@cmmd-center/forge 0.13.2 → 0.13.4

package/dist/bin.mjs

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 
 import { a as __toCommonJS, i as __require, n as __esmMin, o as __toESM, r as __exportAll, t as __commonJSMin } from "./chunk-C5ckVeoz.mjs";
-import { $ as encodeEffect, $a as make$39, $c as fromUndefinedOr, $i as spaced, $l as constUndefined, $n as filterMapOrFail, $r as runPromise, $s as min, $t as stringifyJson, Aa as Scope$1, Ac as fail$1, Ai as void_$1, An as cached$3, Ar as match$1, As as uninterruptibleMask, At as withConstructorDefault, Ba as CurrentLogSpans, Bc as empty$1, Bi as counter, Bl as hasProperty, Bn as catch_, Bo as addFinalizer, Br as orDie, Bs as make$42, Bt as head, C as Record, Ca as mergeAll, Ci as tx$1, Cl as isEffect$1, Cn as andThen, Co as hasDies, Cr as logInfo, Cs as sleep$3, Ct as optionalKey, D as TaggedStruct, Da as succeedContext, Di as uninterruptibleMask$1, Dl as NodeInspectSymbol, Dn as as$3, Do as interruptors, Ds as suspend, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeed$2, Ei as uninterruptible, En as annotateSpans, Eo as interrupt$2, Er as map$3, Et as toCodecJson, F as UndefinedOr, Fa as forkUnsafe, Fi as withParentSpan, Fn as catchFilter, Fr as onError$1, Fs as MinimumTraceLevel, G as decodeExit, Ga as done, Gc as make$35, Gi as withAttributes, Gl as isObject$1, Gn as die$1, Gr as provideService, Gs as format$1, Gt as Transformation, H as declare, Hi as snapshotUnsafe, Hl as isNotNullish, Hn as contextWith, Ho as as$2, Hr as promise, Ht as size$2, I as Union, Ia as make$37, Ic as succeed$1, Ii as withSpan, In as catchIf, Io as ConsoleRef, Ir as onExit, Is as NativeSpan, It as assign, J as decodeUnknownEffect, Ja as failCause$3, Ji as exponential, Jn as exit, Jr as repeat, Jt as transformOrFail, K as decodeSync, Kc as makeUnsafe$3, Ki as addDelay, Kl as isTagged, Ko as consolePretty$1, Kr as race, Ks as fromInput, L as Unknown, La as makeUnsafe$4, Lc as Reference$1, Li as withTracerEnabled, Ln as catchReason, Lo as CurrentLoggers$1, Ls as ParentSpan, Lt as append$1, M as URLFromString, Ma as addFinalizerExit, Mi as whileLoop, Mn as callback, Mo as pretty, Ms as void_$2, Na as close, Nc as isFailure$1, Ni as withFiber$1, Nl as equals, Nn as catchCause, No as prettyErrors, Nr as matchEffect, O as TemplateLiteral, Oa as sync$2, Ol as toJson, On as asSome, Or as mapError, Os as sync, Ot as toJsonSchemaDocument, P as Undefined, Pa as closeUnsafe, Pc as isSuccess$1, Pn as catchDefect, Po as squash, Pr as never$1, Q as encode$4, Qc as fromNullishOr, Qi as recurs, Ql as constTrue, Qn as filter$1, Qr as runForkWith, Qs as millis, R as UnknownFromJsonString$1, Ra as provide$2, Rc as Service$1, Ri as yieldNow, Rn as catchTag, Rr as onInterrupt, Rs as Tracer, Rt as drop$1, S as Option, Sa as merge$3, Si as try_, Sn as all, Sr as logFatal, Ss as scopeAddFinalizerExit, St as optional$4, T as Struct, Ta as provideMerge, Ti as undefined_, Tn as annotateLogs, To as hasInterruptsOnly, Tr as makeSpanScoped, Tt as tag, Ua as TracerTimingEnabled, Ui as timer, Ul as isNotUndefined, Un as currentSpan, Ur as provide, Ut as toArray, V as brand, Va as MinimumLogLevel, Vc as get$3, Vi as gauge, Vl as isNotNull, Vn as context, Vo as andThen$1, Vr as orElseSucceed, Vt as isEmpty$2, W as decodeEffect, Wa as _await, Wc as getUnsafe$1, Wi as update$3, Wl as isNullish, Wr as provideContext, Ws as days, X as decodeUnknownOption, Xc as flatMap$2, Xl as compose, Xn as failCause$1, Xr as retry, Xt as onSome, Y as decodeUnknownExit, Yc as firstSomeOf, Yi as forever$2, Yl as cast, Yn as fail, Yr as result, Z as decodeUnknownSync, Za as isDeferred, Zc as flatten$1, Zi as passthrough$1, Zr as runFork, Zs as max, Zt as parseJson$1, _ as NonEmptyArray, _a as effectContext, _i as tapErrorTag, _n as toUtc, _t as isSchemaError, a as DateTimeUtc, aa as Random$1, ac as zero, al as map$5, an as value, ao as interrupt$3, ar as fnUntraced, at as isBetween, au as pipe$1, b as NullOr, bc as reverse, bi as timeoutOrElse, bn as acquireUseRelease, br as logDebug, bs as reportCauseUnsafe, bt as makeFilter, c as Defect, ca as Clock, cc as ensure, ci as sleep$4, cl as some, cn as add$3, co as match$2, cr as forkChild, cs as flatMap$1, ct as isGreaterThanOrEqualTo, d as Exit, dc as fromIterable, di as succeedSome, dn as isGreaterThanOrEqualTo$1, dr as forkScoped, ds as forkDetach, dt as isMaxLength, ea as catchDone, ec as minutes, el as getOrElse, er as filterOrFail, et as encodeSync, eu as constVoid, fa as TaggedError, fi as suspend$1, fn as make$38, fr as gen, ft as isMaxProperties, g as Never, ga as effect, gi as tapError, gl as YieldableProto, gn as toEpochMillis, gr as interruptible, gt as isSchema, h as Literals, ha as buildWithMemoMap, hi as tapCause, hl as PipeInspectableProto, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ic as toSeconds, ii as scoped, il as isSome, in as make$40, io as failCause$2, ir as fn$1, it as is$1, iu as identity, ja as addFinalizer$1, jn as cachedWithTTL, jo as map$6, jr as matchCauseEffect, jt as withDecodingDefault, k as Trim, ka as unwrap, ki as useSpan, kl as format, kn as asVoid, ks as tracerLogger$1, kt as toType, l as Duration, la as currentTimeMillis, lc as filter, li as succeed, ll as Number$2, ln as distance, lr as forkDetach$1, ls as fnUntraced$1, lt as isInt, m as Literal, ma as build, mc as isReadonlyArrayNonEmpty, mi as tap, mn as now, mo as StackTrace, mr as ignoreCause, ms as loggerMake, mt as isNonEmpty, n as ArraySchema, nc as times, nl as getOrUndefined, no as die$2, nt as encodeUnknownExit, nu as dual, o as DateTimeUtcFromString, oa as clamp, oc as allocate, oi as service, ol as match, oo as isFailure, or as forEach, ot as isFinite$1, ou as pipeArguments, p as Int$1, pa as CurrentMemoMap, pc as isArrayNonEmpty, pi as sync$1, pn as makeUnsafe$5, po as NoSuchElementError, pr as ignore, pt as isMinLength, q as decodeTo, qa as fail$3, qc as merge$2, qi as both, qn as ensuring, qr as raceFirst, qs as fromInputUnsafe, r as Boolean$1, ra as isDoneCause, rc as toMillis, ri as scope$1, rl as isNone, rn as makeFormatterDefault, ro as fail$2, rr as flatten$2, rt as fromJsonString, sa as parse$6, sc as empty$3, si as serviceOption, sl as none$4, sn as encodeBase64Url$2, so as isSuccess, sr as forever$1, st as isGreaterThan, t as Any, tc as seconds, ti as runPromiseWith, tl as getOrNull, tn as InvalidValue$1, to as succeed$3, tr as flatMap, ts as fiberInterrupt, tt as encodeUnknownEffect, tu as constant, u as ErrorClass, ua as Class$1, uc as flatMapNullishOr, ui as succeedNone, ul as make$41, un as formatIso, uo as void_$3, ur as forkIn, us as forever, ut as isLessThanOrEqualTo, v as NonEmptyString, va as effectDiscard, vc as map$4, vi as timeout$1, vn as Transaction$1, vo as done$1, vr as isEffect, w as String$1, wa as provide$1, wi as txRetry, wl as withFiber, wn as annotateCurrentSpan, wo as hasInterrupts, wr as logWarning$1, wt as suspend$2, x as Number$1, xa as launch$1, xc as sort, xi as tryPromise, xn as addFinalizer$2, xr as logError, xs as scope, xt as mutable, y as Null, ya as empty$4, yi as timeoutOption, yn as acquireRelease, yo as fail$4, yr as log$4, yt as make$36, z as Void, za as CurrentLogAnnotations, zc as add$2, zi as zipWith, zl as compose$1, zn as catchTags, zr as option, zs as externalSpan, zt as empty$2 } from "./Schema-CJyk7ah1.mjs";
-import { $ as toAsyncIterable, A as make$45, At as make$44, Bt as publish, C as fromEffect, Ct as make$43, E as fromQueue, Et as end, F as merge$4, Ft as shutdown$1, G as runFold, H as run$2, Ht as subscribe$1, It as sliding, Jt as getCurrent, K as runForEach, Kt as makeUnsafe$7, Lt as take$1, M as mapAccum, Mt as offerAll, N as mapEffect$1, Nt as offerUnsafe, O as fromSubscription, Ot as failCause$4, Q as tick, R as onExit$1, Rt as takeAll, S as fromChannel, T as fromPubSub, Tt as bounded, U as runCollect, Ut as unbounded$1, V as provideContext$1, Vt as shutdown$2, W as runDrain, Y as succeed$4, Yt as interrupt$4, Z as takeWhile, Zt as runIn, _t as mapInput, at as make$46, b as flatMap$3, bt as fromTransform, c as callback$1, d as debounce$1, f as decodeText$1, g as ensuring$1, h as encodeText, it as get$4, j as map$7, jt as offer$1, k as isStream, l as catchCause$1, m as empty$5, mt as forEach$1, ot as get$5, pt as drain, q as runForEachArray, qt as await_, r as FileSystem, rt as unwrap$1, st as make$47, t as Path$2, u as concat$2, v as failCause$5, w as fromIterable$1, wt as makeUnsafe$6, x as fromAsyncIterable, y as filter$2, yt as fromSubscriptionArray, zt as unbounded$2 } from "./Path-C6Zb2WHp.mjs";
-import { _ as ChildProcessSpawner, a as Stdio, g as make$48, o as make$49, r as isQuitError } from "./NodeTerminal-BEGtoMSS.mjs";
-import { n as layer$7 } from "./NodeServices-CBNXOYLG.mjs";
-import { $ as file, A as SocketErrorReason, At as merge$5, Bt as set$3, Ct as HttpClientErrorSchema, Dt as empty$7, Ft as getAndSet, G as TracerPropagationEnabled, Ht as updateAndGet, I as HttpServerError, It as getUnsafe$2, J as transformResponse, K as filterStatusOk$1, Lt as make$50, Ot as fromInput$1, Pt as get$6, Q as empty$6, Rt as makeUnsafe$8, St as setBody, Tt as jsonUnsafe$1, U as layer$8, Vt as update$4, W as HttpClient, Z as symbol$1, _ as schemaBodyUrlParams, _t as acceptJson, a as withLogAddress, at as setCookie, bt as get$7, ct as stream, d as logger$1, dt as filterStatusOk, et as isHttpServerResponse, f as withLoggerDisabled, ft as matchStatus, g as schemaBodyJson, gt as schemaBodyJson$1, i as serve$1, it as schemaJson, kt as fromRecordUnsafe, lt as text$2, m as ParsedSearchParams, nt as raw, ot as setCookies, p as HttpServerRequest, q as retryTransient, rt as redirect, st as setHeader, t as HttpServer, tt as jsonUnsafe, u as cors, ut as uint8Array, v as schemaHeaders, vt as bearerToken, wt as isHttpClientError, xt as post, y as toURL, yt as bodyJson, z as RouteNotFound, zt as modify$3 } from "./HttpServer-DNGCTTdk.mjs";
-import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$2, t as Boolean$2, u as number$2 } from "./Config-AqUR_lhX.mjs";
-import { a as make$51, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$4, t as get$8 } from "./Cache-p0X77SKw.mjs";
-import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$52, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-cyJT2IRY.mjs";
+import { $ as encodeEffect, $a as make$39, $c as fromNullishOr, $i as spaced, $l as constTrue, $n as filterMapOrFail, $r as runPromise, $s as millis, $t as stringifyJson, Aa as Scope$1, Ai as void_$1, Al as format, An as cached$3, Ar as match$1, As as uninterruptibleMask, At as withConstructorDefault, Ba as CurrentLogSpans, Bc as add$2, Bi as counter, Bl as compose$1, Bn as catch_, Bo as addFinalizer, Br as orDie, Bs as make$42, Bt as head, C as Record, Ca as mergeAll, Ci as tx$1, Cn as andThen, Co as hasDies, Cr as logInfo, Cs as sleep$3, Ct as optionalKey, D as TaggedStruct, Da as succeedContext, Di as uninterruptibleMask$1, Dn as as$3, Do as interruptors, Ds as suspend, Dt as toCodecStringTree, E as TaggedErrorClass, Ea as succeed$2, Ei as uninterruptible, En as annotateSpans, Eo as interrupt$2, Er as map$3, Et as toCodecJson, F as UndefinedOr, Fa as forkUnsafe, Fc as isSuccess$1, Fi as withParentSpan, Fn as catchFilter, Fr as onError$1, Fs as MinimumTraceLevel, G as decodeExit, Ga as done, Gc as getUnsafe$1, Gi as withAttributes, Gl as isNullish, Gn as die$1, Gr as provideService, Gs as format$1, Gt as Transformation, H as declare, Hc as get$3, Hi as snapshotUnsafe, Hl as isNotNull, Hn as contextWith, Ho as as$2, Hr as promise, Ht as size$2, I as Union, Ia as make$37, Ii as withSpan, In as catchIf, Io as ConsoleRef, Ir as onExit, Is as NativeSpan, It as assign, J as decodeUnknownEffect, Ja as failCause$3, Jc as merge$2, Ji as exponential, Jn as exit, Jr as repeat, Js as hours, Jt as transformOrFail, K as decodeSync, Kc as make$35, Ki as addDelay, Kl as isObject$1, Ko as consolePretty$1, Kr as race, Ks as fromInput, L as Unknown, La as makeUnsafe$4, Lc as succeed$1, Li as withTracerEnabled, Ln as catchReason, Lo as CurrentLoggers$1, Ls as ParentSpan, Lt as append$1, M as URLFromString, Ma as addFinalizerExit, Mi as whileLoop, Mn as callback, Mo as pretty, Ms as void_$2, Na as close, Ni as withFiber$1, Nn as catchCause, No as prettyErrors, Nr as matchEffect, O as TemplateLiteral, Oa as sync$2, Ol as NodeInspectSymbol, On as asSome, Or as mapError, Os as sync, Ot as toJsonSchemaDocument, P as Undefined, Pa as closeUnsafe, Pc as isFailure$1, Pl as equals, Pn as catchDefect, Po as squash, Pr as never$1, Q