
 }
+const processDomainEvent = (_event) => require_Schema$1.void_;
 function isAssistantTextDeltaEvent(event) {
 	return event.type === "content.delta" && event.payload.streamKind === "assistant_text";
 }
@@ -292245,7 +291620,6 @@ const make$9 = require_Schema$1.fn("make")(function* () {
 			yield* runtimeDrainReporter.reportOnce;
 		}
 	});
-	const processDomainEvent = (_event) => require_Schema$1.void_;
 	const processInput = (input) => input.source === "runtime" ? processRuntimeEvent(input.event) : processDomainEvent(input.event);
 	const processInputSafely = (input) => processInput(input).pipe(require_Schema$1.catchCause((cause) => {
 		if (require_Schema$1.hasInterruptsOnly(cause)) return require_Schema$1.failCause(cause);
@@ -292296,6 +291670,7 @@ const make$9 = require_Schema$1.fn("make")(function* () {
 	return {
 		start: require_Schema$1.fn("start")(function* () {
 			yield* reconcileOrphanedRunningSessions();
+			yield* runtimeDrainState.markExecutionPrecondition("providerLayer");
 			yield* runtimeDrainReporter.start;
 			yield* require_Schema$1.forkScoped(require_Path.runForEach(providerService.streamEvents, (event) => enqueueInput({
 				source: "runtime",
@@ -292535,6 +291910,8 @@ const HANDLED_TURN_START_KEY_MAX = 1e4;
 const HANDLED_TURN_START_KEY_TTL = require_Schema$1.minutes(30);
 const DEFAULT_RUNTIME_MODE = "full-access";
 const DEFAULT_THREAD_TITLE = "New thread";
+const isProviderValidationError = require_Schema$1.is(ProviderValidationError);
+const isProviderKind = require_Schema$1.is(ProviderKind);
 function isPathInsideRoot(candidatePath, rootPath) {
 	let resolvedCandidate;
 	let resolvedRoot;
@@ -292571,6 +291948,38 @@ function resolveExistingWorkspaceCwd(input) {
 function publicProviderFailureDetail(detail) {
 	return sanitizePublicProviderText(detail, { fallback: "CMMD is temporarily unavailable. Check the workspace AI connection and retry." }) ?? "CMMD is temporarily unavailable. Check the workspace AI connection and retry.";
 }
+/**
+* The failure detail a transcript shows, judged on the text and not the envelope.
+*
+* Forge writes its own validation copy, so `ProviderValidationError.issue` is
+* not raw provider output. Every envelope around it hides it, each in its own
+* way: `Cause.pretty` prints the error tag, and the sanitizer counts
+* "ProviderValidationError" as a provider leak, so a validation failure
+* rendered through `Cause.pretty` tripped the guard on its own wrapper. The
+* `message` getter spells the same tag out in prose. On 2026-09-16 the first of
+* those replaced "Reconnect the account and try again" with "CMMD is
+* temporarily unavailable" (#3337).
+*
+* The issue still goes through the sanitizer. `ProviderService` builds some
+* issues from a schema formatter, which echoes the decoded payload, so this is a
+* narrower input to the same guard rather than a way around it.
+*/
+function publicProviderFailureDetailFromError(error) {
+	if (isProviderValidationError(error)) return publicProviderFailureDetail(error.issue);
+	return publicProviderFailureDetail(error instanceof Error ? error.message : String(error));
+}
+/**
+* The same judgement for a failure that arrives as a cause.
+*
+* Only the validation branch delegates. A cause carries what a bare error does
+* not: defects, interrupts, and more than one failure, all of which
+* `Cause.pretty` renders and `.message` would drop. Squashing every failure into
+* its message to reach one shared line would lose that.
+*/
+function publicProviderFailureDetailFromCause(cause) {
+	const error = require_Schema$1.squash(cause);
+	return isProviderValidationError(error) ? publicProviderFailureDetailFromError(error) : publicProviderFailureDetail(require_Schema$1.pretty(cause));
+}
 function canReplaceThreadTitle(currentTitle, titleSeed) {
 	const trimmedCurrentTitle = currentTitle.trim();
 	if (trimmedCurrentTitle === DEFAULT_THREAD_TITLE) return true;
@@ -292726,7 +292135,7 @@ const make$8 = require_Schema$1.gen(function* () {
 		const thread = readModel.threads.find((entry) => entry.id === threadId);
 		if (!thread) return yield* require_Schema$1.die(/* @__PURE__ */ new Error(`Thread '${threadId}' was not found in read model.`));
 		const desiredRuntimeMode = thread.runtimeMode;
-		const currentProvider = thread.session?.status !== "stopped" && require_Schema$1.is(ProviderKind)(thread.session?.providerName) ? thread.session.providerName : void 0;
+		const currentProvider = thread.session?.status !== "stopped" && isProviderKind(thread.session?.providerName) ? thread.session.providerName : void 0;
 		const rawRequestedModelSelection = options?.modelSelection;
 		const threadProvider = currentProvider ?? thread.modelSelection.provider;
 		const isStaleRequestedProvider = rawRequestedModelSelection !== void 0 && rawRequestedModelSelection.provider !== threadProvider;
@@ -293105,7 +292514,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start failed",
-			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			detail: publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})));
@@ -293121,7 +292530,14 @@ const make$8 = require_Schema$1.gen(function* () {
 			turnId: event.payload.turnId ?? null,
 			createdAt: event.payload.createdAt