as encode$4, Qc as flatten$1, Qi as recurs, Qn as filter$1, Qr as runForkWith, Qs as max, R as UnknownFromJsonString$1, Ra as provide$2, Rc as Reference$1, Ri as yieldNow, Rn as catchTag, Rr as onInterrupt, Rs as Tracer, Rt as drop$1, S as Option, Sa as merge$3, Sc as sort, Si as try_, Sn as all, Sr as logFatal, Ss as scopeAddFinalizerExit, St as optional$4, T as Struct, Ta as provideMerge, Ti as undefined_, Tl as withFiber, Tn as annotateLogs, To as hasInterruptsOnly, Tr as makeSpanScoped, Tt as tag, Ua as TracerTimingEnabled, Ui as timer, Ul as isNotNullish, Un as currentSpan, Ur as provide, Ut as toArray, V as brand, Va as MinimumLogLevel, Vc as empty$1, Vi as gauge, Vl as hasProperty, Vn as context, Vo as andThen$1, Vr as orElseSucceed, Vt as isEmpty$2, W as decodeEffect, Wa as _await, Wi as update$3, Wl as isNotUndefined, Wr as provideContext, Ws as days, X as decodeUnknownOption, Xc as firstSomeOf, Xl as cast, Xn as failCause$1, Xr as retry, Xt as onSome, Y as decodeUnknownExit, Yi as forever$2, Yn as fail, Yr as result, Z as decodeUnknownSync, Za as isDeferred, Zc as flatMap$2, Zi as passthrough$1, Zl as compose, Zr as runFork, Zt as parseJson$1, _ as NonEmptyArray, _a as effectContext, _i as tapErrorTag, _l as YieldableProto, _n as toUtc, _t as isSchemaError, a as DateTimeUtc, aa as Random$1, ac as toSeconds, al as isSome, an as value, ao as interrupt$3, ar as fnUntraced, at as isBetween, au as identity, b as NullOr, bi as timeoutOrElse, bn as acquireUseRelease, br as logDebug, bs as reportCauseUnsafe, bt as makeFilter, c as Defect, ca as Clock, cc as empty$3, ci as sleep$4, cl as none$4, cn as add$3, co as match$2, cr as forkChild, cs as flatMap$1, ct as isGreaterThanOrEqualTo, d as Exit, dc as flatMapNullishOr, di as succeedSome, dl as make$41, dn as isGreaterThanOrEqualTo$1, dr as forkScoped, ds as forkDetach, dt as isMaxLength, ea as catchDone, ec as min, el as fromUndefinedOr, er as filterOrFail, et as encodeSync, eu as constUndefined, fa as TaggedError, fc as fromIterable, fi as suspend$1, fn as make$38, fr as gen, ft as isMaxProperties, g as Never, ga as effect, gi as tapError, gl as PipeInspectableProto, gn as toEpochMillis, gr as interruptible, gt as isSchema, h as Literals, ha as buildWithMemoMap, hc as isReadonlyArrayNonEmpty, hi as tapCause, hn as toDate, hr as interrupt$1, ht as isPattern, i as Class, ic as toMillis, ii as scoped, il as isNone, in as make$40, io as failCause$2, ir as fn$1, it as is$1, ja as addFinalizer$1, jc as fail$1, jn as cachedWithTTL, jo as map$6, jr as matchCauseEffect, jt as withDecodingDefault, k as Trim, ka as unwrap, ki as useSpan, kl as toJson, kn as asVoid, ks as tracerLogger$1, kt as toType, l as Duration, la as currentTimeMillis, lc as ensure, li as succeed, ll as some, ln as distance, lr as forkDetach$1, ls as fnUntraced$1, lt as isInt, m as Literal, ma as build, mc as isArrayNonEmpty, mi as tap, mn as now, mo as StackTrace, mr as ignoreCause, ms as loggerMake, mt as isNonEmpty, n as ArraySchema, nc as seconds, nl as getOrNull, no as die$2, nt as encodeUnknownExit, nu as constant, o as DateTimeUtcFromString, oa as clamp, oc as zero, oi as service, ol as map$5, oo as isFailure, or as forEach, ot as isFinite$1, ou as pipe$1, p as Int$1, pa as CurrentMemoMap, pi as sync$1, pn as makeUnsafe$5, po as NoSuchElementError, pr as ignore, pt as isMinLength, q as decodeTo, qa as fail$3, qc as makeUnsafe$3, qi as both, ql as isTagged, qn as ensuring, qr as raceFirst, qs as fromInputUnsafe, r as Boolean$1, ra as isDoneCause, rc as times, ri as scope$1, rl as getOrUndefined, rn as makeFormatterDefault, ro as fail$2, rr as flatten$2, rt as fromJsonString, ru as dual, sa as parse$6, sc as allocate, si as serviceOption, sl as match, sn as encodeBase64Url$2, so as isSuccess, sr as forever$1, st as isGreaterThan, su as pipeArguments, t as Any, tc as minutes, ti as runPromiseWith, tl as getOrElse, tn as InvalidValue$1, to as succeed$3, tr as flatMap, ts as fiberInterrupt, tt as encodeUnknownEffect, tu as constVoid, u as ErrorClass, ua as Class$1, uc as filter, ui as succeedNone, ul as Number$2, un as formatIso, uo as void_$3, ur as forkIn, us as forever, ut as isLessThanOrEqualTo, v as NonEmptyString, va as effectDiscard, vi as timeout$1, vn as Transaction$1, vo as done$1, vr as isEffect, w as String$1, wa as provide$1, wi as txRetry, wl as isEffect$1, wn as annotateCurrentSpan, wo as hasInterrupts, wr as logWarning$1, wt as suspend$2, x as Number$1, xa as launch$1, xc as reverse, xi as tryPromise, xn as addFinalizer$2, xr as logError, xs as scope, xt as mutable, y as Null, ya as empty$4, yc as map$4, yi as timeoutOption, yn as acquireRelease, yo as fail$4, yr as log$4, yt as make$36, z as Void, za as CurrentLogAnnotations, zc as Service$1, zi as zipWith, zn as catchTags, zr as option, zs as externalSpan, zt as empty$2 } from "./Schema-DOBWF8gQ.mjs";
+import { $ as toAsyncIterable, A as make$45, At as make$44, Bt as publish, C as fromEffect, Ct as make$43, E as fromQueue, Et as end, F as merge$4, Ft as shutdown$1, G as runFold, H as run$2, Ht as subscribe$1, It as sliding, Jt as getCurrent, K as runForEach, Kt as makeUnsafe$7, Lt as take$1, M as mapAccum, Mt as offerAll, N as mapEffect$1, Nt as offerUnsafe, O as fromSubscription, Ot as failCause$4, Q as tick, R as onExit$1, Rt as takeAll, S as fromChannel, T as fromPubSub, Tt as bounded, U as runCollect, Ut as unbounded$1, V as provideContext$1, Vt as shutdown$2, W as runDrain, Y as succeed$4, Yt as interrupt$4, Z as takeWhile, Zt as runIn, _t as mapInput, at as make$46, b as flatMap$3, bt as fromTransform, c as callback$1, d as debounce$1, f as decodeText$1, g as ensuring$1, h as encodeText, it as get$4, j as map$7, jt as offer$1, k as isStream, l as catchCause$1, m as empty$5, mt as forEach$1, ot as get$5, pt as drain, q as runForEachArray, qt as await_, r as FileSystem, rt as unwrap$1, st as make$47, t as Path$2, u as concat$2, v as failCause$5, w as fromIterable$1, wt as makeUnsafe$6, x as fromAsyncIterable, y as filter$2, yt as fromSubscriptionArray, zt as unbounded$2 } from "./Path-C851t6sC.mjs";
+import { _ as ChildProcessSpawner, a as Stdio, g as make$48, o as make$49, r as isQuitError } from "./NodeTerminal-BPw7bktz.mjs";
+import { n as layer$7 } from "./NodeServices-BahzLhbo.mjs";
+import { $ as file, A as SocketErrorReason, At as merge$5, Bt as set$3, Ct as HttpClientErrorSchema, Dt as empty$7, Ft as getAndSet, G as TracerPropagationEnabled, Ht as updateAndGet, I as HttpServerError, It as getUnsafe$2, J as transformResponse, K as filterStatusOk$1, Lt as make$50, Ot as fromInput$1, Pt as get$6, Q as empty$6, Rt as makeUnsafe$8, St as setBody, Tt as jsonUnsafe$1, U as layer$8, Vt as update$4, W as HttpClient, Z as symbol$1, _ as schemaBodyUrlParams, _t as acceptJson, a as withLogAddress, at as setCookie, bt as get$7, ct as stream, d as logger$1, dt as filterStatusOk, et as isHttpServerResponse, f as withLoggerDisabled, ft as matchStatus, g as schemaBodyJson, gt as schemaBodyJson$1, i as serve$1, it as schemaJson, kt as fromRecordUnsafe, lt as text$2, m as ParsedSearchParams, nt as raw, ot as setCookies, p as HttpServerRequest, q as retryTransient, rt as redirect, st as setHeader, t as HttpServer, tt as jsonUnsafe, u as cors, ut as uint8Array, v as schemaHeaders, vt as bearerToken, wt as isHttpClientError, xt as post, y as toURL, yt as bodyJson, z as RouteNotFound, zt as modify$3 } from "./HttpServer-ClsGgAq1.mjs";
+import { _ as withDefault$3, a as all$1, c as logLevel, d as option$1, f as port, g as url$2, i as TrueValues, l as map$8, m as string$7, n as FalseValues, o as boolean$5, p as schema$2, r as Record$1, s as int$2, t as Boolean$2, u as number$2 } from "./Config-Cdfpphpo.mjs";
+import { a as make$51, i as keys, n as getOption, o as makeWith$1, r as invalidate, s as set$4, t as get$8 } from "./Cache-BVilO50s.mjs";
+import { S as layer$9, _ as defaultEscape, a as DeadlockError, b as makeCompiler$1, c as SqlError, d as UnknownError, g as custom, h as make$52, i as ConstraintError, l as SqlSyntaxError, m as SqlClient, n as AuthorizationError, o as LockTimeoutError, r as ConnectionError, s as SerializationError, t as AuthenticationError, u as StatementTimeoutError, v as defaultTransforms, y as fragment } from "./SqlError-3aqibZrj.mjs";
 import { r as wrapper_default, t as Mime_default } from "./Mime-Dq9IoNiV.mjs";
 import { a as diag, c as SpanKind$1, d as TraceFlags, f as ROOT_CONTEXT, i as propagation, l as isSpanContextValid, m as DiagLogLevel, n as init_esm$1, o as context$1, p as createContextKey, r as trace, s as SpanStatusCode, t as esm_exports$1 } from "./esm-wLIF-u3N.mjs";
 import { a as verifyCmmdAuthRuntimeTicket, c as verifyCmmdRuntimeTicket, d as setRuntimeGrantToken, f as createReadOnceFileTokenAccessor, i as sendRuntimeControlHeartbeat, l as verifyCmmdRuntimeTicketRefreshProof, n as bootstrapRuntimeControlAuthorityFromNarrowGrant, o as verifyCmmdClaudeReadinessTicket, r as readRuntimeControlAuthority, s as verifyCmmdClaudeUsageTicket, t as bootstrapRuntimeControlAuthority, u as runtimeGrantToken } from "./runtimeControlAuthority-D_zKr_eI.mjs";
-import { n as PtySpawnError, t as PtyAdapter } from "./PTY-rIPf52QR.mjs";
+import { n as PtySpawnError, t as PtyAdapter } from "./PTY-BzdbZ0Ym.mjs";
 import { createRequire } from "node:module";
 import * as HE from "node:child_process";
 import { execFile, execFileSync, spawn, spawnSync } from "node:child_process";
@@ -22,7 +22,7 @@ import { createCipheriv, createDecipheriv, createHash, createHmac, createPublicK
 import * as FS$1 from "node:fs";
 import fs, { accessSync, chmodSync, constants, createReadStream, existsSync, mkdirSync, mkdtempSync, promises, readFile, readFileSync, readdir, readdirSync, realpathSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as NodeOS from "node:os";
-import os, { homedir, networkInterfaces, tmpdir } from "node:os";
+import $U, { homedir, networkInterfaces, tmpdir } from "node:os";
 import * as Path$1 from "node:path";
 import path, { basename, delimiter, dirname, extname, isAbsolute, join, posix, relative, resolve, sep } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -16520,7 +16520,7 @@ function makeNetServiceShape(createServer = Net.createServer) {
 }
 //#endregion
 //#region ../../packages/shared/src/releaseInfo.generated.ts
-const FORGE_RELEASE_VERSION = "0.13.2";
+const FORGE_RELEASE_VERSION = "0.13.4";
 //#endregion
 //#region ../../packages/shared/src/hostProcess.ts
 /**
@@ -16644,6 +16644,70 @@ const CheckpointRef = makeEntityId("CheckpointRef");
 */
 const ThreadEnvMode = Literals(["local", "worktree"]);
 //#endregion
+//#region ../../packages/contracts/src/assets.ts
+/**
+* Addresses for the bytes a client cannot fetch by guessing.
+*
+* Forge already serves the bytes: attachments under `/attachments/*` and
+* project favicons at `GET /api/project-favicon?cwd=`. What it did not serve
+* was the question "what is the URL for this thing", which is the only way a
+* client that holds an attachment id or a workspace root can reach either.
+* The phone asks that question on the thread list for every project, so
+* until this existed the answer was an error the phone drew as a spinner.
+*
+* These schemas are the Forge side of `assets.*` in the vendored t3 contracts.
+* They must decode what that package encodes: same tags, same field names.
+*/
+const ASSET_PATH_MAX_LENGTH = 1024;
+const ASSET_ID_MAX_LENGTH = 256;
+const ASSET_URL_MAX_LENGTH = 4096;
+const AssetResource = Union([
+	TaggedStruct("workspace-file", {
+		threadId: ThreadId,
+		path: TrimmedNonEmptyString.check(isMaxLength(ASSET_PATH_MAX_LENGTH))
+	}),
+	TaggedStruct("attachment", { attachmentId: TrimmedNonEmptyString.check(isMaxLength(ASSET_ID_MAX_LENGTH)) }),
+	TaggedStruct("project-favicon", {
+		cwd: TrimmedNonEmptyString.check(isMaxLength(ASSET_PATH_MAX_LENGTH)),
+		path: optional$4(TrimmedNonEmptyString.check(isMaxLength(ASSET_PATH_MAX_LENGTH)))
+	})
+]);
+const AssetCreateUrlInput = Struct({ resource: AssetResource });
+const AssetCreateUrlResult = Struct({
+	relativeUrl: TrimmedNonEmptyString.check(isMaxLength(ASSET_URL_MAX_LENGTH)),
+	expiresAt: Number$1,
+	sourcePath: optional$4(TrimmedNonEmptyString.check(isMaxLength(ASSET_PATH_MAX_LENGTH)))
+});
+/**
+* The resource cannot be addressed by URL on this server.
+*
+* Tag and message match the vendored client's `AssetAccessError` union so the
+* phone decodes the failure rather than falling through to a generic transport
+* error. `workspace-file` is the case that lands here.
+*/
+var AssetWorkspaceResolutionError = class extends TaggedErrorClass()("AssetWorkspaceResolutionError", {
+	resource: AssetResource,
+	cause: optional$4(Defect)
+}) {
+	get message() {
+		return "Failed to resolve workspace.";
+	}
+};
+/** The signing key that makes an asset URL self-authenticating could not be read. */
+var AssetSigningKeyLoadError = class extends TaggedErrorClass()("AssetSigningKeyLoadError", {
+	resource: AssetResource,
+	cause: optional$4(Defect)
+}) {
+	get message() {
+		return "Failed to load the asset signing key.";
+	}
+};
+const AssetAccessError = Union([AssetWorkspaceResolutionError, AssetSigningKeyLoadError]);
+const AssetsRpcSchemas = { createUrl: {
+	input: AssetCreateUrlInput,
+	output: AssetCreateUrlResult
+} };
+//#endregion
 //#region ../../node_modules/.bun/effect@4.0.0-beta.51/node_modules/effect/dist/unstable/rpc/RpcMiddleware.js
 /**
 * @since 4.0.0
@@ -18144,6 +18208,7 @@ const ExecutionEnvironmentCapabilities = Struct({
 	threadPullRequestLinking: optionalKey(Boolean$1),
 	cloudMode: Boolean$1.pipe(withDecodingDefault(succeed(false))),
 	threadSettlement: optionalKey(Boolean$1),
+	threadTitleRegeneration: optionalKey(Boolean$1),
 	posthogPublicKey: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	posthogHost: NullOr(String$1).pipe(withDecodingDefault(succeed(null))),
 	runtime: optionalKey(ExecutionEnvironmentRuntimeCapabilities),
@@ -19141,6 +19206,51 @@ Struct({
 	headRepositoryNameWithOwner: optional$4(NullOr(TrimmedNonEmptyString)),
 	headRepositoryOwnerLogin: optional$4(NullOr(TrimmedNonEmptyString))
 });
+const SourceControlCloneProtocol = Literals([
+	"auto",
+	"ssh",
+	"https"
+]);
+const SourceControlRepositoryInfo = Struct({
+	provider: SourceControlProviderKind$1,
+	nameWithOwner: TrimmedNonEmptyString,
+	url: TrimmedNonEmptyString,
+	sshUrl: TrimmedNonEmptyString
+});
+const SourceControlRepositoryLookupInput = Struct({
+	provider: SourceControlProviderKind$1,
+	repository: TrimmedNonEmptyString,
+	cwd: optional$4(TrimmedNonEmptyString)
+});
+/**
+* Either name the repository (`provider` + `repository`) or paste a clone URL
+* (`remoteUrl`). Both are optional in the schema because the phone sends one
+* or the other depending on how the user got here; the server rejects a call
+* that supplies neither, and rejects a `remoteUrl` it cannot resolve to a
+* repository it is allowed to fetch a token for.
+*/
+const SourceControlCloneRepositoryInput = Struct({
+	provider: optional$4(SourceControlProviderKind$1),
+	repository: optional$4(TrimmedNonEmptyString),
+	remoteUrl: optional$4(TrimmedNonEmptyString),
+	destinationPath: TrimmedNonEmptyString,
+	protocol: optional$4(SourceControlCloneProtocol)
+});
+const SourceControlCloneRepositoryResult = Struct({
+	cwd: TrimmedNonEmptyString,
+	remoteUrl: TrimmedNonEmptyString,
+	repository: NullOr(SourceControlRepositoryInfo)
+});
+var SourceControlRepositoryError = class extends TaggedErrorClass()("SourceControlRepositoryError", {
+	provider: SourceControlProviderKind$1,
+	operation: String$1,
+	detail: String$1,
+	cause: optional$4(Defect)
+}) {
+	get message() {
+		return `Source control repository operation ${this.operation} failed for ${this.provider}: ${this.detail}`;
+	}
+};
 //#endregion
 //#region ../../packages/contracts/src/orchestration.ts
 const ORCHESTRATION_WS_METHODS = {
@@ -19152,7 +19262,8 @@ const ORCHESTRATION_WS_METHODS = {
 	replayEvents: "orchestration.replayEvents",
 	getArchivedShellSnapshot: "orchestration.getArchivedShellSnapshot",
 	subscribeShell: "orchestration.subscribeShell",
-	subscribeThread: "orchestration.subscribeThread"
+	subscribeThread: "orchestration.subscribeThread",
+	searchThreads: "orchestration.searchThreads"
 };
 const ProviderKind = Literals([
 	"codex",
@@ -20508,6 +20619,31 @@ const OrchestrationGetFullThreadDiffInput = Struct({
 const OrchestrationGetFullThreadDiffResult = ThreadTurnDiff;
 const OrchestrationReplayEventsInput = Struct({ fromSequenceExclusive: NonNegativeInt });
 const OrchestrationReplayEventsResult = ArraySchema(OrchestrationEvent);
+/**
+* Which side of the conversation a search hit came from. `null`
+* `messageCreatedAt` on a match means it came from the thread's own metadata
+* (its title or its branch) rather than from a message.
+*/
+const OrchestrationThreadSearchSource = Literals(["user", "assistant"]);
+/**
+* The server's SQLite client is synchronous and single-connection, so both the
+* scan input and the response size are bounded: a search must not be able to
+* monopolize the connection every keystroke.
+*/
+const OrchestrationSearchThreadsInput = Struct({
+	query: TrimmedString.check(isMinLength(2), isMaxLength(200)),
+	limit: optionalKey(Int$1.check(isBetween({
+		minimum: 1,
+		maximum: 50
+	})))
+});
+const OrchestrationSearchThreadsResult = Struct({ matches: ArraySchema(Struct({
+	threadId: ThreadId,
+	projectId: ProjectId,
+	source: OrchestrationThreadSearchSource,
+	snippet: String$1.check(isMaxLength(240)),
+	messageCreatedAt: NullOr(IsoDateTime)
+})) });
 const ProgressPercent = NonNegativeInt.check(isLessThanOrEqualTo(100));
 const AgentProtocolMessage = Union([
 	Struct({
@@ -20578,6 +20714,10 @@ const OrchestrationRpcSchemas = {
 	getArchivedShellSnapshot: {
 		input: Struct({}),
 		output: OrchestrationShellSnapshot
+	},
+	searchThreads: {
+		input: OrchestrationSearchThreadsInput,
+		output: OrchestrationSearchThreadsResult
 	}
 };
 var OrchestrationGetSnapshotError = class extends TaggedErrorClass()("OrchestrationGetSnapshotError", {
@@ -20600,6 +20740,10 @@ var OrchestrationReplayEventsError = class extends TaggedErrorClass()("Orchestra
 	message: TrimmedNonEmptyString,
 	cause: optional$4(Defect)
 }) {};
+var OrchestrationSearchThreadsError = class extends TaggedErrorClass()("OrchestrationSearchThreadsError", {
+	message: TrimmedNonEmptyString,
+	cause: optional$4(Defect)
+}) {};
 Struct({
 	provider: ProviderKind,
 	status: Literals([
@@ -20659,6 +20803,31 @@ const ProviderRespondToUserInputInput = Struct({
 	requestId: ApprovalRequestId,
 	answers: ProviderUserInputAnswers
 });
+/**
+* Sending a thread to the people who maintain Forge.
+*
+* The vendored client's `/feedback` slash command calls this. Upstream it
+* uploads the transcript to the model provider; Forge routes it to the same
+* CMMD feedback intake the web app's feedback dialog already posts to, so one
+* report lands in one place no matter which surface filed it.
+*
+* `reason` is what the person typed after the command, and is the only part
+* of the report they wrote. The server fills in the rest.
+*/
+const ProviderUploadFeedbackInput = Struct({
+	threadId: ThreadId,
+	reason: optional$4(TrimmedNonEmptyString.check(isMaxLength(4e3)))
+});
+const ProviderUploadFeedbackResult = Struct({ feedbackId: TrimmedNonEmptyString });
+var ProviderUploadFeedbackError = class extends TaggedErrorClass()("ProviderUploadFeedbackError", {
+	threadId: ThreadId,
+	reason: optional$4(TrimmedNonEmptyString.check(isMaxLength(500))),
+	cause: optional$4(Defect)
+}) {
+	get message() {
+		return this.reason ?? "Feedback could not be sent. Please try again.";
+	}
+};
 Struct({
 	id: EventId,
 	kind: Literals([
@@ -21133,6 +21302,46 @@ const TaskStartedPayload = Struct({
 	description: optional$4(TrimmedNonEmptyStringSchema$2),
 	taskType: optional$4(TrimmedNonEmptyStringSchema$2)
 });
+/**
+* Watch-loop task types: Monitor-tool tasks plus background shells. A shell
+* that outlives its turn is in practice a watch loop, not delegated work.
+*/
+const MONITOR_TASK_TYPES = new Set([
+	"monitor",
+	"monitor_mcp",
+	"local_bash",
+	"shell"
+]);
+/** Task types that are neither agents nor watch loops (plan-mode bookkeeping). */
+const INERT_TASK_TYPES = new Set(["plan", "dream"]);
+/**
+* Agent-vs-background classification for a task row.
+*
+* The mobile client reads `agentKind` off the persisted activity payload and
+* treats a row without it as background, so a server that never stamps the
+* field leaves the Agents roster permanently empty however much subagent work
+* is running (FOR-36646). This is the stamp.
+*
+* A denylist, not an allowlist, and deliberately so: the agent-flavoured type
+* names drift with the SDKs (subagent, local_agent, local_workflow, and
+* whatever lands next), and an allowlist drops real subagents the day a new
+* name appears. Only the watch loops and the plan-mode bookkeeping types are
+* named here; everything else is delegated work.
+*
+* A task launched from inside a subagent (`agentId` set) is agent-internal
+* background work unless it is itself agent-flavoured, because a nested agent
+* can outlive its parent and has to stay in the roster.
+*
+* This mirrors `classifyTaskAgentKind` in the contracts the phone speaks. The
+* two packages do not import each other, so the sets are duplicated on
+* purpose; they have to agree, and the tests on both sides pin the same cases.
+*/
+function classifyTaskAgentKind(input) {
+	const { taskType, agentId } = input;
+	const nonAgentType = taskType !== void 0 && (MONITOR_TASK_TYPES.has(taskType) || INERT_TASK_TYPES.has(taskType));
+	if (agentId !== void 0 && agentId.trim().length > 0) return taskType === void 0 || nonAgentType ? "background" : "agent";
+	return nonAgentType ? "background" : "agent";
+}
 const TaskProgressPayload = Struct({
 	taskId: RuntimeTaskId,
 	description: TrimmedNonEmptyStringSchema$2,
@@ -25715,6 +25924,8 @@ const WS_METHODS = {
 	projectsListEntries: "projects.listEntries",
 	serverDiscoverSourceControl: "server.discoverSourceControl",
 	serverReportClientActivity: "server.reportClientActivity",
+	sourceControlLookupRepository: "sourceControl.lookupRepository",
+	sourceControlCloneRepository: "sourceControl.cloneRepository",
 	projectsWriteFile: "projects.writeFile",
 	projectCheckoutDeletionPreview: "projectCheckoutDeletion.preview",
 	projectCheckoutDeletionExecute: "projectCheckoutDeletion.execute",
@@ -25818,7 +26029,9 @@ const WS_METHODS = {
 	subscribeServerConfig: "subscribeServerConfig",
 	subscribeServerLifecycle: "subscribeServerLifecycle",
 	subscribeAuthAccess: "subscribeAuthAccess",
-	subscribeWorkspaceReadiness: "subscribeWorkspaceReadiness"
+	subscribeWorkspaceReadiness: "subscribeWorkspaceReadiness",
+	assetsCreateUrl: "assets.createUrl",
+	providerUploadFeedback: "provider.uploadFeedback"
 };
 const WsServerUpsertKeybindingRpc = make$30(WS_METHODS.serverUpsertKeybinding, {
 	payload: ServerUpsertKeybindingInput,
@@ -26347,6 +26560,29 @@ const WsOrchestrationGetArchivedShellSnapshotRpc = make$30(ORCHESTRATION_WS_METH
 	success: OrchestrationRpcSchemas.getArchivedShellSnapshot.output,
 	error: OrchestrationGetSnapshotError
 });
+const WsOrchestrationSearchThreadsRpc = make$30(ORCHESTRATION_WS_METHODS.searchThreads, {
+	payload: OrchestrationSearchThreadsInput,
+	success: OrchestrationRpcSchemas.searchThreads.output,
+	error: OrchestrationSearchThreadsError
+});
+/**
+* Resolve `owner/repo` to the repository the caller is allowed to clone.
+*
+* Both of these run against the same CMMD-brokered GitHub credential the web
+* add-project flow uses, so a lookup that answers is a lookup whose clone can
+* also be authorized, and a repository the caller cannot reach is a failure
+* here rather than a clone that dies half way.