 		});
-		yield* providerService.interruptTurn({ threadId: event.payload.threadId });
+		yield* providerService.interruptTurn({ threadId: event.payload.threadId }).pipe(require_Schema$1.catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.turn.interrupt.failed",
+			summary: "Provider turn interrupt failed",
+			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			turnId: event.payload.turnId ?? null,
+			createdAt: event.payload.createdAt
+		})));
 	});
 	const processApprovalResponseRequested = require_Schema$1.fn("processApprovalResponseRequested")(function* (event) {
 		const staged = peekThreadContinuationSession(event.commandId);
@@ -293158,7 +292574,7 @@ const make$8 = require_Schema$1.gen(function* () {
 				threadId: event.payload.threadId,
 				kind: "provider.approval.respond.failed",
 				summary: "Provider approval response failed",
-				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+				detail: isUnknownPendingApprovalRequestError(cause) ? stalePendingRequestDetail("approval", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 				turnId: null,
 				createdAt: event.payload.createdAt,
 				requestId: event.payload.requestId
@@ -293201,7 +292617,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.user-input.respond.failed",
 			summary: "Provider user input response failed",
-			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			detail: isUnknownPendingUserInputRequestError(cause) ? stalePendingRequestDetail("user-input", event.payload.requestId) : publicProviderFailureDetailFromCause(cause),
 			turnId: null,
 			createdAt: event.payload.createdAt,
 			requestId: event.payload.requestId
@@ -293214,8 +292630,7 @@ const make$8 = require_Schema$1.gen(function* () {
 		yield* providerService.stopSession({
 			threadId: thread.id,
 			...event.payload.preserveResumeState === true ? { preserveResumeState: true } : {}
-		});
-		yield* setThreadSession({
+		}).pipe(require_Schema$1.tap(() => setThreadSession({
 			threadId: thread.id,
 			session: {
 				threadId: thread.id,
@@ -293227,7 +292642,14 @@ const make$8 = require_Schema$1.gen(function* () {
 				updatedAt: now
 			},
 			createdAt: now
-		});
+		})), require_Schema$1.catchCause((cause) => appendProviderFailureActivity({
+			threadId: event.payload.threadId,
+			kind: "provider.session.stop.failed",
+			summary: "Provider session stop failed",
+			detail: publicProviderFailureDetail(require_Schema$1.pretty(cause)),
+			turnId: null,
+			createdAt: now
+		})));
 	});
 	const processDomainEvent = require_Schema$1.fn("processDomainEvent")(function* (event) {
 		yield* require_Schema$1.annotateCurrentSpan({
@@ -293322,7 +292744,7 @@ const make$8 = require_Schema$1.gen(function* () {
 			threadId: event.payload.threadId,
 			kind: "provider.turn.start.failed",
 			summary: "Provider turn start cleanup failed",
-			detail: publicProviderFailureDetail(cause instanceof Error ? cause.message : String(cause)),
+			detail: publicProviderFailureDetailFromError(cause),
 			turnId: null,
 			createdAt: (/* @__PURE__ */ new Date()).toISOString()
 		})
@@ -298790,7 +298212,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "78b0e072680ed734c4eb8337a6d38c87e7e34393";
+	return "60c000d9c894e2ef04f90b602ddc8eb49c84980a";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -322280,7 +321702,7 @@ const PlatformServicesLive = require_Schema$1.unwrap(require_Schema$1.gen(functi
 }));
 const RuntimeReplicationLayerLive = RuntimeReplicationLive.pipe(require_Schema$1.provideMerge(RuntimeReplicationClientLive), require_Schema$1.provideMerge(RuntimeReplicationOutboxLive), require_Schema$1.provideMerge(ActiveHourMeterLive.pipe(require_Schema$1.provide$1(RuntimeReplicationOutboxLive))));
 const RuntimeDrainLayerLive = RuntimeDrainReporterLive.pipe(require_Schema$1.provideMerge(RuntimeDrainStateLive));
-const RuntimeAwareProviderReactorsLive = require_Schema$1.mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(require_Schema$1.provide$1(RuntimeDrainLayerLive), require_Schema$1.provide$1(ClaudeUsageTelemetryLive));
+const RuntimeAwareProviderReactorsLive = require_Schema$1.mergeAll(ProviderRuntimeIngestionLive, ProviderCommandReactorLive).pipe(require_Schema$1.provide$1(RuntimeDrainLayerLive), require_Schema$1.provideMerge(RuntimeDrainStateLive), require_Schema$1.provide$1(ClaudeUsageTelemetryLive));
 const PipelineWorkerCoordinatorLayerLive = PipelineWorkerCoordinatorLive.pipe(require_Schema$1.provideMerge(PipelineRunClientLive));
 const AgentProtocolReactorLayerLive = AgentProtocolReactorLive.pipe(require_Schema$1.provideMerge(PipelineRunStoreLive));
 const PipelineRunCoordinatorLayerLive = PipelineRunCoordinatorLive.pipe(require_Schema$1.provideMerge(PipelineProviderAuthorityInstallerLive), require_Schema$1.provideMerge(PipelineChangeInspectorLive), require_Schema$1.provideMerge(PipelineContextArtifactStoreLive), require_Schema$1.provideMerge(PipelineModelPolicyLive), require_Schema$1.provideMerge(PipelineRunClientLive), require_Schema$1.provideMerge(PipelineRunStoreLive), require_Schema$1.provideMerge(PipelineRunWorkspaceAllocatorLive), require_Schema$1.provideMerge(PipelineStagePolicyLive), require_Schema$1.provideMerge(PipelineWorkerCoordinatorLayerLive));