+*/
+const WsSourceControlLookupRepositoryRpc = make$30(WS_METHODS.sourceControlLookupRepository, {
+	payload: SourceControlRepositoryLookupInput,
+	success: SourceControlRepositoryInfo,
+	error: SourceControlRepositoryError
+});
+const WsSourceControlCloneRepositoryRpc = make$30(WS_METHODS.sourceControlCloneRepository, {
+	payload: SourceControlCloneRepositoryInput,
+	success: SourceControlCloneRepositoryResult,
+	error: SourceControlRepositoryError
+});
 const WsOrchestrationSubscribeShellRpc = make$30(ORCHESTRATION_WS_METHODS.subscribeShell, {
 	payload: OrchestrationRpcSchemas.subscribeShell.input,
 	success: OrchestrationRpcSchemas.subscribeShell.output,
@@ -26427,7 +26663,15 @@ const WsRpcGroup = make$29(WsServerGetConfigRpc, WsServerRefreshProvidersRpc, Ws
 	payload: UsageSummaryInput,
 	success: UsageSummary,
 	error: UsageReadError
-}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsCodeGraphSummaryRpc, WsCodeGraphNeighborhoodRpc, WsCodeGraphSearchRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc);
+}), WsPullRequestsListRpc, WsPullRequestsListStatsRpc, WsPullRequestsDetailRpc, WsPullRequestsActivityRpc, WsPullRequestsThreadCommentsRpc, WsPullRequestsDiffFileContentsRpc, WsPullRequestsRunActionRpc, WsPullRequestsUpdateRpc, WsPullRequestsCommentRpc, WsPullRequestsUpdateCommentRpc, WsPullRequestsSubmitReviewRpc, WsPullRequestsReplyToThreadRpc, WsPullRequestsSetThreadResolutionRpc, WsPullRequestsSetReactionRpc, WsPullRequestsInvalidateRpc, WsPullRequestsReviewerCandidatesRpc, WsPullRequestsRequestReviewersRpc, WsProjectsSearchEntriesRpc, WsProjectsWriteFileRpc, WsProjectCheckoutDeletionPreviewRpc, WsProjectCheckoutDeletionExecuteRpc, WsCodeGraphSummaryRpc, WsCodeGraphNeighborhoodRpc, WsCodeGraphSearchRpc, WsWorkspaceReadFileRpc, WsWorkspaceBeginWriteFileRpc, WsWorkspaceWriteFileChunkRpc, WsWorkspaceCommitWriteFileRpc, WsWorkspaceCancelWriteFileRpc, WsShellOpenInEditorRpc, WsSubscribeGitStatusRpc, WsGitPullRpc, WsGitRefreshStatusRpc, WsGitRunStackedActionRpc, WsGitResolvePullRequestRpc, WsGitPreparePullRequestThreadRpc, WsGitListBranchesRpc, WsVcsListRefsRpc, WsVcsRefreshStatusRpc, WsSubscribeVcsStatusRpc, WsVcsPullRpc, WsVcsCreateWorktreeRpc, WsVcsRemoveWorktreeRpc, WsVcsCreateRefRpc, WsVcsSwitchRefRpc, WsVcsInitRpc, WsGitCreateWorktreeRpc, WsGitRemoveWorktreeRpc, WsGitCreateBranchRpc, WsGitCheckoutRpc, WsGitInitRpc, WsFilesystemBrowseRpc, WsProjectsReadFileRpc, WsReviewGetDiffPreviewRpc, WsCloudListRuntimesRpc, WsTerminalOpenRpc, WsTerminalAttachRpc, WsTerminalWriteRpc, WsTerminalResizeRpc, WsTerminalSignalRpc, WsTerminalClearRpc, WsTerminalRestartRpc, WsTerminalCloseRpc, WsBrowserOpenSessionRpc, WsBrowserListSessionsRpc, WsBrowserCloseSessionRpc, WsBrowserGetSessionRpc, WsBrowserCommandRpc, WsBrowserClearBrowsingDataRpc, WsBrowserAttachDisplayRpc, WsBrowserAddDisplayIceCandidateRpc, WsComputerInputRpc, WsDevTunnelRegisterRpc, WsDevTunnelUnregisterRpc, WsDevTunnelListRpc, WsThreadDevRuntimeGetRpc, WsThreadDevRuntimeAllocatePortRpc, WsThreadDevRuntimeReleaseRpc, WsWorkspaceEnvironmentPreflightRpc, WsWorkspaceEnsureScratchRpc, WsSubscribeTerminalEventsRpc, WsSubscribeTerminalMetadataRpc, WsProjectsListEntriesRpc, WsServerDiscoverSourceControlRpc, WsServerReportClientActivityRpc, WsSubscribeBrowserEventsRpc, WsSubscribeServerConfigRpc, WsSubscribeServerLifecycleRpc, WsSubscribeAuthAccessRpc, WsSubscribeWorkspaceReadinessRpc, WsOrchestrationDispatchCommandRpc, WsOrchestrationGetTurnDiffRpc, WsOrchestrationGetFullThreadDiffRpc, WsOrchestrationStreamTurnDiffRpc, WsOrchestrationStreamFullThreadDiffRpc, WsOrchestrationReplayEventsRpc, WsOrchestrationGetArchivedShellSnapshotRpc, WsOrchestrationSubscribeShellRpc, WsOrchestrationSubscribeThreadRpc, make$30(WS_METHODS.assetsCreateUrl, {
+	payload: AssetsRpcSchemas.createUrl.input,
+	success: AssetsRpcSchemas.createUrl.output,
+	error: AssetAccessError
+}), make$30(WS_METHODS.providerUploadFeedback, {
+	payload: ProviderUploadFeedbackInput,
+	success: ProviderUploadFeedbackResult,
+	error: ProviderUploadFeedbackError
+}), WsOrchestrationSearchThreadsRpc, WsSourceControlLookupRepositoryRpc, WsSourceControlCloneRepositoryRpc);
 const RelayWsRpcGroup = WsRpcGroup.middleware(RelayAuthorizationMiddleware).middleware(RelayDeliveryMiddleware);
 /**
 * The direct-WebSocket mount of the same group, with per-method scope
@@ -31559,6 +31803,31 @@ const RELAY_METHOD_POLICY_BASES = [
 		method: ORCHESTRATION_WS_METHODS.subscribeThread,
 		requiredScope: "thread.read",
 		deliveryClass: "subscription"
+	},
+	{
+		method: WS_METHODS.assetsCreateUrl,
+		requiredScope: "thread.read",
+		deliveryClass: "read"
+	},
+	{
+		method: ORCHESTRATION_WS_METHODS.searchThreads,
+		requiredScope: "thread.read",
+		deliveryClass: "read"
+	},
+	{
+		method: WS_METHODS.providerUploadFeedback,
+		requiredScope: "thread.read",
+		deliveryClass: "create-command"
+	},
+	{
+		method: WS_METHODS.sourceControlLookupRepository,
+		requiredScope: "git.read",
+		deliveryClass: "read"
+	},
+	{
+		method: WS_METHODS.sourceControlCloneRepository,
+		requiredScope: "project.write",
+		deliveryClass: "idempotent-command"
 	}
 ];
 const FRAME_JOURNALED_METHODS = new Set([
@@ -33726,7 +33995,7 @@ function isRejectedCredential(cause) {
 //#region src/connect/hiddenInput.ts
 /** Ctrl-C arrives as this byte on a raw TTY rather than as a signal. */
 const END_OF_TEXT = "";
-function firstLine(value) {
+function firstLine$1(value) {
 	const index = value.indexOf("\n");
 	const line = index === -1 ? value : value.slice(0, index);
 	return line.endsWith("\r") ? line.slice(0, -1) : line;
@@ -33751,7 +34020,7 @@ function readHiddenLine(input) {
 			settled = true;
 			detach();
 			input.output.write("\n");
-			resolve(firstLine(value));
+			resolve(firstLine$1(value));
 		};
 		const onData = (chunk) => {
 			buffer += chunk.toString();
@@ -35183,7 +35452,7 @@ function stringify(value, fallback = "[unserializable]") {
 		return typeof fallback === "function" ? fallback(value) : fallback;
 	}
 }
-function truncate$1(str, max = 0) {
+function truncate$2(str, max = 0) {
 	if (typeof str !== "string" || max === 0) return str;
 	return str.length <= max ? str : `${str.slice(0, max)}...`;
 }
@@ -35790,7 +36059,7 @@ var Scope = class Scope {
 		const mergedBreadcrumb = {
 			timestamp: dateTimestampInSeconds(),
 			...breadcrumb,
-			message: breadcrumb.message ? truncate$1(breadcrumb.message, 2048) : breadcrumb.message
+			message: breadcrumb.message ? truncate$2(breadcrumb.message, 2048) : breadcrumb.message
 		};
 		this._breadcrumbs.push(mergedBreadcrumb);
 		if (this._breadcrumbs.length > maxCrumbs) {
@@ -38448,9 +38717,9 @@ function applyClientOptions(event, options) {
 	if (!event.release && release) event.release = release;
 	if (!event.dist && dist) event.dist = dist;
 	const request = event.request;
-	if (request?.url && maxValueLength) request.url = truncate$1(request.url, maxValueLength);
+	if (request?.url && maxValueLength) request.url = truncate$2(request.url, maxValueLength);
 	if (maxValueLength) event.exception?.values?.forEach((exception) => {
-		if (exception.value) exception.value = truncate$1(exception.value, maxValueLength);
+		if (exception.value) exception.value = truncate$2(exception.value, maxValueLength);
 	});
 }
 function applyDebugIds(event, stackParser) {
@@ -50194,7 +50463,7 @@ function _supportsColor(haveStream, { streamIsTTY, sniffFlags = true } = {}) {
 	const min = forceColor || 0;
 	if (env.TERM === "dumb") return min;
 	if (process$1.platform === "win32") {
-		const osRelease = os.release().split(".");
+		const osRelease = $U.release().split(".");
 		if (Number(osRelease[0]) >= 10 && Number(osRelease[2]) >= 10586) return Number(osRelease[2]) >= 14931 ? 3 : 2;
 		return 1;
 	}
@@ -52637,7 +52906,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 	exports.processDetector = void 0;
 	const api_1 = (init_esm$1(), __toCommonJS(esm_exports$1));
 	const semconv_1 = require_semconv$1();
-	const os$4 = __require("os");
+	const os$3 = __require("os");
 	/**
 	* ProcessDetector will be used to detect the resources related current process running
 	* and being instrumented from the NodeJS Process module.
@@ -52659,7 +52928,7 @@ var require_ProcessDetector = /* @__PURE__ */ __commonJSMin(((exports) => {
 			};
 			if (process.argv.length > 1) attributes[semconv_1.ATTR_PROCESS_COMMAND] = process.argv[1];
 			try {
-				const userInfo = os$4.userInfo();
+				const userInfo = os$3.userInfo();
 				attributes[semconv_1.ATTR_PROCESS_OWNER] = userInfo.username;
 			} catch (e) {
 				api_1.diag.debug(`error obtaining process owner: ${e}`);
@@ -62067,7 +62336,7 @@ const cacheResponseHook = (span, redisCommand, cmdArgs, response) => {
 		[SEMANTIC_ATTRIBUTE_CACHE_KEY]: safeKey
 	});
 	const spanDescription = safeKey.join(", ");
-	span.updateName(_redisOptions.maxCacheKeyLength ? truncate$1(spanDescription, _redisOptions.maxCacheKeyLength) : spanDescription);
+	span.updateName(_redisOptions.maxCacheKeyLength ? truncate$2(spanDescription, _redisOptions.maxCacheKeyLength) : spanDescription);
 };
 //#endregion
 //#region ../../node_modules/.bun/@sentry+node@10.70.0+cfd4f484ffd29da6/node_modules/@sentry/node/build/esm/integrations/tracing/redis/vendored/semconv.js
@@ -65582,7 +65851,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.13.2";
+var version$1 = "0.13.4";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -69101,6 +69370,102 @@ var BrowserTraceCollector = class extends Service$1()("forge/observability/Servi
 */
 var ProjectFaviconResolver = class extends Service$1()("forge/project/Services/ProjectFaviconResolver") {};
 //#endregion
+//#region src/auth/Services/ServerSecretStore.ts
+var SecretStoreError = class extends TaggedError("SecretStoreError") {};
+var ServerSecretStore = class extends Service$1()("forge/auth/Services/ServerSecretStore") {};
+//#endregion
+//#region src/auth/assetUrlToken.ts
+/**
+* A credential an image tag can carry.
+*
+* `/attachments/*` and `GET /api/project-favicon` both require an authenticated
+* request, and the clients that render those bytes hand a bare URL to an image
+* loader that sends no cookie and no Authorization header. Web gets away with
+* it because the browser attaches the session cookie itself. The phone holds a
+* bearer token it has no way to attach, so every asset it fetched would 401.
+*
+* So the URL carries its own proof. The token is signed with the same server
+* signing key as the session and WebSocket credentials, and it is deliberately
+* weaker than either of those: it names one resource, and presenting it grants
+* that resource and nothing else. A leaked favicon URL is a leaked favicon.
+*/
+const ASSET_TOKEN_KIND = "asset";
+const ASSET_URL_TOKEN_QUERY_PARAM = "assetToken";
+/**
+* An hour, against a client that re-asks every thirty minutes.
+*
+* The vendored client refreshes asset URLs on a thirty-minute interval, so a
+* shorter life would expire URLs the client still believes are good, and the
+* failure would show up as an image that worked and then stopped.
+*/
+const DEFAULT_ASSET_URL_TOKEN_TTL = hours(1);
+const SIGNING_SECRET_NAME$1 = "server-signing-key";
+const decodeAssetTokenClaims = decodeUnknownEffect(fromJsonString(Struct({
+	v: Literal(1),
+	kind: Literal(ASSET_TOKEN_KIND),
+	sid: String$1,
+	res: String$1,
+	iat: Number$1,
+	exp: Number$1
+})));
+/**
+* The canonical name of one addressable asset.
+*
+* Both the mint and the check compute this from their own side: the RPC from
+* the resource it was asked about, the route from the request it received. They
+* have to agree exactly, which is the point. A token minted for one attachment
+* cannot be replayed against another, or against a favicon.
+*
+* The key is built from the address, not the logical id, because the address is
+* what both sides actually hold. The attachments route reads its id straight
+* out of the URL path without percent-decoding, so keying on the decoded id
+* would let the two sides disagree about an id that encodes to something else.
+*/
+function assetResourceKey(resource) {
+	return resource.kind === "attachment" ? `attachment:${resource.urlPathSegment}` : `project-favicon:${resource.cwd}`;
+}
+const resolveSigningSecret = gen(function* () {
+	const serverConfig = yield* ServerConfig;
+	const secretStore = yield* ServerSecretStore;
+	return resolveConfiguredSigningKey(serverConfig.sessionSigningKey) ?? (yield* secretStore.getOrCreateRandom(SIGNING_SECRET_NAME$1, 32));
+});
+const issueAssetUrlToken = (input) => gen(function* () {
+	const secret = yield* resolveSigningSecret;
+	const issuedAt = yield* now;
+	const expiresAt = add$3(issuedAt, { milliseconds: toMillis(input.ttl ?? DEFAULT_ASSET_URL_TOKEN_TTL) });
+	const claims = {
+		v: 1,
+		kind: ASSET_TOKEN_KIND,
+		sid: input.sessionId,
+		res: input.resourceKey,
+		iat: issuedAt.epochMilliseconds,
+		exp: expiresAt.epochMilliseconds
+	};
+	const encodedPayload = base64UrlEncode(JSON.stringify(claims));
+	return {
+		token: `${encodedPayload}.${signPayload(encodedPayload, secret)}`,
+		expiresAt: expiresAt.epochMilliseconds
+	};
+});
+/**
+* Whether this token opens this resource, right now.
+*
+* Returns a boolean rather than failing, because every negative answer means
+* the same thing to the caller: fall through to ordinary request
+* authentication. A malformed token from a stale client should behave like no
+* token at all, not like a different error.
+*/
+const verifyAssetUrlToken = (input) => gen(function* () {
+	const [encodedPayload, signature] = input.token.split(".");
+	if (!encodedPayload || !signature) return false;
+	if (!timingSafeEqualBase64Url(signature, signPayload(encodedPayload, yield* resolveSigningSecret))) return false;
+	const claims = yield* decodeAssetTokenClaims(base64UrlDecodeUtf8(encodedPayload)).pipe(orElseSucceed(() => null));
+	if (!claims) return false;
+	if (claims.res !== input.resourceKey) return false;
+	const now = yield* currentTimeMillis;
+	return claims.exp > now;
+}).pipe(orElseSucceed(() => false));
+//#endregion
 //#region src/environment/Services/ServerEnvironment.ts
 var ServerEnvironment = class extends Service$1()("forge/environment/Services/ServerEnvironment") {};
 //#endregion
@@ -69375,6 +69740,28 @@ const requireAuthenticatedRequest$1 = gen(function* () {
 	const request = yield* HttpServerRequest;
 	yield* (yield* ServerAuth).authenticateHttpRequest(request);
 });
+/**
+* Authenticate a request for asset bytes.
+*
+* Ordinary request authentication first, so the web app's cookie keeps working
+* exactly as it did and nothing about these routes changes for it. An asset
+* token is the fallback, for the clients that render these bytes through an
+* image loader with no way to attach a credential. See `auth/assetUrlToken.ts`
+* for why the token is scoped to one resource.
+*/
+const requireAssetAccess = (resourceKey) => gen(function* () {
+	const request = yield* HttpServerRequest;
+	const serverAuth = yield* ServerAuth;
+	const url = toURL(request);
+	const token = isSome(url) ? url.value.searchParams.get(ASSET_URL_TOKEN_QUERY_PARAM) : null;
+	if (token && token.trim().length > 0) {
+		if (yield* verifyAssetUrlToken({
+			token,
+			resourceKey
+		})) return;
+	}
+	yield* serverAuth.authenticateHttpRequest(request);
+});
 const serverEnvironmentRouteLayer = add$1("GET", "/.well-known/forge/environment", gen(function* () {
 	return jsonUnsafe(yield* service(ServerEnvironment).pipe(flatMap((serverEnvironment) => serverEnvironment.getDescriptor)), { status: 200 });
 }));
@@ -69443,12 +69830,15 @@ const otlpTracesProxyRouteLayer = add$1("POST", OTLP_TRACES_PROXY_PATH, gen(func
 	captureServerError(cause, { route: "/api/observability/v1/traces" });
 }).pipe(andThen(() => logError("otlp-traces unhandled cause", { cause }))))));
 const attachmentsRouteLayer = add$1("GET", `${ATTACHMENTS_ROUTE_PREFIX}/*`, gen(function* () {
-	yield* requireAuthenticatedRequest$1;
 	const url = toURL(yield* HttpServerRequest);
 	if (isNone(url)) return text$2("Bad Request", { status: 400 });
 	const config = yield* ServerConfig;
 	const normalizedRelativePath = normalizeAttachmentRelativePath(url.value.pathname.slice(12));
 	if (!normalizedRelativePath) return text$2("Invalid attachment path", { status: 400 });
+	yield* requireAssetAccess(assetResourceKey({
+		kind: "attachment",
+		urlPathSegment: normalizedRelativePath
+	}));
 	const isIdLookup = !normalizedRelativePath.includes("/") && !normalizedRelativePath.includes(".");
 	const filePath = isIdLookup ? resolveAttachmentPathById({
 		attachmentsDir: config.attachmentsDir,
@@ -69466,12 +69856,14 @@ const attachmentsRouteLayer = add$1("GET", `${ATTACHMENTS_ROUTE_PREFIX}/*`, gen(
 	}).pipe(catch_(() => succeed(text$2("Internal Server Error", { status: 500 }))));
 }).pipe(catchTag("AuthError", respondToAuthError)));
 const projectFaviconRouteLayer = add$1("GET", "/api/project-favicon", gen(function* () {
-	const request = yield* HttpServerRequest;
-	yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const url = toURL(request);
+	const url = toURL(yield* HttpServerRequest);
 	if (isNone(url)) return text$2("Bad Request", { status: 400 });
 	const projectCwd = url.value.searchParams.get("cwd");
 	if (!projectCwd) return text$2("Missing cwd parameter", { status: 400 });
+	yield* requireAssetAccess(assetResourceKey({
+		kind: "project-favicon",
+		cwd: projectCwd
+	}));
 	const faviconFilePath = yield* (yield* ProjectFaviconResolver).resolvePath(projectCwd);
 	if (!faviconFilePath) return empty$6({
 		status: 204,
@@ -74334,7 +74726,7 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var fs$6 = __require("fs");
 	var path$5 = __require("path");
 	var url$1 = __require("url");
-	var os$3 = __require("os");
+	var os$2 = __require("os");
 	var runtimeRequire = typeof __webpack_require__ === "function" ? __non_webpack_require__ : __require;
 	var vars = process.config && process.config.variables || {};
 	var prebuildsOnly = !!process.env.PREBUILDS_ONLY;
@@ -74342,8 +74734,8 @@ var require_node_gyp_build = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 	var abi = versions.modules;
 	if (versions.deno || process.isBun) abi = "unsupported";
 	var runtime = isElectron() ? "electron" : isNwjs() ? "node-webkit" : "node";
-	var arch = process.env.npm_config_arch || os$3.arch();
-	var platform = process.env.npm_config_platform || os$3.platform();
+	var arch = process.env.npm_config_arch || os$2.arch();
+	var platform = process.env.npm_config_platform || os$2.platform();
 	var libc = process.env.LIBC || (isMusl(platform) ? "musl" : "glibc");
 	var armv = process.env.ARM_VERSION || (arch === "arm64" ? "8" : vars.arm_version) || "";
 	var uv = (versions.uv || "").split(".")[0];
@@ -77193,6 +77585,195 @@ succeed$2(TraceDiagnostics, TraceDiagnostics.of({ read: (options) => succeed(mak
 	}
 })) }));
 //#endregion
+//#region src/assets/createAssetUrl.ts
+const PROJECT_FAVICON_ROUTE = "/api/project-favicon";
+/**
+* Turn a resource into an address a client can fetch.
+*
+* Nothing new is served here. `/attachments/*` and `GET /api/project-favicon`
+* already return these bytes; what did not exist was the step in between, and
+* without it a client holding an attachment id or a workspace root has no way
+* to name the URL. The vendored mobile client asks this for every project on
+* its thread list, so the gap was not an edge case, it was the most visited
+* screen.
+*
+* The URL is relative so it resolves against whichever base the client is
+* already talking to, and it carries a token because the clients that render
+* these bytes hand the URL to an image loader that attaches no credential of
+* its own. See `auth/assetUrlToken.ts`.
+*/
+const createAssetUrl = (sessionId, resource) => gen(function* () {
+	if (resource._tag === "workspace-file") return yield* new AssetWorkspaceResolutionError({
+		resource,
+		cause: "Workspace files are read over projects.readFile, not by URL."
+	});
+	const address = resolveAddress(resource);
+	const issued = yield* issueAssetUrlToken({
+		sessionId,
+		resourceKey: address.resourceKey
+	}).pipe(mapError((cause) => new AssetSigningKeyLoadError({
+		resource,
+		cause
+	})));
+	return {
+		relativeUrl: `${address.path}?${address.query}assetToken=${encodeURIComponent(issued.token)}`,
+		expiresAt: issued.expiresAt,
+		...resource._tag === "project-favicon" && resource.path ? { sourcePath: resource.path } : {}
+	};
+});
+function resolveAddress(resource) {
+	if (resource._tag === "attachment") {
+		const urlPathSegment = encodeURIComponent(resource.attachmentId);
+		return {
+			resourceKey: assetResourceKey({
+				kind: "attachment",
+				urlPathSegment
+			}),
+			path: `${ATTACHMENTS_ROUTE_PREFIX}/${urlPathSegment}`,
+			query: ""
+		};
+	}
+	return {
+		resourceKey: assetResourceKey({
+			kind: "project-favicon",
+			cwd: resource.cwd
+		}),
+		path: PROJECT_FAVICON_ROUTE,
+		query: `cwd=${encodeURIComponent(resource.cwd)}&`
+	};
+}
+//#endregion
+//#region src/cmmd/submitFeedback.ts
+/** The intake the web app's feedback dialog already posts to, reached directly. */
+const CMMD_FEEDBACK_PATH = "/api/forge/context/feedback";
+/**
+* The intake answers with the task it created.
+*
+* Web reaches it through the proxy registry, which unwraps `data` before the
+* caller sees it; this calls the gateway directly and does not, so both shapes
+* are read here rather than pinning the one that happens to arrive today.
+*/
+function readFeedbackId(response) {
+	if (!response || typeof response !== "object") return null;
+	const record = response;
+	const envelope = record["data"];
+	const id = (envelope && typeof envelope === "object" ? envelope : record)["id"];
+	if (typeof id === "number") return String(id);
+	if (typeof id === "string" && id.trim().length > 0) return id.trim();
+	return null;
+}
+/**
+* File feedback against the caller's own CMMD account.
+*
+* The session's CMMD JWT is what scopes it. A server with no CMMD connection
+* has nowhere to send feedback and says so in a sentence, because the caller
+* draws this text straight into the thread the person is looking at.
+*/
+function submitCmmdFeedbackForSession(input) {
+	return gen(function* () {
+		const jwt = yield* resolveCmmdJwtForSession({
+			sessionId: input.sessionId,
+			...input.subject === void 0 ? {} : { subject: input.subject },
+			logPrefix: "cmmd-feedback"
+		}).pipe(orElseSucceed(() => null));
+		if (!jwt) return {
+			ok: false,
+			reason: "This server is not connected to CMMD, so there is nowhere to send feedback."
+		};
+		const body = {
+			type: "bug",
+			title: input.title,
+			source: "forge",
+			priority: "medium",
+			...input.description ? { description: input.description } : {},
+			...input.senderName ? { senderName: input.senderName } : {}
+		};
+		const response = yield* tryPromise(() => cmmdGateway.request({
+			method: "POST",
+			jwt,
+			path: CMMD_FEEDBACK_PATH,
+			body
+		})).pipe(orElseSucceed(() => null));
+		if (response === null) return {
+			ok: false,
+			reason: "The feedback service did not accept the report. Please try again."
+		};
+		const feedbackId = readFeedbackId(response);
+		if (feedbackId === null) return {
+			ok: false,
+			reason: "The feedback service answered without recording a report."
+		};
+		return {
+			ok: true,
+			feedbackId
+		};
+	});
+}
+//#endregion
+//#region src/provider/threadFeedback.ts
+const FEEDBACK_TITLE_MAX_CHARS = 120;
+function firstLine(text) {
+	return text.split("\n", 1)[0]?.trim() ?? "";
+}
+function truncate$1(text, max) {
+	return text.length <= max ? text : `${text.slice(0, max - 1).trimEnd()}…`;
+}
+/**
+* A title someone triaging the intake can act on.
+*
+* What the person typed after `/feedback` first, because it is the only part
+* they wrote. The thread's title is the fallback, and a bare thread id is the
+* last resort, since a queue of "Forge feedback" rows tells a triager nothing.
+*/
+function feedbackTitle(input) {
+	const reason = input.reason ? firstLine(input.reason) : "";
+	if (reason.length > 0) return truncate$1(reason, FEEDBACK_TITLE_MAX_CHARS);
+	const threadTitle = input.threadTitle?.trim() ?? "";
+	if (threadTitle.length > 0) return truncate$1(`Forge feedback: ${threadTitle}`, FEEDBACK_TITLE_MAX_CHARS);
+	return truncate$1(`Forge feedback: thread ${input.threadId}`, FEEDBACK_TITLE_MAX_CHARS);
+}
+/** The body, which always names the thread so the report can be traced back to it. */
+function feedbackDescription(input) {
+	const lines = [`Filed from Forge thread \`${input.threadId}\`.`];
+	if (input.threadTitle?.trim()) lines.push(`Thread title: ${input.threadTitle.trim()}`);
+	if (input.reason?.trim()) lines.push("", input.reason.trim());
+	return lines.join("\n");
+}
+/**
+* `/feedback`, served.
+*
+* The vendored client declared this method and called it; Forge answered
+* nothing, so the slash command printed the transport's own "unknown request
+* tag" string into the thread. Routing it to the CMMD intake the web feedback
+* dialog already uses means one report format and one destination, whichever
+* surface it came from.
+*
+* Every failure carries a sentence rather than a cause, because the client
+* draws `message` straight into the thread as an assistant reply.
+*/
+const uploadThreadFeedback = (orchestrationEngine, sessionId, subject, input) => gen(function* () {
+	const threadTitle = (yield* orchestrationEngine.getReadModel().pipe(orElseSucceed(() => null)))?.threads.find((thread) => thread.id === input.threadId)?.title;
+	const outcome = yield* submitCmmdFeedbackForSession({
+		sessionId,
+		...subject === void 0 ? {} : { subject },
+		title: feedbackTitle({
+			...input,
+			threadId: input.threadId,
+			...threadTitle ? { threadTitle } : {}
+		}),
+		description: feedbackDescription({
+			...input,
+			threadId: input.threadId,
+			...threadTitle ? { threadTitle } : {}
+		})
+	});
+	if (!outcome.ok) return yield* new ProviderUploadFeedbackError({
+		threadId: input.threadId,
+		reason: outcome.reason
+	});
+	return { feedbackId: outcome.feedbackId };
+});
+//#endregion
 //#region src/cloudRuntime/listCloudRuntimes.ts
 /**
 * List the caller's Forge Cloud runtimes, through CMMD, as the caller.
@@ -87222,95 +87803,278 @@ function resolveGitHubCloneDir(baseDir, repoFullName, targetDir) {
 	const repoName = repoFullName.split("/")[1] ?? repoFullName;
 	return targetDir ?? join(baseDir, "Projects", repoName);
 }
-const githubCloneRouteLayer = add$1("POST", "/.well-known/forge/github/clone", gen(function* () {
-	const request = yield* HttpServerRequest;
-	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
-	const config = yield* ServerConfig;
-	if (session.method === "proxy-asserted") {
-		const forwardedJwt = normalizeForwardedCmmdJwt(request.headers);
-		if (forwardedJwt !== void 0) yield* setCommandJwtForSession(session.sessionId, forwardedJwt).pipe(ignore({ log: true }));
-	}
-	const runtimeGrantAuth = resolveRuntimeGitHubGrantAuth(config, request.headers);
-	const jwt = runtimeGrantAuth ? null : yield* resolveJwt(session.sessionId, session.subject);
-	if (!runtimeGrantAuth && !jwt) return json$6({ error: "CMMD not connected" }, 401);
-	const rawBody = yield* request.json;
-	const parsed = decodeUnknownExit(CloneBodySchema)(rawBody);
-	if (parsed._tag === "Failure") return json$6({ error: "repo_full_name is required" }, 400);
-	const { repo_full_name, target_dir } = parsed.value;
-	let token = yield* fetchInstallationTokenForAuth(runtimeGrantAuth ?? {
-		kind: "cmmd-jwt",
-		jwt
-	}, repo_full_name);
-	if (!runtimeGrantAuth && !token.ok && shouldRetryWithRefreshedCmmdJwt(token.status)) {
-		const refreshedJwt = yield* resolveJwt(session.sessionId, session.subject, true);
-		if (refreshedJwt && refreshedJwt !== jwt) token = yield* fetchInstallationTokenForAuth({
+/**
+* The public clone URLs for a repository.
+*
+* Never derived from an authenticated remote: `buildAuthenticatedRemoteUrl`
+* embeds an installation token in the URL, and a token that reaches a client is
+* a token that reaches wherever the client writes it down.
+*/
+function describeGitHubRepository(nameWithOwner) {
+	return {
+		nameWithOwner,
+		url: `https://github.com/${nameWithOwner}`,
+		sshUrl: `git@github.com:${nameWithOwner}.git`
+	};
+}
+/**
+* Resolve `owner/repo` against the repositories CMMD says this caller may use.
+*
+* This asks the same brokered listing the web repository picker is populated
+* from, rather than github.com directly, so "found" here means the same thing
+* it means everywhere else in Forge: CMMD will vend this caller a token for it.
+* A repository that exists but that the caller cannot reach is a 404, which is
+* the answer they can act on.
+*/
+function lookupGitHubRepositoryForSession(input) {
+	return gen(function* () {
+		const requested = input.repository.trim().replace(/^\/+|\/+$/g, "");
+		if (!/^[^/\s]+\/[^/\s]+$/.test(requested)) return {
+			status: 400,
+			repository: null,
+			error: "Enter a repository as owner/name."
+		};
+		const jwt = input.runtimeGrantAuth ? null : yield* resolveJwt(input.sessionId, input.subject);
+		if (!input.runtimeGrantAuth && !jwt) return {
+			status: 401,
+			repository: null,
+			error: "CMMD not connected"
+		};
+		const auth = input.runtimeGrantAuth ?? {
 			kind: "cmmd-jwt",
-			jwt: refreshedJwt
-		}, repo_full_name);
-	}
-	if (!token.ok) return json$6(gitHubTokenFailureBody(token.status, token.error), token.status);
-	const gitToken = token.token;
-	const cloneDir = resolveGitHubCloneDir(config.baseDir, repo_full_name, target_dir);
-	yield* promise(() => mkdir(join(cloneDir, ".."), { recursive: true }).catch(() => void 0));
-	if (existsSync(cloneDir)) {
-		const workTree = yield* promise(() => runProcess("git", [
+			jwt
+		};
+		const searchTerm = requested.split("/")[1] ?? requested;
+		let result = yield* promise(() => fetchGitHubReposForAuth(auth, {
+			search: searchTerm,
+			organizationId: input.organizationId ?? ""
+		}));
+		if (!input.runtimeGrantAuth && shouldRetryWithRefreshedCmmdJwt(result.status)) {
+			const refreshedJwt = yield* resolveJwt(input.sessionId, input.subject, true);
+			if (refreshedJwt && refreshedJwt !== jwt) result = yield* promise(() => fetchGitHubReposForAuth({
+				kind: "cmmd-jwt",
+				jwt: refreshedJwt
+			}, {
+				search: searchTerm,
+				organizationId: input.organizationId ?? ""
+			}));
+		}
+		if (result.status !== 200) {
+			const body = result.body;
+			return {
+				status: result.status,
+				repository: null,
+				error: typeof body.error === "string" ? body.error : "GitHub repositories are unavailable."
+			};
+		}
+		const match = selectGitHubRepositoryMatch(result.body, requested);
+		if (match === null) return {
+			status: 404,
+			repository: null,
+			error: `Repository ${requested} was not found in the GitHub accounts connected to Forge.`
+		};
+		return {
+			status: 200,
+			repository: describeGitHubRepository(match),
+			error: null
+		};
+	});
+}
+/**
+* Find the one repository in a brokered listing whose full name is the one
+* asked for.
+*
+* Exact and case-insensitive. The listing is a *search*, so it comes back with
+* near misses in it: asking for `owner/forge` and being handed `someone-else/
+* forge` because it sorted first is how a person ends up cloning a stranger's
+* repository, and a prefix match would do exactly that.
+*/
+function selectGitHubRepositoryMatch(body, requested) {
+	const repos = body?.repos ?? [];
+	const wanted = requested.trim().toLowerCase();
+	for (const repo of repos) if (typeof repo.full_name === "string" && repo.full_name.toLowerCase() === wanted) return repo.full_name;
+	return null;
+}
+/**
+* The repository a clone request is really for, or `null` if there is not one.
+*
+* A caller may name `owner/repo`, or paste a clone URL and let the server work
+* it out. Anything that does not resolve to a GitHub repository returns `null`
+* and must be refused rather than cloned: Forge clones through a CMMD-brokered
+* installation token for a named repository, and "just run `git clone` on this
+* URL instead" would be a second, unbrokered way to write to disk.
+*/
+function resolveGitHubCloneTarget(input) {
+	const named = input.repository?.trim();
+	if (named && /^[^/\s]+\/[^/\s]+$/.test(named)) return named;
+	if (named) return null;
+	const remoteUrl = input.remoteUrl?.trim();
+	return remoteUrl ? parseRepoFullNameFromRemoteUrl(remoteUrl) : null;
+}
+/**
+* Clone `repoFullName` for an authenticated session.
+*
+* Authorization is the caller's own CMMD connection: the session's JWT (or a
+* runtime grant, when this VM is running under one) is exchanged with CMMD for
+* an installation token scoped to that one repository. A session with no CMMD
+* connection gets 401 and no clone; a repository CMMD will not issue a token
+* for gets CMMD's own refusal, not a `git clone` attempt.
+*/
+function runGitHubCloneForSession(input) {
+	return gen(function* () {
+		const { config, repoFullName, targetDir } = input;
+		const token = yield* acquireInstallationTokenForSession(input);
+		if (!token.ok) return token.outcome;
+		const cloneDir = resolveGitHubCloneDir(config.baseDir, repoFullName, targetDir);
+		yield* promise(() => mkdir(join(cloneDir, ".."), { recursive: true }).catch(() => void 0));
+		const target = {
+			cloneDir,
+			repoFullName,
+			token: token.token,
+			config
+		};
+		return existsSync(cloneDir) ? yield* adoptExistingGitHubClone(target) : yield* cloneGitHubRepositoryInto(target);
+	});
+}
+/**
+* The installation token for one repository, on the caller's own authority.
+*
+* A runtime grant is used as-is. A session resolves its CMMD JWT and retries
+* once with a refreshed one when CMMD answers 401 or 403, because the cached
+* JWT may simply have expired. The failure branch is already the HTTP outcome,
+* so a caller returns it rather than translating it.
+*/
+function acquireInstallationTokenForSession(input) {
+	return gen(function* () {
+		const { runtimeGrantAuth, repoFullName } = input;
+		const jwt = runtimeGrantAuth ? null : yield* resolveJwt(input.sessionId, input.subject);
+		if (!runtimeGrantAuth && !jwt) return {
+			ok: false,
+			outcome: {
+				status: 401,
+				body: { error: "CMMD not connected" }
+			}
+		};
+		let token = yield* fetchInstallationTokenForAuth(runtimeGrantAuth ?? {
+			kind: "cmmd-jwt",
+			jwt
+		}, repoFullName);
+		if (!runtimeGrantAuth && !token.ok && shouldRetryWithRefreshedCmmdJwt(token.status)) {
+			const refreshedJwt = yield* resolveJwt(input.sessionId, input.subject, true);
+			if (refreshedJwt && refreshedJwt !== jwt) token = yield* fetchInstallationTokenForAuth({
+				kind: "cmmd-jwt",
+				jwt: refreshedJwt
+			}, repoFullName);
+		}
+		if (!token.ok) return {
+			ok: false,
+			outcome: {
+				status: token.status,
+				body: gitHubTokenFailureBody(token.status, token.error)
+			}
+		};
+		return {
+			ok: true,
+			token: token.token
+		};
+	});
+}
+/**
+* A directory already sits where the clone would go. Adopt it when it is a
+* checkout of the same repository, so a second "add project" is a no-op with
+* fresh credentials rather than a failure; refuse otherwise, naming the
+* folder, because overwriting it would destroy something the person made.
+*/
+function adoptExistingGitHubClone(target) {
+	return gen(function* () {
+		const { cloneDir, repoFullName } = target;
+		const git = (args) => promise(() => runProcess("git", [
 			"-C",
 			cloneDir,
-			"rev-parse",
-			"--is-inside-work-tree"
+			...args
 		], {
 			timeoutMs: 1e4,
 			allowNonZeroExit: true,
 			env: process.env
 		}));
-		const remote = yield* promise(() => runProcess("git", [
-			"-C",
-			cloneDir,
+		const workTree = yield* git(["rev-parse", "--is-inside-work-tree"]);
+		const remote = yield* git([
 			"remote",
 			"get-url",
 			"origin"
-		], {
-			timeoutMs: 1e4,
-			allowNonZeroExit: true,
-			env: process.env
-		}));
-		if (workTree.code === 0 && workTree.stdout.trim() === "true" && remote.code === 0 && isGitHubRemoteForRepo(remote.stdout.trim(), repo_full_name)) {
-			yield* applyGitCredentials({
-				cloneDir,
-				repoFullName: repo_full_name,
-				token: gitToken,
-				mode: config.forgeGitCredentialCache ? "cache" : "embed"
-			});
-			return json$6({
+		]);
+		if (!(workTree.code === 0 && workTree.stdout.trim() === "true" && remote.code === 0 && isGitHubRemoteForRepo(remote.stdout.trim(), repoFullName))) return {
+			status: 409,
+			body: {
+				error: "A project folder with that name already exists, but it is not the selected GitHub repository. Rename the import, remove the VM folder, or choose a different repository.",
+				local_path: cloneDir
+			}
+		};
+		yield* applyGitCredentialsFor(target);
+		return {
+			status: 200,
+			body: {
 				local_path: cloneDir,
 				existing: true
-			});
-		}
-		return json$6({
-			error: "A project folder with that name already exists, but it is not the selected GitHub repository. Rename the import, remove the VM folder, or choose a different repository.",
-			local_path: cloneDir
-		}, 409);
-	}
-	const result = yield* promise(() => runProcess("git", buildAuthenticatedGitCloneArgs(repo_full_name, cloneDir), {
-		timeoutMs: 12e4,
-		allowNonZeroExit: true,
-		env: {
-			...process.env,
-			CMMD_FORGE_GIT_TOKEN: gitToken,
-			GIT_TERMINAL_PROMPT: "0"
+			}
+		};
+	});
+}
+function cloneGitHubRepositoryInto(target) {
+	return gen(function* () {
+		const { cloneDir, repoFullName, token } = target;
+		const result = yield* promise(() => runProcess("git", buildAuthenticatedGitCloneArgs(repoFullName, cloneDir), {
+			timeoutMs: 12e4,
+			allowNonZeroExit: true,
+			env: {
+				...process.env,
+				CMMD_FORGE_GIT_TOKEN: token,
+				GIT_TERMINAL_PROMPT: "0"
+			}
+		}));
+		if (result.code !== 0) {
+			const stderr = sanitizeGitCredentialText(result.stderr).trim().slice(0, 500);
+			return {
+				status: 500,
+				body: { error: `git clone failed${stderr.length > 0 ? `: ${stderr}` : ""}` }
+			};
 		}
-	}));
-	if (result.code !== 0) {
-		const stderr = sanitizeGitCredentialText(result.stderr).trim().slice(0, 500);
-		return json$6({ error: `git clone failed${stderr.length > 0 ? `: ${stderr}` : ""}` }, 500);
+		yield* applyGitCredentialsFor(target);
+		return {
+			status: 200,
+			body: { local_path: cloneDir }
+		};
+	});
+}
+function applyGitCredentialsFor(target) {
+	return applyGitCredentials({
+		cloneDir: target.cloneDir,
+		repoFullName: target.repoFullName,
+		token: target.token,
+		mode: target.config.forgeGitCredentialCache ? "cache" : "embed"
+	});
+}
+const githubCloneRouteLayer = add$1("POST", "/.well-known/forge/github/clone", gen(function* () {
+	const request = yield* HttpServerRequest;
+	const session = yield* (yield* ServerAuth).authenticateHttpRequest(request);
+	const config = yield* ServerConfig;
+	if (session.method === "proxy-asserted") {
+		const forwardedJwt = normalizeForwardedCmmdJwt(request.headers);
+		if (forwardedJwt !== void 0) yield* setCommandJwtForSession(session.sessionId, forwardedJwt).pipe(ignore({ log: true }));
 	}
-	yield* applyGitCredentials({
-		cloneDir,
+	const rawBody = yield* request.json;
+	const parsed = decodeUnknownExit(CloneBodySchema)(rawBody);
+	if (parsed._tag === "Failure") return json$6({ error: "repo_full_name is required" }, 400);
+	const { repo_full_name, target_dir } = parsed.value;
+	const outcome = yield* runGitHubCloneForSession({
+		config,
+		sessionId: session.sessionId,
+		subject: session.subject,
+		runtimeGrantAuth: resolveRuntimeGitHubGrantAuth(config, request.headers),
 		repoFullName: repo_full_name,
-		token: gitToken,
-		mode: config.forgeGitCredentialCache ? "cache" : "embed"
+		targetDir: target_dir
 	});
-	return json$6({ local_path: cloneDir });
+	return json$6(outcome.body, outcome.status);
 }).pipe(catchTag("AuthError", respondToAuthError)));
 const githubCloneJobStartRouteLayer = add$1("POST", "/.well-known/forge/github/clone-jobs", gen(function* () {
 	const request = yield* HttpServerRequest;
@@ -92073,7 +92837,7 @@ const launchDetached = (launch) => gen(function* () {
 });
 const OpenLive = effect(Open, gen(function* () {
 	const open = yield* tryPromise({
-		try: () => import("./open-FIgTDosf.mjs"),
+		try: () => import("./open-D8mGyWmt.mjs"),
 		catch: (cause) => new OpenError$1({
 			message: "failed to load browser opener",
 			cause
@@ -95829,33 +96593,34 @@ function serializeNativeToolActivity(activity) {
 		}
 	};
 }
-/** The failure activities `appendProviderFailureActivity` emits, all `provider.*.failed`. */
-function isProviderFailureActivity(activity) {
-	return activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
+function isReplicatedFailureActivity(activity) {
+	return activity.kind === "runtime.error" || activity.kind.startsWith("provider.") && activity.kind.endsWith(".failed");
 }
 function failureDetail(activity) {
 	const payload = activity.payload;
-	if (!payload || typeof payload !== "object" || !("detail" in payload)) return null;
-	const detail = payload.detail;
-	return typeof detail === "string" && detail.trim() ? detail.trim() : null;
+	if (!payload || typeof payload !== "object") return null;
+	const record = payload;
+	const detail = typeof record.detail === "string" ? record.detail.trim() : "";
+	if (detail) return detail;
+	return (typeof record.message === "string" ? record.message.trim() : "") || null;
 }
 /**
 * Replicates why a turn failed.
 *
-* Without this a failure never crossed the replication boundary — only `tool.`
-* activities were serialized — so durable history could not show one and every
+* Without this a failure never crossed the replication boundary. Only `tool.`
+* activities were serialized, so durable history could not show one and every
 * failure reached the user as an endless "Working" spinner. Measured in
 * production on 2026-08-30: zero failure events had EVER been recorded against
 * 652 tool_call rows, which is how a workspace-path block, a broker-token
 * refusal and a dispatch into a deleted directory all looked identical.
 *
-* `error_summary` is used rather than a new kind because both the Forge
-* protocol and CMMD's ingest schema already accept it; nothing here needed a
-* contract change. The detail carries the actionable sentence, so it is joined
-* onto the summary — the event has no separate detail field.
+* `error_summary` is used because both the Forge protocol and CMMD's ingest
+* schema already accept it. Provider startup failures store `detail`, while
+* active runtime failures store `message`. The event has no separate detail
+* field, so either value is joined onto the summary.
 */
-function serializeProviderFailureActivity(activity) {
-	if (!isProviderFailureActivity(activity)) return null;
+function serializeFailureActivity(activity) {
+	if (!isReplicatedFailureActivity(activity)) return null;
 	const summary = text(activity.summary, 4e3);
 	if (summary === null) return null;
 	const detail = failureDetail(activity);
@@ -96197,7 +96962,7 @@ function isTurnUsageTokens(value) {
 function serializeRuntimeThreadEvents(thread) {
 	const messages = thread.messages.flatMap(serializeThreadMessage);
 	const failureActivities = thread.activities.flatMap((activity) => {
-		const event = serializeProviderFailureActivity(activity);
+		const event = serializeFailureActivity(activity);
 		return event === null ? [] : [event];
 	});
 	const replicaActivities = thread.activities.flatMap((activity) => {
@@ -100459,6 +101224,31 @@ function claudeWriteToken(env = process.env) {
 	return accessor.read(env);
 }
 //#endregion
+//#region ../../packages/shared/src/claudeReadinessReason.ts
+/**
+* The reason literals Forge acts on, confirmed against CMMD-36441's readiness
+* service. If the route renames one, the rename lands here as a fall-through
+* to null, never as the wrong kind.
+*
+* Reading the reason is what makes `stale` legible. CMMD-36441 answers
+* `credential_reconnect_required` on a `stale` answer that still reports
+* `connected: true`, and the older `credential_generation_not_applied` on a
+* `stale` answer that simply has not landed yet. Those want opposite
+* handling, and both used to get "Reconnect Claude in Settings" because the
+* guard read only the delivery status.
+*/
+const CODE_BY_UPSTREAM_REASON$1 = {
+	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
+	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
+	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
+	runtime_unavailable: "RUNTIME_UNAVAILABLE"
+};
+function claudeReadinessReasonCode(reason) {
+	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
+	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
+}
+//#endregion
 //#region src/egress/providerDeliveryReceipt.ts
 const PROVIDER_ACCOUNT_IDENTITY$2 = /^pai_v1_[A-Za-z0-9_-]{43}$/;
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
@@ -100633,82 +101423,6 @@ function providerDeliveryBindingsEqual(left, right) {
 	return classifyProviderDeliveryBindingChange(left, right) === "unchanged";
 }
 //#endregion
-//#region src/provider/claudeReadinessReason.ts
-/**
-* The reason literals Forge has copy for, confirmed against CMMD-36441's
-* readiness service. If the route renames one, the rename lands here as a
-* fall-through to the generic sentence, never as a wrong sentence.
-*
-* Reading the reason is what makes `stale` legible. CMMD-36441 answers
-* `credential_reconnect_required` on a `stale` answer that still reports
-* `connected: true`, and the older `credential_generation_not_applied` on a
-* `stale` answer that simply has not landed yet. Those want opposite
-* sentences, and both used to get "Reconnect Claude in Settings" because the
-* guard read only the delivery status.
-*/
-const CODE_BY_UPSTREAM_REASON$1 = {
-	credential_expired_refreshing: "CREDENTIAL_EXPIRED_REFRESHING",
-	credential_reconnect_required: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_not_connected: "CREDENTIAL_RECONNECT_REQUIRED",
-	credential_generation_not_applied: "CREDENTIAL_GENERATION_NOT_APPLIED",
-	runtime_unavailable: "RUNTIME_UNAVAILABLE"
-};
-const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
-/**
-* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
-* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
-* time is the only part of that sentence Forge repeats.
-*/
-const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
-function claudeReadinessReasonCode(reason) {
-	if (typeof reason !== "string" || !Object.hasOwn(CODE_BY_UPSTREAM_REASON$1, reason)) return null;
-	return CODE_BY_UPSTREAM_REASON$1[reason] ?? null;
-}
-function expiredAtFromReadinessMessage(message) {
-	if (typeof message !== "string") return null;
-	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
-}
-function claudeCredentialExpiredTurnCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
-}
-function claudeCredentialExpiredCardCopy(expiredAt) {
-	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
-}
-/**
-* The last allowlisted readiness reason this process saw.
-*
-* A server process serves exactly one runtime, so one slot is the whole store.
-* It holds a reason code and a timestamp, never credential bytes. The provider
-* catalog reads a local credential file and cannot tell an expired snapshot
-* from a blank one, so without this the card can only offer the generic
-* sentence while the guard already knows better.
-*/
-let latestVerdict = null;
-/**
-* Remember, or clear, what the readiness answer said.
-*
-* An answer carrying no allowlisted reason clears the slot, which is what makes
-* the card go back to the generic sentence the moment CMMD applies a
-* credential: an applied answer carries no reason.
-*/
-function recordClaudeReadinessVerdict(readiness) {
-	const code = claudeReadinessReasonCode(readiness.reason);
-	latestVerdict = code === null ? null : {
-		code,
-		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
-	};
-}
-/**
-* What the provider status card says about a delivered credential it cannot
-* use. Names the expiry only when a readiness answer supplied the time; a
-* guessed time would be worse than the generic sentence.
-*/
-function claudeNativeCredentialUnusableMessage() {
-	const verdict = latestVerdict;
-	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
-	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
-}
-//#endregion
 //#region src/provider/providerReadiness.ts
 const GENERATION_HASH_PATTERN$1 = /^[a-f0-9]{64}$/;
 const STILL_APPLYING_STATUSES = new Set([
@@ -100753,10 +101467,18 @@ async function queryProviderReadiness(input) {
 	}
 	return classifyClaudeSnapshot(snapshot, sprite);
 }
-function isAppliedClaudeSnapshot(snapshot) {
-	return snapshot.connected === true && snapshot.deliveryStatus === "applied" && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
+/**
+* Whether CMMD allows a turn to start on this runtime. The delivery status is
+* not part of it: a refresh that failed over a credential the guest verified
+* and that has not expired reads as failed with nativeExecutable true, and the
+* turn is the probe (FOR-3085). The generation fence and the receipt below
+* still bind the answer.
+*/
+function claudeSnapshotAllowsTurn(snapshot) {
+	return snapshot.connected === true && snapshot.nativeExecutable === true && typeof snapshot.generationId === "string" && snapshot.generationId.trim().length > 0;
 }
-function classifyUnappliedClaudeSnapshot(snapshot) {
+/** Why a turn may not start, for an answer that does not allow one. */
+function classifyClaudeTurnRefusal(snapshot) {
 	const code = claudeReadinessReasonCode(snapshot.reason);
 	if (code === "RUNTIME_UNAVAILABLE") return {
 		kind: "not_ready",
@@ -100784,7 +101506,7 @@ function classifyUnappliedClaudeSnapshot(snapshot) {
 	};
 }
 function classifyClaudeSnapshot(snapshot, sprite) {
-	if (!isAppliedClaudeSnapshot(snapshot)) return classifyUnappliedClaudeSnapshot(snapshot);
+	if (!claudeSnapshotAllowsTurn(snapshot)) return classifyClaudeTurnRefusal(snapshot);
 	const generationId = snapshot.generationId.trim();
 	if (createHash("sha256").update(generationId).digest("hex") !== sprite.localGenerationHash) return {
 		kind: "not_ready",
@@ -104126,7 +104848,9 @@ const REJECT_UNCERTAIN_METHODS = new Set([
 	WS_METHODS.pullRequestsComment,
 	WS_METHODS.pullRequestsSubmitReview,
 	WS_METHODS.pullRequestsReplyToThread,
-	WS_METHODS.projectCheckoutDeletionExecute
+	WS_METHODS.projectCheckoutDeletionExecute,
+	WS_METHODS.providerUploadFeedback,
+	WS_METHODS.sourceControlCloneRepository
 ]);
 function classifyInterruptedRelayCommand(input) {
 	if ((input.method === WS_METHODS.gitCreateBranch || input.method === WS_METHODS.vcsCreateRef) && input.deliveryClass === "create-command") return { kind: "reconcile-git-create-branch" };
@@ -105056,7 +105780,77 @@ const makeWsRpcLayer = (currentSessionId, currentUserId) => WsRpcGroup.toLayer(g
 				payload: initialSnapshot
 			}), liveEvents);
 		}), { "rpc.aggregate": "auth" }),
-		[WS_METHODS.subscribeWorkspaceReadiness]: (_input) => currentUserId === void 0 ? empty$5 : workspaceReadinessState.subscribe(currentUserId)
+		[WS_METHODS.subscribeWorkspaceReadiness]: (_input) => currentUserId === void 0 ? empty$5 : workspaceReadinessState.subscribe(currentUserId),
+		[WS_METHODS.assetsCreateUrl]: (input) => observeRpcEffect(WS_METHODS.assetsCreateUrl, createAssetUrl(currentSessionId, input.resource), { "rpc.aggregate": "assets" }),
+		[WS_METHODS.providerUploadFeedback]: (input) => observeRpcEffect(WS_METHODS.providerUploadFeedback, uploadThreadFeedback(orchestrationEngine, currentSessionId, currentUserId, input), { "rpc.aggregate": "provider" }),
+		[ORCHESTRATION_WS_METHODS.searchThreads]: (input) => observeRpcEffect(ORCHESTRATION_WS_METHODS.searchThreads, gen(function* () {
+			yield* startup.awaitCommandReady;
+			return yield* projectionSnapshotQuery.searchThreads(input);
+		}).pipe(mapError((cause) => new OrchestrationSearchThreadsError({
+			message: "Failed to search threads",
+			cause
+		}))), { "rpc.aggregate": "orchestration" }),
+		[WS_METHODS.sourceControlLookupRepository]: (input) => observeRpcEffect(WS_METHODS.sourceControlLookupRepository, gen(function* () {
+			if (input.provider !== "github") return yield* new SourceControlRepositoryError({
+				provider: input.provider,
+				operation: "lookupRepository",
+				detail: `Forge can only look up GitHub repositories. ${input.provider} is not connected.`
+			});
+			if (currentUserId === void 0) return yield* new SourceControlRepositoryError({
+				provider: "github",
+				operation: "lookupRepository",
+				detail: "Sign in to Forge before looking up a repository."
+			});
+			const outcome = yield* lookupGitHubRepositoryForSession({
+				sessionId: currentSessionId,
+				subject: currentUserId,
+				runtimeGrantAuth: null,
+				repository: input.repository
+			});
+			if (outcome.repository === null) return yield* new SourceControlRepositoryError({
+				provider: "github",
+				operation: "lookupRepository",
+				detail: outcome.error ?? "Repository lookup failed."
+			});
+			return {
+				provider: "github",
+				...outcome.repository
+			};
+		}), { "rpc.aggregate": "sourceControl" }),
+		[WS_METHODS.sourceControlCloneRepository]: (input) => observeRpcEffect(WS_METHODS.sourceControlCloneRepository, gen(function* () {
+			const provider = input.provider ?? "github";
+			const repoFullName = resolveGitHubCloneTarget(input);
+			const refuse = (detail) => new SourceControlRepositoryError({
+				provider,
+				operation: "cloneRepository",
+				detail
+			});
+			if (provider !== "github") return yield* refuse(`Forge can only clone GitHub repositories. ${provider} is not connected.`);
+			if (currentUserId === void 0) return yield* refuse("Sign in to Forge before cloning a repository.");
+			if (repoFullName === null) return yield* refuse("Name the repository as owner/name, or paste a github.com clone URL.");
+			const outcome = yield* runGitHubCloneForSession({
+				config,
+				sessionId: currentSessionId,
+				subject: currentUserId,
+				runtimeGrantAuth: null,
+				repoFullName,
+				targetDir: input.destinationPath
+			});
+			const localPath = outcome.body.local_path;
+			if (outcome.status !== 200 || typeof localPath !== "string") {
+				const detail = outcome.body.error;
+				return yield* refuse(typeof detail === "string" ? detail : "Cloning the repository failed.");
+			}
+			const repository = describeGitHubRepository(repoFullName);
+			return {
+				cwd: localPath,
+				remoteUrl: repository.url,
+				repository: {
+					provider: "github",
+					...repository
+				}
+			};
+		}), { "rpc.aggregate": "sourceControl" })
 	});
 }));
 const websocketRpcRouteLayer = unwrap(succeed(mergeAll(add$1("GET", "/ws", gen(function* () {
@@ -116133,8 +116927,8 @@ effectDiscard(runMigrations());
 //#endregion
 //#region src/persistence/Layers/Sqlite.ts
 const defaultSqliteClientLoaders = {
-	bun: () => import("./SqliteClient-CIsITMoQ.mjs"),
-	node: () => import("./NodeSqliteClient-DGInbxQ3.mjs")
+	bun: () => import("./SqliteClient-DTWCGkrj.mjs"),
+	node: () => import("./NodeSqliteClient-DqFjB3u_.mjs")
 };
 const makeRuntimeSqliteLayer = fn$1("makeRuntimeSqliteLayer")(function* (config) {
 	const loader = defaultSqliteClientLoaders[process.versions.bun !== void 0 ? "bun" : "node"];
@@ -188985,7 +189779,7 @@ var Vce = {
 function Ve() {
 	return Vce;
 }
-var Us = os.homedir(), lk = os.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
+var Us = $U.homedir(), lk = $U.tmpdir(), { env: Vc } = process$1, Yce = (e) => {
 	let t = path.join(Us, "Library");
 	return {
 		data: path.join(t, "Application Support", e),
@@ -199185,12 +199979,12 @@ function qZ(e, t) {
 	}
 	return n;
 }
-var os$2 = "https://code.claude.com/docs/en", kKe = [
+var os$1 = "https://code.claude.com/docs/en", kKe = [
 	{
 		matches: (e) => e.path === "permissions.defaultMode" && e.code === "invalid_value",
 		tip: {
 			suggestion: "Valid modes: \"acceptEdits\" (ask before file changes), \"plan\" (analysis only), \"bypassPermissions\" (auto-accept all), or \"default\" (standard behavior)",
-			docLink: `${os$2}/iam#permission-modes`
+			docLink: `${os$1}/iam#permission-modes`
 		}
 	},
 	{
@@ -199205,7 +199999,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("env.") && e.code === "invalid_type",
 		tip: {
 			suggestion: "Environment variables must be strings. Wrap numbers and booleans in quotes. Example: \"DEBUG\": \"true\", \"PORT\": \"3000\"",
-			docLink: `${os$2}/settings#environment-variables`
+			docLink: `${os$1}/settings#environment-variables`
 		}
 	},
 	{
@@ -199216,14 +200010,14 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path.startsWith("hooks.") && e.code === "invalid_key",
 		tip: {
 			suggestion: "Not a recognized hook event. Common events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, Stop. Check spelling and capitalization.",
-			docLink: `${os$2}/hooks`
+			docLink: `${os$1}/hooks`
 		}
 	},
 	{
 		matches: (e) => /\.hooks\.\d+\.command$/.test(e.path) && e.code === "invalid_type" && e.received === "undefined",
 		tip: {
 			suggestion: "Command hooks require `command`. For exec form (no shell), set `command` to the executable and `args` to its arguments: {\"type\": \"command\", \"command\": \"echo\", \"args\": [\"hi\"]}. For shell form, set `command` to the full shell string: {\"type\": \"command\", \"command\": \"echo hi\"}.",
-			docLink: `${os$2}/hooks#exec-form-and-shell-form`
+			docLink: `${os$1}/hooks#exec-form-and-shell-form`
 		}
 	},
 	{
@@ -199238,7 +200032,7 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.code === "unrecognized_keys",
 		tip: {
 			suggestion: "Check for typos or refer to the documentation for valid fields",
-			docLink: `${os$2}/settings`
+			docLink: `${os$1}/settings`
 		}
 	},
 	{
@@ -199253,13 +200047,13 @@ var os$2 = "https://code.claude.com/docs/en", kKe = [
 		matches: (e) => e.path === "permissions.additionalDirectories" && e.code === "invalid_type",
 		tip: {
 			suggestion: "Must be an array of directory paths. Example: [\"~/projects\", \"/tmp/workspace\"]. You can also use --add-dir flag or /add-dir command",
-			docLink: `${os$2}/iam#working-directories`
+			docLink: `${os$1}/iam#working-directories`
 		}
 	}
 ], AKe = {
-	permissions: `${os$2}/iam#configuring-permissions`,
-	env: `${os$2}/settings#environment-variables`,
-	hooks: `${os$2}/hooks`
+	permissions: `${os$1}/iam#configuring-permissions`,
+	env: `${os$1}/settings#environment-variables`,
+	hooks: `${os$1}/hooks`
 };
 function GZ(e) {
 	let t = kKe.find((r) => r.matches(e));
@@ -211320,6 +212114,83 @@ const makeProviderAuthProvenance = (input) => {
 	};
 };
 //#endregion
+//#region src/provider/claudeReadinessReason.ts
+/**
+* What Forge says about a delivered Claude credential that expired.
+*
+* CMMD's credential authority rotates the refresh token on every refresh, and a
+* runtime holds a one-time snapshot, so the snapshot's refresh token dies at
+* the next rotation. Nothing re-delivers on its own, and on 2026-09-04 23:07Z
+* the turn met a dead credential: the CLI said "OAuth session expired and could
+* not be refreshed", the thread said Claude was unavailable on this
+* Environment, and the provider card said the credential was "unavailable or
+* unusable". Three sentences, none of them the fact, which is that the
+* credential expired at a known time and a replacement is on its way.
+*
+* CMMD-36441 now answers the pre-turn readiness read with a typed reason and
+* queues a same-generation re-delivery. This module is the one place that
+* turns those reasons into words.
+*
+* Which kind of answer a reason names comes from
+* `@cmmd-forge/shared/claudeReadinessReason`, which the browser readiness poll
+* reads too, so the two cannot disagree about a reason (FOR-3085). A reason
+* that maps to nothing falls through to the generic copy, and every sentence a
+* person reads is written here rather than forwarded from upstream. Only an
+* ISO timestamp is ever lifted out of CMMD's message, so no credential detail
+* in an upstream string can reach a browser.
+*/
+const CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY = "The delivered Claude credential is unavailable or unusable in this runtime.";
+/**
+* An ISO 8601 instant, with or without fractional seconds, UTC or offset.
+* Anchored to nothing on purpose: CMMD wraps the time in a sentence, and the
+* time is the only part of that sentence Forge repeats.
+*/
+const ISO_INSTANT_PATTERN = /\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})/;
+function expiredAtFromReadinessMessage(message) {
+	if (typeof message !== "string") return null;
+	return ISO_INSTANT_PATTERN.exec(message)?.[0] ?? null;
+}
+function claudeCredentialExpiredTurnCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one, so retry this turn in a moment.`;
+}
+function claudeCredentialExpiredCardCopy(expiredAt) {
+	return `The delivered Claude credential expired at ${expiredAt}. CMMD is delivering a refreshed one to this runtime.`;
+}
+/**
+* The last allowlisted readiness reason this process saw.
+*
+* A server process serves exactly one runtime, so one slot is the whole store.
+* It holds a reason code and a timestamp, never credential bytes. The provider
+* catalog reads a local credential file and cannot tell an expired snapshot
+* from a blank one, so without this the card can only offer the generic
+* sentence while the guard already knows better.
+*/
+let latestVerdict = null;
+/**
+* Remember, or clear, what the readiness answer said.
+*
+* An answer carrying no allowlisted reason clears the slot, which is what makes
+* the card go back to the generic sentence the moment CMMD applies a
+* credential: an applied answer carries no reason.
+*/
+function recordClaudeReadinessVerdict(readiness) {
+	const code = claudeReadinessReasonCode(readiness.reason);
+	latestVerdict = code === null ? null : {
+		code,
+		expiredAt: expiredAtFromReadinessMessage(readiness.lastErrorMessage)
+	};
+}
+/**
+* What the provider status card says about a delivered credential it cannot
+* use. Names the expiry only when a readiness answer supplied the time; a
+* guessed time would be worse than the generic sentence.
+*/
+function claudeNativeCredentialUnusableMessage() {
+	const verdict = latestVerdict;
+	if (verdict?.code === "CREDENTIAL_EXPIRED_REFRESHING" && verdict.expiredAt !== null) return claudeCredentialExpiredCardCopy(verdict.expiredAt);
+	return CLAUDE_NATIVE_CREDENTIAL_UNUSABLE_COPY;
+}
+//#endregion
 //#region src/provider/claudeCredentialStore.ts
 /**
 * Which Credential Store the Claude CLI uses on this machine, read the way the
@@ -265879,7 +266750,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 	var dgram = __require("dgram");
 	var thunky = require_thunky();
 	var events = __require("events");
-	var os$1 = __require("os");
+	var os = __require("os");
 	var noop = function() {};
 	module.exports = function(opts) {
 		if (!opts) opts = {};
@@ -266010,14 +266881,14 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return that;
 	};
 	function defaultInterface() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		for (var i = 0; i < names.length; i++) {
 			var net = networks[names[i]];
 			for (var j = 0; j < net.length; j++) {
 				var iface = net[j];
 				if (isIPv4(iface.family) && !iface.internal) {
-					if (os$1.platform() === "darwin" && names[i] === "en0") return iface.address;
+					if (os.platform() === "darwin" && names[i] === "en0") return iface.address;
 					return "0.0.0.0";
 				}
 			}
@@ -266025,7 +266896,7 @@ var import_multicast_dns = /* @__PURE__ */ __toESM((/* @__PURE__ */ __commonJSMi
 		return "127.0.0.1";
 	}
 	function allInterfaces() {
-		var networks = os$1.networkInterfaces();
+		var networks = os.networkInterfaces();
 		var names = Object.keys(networks);
 		var res = [];
 		for (var i = 0; i < names.length; i++) {
@@ -286917,6 +287788,7 @@ function taskStartedToActivities(event) {
 		summary: taskStartedSummary(event.payload.taskType),
 		payload: {
 			taskId: event.payload.taskId,
+			agentKind: classifyTaskAgentKind({ taskType: event.payload.taskType }),
 			...event.payload.taskType ? { taskType: event.payload.taskType } : {},
 			...event.payload.description ? { detail: truncateDetail(event.payload.description) } : {}
 		}
@@ -294724,7 +295596,7 @@ function resolveBuildCommitFromEnv(env) {
 * environment descriptor down instead of reporting an honest "unknown".
 */
 function readBakedBuildCommit() {
-	return "69affcc8397652715f8bd06fe2f226f4b607e1db";
+	return "c220fa73834b4651c7fc65f272c171028edc3e81";
 }
 async function resolveServerBuildCommit(input) {
 	if (isFullCommitSha(input.baked)) return input.baked;
@@ -294841,6 +295713,7 @@ function executionEnvironmentCapabilities(serverConfig) {
 		pullRequests: isExecutionPlane,
 		threadPullRequestLinking: isExecutionPlane,
 		threadSettlement: isExecutionPlane,
+		threadTitleRegeneration: isExecutionPlane,
 		cloudMode: serverConfig.forgeCmmdRuntimeMode === true || isCloudShell,
 		runtime: {
 			topology: runtimeTopology(serverConfig),
@@ -295119,10 +295992,6 @@ const pulseSignalStateUpsertRouteLayer = add$1("POST", "/api/pulse/signals/state
 	});
 }).pipe(catchTag("AuthError", respondToAuthError)));
 //#endregion
-//#region src/auth/Services/ServerSecretStore.ts
-var SecretStoreError = class extends TaggedError("SecretStoreError") {};
-var ServerSecretStore = class extends Service$1()("forge/auth/Services/ServerSecretStore") {};
-//#endregion
 //#region src/auth/Layers/ServerSecretStore.ts
 const OWNED_FILE_RECEIPT_PREFIX = "forge-owned-secret-receipt:v1:";
 const LEGACY_FILE_SECRET_NAMESPACE_PREFIX = "forge-secret-namespace:v1:";
@@ -301461,6 +302330,55 @@ const ProjectionCountsRowSchema = Struct({
 const WorkspaceRootLookupInput = Struct({ workspaceRoot: String$1 });
 const ProjectIdLookupInput = Struct({ projectId: ProjectId });
 const ThreadIdLookupInput = Struct({ threadId: ThreadId });
+const ThreadSearchQueryInput = Struct({
+	pattern: String$1,
+	limit: Number$1
+});
+const ThreadSearchMessageRowSchema = Struct({
+	threadId: ThreadId,
+	projectId: ProjectId,
+	role: String$1,
+	text: String$1,
+	createdAt: IsoDateTime
+});
+const ThreadSearchMetadataRowSchema = Struct({
+	threadId: ThreadId,
+	projectId: ProjectId,
+	title: String$1,
+	branch: NullOr(String$1)
+});
+/** The contract caps a snippet at this length, so the server must too. */
+const THREAD_SEARCH_SNIPPET_LIMIT = 240;
+/** How many matches a search returns when the caller does not say. */
+const THREAD_SEARCH_DEFAULT_LIMIT = 20;
+/**
+* `LIKE` treats `%` and `_` as wildcards, so a person searching for a literal
+* underscore (every other identifier in a codebase) would otherwise match any
+* character. Escaped with a backslash, declared to SQL as `ESCAPE '\'`, and
+* lowercased on both sides because Postgres `LIKE` is case-sensitive where
+* SQLite's is not, and Forge runs on both.
+*/
+function toThreadSearchPattern(query) {
+	return `%${query.toLowerCase().replace(/[\\%_]/g, (character) => `\\${character}`)}%`;
+}
+/**
+* A window of the text around the first hit, not the head of it.
+*
+* A match 4000 characters into an assistant message is invisible in a snippet
+* that always starts at character zero, which is the difference between a
+* result a person can recognize and a result they have to open to understand.
+*/
+function buildThreadSearchSnippet(text, lowerQuery) {
+	const collapsed = text.replace(/\s+/g, " ").trim();
+	if (collapsed.length <= THREAD_SEARCH_SNIPPET_LIMIT) return collapsed;
+	const matchIndex = collapsed.toLowerCase().indexOf(lowerQuery);
+	if (matchIndex < 0) return `${collapsed.slice(0, THREAD_SEARCH_SNIPPET_LIMIT - 1)}…`;
+	const leading = Math.floor((THREAD_SEARCH_SNIPPET_LIMIT - lowerQuery.length) / 2);
+	const start = Math.max(0, matchIndex - Math.max(leading, 0));
+	const windowed = collapsed.slice(start, start + THREAD_SEARCH_SNIPPET_LIMIT);
+	const prefixed = start > 0 ? `…${windowed}` : windowed;
+	return prefixed.length > THREAD_SEARCH_SNIPPET_LIMIT ? prefixed.slice(0, THREAD_SEARCH_SNIPPET_LIMIT) : prefixed;
+}
 const ProjectionProjectLookupRowSchema = ProjectionProjectDbRowSchema;
 const ProjectionThreadIdLookupRowSchema = Struct({ threadId: ThreadId });
 const ProjectionThreadCheckpointContextThreadRowSchema = Struct({
@@ -301706,6 +302624,61 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
           AND deleted_at IS NULL
           AND archived_at IS NULL
         ORDER BY created_at ASC, thread_id ASC
+      `
+	});
+	/**
+	* Message bodies containing the query.
+	*
+	* `role IN ('user', 'assistant')` is not a filter for tidiness: the match
+	* shape on the wire names one of those two as the side the hit came from,
+	* and a system message has no side to report. Ordered newest first because a
+	* capped search should keep what the person is most likely still thinking
+	* about.
+	*/
+	const searchThreadMessageRows = findAll({
+		Request: ThreadSearchQueryInput,
+		Result: ThreadSearchMessageRowSchema,
+		execute: ({ pattern, limit }) => sql`
+        SELECT
+          m.thread_id AS "threadId",
+          t.project_id AS "projectId",
+          m.role AS "role",
+          m.text AS "text",
+          m.created_at AS "createdAt"
+        FROM projection_thread_messages AS m
+        JOIN projection_threads AS t ON t.thread_id = m.thread_id
+        WHERE t.deleted_at IS NULL
+          AND m.role IN ('user', 'assistant')
+          AND LOWER(m.text) LIKE ${pattern} ESCAPE '\\'
+        ORDER BY m.created_at DESC, m.message_id ASC
+        LIMIT ${limit}
+      `
+	});
+	/**
+	* Threads whose own metadata contains the query.
+	*
+	* Title and branch, which is what the web command palette matches on. Title
+	* is duplicated work for a client that already filters its in-memory list,
+	* and harmless because matches are deduplicated by thread; branch is not,
+	* because no client holds every branch.
+	*/
+	const searchThreadMetadataRows = findAll({
+		Request: ThreadSearchQueryInput,
+		Result: ThreadSearchMetadataRowSchema,
+		execute: ({ pattern, limit }) => sql`
+        SELECT
+          thread_id AS "threadId",
+          project_id AS "projectId",
+          title,
+          branch
+        FROM projection_threads
+        WHERE deleted_at IS NULL
+          AND (
+            LOWER(title) LIKE ${pattern} ESCAPE '\\'
+            OR LOWER(branch) LIKE ${pattern} ESCAPE '\\'
+          )
+        ORDER BY updated_at DESC, thread_id ASC
+        LIMIT ${limit}
       `
 	});
 	/**
@@ -302452,6 +303425,40 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 	};
 	const getShellSnapshot = () => readShellSnapshot("getShellSnapshot", listThreadRows);
 	const getArchivedShellSnapshot = () => readShellSnapshot("getArchivedShellSnapshot", listArchivedThreadRows);
+	const searchThreads = (input) => {
+		const limit = input.limit ?? THREAD_SEARCH_DEFAULT_LIMIT;
+		const lowerQuery = input.query.toLowerCase();
+		const request = {
+			pattern: toThreadSearchPattern(input.query),
+			limit
+		};
+		return all([searchThreadMessageRows(request).pipe(mapError(toPersistenceSqlOrDecodeError("ProjectionSnapshotQuery.searchThreads:messages:query", "ProjectionSnapshotQuery.searchThreads:messages:decodeRows"))), searchThreadMetadataRows(request).pipe(mapError(toPersistenceSqlOrDecodeError("ProjectionSnapshotQuery.searchThreads:metadata:query", "ProjectionSnapshotQuery.searchThreads:metadata:decodeRows")))]).pipe(map$3(([messageRows, metadataRows]) => {
+			const byThread = /* @__PURE__ */ new Map();
+			for (const row of messageRows) {
+				if (byThread.has(row.threadId)) continue;
+				byThread.set(row.threadId, {
+					threadId: row.threadId,
+					projectId: row.projectId,
+					source: row.role === "assistant" ? "assistant" : "user",
+					snippet: buildThreadSearchSnippet(row.text, lowerQuery),
+					messageCreatedAt: row.createdAt
+				});
+			}
+			for (const row of metadataRows) {
+				if (byThread.has(row.threadId)) continue;
+				const branchMatched = row.branch?.toLowerCase().includes(lowerQuery) === true;
+				const titleMatched = row.title.toLowerCase().includes(lowerQuery);
+				byThread.set(row.threadId, {
+					threadId: row.threadId,
+					projectId: row.projectId,
+					source: "user",
+					snippet: buildThreadSearchSnippet(titleMatched || !branchMatched ? row.title : row.branch ?? row.title, lowerQuery),
+					messageCreatedAt: null
+				});
+			}
+			return { matches: [...byThread.values()].slice(0, limit) };
+		}));
+	};
 	const listActiveWorkerShells = () => sql.withTransaction(all([
 		listActiveWorkerThreadRows(void 0).pipe(mapError(toPersistenceSqlOrDecodeError("ProjectionSnapshotQuery.listActiveWorkerShells:listThreads:query", "ProjectionSnapshotQuery.listActiveWorkerShells:listThreads:decodeRows"))),
 		listActiveWorkerSessionRows(void 0).pipe(mapError(toPersistenceSqlOrDecodeError("ProjectionSnapshotQuery.listActiveWorkerShells:listThreadSessions:query", "ProjectionSnapshotQuery.listActiveWorkerShells:listThreadSessions:decodeRows"))),
@@ -302619,6 +303626,7 @@ const OrchestrationInfrastructureLayerLive = mergeAll(effect(ProjectionSnapshotQ
 		getSnapshot,
 		getShellSnapshot,
 		getArchivedShellSnapshot,
+		searchThreads,
 		listActiveWorkerShells,
 		listStaleRunningSessionShells,
 		getCounts,
@@ -317801,13 +318809,13 @@ const gitUrlCloneRouteLayer = add$1("POST", "/api/cloud/git/clone-url", gen(func
 //#endregion
 //#region src/server.ts
 const PtyAdapterLive = unwrap(gen(function* () {
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-oVISucl_.mjs"))).layer;
-	else return (yield* promise(() => import("./NodePTY-CVH2yNYl.mjs"))).layer;
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunPTY-DkAIzLIx.mjs"))).layer;
+	else return (yield* promise(() => import("./NodePTY-loxi8Vku.mjs"))).layer;
 }));
 const HttpServerLive = unwrap(gen(function* () {
 	const config = yield* ServerConfig;
-	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-VI75aqJw.mjs"))).layer(bunHttpServerOptions(config));
-	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-Dw7ivXfX.mjs")), promise(() => import("node:http"))]);
+	if (typeof Bun !== "undefined") return (yield* promise(() => import("./BunHttpServer-CDh4Vioe.mjs"))).layer(bunHttpServerOptions(config));
+	const [NodeHttpServer, NodeHttp] = yield* all([promise(() => import("./NodeHttpServer-DT0TF8s4.mjs")), promise(() => import("node:http"))]);
 	return NodeHttpServer.layer(NodeHttp.createServer, {
 		host: config.host,
 		port: config.port
@@ -317815,10 +318823,10 @@ const HttpServerLive = unwrap(gen(function* () {
 }));
 const PlatformServicesLive = unwrap(gen(function* () {
 	if (typeof Bun !== "undefined") {
-		const { layer } = yield* promise(() => import("./BunServices-D0JTDujL.mjs"));
+		const { layer } = yield* promise(() => import("./BunServices-D6PAheqS.mjs"));
 		return layer;
 	} else {
-		const { layer } = yield* promise(() => import("./NodeServices-CBNXOYLG.mjs").then((n) => n.t));
+		const { layer } = yield* promise(() => import("./NodeServices-BahzLhbo.mjs").then((n) => n.t));
 		return layer;
 	}
 }));
@@ -318813,7 +319821,7 @@ const connectLoginCommand = make$34("login", {
 			})).json();
 		},
 		openBrowser: async (url) => {
-			const open = (await import("./open-FIgTDosf.mjs")).default;
+			const open = (await import("./open-D8mGyWmt.mjs")).default;
 			await open(url);
 			return true;
 		},